You are on page 1of 563

CCNP-SWITCH_IPHELPER_April_2018

Number: 300-115
Passing Score: 790
Time Limit: 120 min
File Version: 10.0

300-115 - Implementing Cisco IP Switched Networks

Updated - April 2018 by IPHELPER

Exam A - MCQs - Cisco Official
Exam B - Simlet HSRP
Exam C - Simlet VTPv3
Exam D - HSRP Ferris Plastics

Exam E - HSRP Hotspot Certprepare
Exam F - Simulation Labs
Exam G - Drag and Drop - Official
Exam H - Drag and Drop - Concepts
Exam I - MCQs April 2017 - Contribute
Exam J - MCQs May 2017 - Contribute
Exam K - MCQs June 2017 - Contribute
Exam L - MCQs August 2017 - Contribute
Exam M - MCQs Sept-Oct-Nov 2017 - Contribute
Exam N - MCQs Dec 2017_Feb-March 2018 - Contribute
Exam O - MCQs April 2018 - Contribute

CONTRIBUTED ONLY POOLS
- THIS IS FROM CANDIDATES FROM CERTPREPARE BASED ON WHAT THEY CAN REMEMBER IN THEIR EXAM.
- REMEMBER THESE ARE NOT OFFICIALLY WRITTEN CISCO QUESTIONS.

Sections
1. Layer 2 Technologies
2. Infrastructure Security
3. Infrastructure Services
4. Mix QUESTIONS

MCQs - Cisco Official

QUESTION 1
What is the maximum number of switches that can be stacked using Cisco StackWise?

A. 4
B. 5
C. 8
D. 9
E. 10
F. 13

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Up to 9 Cisco Catalyst switches can be stacked together to build single logical StackWise switch since Cisco IOS XE Release 3.3.0SE. Prior to Cisco IOS XE
Release3.3.0SE, up to 4 Cisco Catalyst switches could be stacked together.

Reference: http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-series-switches/qa_c67-722110.html

QUESTION 2
A network engineer wants to add a new switch to an existing switch stack. Which configuration must be added to the new switch before it can be added to
the switch stack?

A. No configuration must be added.
B. stack ID
C. IP address
D. VLAN information
E. VTP information

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Switch Stack Offline Configuration
You can use the offline configuration feature to provision (to supply a configuration to) a new switch before it joins the switch stack. You can configure in
advance the stack member number, the switch type, and the interfaces associated with a switch that is not currently part of the stack. The configuration that
you create on the switch stack is called the provisioned configuration . The switch that is added to the switch stack and that receives this configuration is
called the provisioned switch.
You manually create the provisioned configuration through the switch stack-member-number provision type global configuration command. The provisioned
configuration is automatically created when a switch is added to a switch stack and when no provisioned configuration exists.
When you configure the interfaces associated with a provisioned switch (for example, as part of a VLAN), the switch stack accepts the configuration, and the
information appears in the running configuration. The interface associated with the provisioned switch is not active, operates as if it is administratively shut
down, and the no shutdown interface configuration command does not return it to active service. The interface associated with the provisioned switch does
not appear in the display of the specific feature; for example, it does not appear in the show vlan user EXEC command output.
The switch stack retains the provisioned configuration in the running configuration whether or not the provisioned switch is part of the stack. You can save the
provisioned configuration to the startup configuration file by entering the copy running-config startup-config privileged EXEC command. The startup
configuration file ensures that the switch stack can reload and can use the saved information whether or not the provisioned switch is part of the switch
stack.
Effects of Adding a Provisioned Switch to a Switch Stack
When you add a provisioned switch to the switch stack, the stack applies either the provisioned configuration or the default configuration. Table 5-1 lists the
events that occur when the switch stack compares the provisioned configuration with the provisioned switch.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstack.html

QUESTION 3
What percentage of bandwidth is reduced when a stack cable is broken?

A. 0
B. 25
C. 50
D. 75
E. 100

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Physical Sequential Linkage
The switches are physically connected sequentially, as shown in Figure 3. A break in any one of the cables will result in the stack bandwidth being reduced to
half of its full capacity. Subsecond timing mechanisms detect traffic problems and immediately institute failover. This mechanism restores dual path flow
when the timing mechanisms detect renewed activity on the cable.
Figure 3. Cisco StackWise Technology Resilient Cabling

Reference: http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/prod_white_paper09186a00801b096a.html

QUESTION 4
Refer to the exhibit.

Which set of configurations will result in all ports on both switches successfully bundling into an EtherChannel?

A. switch1
channel-group 1 mode active
switch2
channel-group 1 mode auto
B. switch1
channel-group 1 mode desirable
switch2
channel-group 1 mode passive
C. switch1
channel-group 1 mode on
switch2

channel-group 1 mode auto
D. switch1
channel-group 1 mode desirable
switch2
channel-group 1 mode auto

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The different etherchannel modes are described in the table below:

Both the auto and desirable PAgP modes allow interfaces to negotiate with partner interfaces to determine if they can form an EtherChannel based on criteria
such as interface speed and, for Layer 2 EtherChannels, trunking state and VLAN numbers.
Interfaces can form an EtherChannel when they are in different PAgP modes as long as the modes are compatible. For example:
An interface in the desirable mode can form an EtherChannel with another interface that is in the desirable or auto mode.

An interface in the auto mode can form an EtherChannel with another interface in the desirable mode.
An interface in the auto mode cannot form an EtherChannel with another interface that is also in the auto mode because neither interface starts PAgP
negotiation.
An interface in the on mode that is added to a port channel is forced to have the same characteristics as the already existing on mode interfaces in the
channel.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_13_ea1/configuration/guide/3550scg/swethchl.html

QUESTION 5
Refer to the exhibit.

How can the traffic that is mirrored out the GigabitEthernet0/48 port be limited to only traffic that is received or transmitted in VLAN 10 on the
GigabitEthernet0/1 port?

A. Change the configuration for GigabitEthernet0/48 so that it is a member of VLAN 10.
B. Add an access list to GigabitEthernet0/48 to filter out traffic that is not in VLAN 10.
C. Apply the monitor session filter globally to allow only traffic from VLAN 10.
D. Change the monitor session source to VLAN 10 instead of the physical interface.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
To start a new flow-based SPAN (FSPAN) session or flow-based RSPAN (FRSPAN) source or destination session, or to limit (filter) SPAN source traffic to
specific VLANs, use the monitor session filter global configuration command.
Usage Guidelines
You can set a combined maximum of two local SPAN sessions and RSPAN source sessions. You can have a total of 66 SPAN and RSPAN sessions on a
switch or switch stack.
You can monitor traffic on a single VLAN or on a series or range of ports or VLANs. You select a series or range of VLANs by using the [ , | -] options.
If you specify a series of VLANs, you must enter a space before and after the comma. If you specify a range of VLANs, you must enter a space before and
after the hyphen ( -).
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By default, all VLANs are monitored on trunk source ports.
You can use the monitor session session_number filter vlan vlan-id command to limit SPAN traffic on trunk source ports to only the specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering cannot be enabled. If VLAN filtering is configured, a VLAN
cannot become a source.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/network_management/command_reference/
b_nm_3se_3850_cr/b_nm_3se_3850_cr_chapter_010.html#wp3875419997

QUESTION 6
Refer to the exhibit.

A network engineer wants to analyze all incoming and outgoing packets for an interface that is connected to an access switch. Which three items must be

configured to mirror traffic to a packet sniffer that is connected to the distribution switch? (Choose three.)

A. A monitor session on the distribution switch with a physical interface as the source and the remote SPAN VLAN as the destination
B. A remote SPAN VLAN on the distribution and access layer switch
C. A monitor session on the access switch with a physical interface source and the remote SPAN VLAN as the destination
D. A monitor session on the distribution switch with a remote SPAN VLAN as the source and physical interface as the destination
E. A monitor session on the access switch with a remote SPAN VLAN source and the physical interface as the destination
F. A monitor session on the distribution switch with a physical interface as the source and a physical interface as the destination

Correct Answer: BCD
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy of the traffic to another port on the switch or on
another switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or
both) on source ports or source VLANs to a destination port for analysis.
RSPAN supports source ports, source VLANs, and destination ports on different switches (or different switch stacks), enabling remote monitoring of multiple
switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in
all participating switches. The RSPAN traffic from the source ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports carrying the
RSPAN VLAN to a destination session monitoring the RSPAN VLAN. Each RSPAN source switch must have either ports or VLANs as RSPAN sources. The
destination is always a physical port.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

QUESTION 7
After an EtherChannel is configured between two Cisco switches, interface port channel 1 is in the down/down state. Switch A is configured with channel-
group 1 mode active, while Switch B is configured with channel-group 1 mode desirable. Why is the EtherChannel bundle not working?

A. The switches are using mismatched EtherChannel negotiation modes.
B. The switch ports are not configured in trunking mode.
C. LACP priority must be configured on both switches.
D. The channel group identifier must be different for Switch A and Switch B.

Correct Answer: A
Section: (none)

Adjust the EtherChannel load-balancing method based on destination IP addresses. You can not mix the LACP and PAGP protocols to form an etherchannel. . The network administrator noticed that only one of the EtherChannel links is being utilized to reach the web server.cisco. What should be done on the Cisco switch to allow for better EtherChannel utilization to the corporate web server? A. B. and the other is using desirable.Explanation Explanation/Reference: Explanation: Here we have a situation where one switch is using active mode.html QUESTION 8 An EtherChannel bundle has been established between a Cisco switch and a corporate web server. Enable Cisco Express Forwarding to allow for more effective traffic sharing over the EtherChannel bundle. which is an LACP mode.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swethchl. which is a PAGP mode. Here is a summary of the various etherchannel modes: Reference: http://www.

Reference: http://www. The mode you select applies to all EtherChannels that you configure on the switch. For example. since all traffic is going to the same web server). D. Disable spanning tree on all interfaces that are participating in the EtherChannel bundle. destination mode. 52 What is the result of the implemented command? A. Use of source addresses or IP addresses can result in a better load balance. E. Filtering a trunked SPAN port effectively disables SPAN operations for all VLANs.C. Use the option that provides the greatest variety in your configuration.html QUESTION 9 Interface FastEthernet0/1 is configured as a trunk interface that allows all VLANs. B. E. if the traffic on a channel only goes to a single MAC address (which is the case in this example. or Layer 4 port numbers. The trunk’s native VLAN must be changed to something other than VLAN 1. or both. 39.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.cisco. C. This command is configured globally: monitor session 2 filter vlan 1 – 8. Traffic from VLAN 4 is not sent to the SPAN destination interface. D. All VLAN traffic is sent to the SPAN destination interface. and either source mode. Adjust the EtherChannel load-balancing method based on source IP addresses. 39. Correct Answer: E Section: (none) Explanation Explanation/Reference: Explanation: EtherChannel load balancing can use MAC addresses. and 52 is replicated to the SPAN destination port. Traffic from VLANs 1 to 8. use of the destination MAC address results in the choice of the same link in the channel each time. IP addresses. Correct Answer: E Section: (none) Explanation Explanation/Reference: Explanation: . Use link-state tracking to allow for improved load balancing of traffic upon link failure to the server.

Even though multiple routing neighbors can be formed over a layer 2 network. 9 Reference: http://www.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/span.cisco. Cisco Discovery Protocol advertisements are inconsistent between the local and remote devices. Which vendor-neutral protocol could be used to resolve this issue? A.html#wp1066836 QUESTION 10 A network engineer notices inconsistent Cisco Discovery Protocol neighbors according to the diagram that is provided. but not necessarily the logical topology. a network engineer notices that directly connected devices that use Cisco Discovery Protocol are not visible. NetFlow D. Local Area Mobility B. Directed Response Protocol Correct Answer: B Section: (none) .The “monitor session filter” command is used to specify which VLANS are to be port mirrored using SPAN. B. only the physical port that it connects to will be seen as a CDP neighbor. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: If all of the routers are connected to each other using a layer 2 switch. This example shows how to monitor VLANs 1 through 5 and VLAN 9 when the SPAN source is a trunk interface: Switch(config)# monitor session 2 filter vlan 1 – 5 . The engineer notices only a single neighbor that uses Cisco Discovery Protocol. The routers are connected via a Layer 2 switch. QUESTION 11 After the implementation of several different types of switches from different vendors. then each router will only have the single switch port that it connects to as its neighbor. Link Layer Discovery Protocol C. What would cause the output to show only the single neighbor? A. D. C.html/index. IP routing is disabled on neighboring devices. CDP can be used to determine the physical topology. but it has several routing neighbor relationships. Cisco Express Forwarding is enabled locally.

wikipedia. If any password is set. capabilities.cisco. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: VTP allows switches to advertise VLAN information between other members of the same VTP domain. Reference: http://en. LLDP performs functions similar to several proprietary protocols. B. Configure a different native VLAN on all new switches that are configured as VTP clients. However. All VLAN changes must be done on this switch in order to have them propagated to the VTP clients. Reference: http://www.Explanation Explanation/Reference: Explanation: The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by network devices for advertising their identity. Make sure that all ports that interconnect switches are configured as trunks and are actually trunking. make sure that the password is the same on both sides. and neighbors on an IEEE 802 local area network. VLANs are not passing from the VTP server (existing network) to the VTP clients. Provision one of the new switches to be the VTP server and duplicate information from the existing network. only Layer 2 EtherChannels propagate VLAN information.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613. Make sure that the VLANs are active in all the devices. Verify these items if switches that run VTP fail to exchange VLAN information: VTP information only passes through a trunk port. CISCO and cisco are two different domain names. What must be done to fix this? A. and version. There are several reasons why the VLAN information can fail to be exchanged.shtml . Ensure that all switch interconnects are configured as trunks to allow VTP information to be transferred. One of the switches must be the VTP server in a VTP domain. Make sure that no password is set between the server and client. All of the new switches have been configured with the same VTP domain. Remove the VTP domain name from all switches with "null" and then replace it with the new domain name. D. C. password.org/wiki/Link_Layer_Discovery_Protocol QUESTION 12 Several new switches have been added to the existing network as VTP clients. The VTP domain name must match and it is case sensitive. principally wired Ethernet. Make sure that if EtherChannels are created between two switches. VTP allows a consistent view of the switched network across all switches. such as the Cisco Discovery Protocol (CDP).

What should be configured for extended VLANs? A. and C are trunked together and have been properly configured for VTP. C. Enable VTP version 3. What is the most probable cause of this behavior? .com/en/US/docs/switches/lan/catalyst6500/ios/15. Switch C receives VLAN information from the VTP server Switch A. VTP version 3 supports extended-range VLANs (VLAN numbers 1006 to 4094). which supports extended VLAN propagation. B.1SY/config_guide/sup2T/vtp. VTP authentication is required when using extended VLANs because of their ability to cause network instability. You must configure extended-range VLANs manually on each network device. the VLANs in the range 1006 to 4094 are removed from VTP control. If you convert from VTP version 3 to VTP version 2. Reference: http://www. Extended VLANs will not propagate to different IOS versions when extended VLANs are in use. Switch A. D. B. VTP does not support extended VLANs and should be manually added to all switches.pdf QUESTION 14 Refer to the exhibit. but Switch B does not receive any VLAN information. Ensure that all switches run the same Cisco IOS version.cisco. the extended VLANs are not being propagated to other VTP switches. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: VTP version 1 and VTP version 2 do not propagate configuration information for extended-range VLANs (VLAN numbers 1006 to 4094).QUESTION 13 After implementing VTP.

Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: VTP transparent switches do not participate in VTP. Switch A. B. What would cause this issue? A. Reference: http://www. and C are trunked together and have been properly configured for VTP. The trunk between Switch A and Switch B is misconfigured.shtml QUESTION 15 Refer to the exhibit. A VTP transparent switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. Switch B is configured in transparent mode. D. while Switch C is configured with a trunk port to Switch B. Switch B is configured with an access port to Switch A. B. . C. The VTP revision number of the Switch B is higher than that of Switch A. A VTP authentication mismatch occurred between Switch A and Switch B. but Switch C is not receiving traffic from certain VLANs. Switch B has all VLANs.A. The VTP revision number of Switch B is higher than that of Switch A.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080094c52. but transparent switches do forward VTP advertisements that they receive out their trunk ports in VTP Version 2.cisco. B.

The new switches are using RSTP instead of legacy IEEE 802. The administrator has defined the switch as the root in the STP domain. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: RSTP works by adding an alternative port and a backup port compared to STP. B. D. C. This path is different than using the root port. VTP pruning is configured globally on all switches and it removed VLANs from the trunk interface that is connected to Switch C.C. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to reach the destination devices. VTP pruning is disabled by default. is that VTP pruning has been configured. RSTP bridge port roles: * Root port – A forwarding port that is the closest to the root bridge in terms of path cost * Designated port – A forwarding port for every LAN segment * Alternate port – A best alternate path to the root bridge. The port roles have been adjusted based on the interface bandwidth and timers of the new Cisco Catalyst switches. The backup port applies only when a single switch has . The alternative port moves to the forwarding state if there is a failure on the designated port for the segment. QUESTION 16 After the recent upgrade of the switching infrastructure. The trunk between Switch A and Switch B is misconfigured. and unknown unicast traffic across all trunk links within a VTP domain even though receiving switches might discard them.1D STP. multicast. the network engineer notices that the port roles that were once “blocking” are now defined as “alternate” and “backup. The best explanation for why switch C is not seeing traffic from only some of the VLANs.1D STP and PortFast have been configured by default on all newly implemented Cisco Catalyst switches. Without VTP pruning.” What is the reason for this change? A. a switch floods broadcast. These ports are allowed to immediately enter the forwarding state rather than passively wait for the network to converge. D. * Backup port – A backup/redundant path to a segment where another bridge port already connects. IEEE 802. VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in the pruning-eligible list.

What is the reason for this? A.html QUESTION 17 An administrator recently configured all ports for rapid transition using PortFast. VTP pruning D.two links to the same segment (collision domain). In switched networks today. To have two links to the same collision domain. The link type is automatically derived from the duplex mode of a port. A port that operates in full-duplex is assumed to be point-to-point. * Disabled port – Not strictly part of STP. PBR Correct Answer: C Section: (none) .cisco. B.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146. access lists B. RSTP has been enabled per interface and not globally. it has been determined that several ports are not transitioning as they should.html QUESTION 18 Which technique automatically limits VLAN traffic to only the switches that require it? A. D. DTP in nonegotiate C. This automatic link type setting can be overridden by explicit configuration. The STP root bridge selection is forcing key ports to remain in non-rapid transitioning mode. Reference: http://www. STP is unable to achieve rapid transition for trunk links. This makes them candidates for rapid transition to the forwarding state. After testing. most links operate in full-duplex mode and are treated as point-to-point links by RSTP. while a half-duplex port is considered as a shared port by default.cisco. The switch does not have the processing power to ensure rapid transition for all ports. not on trunk links. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: RSTP can only achieve rapid transition to the forwarding state on edge ports and on point-to-point links.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146. C. the switch must be attached to a hub. a network administrator can manually disable a port Reference: http://www.

The MAC address-table will hold addresses 180 seconds longer than the default of 10 minutes. Reference: http://www. VTP pruning is disabled. The MAC address-table will be flushed every 3 minutes.cisco.Explanation Explanation/Reference: Explanation: VTP pruning enhances network bandwidth use by reducing unnecessary flooded traffic. This is how long a dynamic MAC address will remain in the CAM table. C. VTP pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. B. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: You can configure the amount of time that an entry (the packet source MAC address and port that packet ingresses) remain in the MAC table. such as broadcast. unknown. ARP requests will be processed less frequently by the switch. The default timeout period will be 360 seconds. multicast. By default. D.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vtp. and flooded unicast packets to only the switches that require it.html#wp1020444 QUESTION 19 What effect does the mac address-table aging-time 180 command have on the MAC address-table? A. E. To configure the aging time for all MAC addresses. perform this task: .

This example shows how to set the aging time for entries in the MAC address table to 600 seconds (10 minutes): switch# configure terminal switch(config)# mac-address-table aging-time 600 Reference: http://www. the link was placed into a non-forwarding state due to a fault with UDLD. As designed. command aliases E. a technician accidently bumps the fiber connection between two core switches and damages one of the pairs of fiber. the link did not recover.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/ MACAddress. What solution allows the network switch to automatically recover from such an issue? A. errdisable autorecovery C. Bidirectional Forwarding Detection Correct Answer: B Section: (none) Explanation . After the damaged cable was replaced. macros B. IP Event Dampening D.html#wp1126206 QUESTION 20 While working in the core network building.cisco.

Reference: http://packetlife. The VLAN receives additional frames from neighboring switches. manual intervention by an administrator is necessary to restore the interface to working order. The SDM VLAN template causes the MAC address-table to overflow. . by removing an unapproved device) without the need for administrative intervention. Choosing the VLAN template will actually disable routing (number of entry for unicast or multicast route is zero) in hardware.Explanation/Reference: Explanation: There are a number of events which can disable a link on a Catalyst switch. The switch reload is required to use a new SDM template. The VLAN template disables routing in hardware. such as the detection of a loopback. We can configure the switch to automatically re-enable any error-disabled interfaces after a specified timeout period. This is where errdisable autorecovery can be of great assistance.net/blog/2009/sep/14/errdisable-autorecovery/ QUESTION 21 A network engineer deployed a switch that operates the LAN base feature set and decides to use the SDM VLAN template. this can be done by issuing shutdown followed by no shutdown on the interface. There is no way to edit template category individual values. all processing overflow is sent to the CPU which can have a major impact on the performance of the switch. assess. What is the root cause of this issue? A. The SDM template is causing the CPU of the switch to spike during peak working hours. By default. This gives the offending issue a chance to be cleared by the user (for example. B. some configurations may be prone to accidental violations. and a steady recurrence of these can amount to a huge time sink for the administrative staff. D. UDLD failure. The ACL merge algorithm. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: SDM Template Notes: All templates are predefined. If the boundary is exceeded. C. However. as opposed to the original access control entries (ACEs) configured by the user. generate the number of TCAM entries listed for security and QoS ACEs. The switch needs to be rebooted before the SDM template takes effect. or a broadcast storm. and (ideally) correct the issue. The first eight lines (up to Security ACEs) represent approximate hardware boundaries set when a template is used. The idea behind requiring administrative action is so that a human engineer can intercede.

You can configure both Layer 2 and Layer 3 ports and EtherChannels as SPAN sources.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/44921-swdatabase-3750ss-44921. SPAN encapsulation replication must be enabled to capture EtherChannel destination traffic. RSPAN must be used to capture EtherChannel bidirectional traffic. SPAN can monitor one or more source ports or EtherChannels in a single SPAN session. but not a destination. A port-channel interface (an EtherChannel) can be a SPAN source. You can configure ports or EtherChannels in any VLAN as SPAN sources. the network administrator notices that not all traffic is being replicated to the management server. The port channel can be used as a SPAN source. D.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/span. After configuring SPAN to monitor this port.html QUESTION 22 An access switch has been configured with an EtherChannel port.cisco. Reference: http://www. . VLAN filters are required to ensure traffic mirrors effectively.html#wp1040905 QUESTION 23 Refer to the exhibit. C.Reference: http://www. B. but not a destination. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: A source port or EtherChannel is a port or EtherChannel monitored for traffic analysis. Trunk ports or EtherChannels can be configured as sources and mixed with nontrunk sources.cisco. What is a cause for this issue? A.

The EtherChannels would form. D. B. C. The EtherChannels would form and both devices would use the dst-ip load-balancing method because Switch1 is configured with EtherChannel mode active. The EtherChannels would form and function properly even though the load-balancing and EtherChannel modes do not match.What is the result of the configuration? A. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: An etherchannel will form if one end is active and the other is passive. The EtherChannels would not form because the load-balancing method must match on the devices. The table below summarizes the results for LACP channel establishment based on the . but network loops would occur because the load-balancing methods do not match.

B. you cannot configure Storm Control on some of the members of an EtherChannel.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/channel. you should configure Storm Control at the EtherChannel Interface level. Reference: http://www. The storm control settings will appear on the EtherChannel. This is true for the switch globally. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: After you configure an EtherChannel. The storm control configuration will be accepted. As a result. those ports will be dropped from the EtherChannel interface (put in suspended state). any configuration that you apply to the physical interfaces affects only the interface where you apply the configuration. or LACP) use the same load-balancing. but will only be present on the physical interfaces.cisco.html#wp1020804 QUESTION 24 A network engineer tries to configure storm control on an EtherChannel bundle.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/channel. all channels (manually configured. PagP.configuration of each side of a link: LACP Channel Establishment Load balancing can only be configured globally. Storm Control must be configured on all or none of the ports. but not on the associated physical ports. The settings will be applied to the EtherChannel bundle and all associated physical interfaces. and not at the physical interface level. D. C. Therefore. The configuration will be rejected because storm control is not supported for EtherChannel. any configuration that you apply to the port-channel interface affects the EtherChannel. Storm Control is an exception to this rule. although each switch involved in the etherchannel can have non matching parameters for load balancing. Reference: http://www. If you configure Storm Control on only some of the ports. What is the result of the configuration? A.cisco.html . For example.

In a VSS. UDLD port is configured in aggressive mode. This port continues to reestablish until after eight failed retries.4 Tbps. a Network Administrator noticed that one port stops receiving UDLD packets.com/article-cisco-catalyst-6500-series-vss-1440-124536783. and scaling system bandwidth capacity to 1. D. Only one of the virtual switch members has the active control plane. Reference: http://ciscorouterswitch. UDLD timers are inconsistent. combining for an active 1400-Gbps switching capacity per VSS. provide automatic failover to back up supervisor in VSS mode D. Which option describes what causes the port to go into the errdisable state? A. boosting nonstop communications. Switches would operate as a single logical virtual switch called a virtual switching system 1440 (VSS1440). B. forward traffic based on Cisco Express Forwarding C. increasing operational efficiency. Normal UDLD operations that prevent traffic loops. Both chassis are kept in sync with the inter-chassis Stateful Switchover (SSO) mechanism along with Nonstop Forwarding (NSF) to provide nonstop communication even in the event of failure of one of the member supervisor engines or chassis. C. VSS formed by two Cisco Catalyst 6500 Series Switches with the Virtual Switching Supervisor 720-10GE.over-blog. forward traffic simultaneously using both supervisors B. Correct Answer: B Section: (none) Explanation .html QUESTION 26 After UDLD is implemented. UDLD is enabled globally. the data plane and switch fabric with capacity of 720 Gbps of supervisor engine in each chassis are active at the same time on both chassis.QUESTION 25 What is the function of NSF? A. provide nonstop forwarding in the event of failure of one of the member supervisors Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: VSS is network system virtualization technology that pools multiple Cisco Catalyst 6500 Series Switches into one virtual switch. The port then transitions into the errdisable state.

html QUESTION 27 After reviewing UDLD status on switch ports. The UDLD port is placed in the “unknown” state for 5 seconds until the next UDLD packet is received on the interface. The port will remain operational during this time. which is not necessarily an error condition.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/udld. UDLD moved into aggressive mode after inconsistent acknowledgements were detected. STP immediately replaces the root port with an alternative root port. Reference: http://packetlife. BackboneFast . the port is disabled. The bidirectional status of “unknown” indicates that the port will go into the disabled state because it stopped receiving UDLD packets from its neighbor. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: By default. PVST+ B. when a port on a bidirectional link that has a UDLD neighbor relationship established stops receiving UDLD packets.” Which statement describes what this indicates about the status of the port? A. This enables UDLD in normal mode. The port is fully operational and no known issues are detected. or individually on specific interfaces with the command udld port.Explanation/Reference: Explanation: With UDLD aggressive mode enabled. Which spanning-tree technology is used to accomplish backup root port selection? A. D. It would be prohibitively difficult to coordinate the configuration of UDLD on both ends of a link at the same time. UDLD tries to reestablish the connection with the neighbor. UDLD is disabled on all interfaces. When UDLD is finally enabled on the other end. B. C. so when UDLD is first enabled and does not detect a neighbor the link state is considered unknown. an engineer notices that the. We can enable UDLD globally on the device. PortFast C.net/blog/2011/mar/7/udld/ QUESTION 28 Pilot testing of the new switching infrastructure finds that when the root port is lost. After eight failed retries.cisco. Reference: http://www. the status will transition to bidirectional.

D. link type E. The uplink group provides an alternate path in case the currently forwarding link fails. root guard Correct Answer: AB Section: (none) Explanation Explanation/Reference: Explanation: Spanning tree forces redundant data paths into a standby (blocked) state. Which two elements are used to accomplish this? (Choose two. called . only one of which is forwarding at any given time. as it would with the normal spanning-tree procedures. UDLD Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: I f a switch loses connectivity.) A.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swstpopt.html QUESTION 29 A network engineer must adjust the STP interface attributes to influence root port selection.cisco. Specifically. except for self-looping ports. By enabling UplinkFast with the spanning-tree uplinkfast global configuration command. it begins using the alternate paths as soon as the spanning tree selects a new root port. an uplink group consists of the root port (which is forwarding) and a set of blocked ports. Switches send and receive spanning-tree frames. port-priority B. If a network segment in the spanning tree fails and a redundant path exists. An uplink group is a set of Layer 2 interfaces (per VLAN). forward-timers D. UplinkFast E. Reference: http://www. UplinkFast provides fast convergence after a direct link failure and achieves load balancing between redundant Layer 2 links using uplink groups. cost C. the spanning-tree algorithm recalculates the spanning-tree topology and activates the standby path. Loop Guard F. you can accelerate the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. The root port transitions to the forwarding state immediately without going through the listening and learning states.

Ensure that IP CEF is enabled globally to support all load balancing methods.cisco. BPDUs contain information about the sending switch and its ports. Reference: http://www. Adjust the switch SDM back to “default”. Configure the new load balancing method using port-channel load-balance. EtherChannel load balancing can use MAC addresses or IP addresses. The path cost value represents the media speed. at regular intervals. switch priority. The spanning-tree port priority value represents the location of a port in the network topology and how well it is located to pass traffic. Reference: http://www.cisco. or both source and destination addresses. and path cost. The switches do not forward these frames but use them to construct a loop-free path. The mode applies to all EtherChannels that are configured on the switch. port priority.bridge protocol data units (BPDUs). D. You configure the load balancing and forwarding method with use of the port-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac} global configuration command. B. the spanning-tree port priority and path cost settings control which port is put in the forwarding state and which is put in the blocking state. Which action must be done to apply a new load balancing method? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: Example: EtherChannel balances the traffic load across the links in a channel through the reduction of part of the binary pattern that the addresses in the frame form to a numerical value that selects one of the links in the channel.html QUESTION 31 Refer to the exhibit.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstp.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. source or destination addresses. C. When two ports on a switch are part of a loop.html QUESTION 30 A network engineer must set the load balance method on an existing port channel. Upgrade the PFC to support the latest load balancing methods. . including switch and MAC addresses. Spanning tree uses this information to elect the root switch and root port for the switched network and the root port and designated port for each switched segment.

Reference: http://www.cisco. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: With the SAPN destination port.A network engineer investigates a recent network failure and notices that one of the interfaces on the switch is still down. it is found that rapid error tracking is not currently enabled. C.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612. There is a speed mismatch on the interface. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port. There is a layer 1 physical issue. the state of the destination port is up/down by design. Which option must be enabled to allow for enhanced reporting mechanisms using Cisco Discovery Protocol? . There is a duplex mismatch on the interface. This is the normal operational state for SPAN destinations. D. The interface is configured as the source of the SPAN session. B. The interface is configured as the target of the SPAN session. What is causing the line protocol on this interface to be shown as down? A. E.shtml QUESTION 32 While doing network discovery using Cisco Discovery Protocol.

use the “switchport trunk .A. preventing traffic from those VLANs from passing over the trunk. This is the default version on all switches. you can remove VLANs from the allowed list.aspx? docid=0ed03cbac49b446ab390a657917d817c_Cisco_Discovery_Protocol_CDP__Properties_Settings_on_Sx500_S. 1 to 4094. transparent bridging C. VTP pruning B. Cisco Discovery Protocol version 2 B. L2P tunneling Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: By default. Cisco IOS Embedded Event Manager C. which is used to track down errors and minimize costly downtime.com/CiscoSB/GetArticle. CDP Version 2 — This is the most recent version of CDP which has enhanced features such as rapid reporting mechanism. Cisco Discovery Protocol logging options Correct Answer: A Section: (none) Explanation Explanation/Reference: CDP Version 1 — This is the first version of CDP which was used for the discovery of Cisco devices in the network. VLAN access-list E. trunk allowed VLANs D. a trunk port sends traffic to and receives traffic from all VLANs. logging buffered D.xml&pid=2&converted=0 QUESTION 33 Which technique allows specific VLANs to be strictly permitted by the administrator? A.cisco. All VLAN IDs. are allowed on each trunk. It allows you to track instances even if the native VLAN ID or port duplex states do not match between connecting devices. This version is mainly used for backward compatibility. However. To restrict the traffic a trunk carries. Cisco Discovery Protocol source interface E. Reference: http://sbkb.

DTP C. Apply BPDU guard and BPDU filter. Correct Answer: AB Section: (none) Explanation Explanation/Reference: Explanation: The Dynamic Trunking Protocol (DTP) is used to negotiate forming a trunk between two Cisco devices. otherwise the link will be a non-trunking link. Reference: http://www. Which two actions can prevent interface trunking? (Choose two. You must manually configure the neighboring interface as a trunk interface to establish a trunk link. B. D. Configure trunk and access interfaces manually. ISL D.” This prevents the interface from generating DTP frames.) A.cisco.html QUESTION 34 For security reasons.com/en/US/docs/switches/lan/catalyst3550/software/release/12. C.ciscopress. PPP B. configure “switchport nonegotiate.allowed vlan remove vlan-list” interface configuration command to remove specific VLANs from the allowed list.) A. DTP causes increased traffic. DLCI F. DOT1Q Correct Answer: CF . Reference: http://www. To disable DTP.asp?p=2181837&seqNum=8 QUESTION 35 Which two protocols can be automatically negotiated between switches for trunking? (Choose two. HDLC E. but may be disabled. the IT manager has prohibited users from dynamically establishing trunks with their associated upstream switch. Enable switchport block on access ports.com/articles/article. and is enabled by default. You can use this command only when the interface switchport mode is access or trunk.1_13_ea1/configuration/guide/swvlan. Disable DTP on a per interface basis.

the network engineer notices that the new switch is not receiving the list of VLANs from the server. C.1Q or ISL trunking encapsulation. Reference: https://learningnetwork.PDF QUESTION 36 A network is running VTPv2.cisco.Section: (none) Explanation Explanation/Reference: Explanation: Switches such as the Catalyst 3550 that are capable of either 802. Restart the VTP process on the new switch. The first thing that should be done is to verify that the trunk ports are connected and up. The VTP server must be reloaded.com/servlet/JiveServlet/previewBody/14792-102-1-57313/Dynamic%20Trunking%20Protocol. The VTP version number must be set to version 3. C. D. E. What is the problem? A. Reload the new switch. the switchport trunk encapsulation [dot1q | isl | negotiate] interface command must be used prior to the switchport mode trunk command. After each update to the VTP server. Verify connected trunk ports. After verifying all VTP settings. QUESTION 37 After configuring new data VLANs 1020 through 1030 on the VTP server. Reload the VTP server. . D. Which action resolves this problem? A. B. Another switch in the domain has a higher revision number than the server. it takes up to 4 hours propagate. VTP must be stopped and restarted on the server. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: VTP should never need to have the switch reloaded or the VTP process to restart in order for it to work. B. a network engineer notices that none of the VTP clients are receiving the updates.

Instead. you can directly configure the password secret key. You must reenter the password if you enter a takeover command in the domain. When you enter the secret keyword.com/en/US/docs/switches/lan/catalyst3560/software/release/12. Support for extended range VLAN (VLANs 1006 to 4094) database propagation. . the secret key from the password string is saved in the VLAN database file. When hidden.cisco. VTP pruning—Avoid this method if the goal is to reduce the number of STP instances. the key associated with the password is saved in hexadecimal format in the running configuration.2_52_se/configuration/guide/swvtp. Which enhancement to a spanning-tree design prevents unnecessary traffic from crossing the extended LAN segment? A. VTP-pruned VLANs on a trunk are still part of the spanning tree. VTP pruning is the best choice. and it avoids the use of the spanning tree. VTP versions 1 and 2 propagate only VLANs 1 to 1005. VTP-pruned VLANs do not reduce the number of spanning tree port instances. Instead. D. you cannot convert from VTP version 3 to version 1 or 2. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Pruning unnecessary VLANs from the trunk can be performed with one of two methods: Manual pruning of the unnecessary VLAN on the trunk—This is the best method.Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: VTP version 3 supports these features that are not supported in version 1 or version 2: Enhanced authentication—You can configure the authentication as hidden or secret.html#wp1316856 QUESTION 38 A network engineer is extending a LAN segment between two geographically separated data centers. Reference: http://www. but it does not appear in plain text in the configuration. B. Create a Layer 3 transit VLAN to segment the traffic between the sites. C. Use VTP pruning on the trunk interfaces. Configure manual trunk pruning between the two locations. Modify the spanning-tree priorities to dictate the traffic flow. Since the question asked for the choice that is an enhancement to the STP design. the method runs the pruned VLAN on trunks. Therefore. If extended VLANs are configured.

cisco. and overwrite any others that were previously defined.cisco. or use the “issue the switchport trunk allowed vlan add vlan-list” command instead to add these 3 VLANS to the other defined allowed VLANs.20.Reference: http://www. VTP pruning removed all unused VLANs. Allowing additional VLANs across the trunk introduced a loop in the network. all other existing VLANs no longer pass traffic over the trunk. ISL was unable to encapsulate more than the already permitted VLANs across the trunk.com/document/11836/how-define-vlans-allowed-trunk-link QUESTION 40 When you design a switched network using VTPv2. 1024 D. 1001 C.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613. The command effectively removed all other working VLANs and replaced them with the new VLANs. 2048 E. B. 20. Reference: https://supportforums. how many VLANs can be used to carry user traffic? A. What is the root cause of the problem? A. D. 4095 F.shtml QUESTION 39 The network manager has requested that several new VLANs (VLAN 10. 1000 B. You would also need to explicitly allow the other working VLANs to this configuration command. After the command switchport trunk allowed vlan 10. and 30) are allowed to traverse the switch trunk interface. C. 4096 Correct Answer: B Section: (none) Explanation .30 is issued. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The “switchport trunk allowed vlan” command will only allow the specified VLANs.

NDP D. Only VTP version 3 supports extended VLANs (1-4095). It allows control traffic to pass using the non-default VLAN. IRDP B. All frames within the native VLAN are tagged. with the defined native VLAN. Control traffic is tagged.com/2012/11/difference-between-vtp-versions. QUESTION 42 A network engineer has just deployed a non-Cisco device in the network and wants to get information about it from a connected device.blogspot. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The “vlan dot1q tag native” will tag all untagged frames. so the open standard protocol must be configured. except when the native VLAN is set to 1. It removes the 4-byte dot1q tag from every frame that traverses the trunk interface(s).Explanation/Reference: Explanation: VTP versions 1 and 2 Supports normal VLAN numbers (1-1001). D. Which protocol does the network engineer configure on both devices to accomplish this? A. including control traffic. Reference: http://cciememo. LLDP C. B. Cisco Discovery Protocol is not supported. C. LLTD Correct Answer: B Section: (none) Explanation .html QUESTION 41 What does the command vlan dot1q tag native accomplish when configured under global configuration? A.

capabilities. principally wired Ethernet. This keeps traffic from the VLANs from passing over the trunk link. all of the configured VLANs are allowed to send and receive traffic across the link. Rapid Spanning-Tree B. such as the Cisco Discovery Protocol (CDP).wikipedia. perform these steps: 1. For their disaster recovery feature to operate successfully. This removes specific VLANs from the allowed list. L2P tunneling Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: When a trunk link is established.cisco. Note: The allowed VLAN list on both the ends of the trunk link should be the same. To restrict the traffic that a trInk carries. VLANs 1 through 1005 are allowed on each trunk by default. VACL D. Spanning-Tree Timers . VTP pruning C. Which option can be configured to accomplish this? A. For Integrated Cisco IOS Software based switches. Reference: http://en. However. issue the switchport trunk vlan-Iist interface configuration command.Explanation/Reference: Explanation: The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by network devices for advertising their identity. Reference: https://supportforums. and neighbors on an IEEE 802 local area network. the application server team has indicated that they must not have the standard 30 second delay before their switchport enters a forwarding state. allowed VLAN list B.org/wiki/Link_Layer_Discovery_Protocol QUESTION 43 A manager tells the network engineer to permit only certain VLANs across a specific trunk interface. VLAN traffic can be removed from the allowed list. they require the switchport to enter a forwarding state immediately. Which spanning-tree feature satisfies this requirement? A. LLDP performs functions similar to several proprietary protocols.com/document/11836/how-define-vlans-allowed-trunk-link QUESTION 44 For client server failover purposes.

C.24 Switch-C(config-if-range)# sp–nning-tree portfast Reference: http://www. PortFast immediately transitions the port into STP forwarding mode upon linkup. switch# show spanning-tree vlan 10 B.informit. Spanning-Tree PortFast E. switch# show spanning-tree brief D. switch# show spanning-tree bridge C. the port eventually transitions into STP blocking mode. Example configuration: Switch-C# configure terminal Switch-C(config)# interface range fa0/3 . The port still participates in STP. Spanning-Tree Fast Forward Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: In order to allow immediate transition of the port into forwarding state.com/library/content.aspx?b=CCNP_Studies_Switching&seqNum=36 QUESTION 45 Which command does a network engineer use to verify the spanning-tree status for VLAN 10? A. switch# show spanning-tree vlan 10 brief Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: . Spanning-Tree FastPort D. switch# show spanning-tree summary E. enable the STP PortFast feature. So if the port is to be a part of the loop.

html QUESTION 46 A new network that consists of several switches has been connected together via trunking interfaces. --------.Example output: SW2#show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 24586 Address 0014. C. D. B.57d8. VTP summary advertisements are sent out of all ports with the new domain name. All other switches with the default domain name become VTP clients. The switch with the non-default domain name restores back to "null" upon reboot. Correct Answer: C Section: (none) . --------------------------- Po21 Root FWD 9 128.9000 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio. --.com/en/US/docs/ios/lanswitch/command/reference/lsw_s2.216 P2p Po23 Altn BLK 9 128.232 P2p Reference: http://www. -------. Switches with higher revision numbers does not accept the new domain name.cisco. which statement describes what happens when a domain name is configured on one of the switches? A. ---.f2d2.Nbr Type ------------------.4180 Cost 9 Port 216 (Port-channel21) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 001c. If all switches currently have the default VTP domain name "null".

net/configuring-cisco-vtp/ QUESTION 47 A network engineer is setting up a new switched network. VLANs. Which Spanning Tree Protocol should be used to reduce switch resources and managerial burdens that are associated with multiple spanning-tree instances? A. PVST+ E. In this setup. a switch will have a domain name of NULL and no password. and the network administrator typically seeks to achieve load balancing on the access switch uplinks based on even or odd VLANs—or any other scheme deemed appropriate. featuring an access Switch A. If the switch hears a VTP advertisement it will automatically learn the VTP domain name. RSTP B. MST D. Summary advertisements – sent out every 300 seconds and every time a change occurs on the VLAN database.1w RST algorithm to multiple spanning trees. PVST C. there are 1000 VLANs. uses a minimum number of STP instances to match the number of physical topologies present. The network is expected to grow and add many new VLANs in the future. MST. . RPVST+ Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Multiple Spanning Tree (MST) extends the IEEE 802.Explanation Explanation/Reference: Explanation: By default. and the configuration revision number. The main purpose of MST is to reduce the total number of spanning-tree instances to match the physical topology of the network and thus reduce the CPU cycles of a switch. Figure 3-15 shows a common network design. connected to two Building Distribution submodule Switches D1 and D2. PVRST+ runs STP instances for each VLAN and does not take into consideration the physical topology that might not require many different STP topologies. Contained in a summary advertisement: VTP version Domain name Configuration revision number Time stamp MD5 encryption hash code Reference: https://rowell.dionicio. on the other hand.

depending on how the switch is used in the network. To allocate hardware resources for different usages. C. B. E. SDM templates are used to configure a set of ACLs that allows the users to manage the flow of traffic handled by the route processor. D. the switch SDM templates prioritize system . SDM templates are used to configure system resources in the switch to optimize support for specific features. use the default template to balance resources. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: You can use SDM templates to configure system resources in the switch to optimize support for specific features. Reference: http://ciscodocuments. The 1000 VLANs map to two MST instances. SDM templates are configured by accessing the switch using the web interface.Figure 3-15: VLAN Load Balancing Figure 3-15 illustrates two links and 1000 VLANs.blogspot. depending on how the switch is used in the network. SDM templates are used to create Layer 3 interfaces (switch virtual interfaces) to permit hosts in one VLAN to communicate with hosts in another VLAN. reducing the need for switch resources.html QUESTION 48 Which statement about the use of SDM templates in a Cisco switch is true? A. Rather than maintaining 1000 spanning trees. and use access template to obtain maximum ACL usage. for example. SDM templates are used to configure ACLs that protect networks and specific hosts from unnecessary or unwanted traffic.com/2011/05/chapter-03-implementing-spanning-tree_19. each switch needs to maintain only two spanning trees. You can select a template to provide maximum system usage for some functions.

Routing — The routing template maximizes system resources for Ipv4 unicast routing.com/en/US/docs/switches/lan/catalyst3560/software/release/12. VLAN B. Reference: http://www. routing . It would typically be selected for a Layer 2 switch.cisco. You can select SDM templates to optimize these features: Access — The access template maximizes system resources for access control lists (ACLs) to accommodate a large number of ACLs. VLAN B. VLANs — The VLAN template disables routing and supports the maximum number of unicast MAC addresses.2_55_se/configuration/guide/swsdm. default D. access C.2_55_se/configuration/guide/swsdm. default C.pdf QUESTION 49 Which SDM template disables routing and supports the maximum number of unicast MAC addresses? A. typically required for a router or aggregator in the center of a network.resources to optimize support for certain features.pdf QUESTION 50 Which SDM template is the most appropriate for a Layer 2 switch that provides connectivity to a large number of clients? A.cisco. Default — The default template gives balance to all functions. access D.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12. the switch SDM templates prioritize system resources to optimize support for certain features. Reference: http://www. routing Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: To allocate ternary content addressable memory (TCAM) resources for different usages.

cisco. You can select SDM templates to optimize these features: Access—The access template maximizes system resources for access control lists (ACLs) to accommodate a large number of ACLs. Default—The default template gives balance to all functions.pdf QUESTION 51 In a Cisco switch.Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: To allocate ternary content addressable memory (TCAM) resources for different usages. 180 seconds C. typically required for a router or aggregator in the center of a network. 100 seconds B. Routing—The routing template maximizes system resources for Ipv4 unicast routing. the switch SDM templates prioritize system resources to optimize support for certain features. what is the default period of time after which a MAC address ages out and is discarded? A.2_55_se/configuration/guide/swsdm. 600 seconds Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: To configure the aging time for all MAC addresses. 300 seconds D.com/en/US/docs/switches/lan/catalyst3560/software/release/12. VLANs—The VLAN template disables routing and supports the maximum number of unicast MAC addresses (clients). Reference: http://www. It would typically be selected for a Layer 2 switch. perform this task: .

cisco. use the mac-address-table notification mac-move command in global configuration mode. Mac-address-table notification mac-move [counter [syslog]] no mac-address-table notification mac-move [counter [syslog]] Syntax Description . Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: mac-address-table notification mac-move To enable MAC-move notification.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/MACAddress. A MAC address or host moves between different switch ports.Reference: http://www. C.html QUESTION 52 If a network engineer applies the command mac-address-table notification mac-move on a Cisco switch port. D. when is a syslog message generated? A. A new MAC address is added to the content-addressable memory. A new MAC address is removed from the content-addressable memory. use the no form of this command. B. More than 64 MAC addresses are added to the content-addressable memory. To disable MAC-move notification.

cable unplugged C. routing loop B. STP loop guard D.Usage Guidelines MAC-move notification generates a syslog message whenever a MAC address or host moves between different switch ports. Reference: http://www.html QUESTION 53 Which option is a possible cause for an errdisabled interface? A. The reason can be: Duplex mismatch Port channel misconfiguration BPDU guard violation UniDirectional Link Detection (UDLD) condition Late-collision detection Link-flap detection Security violation Port Aggregation Protocol (PAgP) flap Layer 2 Tunneling Protocol (L2TP) guard DHCP snooping rate-limit Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable .com/en/US/docs/ios/lanswitch/command/reference/lsw_m1.cisco. security violation Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: There are various reasons for the interface to go into errdisable.

-------------- udld Disabled bpduguard Disabled security-violatio Disabled channel-misconfig Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled l2ptguard Disabled psecure-violation Disabled gbic-invalid Disabled dhcp-rate-limit Disabled . cat6knative#show errdisable recovery ErrDisable Reason Timer Status ----------------. The errdisable recovery command allows you to choose the type of errors that automatically reenable the ports after a specified amount of time. 300 seconds D.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b.cisco. you must reenable the ports manually. Issue the shutdown command and then the no shutdown interface mode command on the associated interface in order to manually reenable the ports. Address Resolution Protocol (ARP) inspection Inline power Reference: http://www. In this case. The show errdisable recovery command shows the default error-disable recovery state for all the possible conditions. 30 seconds B. 100 seconds C.shtml QUESTION 54 What is the default value for the errdisable recovery interval in a Cisco switch? A. 600 seconds Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: After you fix the root problem. the ports are still disabled if you have not configured errdisable recovery on the switch.

Reference: http://www. C. network policy. the timeout feature is disabled.pdf QUESTION 56 Which statement about Cisco devices learning about each other through Cisco Discovery Protocol is true? A. D. C. It specifically provides support for voice over IP (VoIP) applications and provides additional TLVs for capabilities discovery.cisco. and inventory management. Each device broadcasts periodic advertisements to all of its neighbors.cisco. B. LLDP-MED is an extension to LLDP that operates only between network devices. LLDP-MED is an extension to LLDP that operates only between endpoint devices.shtml QUESTION 55 Which statement about LLDP-MED is true? A. Power over Ethernet.com/en/US/docs/switches/metro/me3400/software/release/12. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: LLDP for Media Endpoint Devices (LLDP-MED) is an extension to LLDP that operates between endpoint devices such as IP phones and network devices such as switches.mac-limit Disabled unicast-flood Disabled arp-inspection Disabled Timer interval: 300 seconds Interfaces that will be enabled at the next timeout: Note: The default timeout interval is 300 seconds and. by default. LLDP-MED is an extension to LLDP that operates between endpoint devices and network devices. Reference: http://www.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b. Each device sends periodic advertisements to multicast address 01:00:0C:CC:CC:CC. LLDP-MED is an extension to LLDP that operates between routers that run BGP. B.2_58_se/configuration/guide/swlldp. Each device sends periodic advertisements to a central device that builds the network topology. .

spravcesite. native VLAN IDs. memory errors Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Type-Length-Value fields (TLVs) are blocks of information embedded in CDP advertisements. . hardware platform. memory errors C. Table 21 summarizes the TLV definitions for CDP advertisements.D. port-duplex. Each device sends periodic advertisements to all IP addresses in its ARP table. native VLAN IDs. Reference: http://network.php?id=cdp QUESTION 57 Which option lists the information that is contained in a Cisco Discovery Protocol advertisement? A. out each connected network interface. memory errors. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cisco devices send periodic CDP announcements to the multicast destination address 01-00-0c-cc-cc-cc. These multicast packets may be received by Cisco switches and other networking devices that support CDP into their connected network interface. port-duplex. hardware platform B. native VLAN IDs. hardware platform D. port-duplex.net/subdom/network/index.

html QUESTION 58 Which option describes a limitation of LLDP? A. D. LLDP cannot provide information about VTP. C. LLDP does not support TLVs. Correct Answer: A Section: (none) Explanation .cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf015. B.Reference: http://www. LLDP can discover only Windows servers. LLDP can discover up to two devices per port.

UDLD is a Cisco-proprietary Layer 2 protocol that enables devices to advertise their identity. capabilities. . B.com/en/US/technologies/tk652/tk701/technologies_white_paper0900aecd804cd46d. and neighbors on a local area network.Explanation/Reference: Explanation: LLDP Versus Cisco Discovery Protocol TLV Comparison Reference: http://www.html QUESTION 59 Which statement about the UDLD protocol is true? A. UDLD is a Cisco-proprietary Layer 2 protocol that enables devices to monitor the physical status of links and detect unidirectional failures.cisco.

com/en/US/docs/switches/lan/catalyst6500/ios/12. UDLD is a standardized Layer 2 protocol that enables devices to monitor the physical status of links and detect unidirectional failures. D. UDLD detects the existence of unidirectional links.2SX/configuration/guide/udld. active and aggressive C. UDLD is a standardized Layer 2 protocol that enables devices to advertise their identity. When a unidirectional link is detected. normal and passive E. When a unidirectional link is detected.html QUESTION 61 What is the default interval at which Cisco devices send Cisco Discovery Protocol advertisements? . UDLD puts the affected port into the errdisabled state and alerts the user. normal and active D.cisco. normal and aggressive B. normal and standby Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The Cisco-proprietary UDLD protocol monitors the physical configuration of the links between devices and ports that support UDLD.2SX/configuration/guide/udld. capabilities. Reference: http://www. UDLD detects the existence of unidirectional links.html QUESTION 60 Which option lists the modes that are available for configuring UDLD on a Cisco switch? A. UDLD can operate in either normal or aggressive mode.com/en/US/docs/switches/lan/catalyst6500/ios/12. and neighbors on a local area network. Reference: http://www. UDLD puts the affected port into the errdisabled state and alerts the user. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The Cisco-proprietary UDLD protocol monitors the physical configuration of the links between devices and ports that support UDLD.cisco.C.

Cisco Discovery Protocol is enabled by default.cisco. B. They also listen to messages to learn when interfaces on other devices are up or go down. and network-independent protocol that networking applications use to learn about nearby. CDP is disabled by default and can be enabled globally with the command cdp run. 60 seconds C. by default. Devices discover each other by listening at that address.A. which indicates the length of time a receiving device should hold Cisco Discovery Protocol information before discarding it. 120 seconds D. . which means the Cisco IOS software will receive CDP information. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: CDP is enabled on your router by default. CDP is enabled by default and can be disabled globally with the command no cdp enable. CDP is disabled by default and can be enabled globally with the command cdp enable. Each device configured for Cisco Discovery Protocol advertises at least one address at which the device can receive messages and sends periodic advertisements (messages) to the well-known multicast address 01:00:0C:CC:CC:CC. D. every 60 seconds. use the “no cdp enable interface” configuration command. C. Advertisements supported and configured in Cisco software are sent. media-independent.com/en/US/docs/ios-xml/ios/cdp/configuration/15-mt/nm-cdp-discover.html QUESTION 62 Which statement about Cisco Discovery Protocol configuration on a Cisco switch is true? A. CDP also is enabled on supported interfaces by default. CDP is enabled by default and can be disabled globally with the command no cdp run. Advertisements contain time-to-live information. 30 seconds B. To disable CDP on an interface. 300 seconds Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Cisco Discovery Protocol is a Layer 2. To disable it globally. use the “no cdp run” command. directly connected devices. Reference: http://www.

wikipedia.com/en/US/docs/ios/12_2/configfun/command/reference/frf015.Reference: http://www.1q frame? A. 2 D.1Q QUESTION 64 What is the maximum number of VLANs that can be assigned to an access switchport without a voice VLAN? A. allowing up to 4. 0 B. 12-bit C. If more than one VLAN is needed. 8-bit B. 1 C.html#wp1017573 QUESTION 63 What is the size of the VLAN field inside an 802. The hexadecimal values of 0x000 and 0xFFF are reserved. All other values may be used as VLAN identifiers.org/wiki/IEEE_802. 16-bit D. 1024 Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: A standard (non-voice VLAN port) access switch port can belong to only a single VLAN.094 VLANs Reference: http://en.cisco. 32-bit Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The VLAN field is a 12-bit field specifying the VLAN to which the frame belongs. the port should be configured as a .

trunk port. . QUESTION 65 Refer to the exhibit. Which option shows the expected result if a show vlan command is issued? A.

B. . C. D.

spanning tree D. so even though Cisco IOS will accept both.1_22_ea11x/configuration/guide/swvoip. the port has been configured both as a trunk and as a switchport in data vlan 10. Reference: http://www. Use the show vlan privileged EXEC command to see if the VLAN is present (listed in the display). a port can not be both. the port will actually be used as a trunk. the Port Fast feature is not automatically disabled. ignoring the switchport access VLAN 10 command. Obviously. The voice VLAN should be present and active on the switch for the IP phone to correctly communicate on the voice VLAN.Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: In this case. within the Ethernet header B.cisco. When you disable voice VLAN.html QUESTION 67 In which portion of the frame is the 802. The Port Fast feature is automatically enabled when voice VLAN is configured. port-security C. QUESTION 66 Which feature is automatically enabled when a voice VLAN is configured. within the Ethernet payload . storm control Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Voice VLAN Configuration Guidelines You should configure voice VLAN on switch access ports.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1q header found? A. but not automatically disabled when a voice VLAN is removed? A. portfast B.

within the Ethernet source MAC address Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Frame format Insertion of 802. VLANs 1-1001 B. VLANs 2-1001 D. it adds a 32-bit field between the source MAC address and the EtherType/ length fields of the original frame Reference: http://en. for Ethernet frames.1Q does not encapsulate the original frame.org/wiki/IEEE_802. within the Ethernet FCS D.1Q tag in an Ethernet frame 802.1Q QUESTION 68 Which VLAN range is eligible to be pruned when a network engineer enables VTP pruning on a switch? A. VLANs 1-4094 C.wikipedia.C. VLANs 2-4094 Correct Answer: C Section: (none) Explanation . Instead.

All unknown unicasts and broadcasts in a VLAN are flooded over the entire VLAN. port-security C. there are occasions when VTP can create unnecessary traffic.php QUESTION 69 Which feature must be enabled to eliminate the broadcasting of all unknown traffic to switches that are not participating in the specific VLAN? A. All switches in the network receive all broadcasts. VLANs 2 – 1001 are pruning eligible. .com/c/en/us/support/docs/lan-switching/vtp/10558-21. Both VTP versions 1 and 2 supports pruning. even in situations in which few users are connected in that VLAN. bpdguard Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: VTP ensures that all switches in the VTP domain are aware of all VLANs.com/VTP-Pruning.html#vtp_pruning QUESTION 70 Refer to the exhibit. storm control D. VTP pruning is a feature that you use in order to eliminate or prune this unnecessary traffic. However. Reference: http://www.Explanation/Reference: Explanation: VTP pruning should only be enabled on VTP servers. VTP pruning B.orbit-computer-solutions. but VLAN 1 can’t be pruned because it’s an administrative VLAN. By default. Reference: http://www.cisco. all the clients in the VTP domain will automatically enable VTP pruning.

Update the VTP revision number. so to enable vlan 10 on this switch you will first need to change the VTP mode from client to server.The users in an engineering department that connect to the same access switch cannot access the network. The network engineer found that the engineering VLAN is missing from the database. Disable VTP pruning and disable 802. . Change VTP mode to server and enable 802. Then. B.1q.1Q trunking to pass this new VLAN along to the other switches. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Only VTP servers can add new VLANs to the switched network. Enable VTP pruning and disable 802.1q. you will need to enable 802. C.1q. Which action resolves this problem? A. QUESTION 71 Refer to the exhibit. D.

The network switches for two companies have been connected and manually configured for the required VLANs. . but users in company A are not able to access network resources in company B when DTP is enabled. Delete vlan. Which action resolves this problem? A.dat and ensure that the switch with lowest MAC address is the VTP server.

Disable DTP and document the VTP domain mismatch. C. Manually force trunking with switchport mode trunk on both switches. The VTP domain names do match and they are both VTP servers so there are no issues there. PPP encapsulation with a virtual template B.B. . D. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Since the number of existing VLANs differ on the switches (9 on A and 42 on B) we know that there is a problem with VTP or the trunking interfaces. Consider that this is a multivendor environment. Link Aggregation Protocol at the access layer C. dot1q VLAN trunking D. QUESTION 72 A network engineer must implement Ethernet links that are capable of transporting frames and IP traffic for different broadcast domains that are mutually isolated. Enable the company B switch with the vtp mode server command. Of these. but version 1 does not. The only viable solution is that there is a DTP issues and so you must instead manually configure the trunk ports between these two switches so that the VLAN information can be sent to each switch. There are 2 different methods for trunking. 802. only 802. Inter-Switch Link Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Here the question asks for transporting “frames and IP traffic for different broadcast domains that are mutually isolated” which is basically a long way of saying VLANs so trunking is needed to carry VLAN information. Cisco Discovery Protocol version 2 carries native VLAN information. QUESTION 73 Which statement about using native VLANs to carry untagged frames is true? A. Which Cisco IOS switching feature can be used to achieve the task? A.1Q and ISL.1Q is supported by multiple vendors since ISL is a Cisco proprietary protocol.

B. you will see CDP error messages on the console output.B.ciscopress. 802. Reference: http://www. Correct Answer: C Section: (none) Explanation . Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cisco Discovery Protocol (CDP) version 2 passes native VLAN information between Cisco switches. If you have a native VLAN mismatch. C. Cisco Discovery Protocol version 3 carries native VLAN information. both with native VLAN mismatch. D. VLAN 2013 on the multilayer switch is configured as the native VLAN. but version 2 does not. Cisco Discovery Protocol version 1 carries native VLAN information.com/articles/article. but versions 1 and 2 do not. C. Cisco Discovery Protocol version 1 and version 2 carry native VLAN information. D. VLAN ID 1 should not be used for management traffic because its unsafe.asp?p=29803&seqNum=3 QUESTION 74 Refer to the exhibit.1q trunks are on both sides. VLAN spanning-tree in SW-2 is configured. spanning-tree bpdu-filter is enabled. Which option is the cause of the spanning-tree error? A. A multilayer switch has been configured to send and receive encapsulated and tagged frames.

switchport trunk allowed VLAN D. not via DTP messages.aspx?b=CCNP_Studies_Switching&seqNum=25 QUESTION 75 A network engineer must improve bandwidth and resource utilization on the switches by stopping the inefficient flooding of frames on trunk ports where the frames are not needed. Manually prune default VLAN with switchport trunk allowed vlans remove. Use trunk pruning vlan 1.informit. Which Cisco IOS feature can be used to achieve this task? A. Native VLAN mismatches are detected via spanning tree and Cisco Discovery Protocol (CDP). The “vtp pruning” command prunes VLANs automatically.com/library/content.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/24330-185. Failure to do this causes Cisco switches to partially shut down the trunk port because having mismatched native VLANs can result in spanning-tree loops. the trunk still remains up for other VLANs. VLAN access-map Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cisco advocates the benefits of pruning VLANs in order to reduce unnecessary frame flooding. B.cisco. Enable VTP pruning on the VTP server.Explanation/Reference: Here we see that the native VLAN has been configured as 2013 on one switch. but 1 (the default native VLAN) on the other switch. If spanning tree detects a native VLAN mismatch. D. Reference: http://www. If you use 802. which stops the inefficient flooding of frames where they are not needed.html QUESTION 76 Which action allows a network engineer to limit a default VLAN from being propagated across all trunks? A. however. .1Q trunks. VTP pruning B. you must ensure that you choose a common native VLAN for each port in the trunk. spanning tree blocks local native VLAN traffic and the remote switch native VLAN traffic on the trunk. Upgrade to VTP version 3 for advanced feature set support. access list C. Reference: http://www. C.

1_13_ea1/configuration/guide/swtunnel. Support 1504 MTU or higher C. Support less than 1500 MTU B. The “trunk pruning vlan 1” option is not a valid command.1Q tunneling (Q-in-Q) feature increases the frame size by 4 bytes when the extra tag is added. . Because the 802.com/en/US/docs/switches/lan/catalyst3550/software/release/12. QUESTION 77 What is required for a LAN switch to support 802. you must configure all switches in the service-provider network to be able to process maximum frames by increasing the switch system MTU size to at least 1504 bytes.cisco. Reference: http://www. VLAN 1 is not VTP pruning eligible so it cannot be done via VTP pruning.1q Q-in-Q encapsulation? A. Support 1522 layer 3 IP and IPX packet D.Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Manaully pruning the default VLAN (1) can only be done with the “switchport trunk allowed vlans remove” command. Support 1547 MTU only Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The default system MTU for traffic on Catalyst switches is 1500 bytes.html QUESTION 78 Refer to the exhibit.

cisco. C. 8-bytes except the native VLAN C. Reference: http://www. The valid range is from 1 to 65535. A VLAN tag adds 4 bytes to the frame. LACP uses the port priority with the port number to form the port identifier. 4-bytes except the native VLAN B. Which action allows interface G0/1 to always actively forward traffic in the port-channel? A. B. Configure G0/1 as half duplex and G0/2 as full duplex. LACP traffic goes through G0/4 because it is the highest interface ID. 4-bytes including native VLAN D. The higher the number. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: A LACP port priority is configured on each port using LACP.1Q trunking. Two bytes are used for the tag protocol identifier (TPID). The port priority determines which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating. The default is 32768. D. and G0/4 between two switches using Ethernet port-channel.com/c/en/us/td/docs/ios/12_2sb/feature/guide/gigeth. the other two bytes for tag control information (TCI). QUESTION 79 A network engineer configured a fault-tolerance link on Gigabit Ethernet links G0/1. the lower the priority. 8-bytes including native VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: In 802. The port priority can be configured automatically or through the CLI. Configure LACP port-priority on G0/1 to 65535.html#wp1081491 . G0/3. all VLAN packets are tagged on the trunk link.How many bytes are added to each frame as a result of the configuration? A. Configure LACP port-priority on G0/1 to 1. G0/2. except the native VLAN.

desirable-desirable. PagP modes are active. and on. desirable. 2. and on-on allow the formation of a channel. The channel is forced to remain down. Only the combinations active-desirable. Reference: http://www.QUESTION 80 Which statement about the use of PagP link aggregation on a Cisco switch that is running Cisco IOS Software is true? A. desirable. 1. auto. PagP modes are active. and on-on allow the formation of a channel. The formation of a channel is desired. and on-on allow the formation of a channel. and on. desirable-desirable. desirable. the device on the other side must have PagP set to on.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/21041-131. 4. such as a router. Only the combinations auto-desirable. desirable: PagP is running actively. however. . D.html QUESTION 81 Refer to the exhibit. 3. and on. and on. it is not initiated. and on-on allow the formation of a channel. auto: PagP is running passively. Only the combinations auto-auto. C. PagP modes are off. The PagP modes are explained below. desirable-desirable. desirable-desirable. If a device on one side of the channel does not support PagP. The channel is forced to come up. desirable-desirable. The formation of a channel is desired and initiated. active. and on-on will allow a channel to be formed. B. and on. and on-on will allow a channel to be formed. off: PagP will not run. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: PagP modes are off. Only the combinations active-active. desirable. Only the combinations auto-desirable. Only the combinations of auto-desirable. on: PagP will not run. desirable-desirable. PagP modes are off. desirable.cisco. auto.

Which EtherChannel negotiation protocol is configured on the interface f0/13 – f0/15? A. Link Combination Control Protocol .

it is not initiated. 1. . The link aggregate is formed if the other end runs in LACP active or passive mode. This is similar to the desirable mode of PAgP. the switch neither sends the LACP packet nor processes any inbound LACP packet. Only the combinations auto-desirable. 4. fa0/14. desirable: PAgP is running actively. The Link Aggregate Control Protocol (LACP) trunking supports four modes of operation: On: The link aggregation is forced to be formed without any LACP negotiation . Active: We can form an aggregate link and initiate the negotiation. Link Aggregation Control Protocol Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: PAgP modes are off. Off: The link aggregation is not formed. In this example. however. The channel is forced to come up. we see that fa 0/13. on: PAgP will not run. auto: PAgP is running passively. We do not send or understand the LACP packet. This is similar to the off state for PAgP. which is only a PAgP mode. 3. eventually to form the aggregation channel with the peer. 2. Port Combination Protocol D.B. off: PAgP will not run. The formation of a channel is desired. . This is similar to the on state for PAgP. This is similar to the auto mode in PAgP. The peer (in active state) initiates negotiation (when it sends out an LACP packet) which we receive and answer. auto. and on-on will allow a channel to be formed. desirable. QUESTION 82 Refer to the exhibit. and on. The channel is forced to remain down. Passive: The switch does not initiate the channel but does understand inbound LACP packets.In other words. and fa0/15 are all in Port Channel 12. desirable-desirable. Port Aggregation Protocol C. The formation of a channel is desired and initiated. which is operating in desirable mode.

since the web server has two NICs traffic will be load balanced across both MAC addresses. Change the load-balance method to dst-mac. Which action can the engineer take to resolve this issue? A. Disable EtherChannel load balancing. D. C. the network engineer configured an EtherChannel on interfaces Fa1/0 and Fa0/1 of the server farm switch.Users of PC-1 experience slow connection when a webpage is requested from the server. To increase bandwidth. Upgrade the switch IOS to IP services image. The load balancing method should be changed to destination MAC. Contact Cisco TAC to report a bug on the switch. traffic will only be using one of the port channel links. as shown here: Server_Switch#sh etherchannel load-balance EtherChannel Load-Balancing Operational State (src-mac): Non-IP: Source MAC address IPv4: Source MAC address IPv6: Source IP address Server_Switch# HoweIer. . and since the load balancing method is source MAC. B. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Since this traffic is coming from PC-1. traffic is still slow. the source MAC address will always be that of PC-1.

A switch can support up to 10 compatibly configured Ethernet interfaces in an EtherChannel. such as a router. desirable. Some restrictions are deliberately introduced into PAgP. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: PAgP aids in the automatic creation of EtherChannel links. •PAgP modes are off.html QUESTION 84 Which statement about using EtherChannel on Cisco IOS switches is true? A. PAgP requires that all ports in the channel belong to the same VLAN or are configured as trunk ports. If speed and duplex change when a bundle exists. PAgP changes the port speed and duplex for all ports in the bundle. The device on the other side must have PAgP set to on if a device on one side of the channel does not support PAgP. The EtherChannel provides full-duplex bandwidth up to 800 Mbps only for Fast EtherChannel or 16 Gbps only for Gigabit EtherChannel. Reference: http://www. •PAgP does not group ports that operate at different speeds or port duplex. all ports in the bundle are modified to match that VLAN.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. D. PAgP drops the ports that do not match the configuration. PAgP packets are sent between EtherChannel-capable ports in order to negotiate the formation of a channel. Only the combinations auto-desirable. B. PAgP changes the port speed but not the duplex for all ports in the bundle. The EtherChannel provides full-duplex bandwidth up to 800 Mbps only for Fast EtherChannel or 8 Gbps only for Gigabit EtherChannel. desirable-desirable.QUESTION 83 A network engineer changed the port speed and duplex setting of an existing EtherChannel bundle that uses the PAgP protocol. When a bundle already exists and a VLAN of a port is modified. C. The EtherChannel provides full-duplex bandwidth up to 1000 Mbps only for Fast EtherChannel or 8 Gbps only for Gigabit EtherChannel. B. PAgP changes the port speed and duplex for all ports in the bundle. The restrictions are: •PAgP does not form a bundle on ports that are configured for dynamic VLANs. The EtherChannel provides full-duplex bandwidth up to 1000 Mbps only for Fast EtherChannel or 10 Gbps only for Gigabit EtherChannel. . Which statement describes what happens to all ports in the bundle? A.cisco. and on. PAgP does not change the port speed and duplex for all ports in the bundle until the switch is rebooted. A switch can support up to 10 compatibly configured Ethernet interfaces in an EtherChannel. auto. C. and on-on allow the formation of a channel. D. A switch can support up to eight compatibly configured Ethernet interfaces in an EtherChannel. A switch can support up to eight compatibly configured Ethernet interfaces in an EtherChannel.

and all must be configured as either Layer 2 or Layer 3 interfaces.html QUESTION 85 Refer to the exhibit. .Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: An EtherChannel consists of individual Fast Ethernet or Gigabit Ethernet links bundled into a single logical link. Reference: http://www. Each EtherChannel can consist of up to eight compatibly configured Ethernet interfaces.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4. The EtherChannel provides full-duplex bandwidth up to 800 Mbps (Fast EtherChannel) or 8 Gbps (Gigabit EtherChannel) between your switch and another switch or host.cisco. All interfaces in each EtherChannel must be the same speed.

Logical port Fa0/13. C. and Fa0/15 successfully formed a Layer 3 physical port-channel interface using an open standard protocol. and Fa0/15 successfully formed a Layer 2 physical port-channel interface using a Cisco proprietary protocol. Physical port Fa0/13. Correct Answer: A . and Fa0/15 successfully formed a Layer 3 port-channel interface using a Cisco proprietary protocol.Which statement about switch S1 is true? A. Fa0/14. Fa0/14. Fa0/14. Logical port Fa0/13. Physical port Fa0/13. and Fa0/15 successfully formed a Layer 2 port-channel interface using an open standard protocol. Fa0/14. D. B.

1d BPDU? A.1D switches.1d BPDU and eventually the two switches run 802.1d BPDU and eventually the two switches run 802.1d does not understand RSTP BPDUs because they are different versions.1d BPDU. which is a standards based protocol.1d BPDU.1d to communicate.1d BPDU.1D BPDU after the port migration-delay timer has expired. the migrate-delay timer is started (specifies the minimum time during which RSTP BPDUs are sent).1D BPDUs on a port and receives an RSTP BPDU after the timer has expired.1d BPDU.html QUESTION 87 When two MST instances (MST 1 and MST 2) are created on a switch. B. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: For backward compatibility with 802. If the switch receives an 802.1d to communicate.1D BPDUs.1d BPDU and eventually the two switches run 802. but when a RSTP switch receives a 802.1d to communicate.Section: (none) Explanation Explanation/Reference: Explanation: These three ports show that they are in Port Channel 1. and RSTP BPDUs are sent. 802.1d does not understand RSTP BPDUs because they are different versions. The protocol used for this port channel shows as LACP. 802. the switch processes all BPDUs received on that port and ignores the protocol type. as opposed to PagP.1d understands RSTP BPDUs because they are the same version. However. it does not respond with a 802. C.1D switch and starts using only 802. but when a RSTP switch receives a 802. 802. When a port is initialized.cisco. it assumes that it is connected to an 802. QUESTION 86 What happens on a Cisco switch that runs Cisco IOS when an RSTP-configured switch receives 802. what is the total number of spanning-tree instances running on the switch? . it restarts the timer and starts using RSTP BPDUs on that port. RSTP selectively sends 802. but when a RSTP switch receives a 802. it does not respond with a 802. While this timer is active. and the (SU) means they are in use and operating at layer 2.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree. Reference: http://www. if the RSTP switch is using 802. which is Cisco proprietary. D.1d BPDU.1D configuration BPDUs and TCN BPDUs on a per-port basis. but when a RSTP switch receives an 802. it responds with an 802. 802. it responds with a 802.1d understands RSTP BPDUs because they are the same version.

there will be the 2 defined MST instances. The CST interconnects the MST regions and single spanning trees.html QUESTION 88 Refer to the exhibit. Instance 0 is a special instance for a region. The IST is the only spanning tree instance that sends and receives BPDUs. By default. All MST instances within the same region share the same protocol timers. Because the MST BPDU carries information for all instances. all VLANs are assigned to the IST.cisco. which are 68sername6868eed within MST BPDUs. MST establishes and maintains IST. the number of BPDUs that need to be processed to support multiple spanning tree instances is 68sernamcantly reduced. even if regions A and B are interconnected. Within each MST region. such as root bridge ID. In the case for this question. All other MST instances are numbered from 1 to 4094. CIST. and CST spanning trees: An IST is the spanning tree that runs in an MST region. root path cost. All of the other spanning tree instance information is contained in MSTP records (M-records). and the special 0 instance. for example. 1 B. MST maintains multiple spanning tree instances. known as the IST. An MST instance is local to the region. 4 Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Unlike other spanning tree protocols. for a total of 3 instances.A. Reference: http://www. 2 C. . but each MST instance has its own topology parameters.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree. MST instance 1 in region A is independent of MST instance 1 in region B. in which all the spanning tree instances are independent. 3 D. A CIST is a collection of the ISTs in each MST region. and so forth.

Which action is needed to modify the Layer 2 spanning-tree network so that traffic for PC1 VLAN from switch SW3 uses switchport f1/1 as a primary port? A. Modify the spanning-tree port-priority on SW2 f1/1 to 0 and f1/0 to 16. Modify the spanning-tree port-priority on SW2 f1/1 to 16 and f1/0 to 0. Modify the spanning-tree port-priority on SW1 f1/1 to 0 and f1/0 to 16. Modify the spanning-tree port-priority on SW1 f1/1 to 16 and f1/0 to 0. D.f1/0 and f1/1 have the same end-to-end path cost to the designated bridge. B. C. Correct Answer: C Section: (none) Explanation .

cisco. If all LAN ports have the same priority value. A lower path cost represents higher-speed transmission and is preferred.com/en/US/docs/switches/lan/catalyst2950/software/release/12.html#wp1105354 QUESTION 89 Refer to the exhibit. . The possible priority range is 0 through 240 (default 128). You can assign higher priority values to LAN ports that you want STP to select first and lower priority values to LAN ports that you want STP to select last. STP puts the LAN port with the lowest LAN port number in the forwarding state and blocks other LAN ports. configurable in increments of 16.1_9_ea1/configuration/guide/swstp. STP considers port priority when selecting a LAN port to put into the forwarding state.Explanation/Reference: Explanation: If a loop occurs. Reference: http://www.

The bridge priority is 1 and all ports are forwarding. The switch priority value is zero. The switch priority for VLAN 1 and the macro specifies “This Bridge is the root”.Why would the switch be considered as a root bridge? A. The bridge priority is 128. it has the lowest priority value for VLAN 1.19 and all ports are forwarding. Correct Answer: D Section: (none) Explanation . C. B. D.

interface f0/13 B.Explanation/Reference: Explanation: For priority. which option will be the new root port for VLAN 10? A. the range is 0 to 61440 in increments of 4096. The lower the number. interface f0/15 D. the more likely the switch will be chosen as the root switch.cisco. the default is 32768. interface f0/21 . Reference: http://www.com/en/US/docs/switches/lan/catalyst2950/software/release/12.html#wp1020666 QUESTION 90 Refer to the exhibit. Considering the default cost of upstream bridges to the root bridge is equal.1_9_ea1/configuration/guide/swstp. All ports are members of VLAN 10. interface f0/14 C.

Which Layer 2 enhancement can be used to eliminate this delay? A. BPDU data is still received in blocking state. from the direction of Root Bridge) Connected Bridge ID .extremenetworks. C.com/extreme/topics/802_1d_spanning_tree_election_rules QUESTION 91 A network engineer is trying to deploy a PC on a network. Configure no switchport. 2. With the initial version of spanning tree.lowest prevails Connected Port ID (Port Priority + Port#) . Total Path Cost to root .lowest prevails In this case. no user data is sent or received but it may go into forwarding mode if the other links in use were to fail and the spanning tree algorithm determines the port may transition to the forwarding state.Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Root Port election on each bridge Each (non-Root) bridge has exactly one Root Port. 3. D.Learning – While the port does not yet forward frames (packets) it does learn source addresses from frames received and adds them to the filtering .lowest prevails (local Root Port cost added upon receipt of Configuration – PDUs on that port.lowest prevail– Local Port ID . Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: When first powered on. These steps are outlined as follows. so it will be the root port. B. each port goes through 4 states to ensure that there are no physical loops in the layer 2 broadcast domain. Reference: https://community. it takes 30 to 60 seconds for the PC to see any activity on the network interface card. Configure port to duplex full and speed 1000.Listening – The switch processes BPDUs and awaits possible new information that would cause it to return to the blocking state. The engineer observes that when the PC is connected to the network. Configure spanning-tree portfast.Blocking – A port that would cause a switching loop. fa0/21 has the lowest cost. this process could take from 30-60 seconds. Configure port duplex and speed to auto negotiation. 1. which represents the best path to the Root Bridge.

If an interface is enabled for portfast receives BDPU. The port goes into loop-inconsistent state and stops forwarding traffic. The port goes into root-inconsistent state and stops forwarding traffic. the “Spanning-tree portfast bpdufilter default” command specifies that if a BPDU is received on that port. Switchone(config) # Spanning-tree portfast bpdufilter default Which statement about the spanning-tree portfast feature on the switch is true? A. bypassing the listening and learning states. If an interface is enabled for portfast receives BDPU.Forwarding – A port receiving and sending data. If an interface is enabled for portfast receives BDPU. .us/Home/ethernet-and-ip/spanning-tree-protocol QUESTION 92 A network engineer configured an Ethernet switch using these commands. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately. the port goes through the spanning-tree listening. learning. the port goes into the spanning-tree inconsistent state. However. database (switching database) 4. learning.cmed. B. If an interface is enabled for portfast receives BDPU. STP still monitors incoming BPDUs that would indicate it should return to the blocking state to prevent a loop. C. the port is shut down immediately. The port goes into errdisabled state and stops forwarding traffic. B. the port does not go through the spanning-tree listening. and forwarding states. learning. Reference: http://net. and forwarding states. STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately. D. then the default action of STP of listening. D. normal operation. bypassing the listening and learning states. QUESTION 93 Which statement describes what happens when a port configured with root guard receives a superior BPDU? A. The port goes into BPDU-inconsistent state and stops forwarding traffic. and forwarding states should be used. C.

C.cisco. unless two or more ports of the root bridge are connected together.html . Converting a port channel to mLACP can cause a service disruption. In this way.Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The root guard ensures that the port on which root guard is enabled is the designated port. Reference: http://www. D.com/en/US/docs/switches/lan/catalyst6500/ios/12.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00800ae96b. It is available only on a Cisco Catalyst 6500 Series chassis. the root guard enforces the position of the root bridge. The DHD system priority must be lower (higher numerically) than the PoA system priority. This root-inconsistent state is effectively equal to a listening state. Reference: http://www. Normally. No traffic is forIarded across this port. follow these guidelines and restrictions: PFC3A mode does not support the mLACP for server access feature. mLACP does not support half-duplex links. B. If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port. root guard moves this port to a root-inconsistent STP state.2SX/configuration/guide/mlacp_server_support. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: When configuring mLACP for Server Access. mLACP does not support multiple neighbors. root bridge ports are all designated ports. Converting a port channel to mLACP can cause a service disruption. It does not support 1Gb links.cisco.shtml QUESTION 94 Which statement about restrictions for multichassis LACP is true? A. No more than 100 VLANs can be active on a switch configured as a PoA. It is not available in VSS. VSS mode does not support the mLACP for server access feature.

cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html QUESTION 96 Which statement describes what happens if all VSL connections between the virtual switch members are lost? A. D. The VSS transitions to the dual active recovery mode. Reference: http://www. and only the new active virtual switch continues to forward traffic. 8 D. 12 Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: The VSS is made up of the following: Virtual switch members: Cisco Catalyst 6500 Series Switches (up to two switches with initial release) deployed with the Virtual Switching Supervisor 720 10GE Virtual switch link (VSL): 10 Gigabit Ethernet connections (up to eight using EtherChannel) between the virtual switch members. C. Both virtual switch members cease to forward traffic. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Q. 6 C.QUESTION 95 What is the maximum number of 10 Gigabit Ethernet connections that can be utilized in an EtherChannel for the virtual switch link? A. and both virtual switch members continue to forward traffic independently. B. What happens if all VSL connections between the virtual switch members are lost? . The VSS transitions to the dual active recovery mode. The virtual switch members reload. 4 B.

If for some rare reason all VSL connections are lost between the virtual switch members leaving both the virtual switch members up.A.2(33) SXI) In the dual active recovery mode. The dual active state is detected rapidly (subsecond) by any of the following three methods: Enhancement to PagP used in MEC with connecting Cisco switches L3 Bidirectional Forwarding Detection (BFD) configuration on a directly connected link (besides VSL) between virtual switch members or through an L2 link through an access layer switch L2 Fast-Hello Dual-Active Detection configuration on a directly connected link (besides VSL) between virtual switch members (supported with 12. B. all interfaces except the VSL interfaces are in an operationally shut down state in the formerly active virtual switch member.html QUESTION 98 A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database. The new active virtual switch continues to forward traffic on all links. C. Reference: http://www. VSLs can be configured with up to eight links between the two switches across any combination of line cards or supervisor ports to provide a high level of redundancy.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b. The switch shuts down and waits for the VSL link to be restored before sending traffic. All interfaces are shut down in the formerly active virtual switch member. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: In the dual active recovery mode. The VSS detects which system was last in active state and shuts down the other switch. all interfaces except the VSL interfaces are in an operationally shut down state in the formerly active virtual switch member.cisco. The new active virtual switch continues to forward traffic on all links. Reference: http://www. the VSS will transition to the dual active recovery mode. The switch continues to forward traffic out all links and enables spanning tree on VSL link and all other links to prevent loops.html QUESTION 97 Which statement describes what happens when a switch enters dual active recovery mode? A.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b. D.cisco. What is the solution to avoid the snooping database from being rebuilt after every device reboot? . but the new active virtual switch forwards traffic on all links.

B. Configure the DHCP snooping database agent. Enable DHCP snooping globally. 3. A DHCP snooping database agent should be configured. 2. The feature is not active until you complete this step.html#wp1090479 QUESTION 99 Which portion of AAA looks at what a user has access to? A. Ensure that DHCP server is connected through a trusted interface. authorization B. the trust state of all interfaces is untrusted. This step ensures that database entries are restored after a restart or switchover. Enable DHCP snooping on at least one VLAN. E. Define and configure the DHCP server. By default. DHCP snooping is inactive on all VLANs.A. auditing Correct Answer: A Section: (none) Explanation . Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting. Apply ip dhcp snooping trust on all interfaces with dynamic addresses. 5. accounting D.cisco. By default. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Minimum DHCP Snooping Configuration The minimum configuration steps for the DHCP snooping feature are as follows: 1. Disable Option 82 for DHCP data insertion. D. Enable DHCP snooping for all VLANs that are associated with the switch. 4. authentication C.2SX/configuration/guide/snoodhcp. Reference: http://www. C.com/en/US/docs/switches/lan/catalyst6500/ios/12.

Authorization: After initial authentication. you could get a log of when users logged in and when they logged out. QUESTION 101 A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP snooping. Reference: http://www. it can also support encryption. (config)# aaa authentication login radius local Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: In the command “aaa authentication login login radius local” the second login is the name of the AAA method. For more protection against malicious attacks. which would be specific to the individual user rights. It provides a way“o” collecting security information that you can use for billing. (config)# aaa authentication login default radius local B. . the network team is considering enabling dynamic ARP inspection alongside DHCP snooping.techrepublic. (config)# aaa authentication login default local radius D. so it will primarily use RADIUS for authentication and fail over to the local user database only if the RADIUS server is unreachable. and reporting. authorization looks at what that authenticated user has access to do. (config)# aaa authentication login login radius local C. RADIUS or TACACS+ security servers perform authorization for specific privileges by defining attribute-value (AV) pairs. Depending on your security options. For example. Accounting: The last "A" is for accounting.Explanation/Reference: Explanation: AAA consists of the following three elements: Authentication: Identifies users by login and password using challenge and response methodology before the user even gains access to the network. with accounting. you can define AAA authorization with a named list or authorization method.com/blog/data-center/what-is-aaa-and-how-do-you-configure-it-in-the-cisco-ios/ QUESTION 100 Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the local user database? A. It also lists radius first then local. You can use accounting to see what users do once they are authenticated and authorized. Which solution ensures that the server maintains network reachability in the future? A. In the Cisco IOS. Disable DHCP snooping information option. auditing.

To ensure network reachability to the server. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Dynamic ARP inspection is a security feature that validates ARP packets in a network. Correct Answer: C Section: (none) Explanation . the switch forwards the packet only if it is valid. D. C. Drops invalid ARP packets Dynamic ARP inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database. This capability protects the network from certain man-in-the-middle attacks. It intercepts. Ensure all switches are configured as VTP server mode. On untrusted interfaces. Disable VTP and manually assign VLANs.html QUESTION 102 A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. The switch performs these activities: Intercepts all ARP requests and responses on untrusted ports Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating the local ARP cache or before forwarding the packet to the appropriate destination. Reference: http://www. Enable VTP version 3. Dynamic ARP inspection ensures that only valid ARP requests and responses are relayed. logs.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/swdynarp. Configure a static DHCP snooping binding entry on the switch.cisco. Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify mac-address command. C. D. the switch forwards the packet without any checks. configure a static DHCP snooping binding entry on the switch. Configure VTP Transparent Mode. If the ARP packet is received on a trusted interface.B. Trust the interface that is connected to the server with the ip dhcp snooping trust command. and discards ARP packets with invalid IP-to-MAC address bindings. the DHCP snooping binding database. B. Which configuration must be made before the private VLAN is configured? A.

The switch uses the IP source binding table only wIen IP source guard is enabled. clients are not receiving an IP address via the DHCP server. If there is no match. Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The IP source binding table has bindings that are learned by DHCP snooping or are manually configured (static IP source bindings).html#ipsourceguard QUESTION 104 A DHCP configured router is connected directly to a switch that has been provisioned with DHCP snooping. The switch forwards traffic only when the source IP and MAC addresses match an entry in the IP source binding table. Which option is the cause of this issue? . Private VLANs are configured in the context of a single switch and cannot have members on other switches. When IP source guard is enabled with this option. Reference: http://www. Reference: http://www.ciscopress.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed. The IP address of one of the workstations does not match any entries found in the DHCP binding database. Traffic will pass accordingly after the new IP address is populated into the binding database. C. D. the packets are assumed to be spoofed and will be discarded. IP Source Guard with the ip verify source port- security command is configured under the interfaces that connect to all DHCP clients on the switch. Private VLANs also carry TLVs that are not known to all types of Cisco switches. Which statement describes the outcome of this scenario? A. However. The interface that is connected to the workstation in question will be put into the errdisabled state.asp?p=29803&seqNum=6 QUESTION 103 DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. You can configure IP source guard with source IP address filtering. When IP source guard is enabled with this option. IP traffic is filtered based on the source IP and MAC addresses. Packets from the workstation will be rate limited according to the default values set on the switch. IP traffic is filtered based on the source IP address.cisco. or with source IP and MAC address filtering. The packets originating from the workstation are assumed to be spoofed and will be discarded.Explanation/Reference: Explanation: You must configure VTP to transparent mode before you can create a private VLAN.com/articles/article. and its associated VLAN number. The switch forwards IP traffic when the source IP address matches an entry in the DHCP snooping binding database or a binding in the IP source binding table. its associated MAC address. An entry in this table has an IP address. B.

D. there are two caveats: The DHCP server must support option 82. The MAC address in the DHCP packet is not learned as a secure address. even if they are not utilized for dynamic address allocation. DHCP snooping must be enabled on all VLANs. C. using the ip verify source port-security interface configuration command. Which option is the cause of the problem? A. The interfaces are configured as Layer 3 using the no switchport command. The DHCP client interfaces have storm control configured. C. Reference: http://www.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/guide/3550SCG/ swdhcp82. The MAC address of the DHCP client is learned as a secure address only when the switch receives non-DHCP data traffic. E. Layer 2 interfaces by filtering traffic based on the DHCP snooping binding . Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: IP source guard is a security feature that restricts IP traffic on nonrouted. but is unable to configure ip verify source under several of the interfaces.A. B. The DHCP server does not support information option 82. or the client is not assigned an IP address. The switch is configured for sdm prefer routing as the switched database management template. The configured SVIs on the switch have been removed for the associated interfaces. The local DHCP server is disabled prior to enabling IP Source Guard. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: When you enable both IP Source Guard and Port Security. No VLANs exist on the switch and/or the switch is configured in VTP transparent mode.html#wp1069615 QUESTION 105 A switch is added into the production network to increase port capacity. D. A network engineer is configuring the switch for DHCP snooping and IP Source Guard. Static DHCP bindings are not configured on the switch.cisco. B.

Reference: http://www.database and on manually configured IP source bindings. SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold. including access and trunk ports. You can configure IP source guard with source IP address filtering or with source IP and MAC address filtering. An entry in this table has an IP address. The port ACL allows only IP traffic with a source IP address in the IP source binding table and denies all other traffic. The IP source binding table has bindings that are learned by DHCP snooping or are manually configured (static IP source bindings). After IP source guard is enabled on an interface. the switch blocks all IP traffic received on the interface.cisco. F. Only broadcast traffic is limited by this particular storm control configuration. except for DHCP packets allowed by DHCP snooping. B. and its associated VLAN number. IP source guard is supported only on Layer 2 ports. The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth. You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. The switch drops broadcasts when they reach 75% of bandwidth. its associated MAC address. Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface bandwidth. C.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/guide/3550SCG/ swdhcp82. You can use IP source guard to prevent traffic attacks caused when a host tries to use the IP address of its neighbor.) A. The switch uses the IP source binding table only when IP source guard is enabled. A port access control list (ACL) is applied to the interface. D. The switch resumes forwarding broadcasts when they are below 65% of bandwidth. In which three ways does this command impact the traffic? (Choose three.html#wp1069615 QUESTION 106 The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail server. E. Correct Answer: CDF Section: (none) Explanation Explanation/Reference: Explanation: .

Reference: http://www. the network team has been overwhelmed with port reset requests. switch(config)# errdisable recovery cause psecure-violation C. They decide to configure the network to automate the process of re-enabling user ports.In this case. Which command accomplishes this task? A.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/guide/3550SCG/swtrafc.cisco. switch(config)# errdisable recovery interval 180 B. switch(config)# switchport port-security protect D. switch(config)# switchport port-security aging type inactivity E.html QUESTION 107 After port security is deployed throughout an enterprise campus. switch(config)# errdisable recovery cause security-violation Correct Answer: B Section: (none) Explanation Explanation/Reference: . the broadcast keyword was used so only broadcast traffic is limited.

you can also use clear errdisable interface name vlan range command to re-enable the VLAN on the port. you can bring it out of this state automatically by configuring the errdisable recovery cause psecure-violation global configuration command or you can manually reenable it by entering the shutdown and no shut down interface configuration commands.cisco. switch# show mac address-table address <mac address> Correct Answer: AE Section: (none) Explanation Explanation/Reference: Explanation: These two commands will show the MAC address table.---.0de0.e289 Dynamic 1 FastEthernet0/1 0010. including the switch port that the particular host is using. switch# show ip verify source D. switch# show port-security C. Reference: http://www.) A. switch# show mac address-table B. If a port is in per-VLAN errdisable mode.pdf QUESTION 108 The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server.-----------. switch# show ip arp inspection E. Here is an example output: Switch> show mac-address-table Dynamic Addresses Count: 9 Secure Addresses (User-defined) Count: 0 Static Addresses (User-defined) Count: 0 System Self Addresses Count: 41 Total MAC addresses: 50 Non-static Address Table: Destination Address Address Type VLAN Destination Port ------------------. This is the default mode. You can also customize the time to recover from the specified error disable cause (default is 300 seconds) by entering the errdisable recovery interval interval command. Which two commands help trace this PC when the MAC address is known? (Choose two.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/53SG/configuration/config/port_sec.7b00.Explanation: When a secure port is in the error-disabled state.1540 Dynamic 2 FastEthernet0/5 .-------------------- 0010.

1545 Dynamic 2 FastEthernet0/5 QUESTION 109 While troubleshooting a network outage.cisco. multicast. By default. aaa authorization D.html QUESTION 110 Which command globally enables AAA on a device? A.7b00. Cisco IOS parser D.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_22ea/SCG/scg/swtrafc. A LAN storm occurs when packets flood the LAN. You can also set the switch to shut down the port when the rising threshold is reached. Which option decreases consumption of bandwidth used by broadcast traffic? A. aaa new-model B. or unicast storm on a port. Reference: http://www. or users issuing a denial-of-service attack can cause a storm. or multicast packets. integrated routing and bridging E. Dynamic ARP Inspection Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Storm control prevents traffic on a LAN from being disrupted by a broadcast. Errors in the protocol-stack implementation. a network engineer discovered an unusually high level of broadcast traffic coming from one of the switch interfaces.0010. storm control is disabled. Storm control uses rising and falling thresholds to block and then restore the forwarding of broadcast. mistakes in network configuration. SDM routing C. storm control B. Storm control is configured for the switch as a whole but operates on a per-port basis. aaa authentication C. creating excessive traffic and degrading network performance. aaa accounting Correct Answer: A Section: (none) . unicast.

EXEC D. Command authorization attempts authorization for all EXEC mode commands. This process continues until there is successful communication with a listed authorization method. network B. SLIP. . or all methods defined are exhausted.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathen. Reverse Access — Applies to reverse Telnet sessions. or ARAP connection. For detailed information on the authentication proxy feature. the Cisco IOS software selects the next method listed in the method list. SLIP. EXEC — Applies to the attributes associated with a user EXEC terminal session. refer to the chapter "Configuring Authentication Proxy" in the "Traffic Filtering“and Firewalls" part of this book” Comma“ds — Applies to the EXEC mode com”ands a user issues. Method lists enable you to designate one or more security protocols to be used for authorization. Network — Applies to network connections.Explanation Explanation/Reference: Explanation: To configure AAA authentication. enable AAA by using the aaa new-model global configuration command. in sequence. IP mobile C. Method lists are specific to the authorization type requested: Auth-proxy — Applies specific security policies on a per-user basis. associated with a specific privilege level. including global configuration commands. When you create a named method list. AAA features are not available for use until you enable AAA globally by issuing the aaa new-model command. auth-proxy Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Method lists for authorization define the ways that authorization will be performed and the sequence in which these methods will be performed.cisco. if that method fails to respond. Reference: http://www. and ARAP connections? A. you are defining a particular list of authorization methods for the indicated authorization type. This can include a PPP. Cisco IOS software uses the first method listed to authorize users for specific network services.html QUESTION 111 Which AAA Authorization type includes PPP. thus ensuring a backup system in case the initial method fails. A method list is simply a named list describing the authorization methods to be queried (such as RADIUS or TACACS+).

html QUESTION 112 Which authentication service is needed to configure 802.com/c/en/us/td/docs/switches/lan/catalyst2940/software/release/12-1_19_ea1/configuration/guide/2940scg_1/sw8021x. Because the switch acts as the proxy. the authentication server — performs the actual authentication of the client.1x? A.cisco. RADIUS with EAP Extension B.Reference: http://www.cisco. RADIUS with CoA D. TACACS+ C.1x.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathor. the authentication service is transparent to the client. The Remote Authentication Dial-In User Service (RADIUS) security system with Extensible Authentication Protocol (EAP) extensions is the only supported authentication server. . RADIUS using VSA Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: With 802. The authentication server validates the identity of the client and notifies the switch whether or not the client is authorized to access the LAN and switch services.pdf QUESTION 113 Refer to the exhibit. Reference: http://www.

.Which login credentials are required when connecting to the console port in this output? A. meaning that credentials are not required and all sessions are allowed access immediately. none required B. which lists none as the authentication method. username cisco with password cisco C. no username with password linepass D. QUESTION 114 Refer to the exhibit. None means no authentication. login authentication default Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Here the console has been configured with the NO_AUTH name.

Line password. RADIUS server. line password B. in which order does the device check the login credentials? A. local username Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: sessions use the vty lines.When a network administrator is attempting an SSH connection to the device. QUESTION 115 Which type of information does the DHCP snooping binding database contain? . local username C. if that fails use the line password. RADIUS server. line password. so here the “aaa authentication login default group radius local line” means to use RADIUS first.” The AAA default login preference is stated in order from first to last. local username. RADIUS server D. then if that fails use the local user database. RADIUS server. Finally. local username. Line password. where the configured authentication method is named “default.

On untrusted interfaces. Utilizes the DHCP snooping binding database to validate subsequent requests from untrusted hosts. If the ARP packet is received on a trusted interface. storm control C. Dynamic ARP Inspection B.pdf QUESTION 116 Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database? A. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch.cisco. the switch forwards the packet without any checks. Reference: http://www. which contains information about untrusted hosts with leased IP addresses. VTP pruning D. untrusted hosts with leased IP addresses B. the DHCP snooping binding database.A. untrusted hosts with available IP addresses D.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. the switch forwards the packet only if it is valid. Builds and maintains the DHCP snooping binding database. Rate-limits DHCP traffic from trusted and untrusted sources. trusted hosts with available IP addresses Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. The DHCP snooping feature performs the following activities: Validates DHCP messages received from untrusted sources and filters out invalid messages. DHCP snooping Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Dynamic ARP inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database. trusted hosts with leased IP addresses C. .

If a Layer 2 LAN port is connected to a DHCP client.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. make sure that the devices acting as the DHCP server and the DHCP relay agent are configured and enabled.Reference: http://www. configure the port as trusted by entering the “ip dhcp snooping trust” interface configuration command. and enable DHCP globally on the switch.html QUESTION 117 Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server? A.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed. community port D. Before globally enabling DHCP snooping on the switch. promiscuous port B. ip dhcp snooping C. ip dhcp snooping trust B. Reference: http://www. follow these guidelines: DHCP snooping is not active until you enable the feature on at least one VLAN. ip dhcp snooping information Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: When configuring DHCP snooping.cisco. including the community and isolated host ports? A. trunk port Correct Answer: A . ip dhcp trust D.html QUESTION 118 Which private VLAN access port belongs to the primary VLAN and can communicate with all interfaces. configure the port as untrusted by entering the no ip dhcp snooping trust interface configuration command. If a Layer 2 LAN port is connected to a DHCP server. isolated port C.cisco.

isolated VLAN B. or no secondary VLANs.cisco. Isolated. Each promiscuous port can have several secondary VLANs. Community ports communicate with other ports in the same community VLAN and with associated promiscuous ports. community VLAN D. promiscuous VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Understanding Primary. This port has complete isolation from other ports within the same private VLAN domain. primary VLAN C. You can have several promiscuous ports in a primary VLAN. The promiscuous port can communicate with all interfaces.html QUESTION 119 Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional traffic upstream from the hosts toward the promiscuous ports and the gateway? A. that belong to those secondary VLANs associated to the promiscuous port and associated with the primary VLAN. Isolated — An isolated port is a host port that belongs to an isolated secondary VLAN. Community — A community port is a host port that belongs to a community secondary VLAN. except that it can communicate with associated promiscuous ports.Section: (none) Explanation Explanation/Reference: Explanation: The types of private VLAN ports are as follows: Promiscuous — A promiscuous port belongs to the primary VLAN.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs. Each port is completely isolated from all other ports in the isolated VLAN. associated to that port. Traffic received from an isolated port is forwarded only to promiscuous ports. These interfaces are isolated from all other interfaces in other communities and from all isolated ports within the private VLAN domain. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. You can have more than one isolated port in a specified isolated VLAN. including the community and isolated host ports. You can associate a secondary VLAN to more than one promiscuous port. and Community Private VLANs . You may want to do this for load-balancing or redundancy purposes. You can also have secondary VLANs that are not associated to any promiscuous port. as long as the promiscuous port and secondary VLANs are within the same primary VLAN. Reference: http://www.

dynamic ARP database C. You can configure multiple isolated VLANs in a private VLAN domain. but these ports cannot communicate with ports in any other community or isolated VLAN in the private VLAN. static ARP database Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Information About Dynamic ARP Inspection DAI is used to validate ARP requests and responses as follows: Intercepts all ARP requests and responses on untrusted ports. DHCP snooping database B. The ports within one community can communicate. all the traffic remains isolated within each one.html QUESTION 120 Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC address binding? A. This database is built by DHCP snooping when it is enabled on the VLANs and on the device. Community VLAN — A community VLAN is a secondary VLAN that carries upstream traffic from the community ports to the promiscuous port and to other host ports in the same community. Drops invalid ARP packets.com/c/en/us/td/docs/switches/datacenter/nexus1000/hyperv/sw/5_2_1_s_m_1_5_2/troubleshooting/configuration/guide/ n1000v_troubleshooting/n1000v_trouble_19dhcp. dynamic routing database D.cisco. You can configure multiple community VLANs in a private VLAN domain. It may also contain static entries that you have created. Isolated VLAN — An isolated VLAN is a secondary VLAN that carries unidirectional traffic upstream from the hosts toward the promiscuous ports. Each isolated VLAN can have several isolated ports. and to other promiscuous ports. Reference: http://www. Reference: http://www.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs. Verifies that a packet has a valid IP-to-MAC address binding before updating the ARP cache or forwarding the packet.Primary VLANs and the two types of secondary VLANs (isolated and community) have these characteristics: Primary VLAN — The primary VLAN carries traffic from the promiscuous ports to the host ports. and the traffic from each isolated port also remains completely separate. DAI can determine the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a DHCP snooping binding database. both isolated and community.cisco.html QUESTION 121 .

If you enter the ip source binding mac-address vlan vlan-id ip-address interface interface-id global configuration command on a routed interface.cisco. storm control C. VTP pruning D. the source IP address filter is applied on all the VLANs. DHCP snooping must be enabled on the access VLAN for that interface. If you are enabling IP source guard on a trunk interface with multiple VLANs and DHCP snooping is enabled on all the VLANs. port security C.html QUESTION 122 Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or broadcast traffic? A. spanning-tree portfast D.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/ b_sec_152ex_2960-x_cg_chapter_01110. Reference: http://www. DHCP snooping B. this error message appears: Static IP source binding can only be configured on switch port. VLAN trunking Correct Answer: A Section: (none) Explanation .1x port-based authentication is enabled. private VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: IP Source Guard Configuration Guidelines • You can configure static IP bindings only on nonrouted ports. When IP source guard with source IP filtering is enabled on an interface. storm control B. which feature must be enabled on the access VLAN for that interface? A. You can enable this feature when 802.When IP Source Guard with source IP filtering is enabled on an interface.

perform this task: .com/c/en/us/td/docs/routers/7600/ios/122SR/configuration/guide/swcg/dos.pdf QUESTION 123 Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected? A. router(config-if)#storm-control action error D. which creates excessive traffic and degrades network performance. router(config-if)#storm-control action shutdown B. multicast. router(config-if)#storm-control action enable Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Configuring the Traffic Storm Control Shutdown Mode To configure the traffic storm control shutdown mode on an interface. Reference: http://3c3cc. router(config-if)#storm-control action trap C. The traffic storm control feature prevents LAN ports from being disrupted by a broadcast.Explanation/Reference: Explanation: A traffic storm occurs when packets flood the LAN. or unicast traffic storm on physical interfaces from either mistakes in network configurations or from users issuing a DoS attack.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/storm.html

QUESTION 124
A network engineer configures port security and 802.1x on the same interface. Which option describes what this configuration allows?

A. It allows port security to secure the MAC address that 802.1x authenticates.
B. It allows port security to secure the IP address that 802.1x authenticates.
C. It allows 802.1x to secure the MAC address that port security authenticates.
D. It allows 802.1x to secure the IP address that port security authenticates.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
802.1X and Port Security
You can configure port security and 802.1X on the same interfaces. Port security secures the MAC addresses that 802.1X authenticates. 802.1X processes
packets before port security processes them, so when you enable both on an interface, 802.1X is already preventing inbound traffic on the interface from
unknown MAC addresses.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_portsec.html

QUESTION 125
Which feature describes MAC addresses that are dynamically learned or manually configured, stored in the address table, and added to the running
configuration?

A. sticky
B. dynamic
C. static
D. secure

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
With port security, you can configure MAC addresses to be sticky. These can be dynamically learned or manually configured, stored in the address table, and
added to the running configuration. If these addresses are saved in the configuration file, the interface does not need to dynamically relearn them when the
switch restarts. Although sticky secure addresses can be manually configured, it is not recommended.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.pdf

QUESTION 126
On which interface can port security be configured?

A. static trunk ports
B. destination port for SPAN
C. EtherChannel port group
D. dynamic access point

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

Explanation:
Port Security and Port Types
You can configure port security only on Layer 2 interfaces. Details about port security and different types of interfaces or ports are as follows:
Access ports — You can configure port security on interfaces that you have configured as Layer 2 access ports. On an access port, port security applies
only to the access VLAN.
Trunk ports — You can configure port security on interfaces that you have configured as Layer 2 trunk ports. VLAN maximums are not useful for access
ports. The device allows VLAN maximums only for VLANs associated with the trunk port.
SPAN ports — You can configure port security on SPAN source ports but not on SPAN destination ports.
Ethernet Port Channels — Port security is not supported on Ethernet port channels.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_portsec.html

QUESTION 127
When you configure private VLANs on a switch, which port type connects the switch to the gateway router?

A. promiscuous
B. community
C. isolated
D. trunked

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
There are mainly two types of ports in a Private VLAN: Promiscuous port (P-Port) and Host port. Host port further divides in two types – Isolated port (I-Port)
and Community port (C-port).
Promiscuous port (P-Port): The switch port connects to a router, firewall or other common gateway device. This port can communicate with anything else
connected to the primary or any secondary VLAN. In other words, it is a type of a port that is allowed to send and receive frames from any other port on
the VLAN.
Host Ports:
- Isolated Port (I-Port): Connects to the regular host that resides on isolated VLAN. This port communicates only with P-Ports.
- Community Port (C-Port): Connects to the regular host that resides on community VLAN. This port communicates with P-Ports and ports on the
same community VLAN.

Reference: http://en.wikipedia.org/wiki/Private_VLAN

QUESTION 128
When you configure a private VLAN, which type of port must you configure the gateway router port as?

A. promiscuous port
B. isolated port
C. community port
D. access port

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
There are mainly two types of ports in a Private VLAN: Promiscuous port (P-Port) and Host port. Host port further divides in two types – Isolated port (I-Port)
and Community port (C-port).
Promiscuous port (P-Port): The switch port connects to a router, firewall or other common gateway device. This port can communicate with anything else
connected to the primary or any secondary VLAN. In other words, it is a type of a port that is allowed to send and receive frames from any other port on
the VLAN.
Host Ports:
- Isolated Port (I-Port): Connects to the regular host that resides on isolated VLAN. This port communicates only with P-Ports.
- Community Port (C-Port): Connects to the regular host that resides on community VLAN. This port communicates with P-Ports and ports on the same
community VLAN.

Reference: http://en.wikipedia.org/wiki/Private_VLAN

Q32 SIMULATION
SWITCH.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches; DSW1 and ASW1. The topology diagram
indicates their layer 2 mapping. VLAN 20 is a new VLAN that will be used to provide the shipping personnel access to the server. Corporate polices do not
allow layer 3 functionality to be enabled on the switches. For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:
• Users connecting to VLAN 20 via portfO/1 on ASW1 must be authenticated before they are given access to the network. Authentication is to be done via a
Radius server:
• Radius server host: 172.120.40.46
• Radius key: rad123
• Authentication should be implemented as close to the host as possible.
• Devices on VLAN 20 are restricted to the subnet of 172.120.40.0/24.
• Packets from devices in the subnet of 172.120.40.0/24 should be allowed on VLAN 20.
• Packets from devices in any other address range should be dropped on VLAN 20.

• Filtering should be implemented as close to the serverfarm as possible.
The Radius server and application servers will be installed at a future date. You have been tasked with implementing the above access control as a pre-
condition to installing the servers. You must use the available IOS switch features.

Answer: The configuration:
Step1: Console to ASW1 from PC console 1
ASW1(config)#aaa new-model
ASW1(config)#radius-server host 172.120.39.46 key rad123
ASW1(config)#aaa authentication dot1x default group radius
ASW1(config)#dot1x system-auth-control
ASW1(config)#inter fastEthernet 0/1
ASW1(config-if)#switchport mode access
ASW1(config-if)#dot1x port-control auto
ASW1(config-if)#exit
ASW1#copy run start

Step2: Console to DSW1 from PC console 2
DSW1(config)#ip access-list standard 10
DSW1(config-ext-nacl)#permit 172.120.40.0 0.0.0.255
DSW1(config-ext-nacl)#exit
DSW1(config)#vlan access-map PASS 10

DSW1(config-access-map)#match ip address 10
DSW1(config-access-map)#action forward
DSW1(config-access-map)#exit
DSW1(config)#vlan access-map PASS 20
DSW1(config-access-map)#action drop
DSW1(config-access-map)#exit
DSW1(config)#vlan filter PASS vlan-list 20
DSW1#copy run start

QUESTION 129
Which configuration command ties the router hot standby priority to the availability of its interfaces?

A. standby group
B. standby priority
C. backup interface
D. standby track

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and is useful for tracking interfaces
that are not configured for HSRP. When a tracked interface fails, the hot standby priority on the device on which tracking has been configured decreases by
10. If an interface is not tracked, its state changes do not affect the hot standby priority of the configured device. For each interface configured for hot
standby, you can configure a separate list of interfaces to be tracked.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swhsrp.html

QUESTION 130
What is the default HSRP priority?

A. 50
B. 100
C. 120
D. 1024

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swhsrp.html#wp1044327

QUESTION 131
Which option is a benefit of using VSS?

A. reduces cost
B. simplifies configuration
C. provides two independent supervisors with two different control planes
D. removes the need for a First Hop Redundancy Protocol

Correct Answer: D

Section: (none)
Explanation

Explanation/Reference:
Explanation: First Hop Redundancy Protocols (FHRPs) such as VRRP and HSRP were designed to allow for a highly available first IP route hop for host
systems. FHRPs allow two (or more) distinct routers to share a common IP address providing a redundant Layer-3 default gateway for end nodes. The VSS
system creates a single logical router at Layer 3. This VSS routing instance fulfills this first-hop role without the need for a dedicated protocol. The VSS IP
route is highly available due to MEC and the resiliency of the VSS system. VSS eliminates the need for FHRP at the aggregation layer of the data center.

Reference: http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/vssdc_integrate.html

QUESTION 132
Which First Hop Redundancy Protocol is an IEEE Standard?

A. GLBP
B. HSRP
C. VRRP
D. OSPF

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
A comparison of the three First Hop Redundancy Protocols are listed below:

Reference: http://cciethebeginning.wordpress.com/2008/08/23/router-high-availability-protocol-comparison-2/

QUESTION 133
What is the default amount by which the hot standby priority for the router is decremented or incremented when the interface goes down or comes back up?

A. 1
B. 5
C. 10
D. 15

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and is useful for tracking interfaces
that are not configured for HSRP. When a tracked interface fails, the hot standby priority on the device on which tracking has been configured
decreases by 10. If an interface is not tracked, its state changes do not affect the hot standby priority of the configured device. For each interface configured
for hot standby, you can configure a separate list of interfaces to be tracked.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swhsrp.html

QUESTION 134
What is the maximum number of virtual MAC addresses that GLBP allows per group?

A. 2
B. 4
C. 6
D. 8

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

Explanation:
GLBP Virtual MAC Address Assignment
A GLBP group allows up to four virtual MAC addresses per group. The AVG is responsible for assigning the virtual MAC addresses to each member of the
group. Other group members request a virtual MAC address after they discover the AVG through hello messages. Gateways are assigned the next MAC
address in sequence. A virtual forwarder that is assigned a virtual MAC address by the AVG is known as a primary virtual forwarder. Other members of the
GLBP group learn the virtual MAC addresses from hello messages. A virtual forwarder that has learned the virtual MAC address is referred to as a secondary
virtual forwarder.

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039651

QUESTION 135
Which gateway role is responsible for answering ARP requests for the virtual IP address in GLBP?

A. active virtual forwarder
B. active virtual router
C. active virtual gateway
D. designated router

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
GLBP Active Virtual Gateway
Members of a GLBP group elect one gateway to be the active virtual gateway (AVG) for that group. Other group members provide backup for the AVG in the
event that the AVG becomes unavailable. The AVG assigns a virtual MAC address to each member of the GLBP group. Each gateway assumes
responsibility for forwarding packets sent to the virtual MAC address assigned to it by the AVG. These gateways are known as active virtual forwarders
(AVFs) for their virtual MAC address.
The AVG is responsible for answering Address Resolution Protocol (ARP) requests for the virtual IP address. Load sharing is achieved by the AVG
replying to the ARP requests with different virtual MAC addresses.

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html

QUESTION 136
Which VRRP router is responsible for forwarding packets that are sent to the IP addresses of the virtual router?

A. virtual router master

B. virtual router backup
C. virtual router active
D. virtual router standby

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
VRRP Definitions

VRRP Router A router running the Virtual Router Redundancy
Protocol. It may participate in one or more
virtual routers.

Virtual Router An abstract object managed by VRRP that acts
as a default router for hosts on a shared LAN.
It consists of a Virtual Router Identifier and
a set of associated IP address(es) across a
common LAN. A VRRP Router may backup one or
more virtual routers.

IP Address Owner The VRRP router that has the virtual router's
IP address(es) as real interface address(es’.
This is the router that, when up, will respond
to packets addressed to one of these IP
addresses for ICMP pings, TCP connections,
etc.

Primary IP Address An IP address selected from the set of real
interface addresses. One possible selection
algorithm is to always select the first
address. VRRP advertisements are always sent
using the primary IP address as the source of
the IP packet.

Virtual Router Master The VRRP router that is assuming the
responsibility of forwarding packets sent to
the IP address(es) associated with the virtual

router, and answering ARP requests for these
IP addresses. Note that if the IP address
owner is available, then it will always become
the Master.

Reference: http://www.ietf.org/rfc/rfc3768.txt

QUESTION 137
Which command correctly configures standby tracking for group 1 using the default decrement priority value?

A. standby 1 track 100
B. standby 1 track 100 decrement 1
C. standby 1 track 100 decrement 5
D. standby 1 track 100 decrement 20

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The default decrement value for HSRP standby tracking is 10. There is no need to explicitly state the value if the desired value is the default value.

QUESTION 138
Which command configures an HSRP group to become a slave of another HSRP group?

A. standby slave
B. standby group track
C. standby follow
D. standby group backup

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Perform this task to configure multiple HSRP client groups.
The “standby follow” command configures an HSRP group to become a slave of another HSRP group.
HSRP client groups follow the master HSRP with a slight, random delay so that all client groups do not change at the same time.

Reference: http://www.cisco.com/en/US/docs/ios-xml/ios/ipapp_fhrp/configuration/15-mt/fhp-hsrp-mgo.html

QUESTION 139
Refer to the exhibit.

Which option describes the reason for this message in a GLBP configuration?

A. Unavailable GLBP active forwarder
B. Incorrect GLBP IP address
C. HSRP configured on same interface as GLBP
D. Layer 2 loop

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
This section provides information you can use to troubleshoot your configuration.

%GLBP-4-DUPADDR: Duplicate address

The error message indicates a possible layer2 loop and STP configuration issues.
In order to resolve this issue, issue the show interface command to verify the MAC address of the interface. If the MAC address of the interface is the same
as the one reported in the error message, then it indicates that this router is receiving its own hello packets sent. Verify the spanning-tree topology and check
if there is any layer2 loop. If the interface MAC address is different from the one reported in the error message, then some other device with a MAC address
reports this error message.
Note: GLBP members communicate between each other through hello messages sent every 3 seconds to the multicast address 224.0.0.102 and User
Datagram Protocol (UDP) port 3222 (source and destination). When configuring the multicast boundary command, permit the Multicast address by permit
224.0.0.0 15.255.255.255.

Reference: http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a00807d2520.shtml#dr

QUESTION 140
Refer to the exhibit.

When troubleshooting a network problem, a network analyzer is connected to Port f0/1 of a LAN switch. Which command can prevent BPDU transmission on
this port?

A. spanning-tree portfast bpduguard enable
B. spanning-tree bpduguard default
C. spanning-tree portfast bpdufilter default
D. no spanning-tree link-type shared

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 141
Which four LACP components are used to determine which hot-standby links become active after an interface failure within an EtherChannel bundle?
(Choose four.)

A. LACP system priority
B. LACP port priority
C. interface MAC address
D. system ID

The local RSPAN switch is replicating only Rx traffic to the remote switch. traffic is not being replicated to the remote switch. The RSPAN designated VLAN is missing the remote span command. The local switch is overloaded with the amount of sourced traffic that must be replicated to the remote switch. however. interface bandwidth Correct Answer: ABDE Section: (none) Explanation Explanation/Reference: QUESTION 142 RSPAN has been configured on a Cisco Catalyst switch. D. Which option describes what causes the port to go into the errdisable state? A. hot-standby link identification number G. B. C. This port continues to reestablish until after eight failed retries. D. a Network Administrator noticed that one port stops receiving UDLD packets. port number F. Which type of misconfiguration is a cause? A. B. C. UDLD port is configured in aggressive mode.E. The local and remote RSPAN switches are configured using different session IDs. Normal UDLD operations that prevent traffic loops. UDLD timers are inconsistent. The port then transitions into the errdisable state. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 143 After UDLD is implemented. UDLD is enabled globally. .

STP Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 145 A network engineer is installing a switch for temporary workers to connect to. Which version of spanning tree is appropriate to meet the company policy? A. The engineer does not want this switch participating in Spanning Tree with the rest of the network. MST B. BPDUfilter C. end user connectivity is still required. BPDUguard E. BPDUignore D. a network engineer decides to create a separate spanning tree for every group of 10 VLANs. RPVST+ E.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 144 To follow the Layer 2 switching guidelines. however. Which spanning-tree feature accomplishes this? A. PVST+ C. RSTP D. BPDUdisable Correct Answer: B Section: (none) . BPDUblock B.

Configure a SPAN session to monitor the received traffic on interface g0/4 only for VLAN 3. B. Configure a SPAN session to monitor the received traffic on interface g0/5 for all VLANs except VLAN 3. write memory D. reload B. which action must be performed for the configuration to take effect? A. C. D. backup config Correct Answer: A . Configure a SPAN session to monitor the received traffic on interface g0/5 only for VLAN 3. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 147 When SDM templates are configured.Explanation Explanation/Reference: QUESTION 146 Refer to the exhibit. Configure a SPAN session to monitor the received traffic on interface g0/4 for all VLANs except VLAN 3. shutdown C. What is the result of the SPAN configuration on a Cisco switch? A.

A sticky MAC address can be a unicast or multicast address. EtherChannel D. B. BackboneFast C. A sticky MAC address is retained when the switch reboots. A sticky MAC address is lost when the switch reboots.Section: (none) Explanation Explanation/Reference: QUESTION 148 Which statement about the MAC address sticky entries in the switch when the copy run start command is entered is true? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 149 Enablement of which feature puts the port into err-disabled state when the port has PortFast enabled and it receives BPDUs? A. C. BPDU guard Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 150 . D. A sticky MAC address ages out of the MAC address table after 600 seconds. BPDU filtering B.

DSW1(config-if)#cdp holdtime 60 C.Refer to the exhibit. DSW1(config-if)#cdp timer 60 Correct Answer: C . Which configuration ensures that the Cisco Discovery Protocol packet update frequency sent from DSW1 to ALS1 is half of the default value? A. DSW1(config-if)#cdp holdtime 30 F. DSW1(config)#cdp holdtime 90 E. DSW1(config)#cdp timer 90 B. DSW1(config)#cdp timer 30 D.

but they are reassigned to the default VLAN. They remain up. but they are reassigned to the default VLAN. but they are reassigned to the native VLAN. D. and then the VLAN is deleted. B. private VLANs Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 153 . Which state are these interfaces in after the VLAN is deleted? A. PortFast C. They go down.1Q trunking B. 802. They remain up. QoS D. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 152 Which feature is automatically configured when an administrator enables a voice VLAN? A.Section: (none) Explanation Explanation/Reference: QUESTION 151 Interfaces are assigned to a VLAN. C. They go down until they are reassigned to a VLAN.

C.Which statement describes one major issue that VTP can cause in an enterprise network when a new switch is introduced in the network in VTP mode server? A. version 1 B. It can cause a network-wide VLAN configuration change if the revision number on the new switch is lower. auto . Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 155 An engineer is configuring an EtherChannel between two switches using LACP. version 3 D. VTP does not recognize extended VLANs. active B. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 154 A network administrator configures 10 extended VLANs ranging from VLANs 3051 to 3060 in an enterprise network. If the EtherChannel mode on switch 1 is configured to active. It can cause routing loops. version 2 C. It can cause a network-wide VLAN configuration change if the revision number on the new switch is higher. B. It can cause network access ports to go into err-disabled state. D. which two modes on switch 2 establish an operational EtherChannel? (Choose two. Which version of VTP supports these extended VLANs? A.) A.

source MAC address and destination IP address D. destination MAC address and destination IP address C. The IP address is placed on the lowest numbered member port. passive Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 156 When a Layer 2 EtherChannel is configured. B. The IP address is placed on the highest numbered member port. desirable D. source MAC address and source IP address B. on E. The IP address is placed on the port-channel logical interface. source MAC address and destination MAC address Correct Answer: D Section: (none) . C. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 157 Which option is valid for EtherChannel load balancing? A.C. The IP address is assigned via DHCP only. which statement about placement of the IP address is true? A. D.

An engineer is configuring EtherChannel between two switches and notices the console message on switch 2. which option describes . Based on the output.Explanation Explanation/Reference: QUESTION 158 Refer to the exhibit.

The port channel interface numbers do not match. Switch 2 has too many member ports configured. The EtherChannel protocols do not match. B. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 159 Refer to the exhibit.the reason for this error? A. Switch 1 does not have enough member ports configured. C. . D.

it automatically inherits MST configuration from DW2. revision number. DSW2 uses the VTP server mode to automatically propagate the MST configuration to DSW1. Which statement is true? A. DSW1 is in VTP client mode with a lower configuration revision number. Configure DSW1 with the same version number. Correct Answer: D . DSW1 automatically inherits MST configuration from DSW2 because they have the same domain name.DSW1 should share the same MST region with switch DSW2. therefore. and VLAN-to-instance mapping as shown on DSW2. D. C. E. and VLAN-to-instance mapping as shown on DSW2. Configure DSW1 with the same region name. B.

B. You can mix individual source ports and source VLANs within a single session. E. C. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 161 In a switch stack environment.Section: (none) Explanation Explanation/Reference: QUESTION 160 Which two statements about SPAN source and destination ports during an active session are true? (Choose two. D.) A. The destination port does not participate in STP. 16 Gbps B. 64 Gbps D. The destination port can be destination in multiple SPAN sessions. 128 Gbps Correct Answer: B Section: (none) Explanation Explanation/Reference: . what is the total bidirectional traffic flow between two logical counter-rotating paths? A. The source port can be monitored in multiple SPAN sessions. 32 Gbps C. The source port can be only an Ethernet physical port.

RSPAN session 1 is incompletely configured for monitoring. C.QUESTION 162 Refer to the exhibit. Which statement about the SPAN and RSPAN configuration on SW1 is true? A. RSPAN session 1 monitors activity on VLAN 50 of a remote switch. SPAN session 2 only monitors egress traffic exiting port FastEthernet 0/14. B. SPAN session 2 monitors all traffic entering and exiting port FastEthernet 0/15. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 163 . D.

Layer 2 C.Which information does the subordinate switch in a switch stack keep for all the VLANs that are configured on it? A. 8000 bindings Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 165 On which layer does IP source guard provide filtering to prevent a malicious host from impersonating the IP address of a legitimate host? A. VLAN database B. Layer 3 D. Layer 1 B. 5000 bindings D. DHCP snooping database C. routing information Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 164 Which option is the minimum number of bindings that the DHCP snooping database can store? A. 1000 bindings B. spanning trees D. Layer 7 . 2000 bindings C.

off D. disabled B. B. and many listening routers. Correct Answer: CD Section: (none) Explanation Explanation/Reference: . one standby router. GLBP. VRRP is a Cisco proprietary protocol. what is the state of port security on a switch? A. HSRP supports up to 255 groups on the same switch or router. C. HSRP is the preferred protocol to be used on multivendor environments. GLBP allows for a maximum of four MAC addresses per group. E.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 166 By default. D. learning Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 167 Which two statements about HSRP. and VRRP are true? (Choose two.) A. VRRP has one master router. on C.

10. HSRP misconfiguration C. a hardware problem Correct Answer: B Section: (none) Explanation Explanation/Reference: . a PC with IP of 10.QUESTION 168 Refer to the exhibit.1.1 D. Which option is the most likely explanation of the duplicate address message logged? A. spanning-tree loop B.

The switchport mode trunk command should be first in the output.) A. A network engineer changes the default native VLAN to VLAN 999. The control traffic must be manually enabled on the new native VLAN. E. The encapsulation type is incorrect. the switch control traffic. C. The native VLAN is not present on the trunk. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 170 Which two options are two results of using the command spanning-tree vlan 50 root primary within a spanning-tree network under global configuration? (Choose two. What is wrong with the configuration? A. The interface is administratively down. The standard configuration is used for each uplink. B. such as CDP and VTP. After applying the settings on the uplinks to the core switches. Spanning tree determines the priority of the current root for VLAN 50 and reduces the priority of the local switch to a lower value. D. . is no longer working.QUESTION 169 Refer to the exhibit.

D. Change the link-type to point-to-point. What action will accomplish this task? A. The spanning-tree timers are reduced to improve the convergence time for VLAN 50. E. All ports that are configured on the current switch with VLAN 50 transition to designated ports. D. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 171 An access switch at a remote location is connected to the spanning-tree root with redundant uplinks. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 172 A network engineer wants to make sure that an access switch will never become a Spanning Tree root for VLAN 5. B. disable STP globally C.B. Adjust the secondary link to have a lower priority than the primary link. Which action accomplishes this task? A. C. Apply a BPDU filter on the primary interface of the remote switches. The switchport that is configured for VLAN 50 is the primary connection to the spanning-tree root switch. adjust STP priority to the maximum value B. C. A network engineer notices that there are issues with the physical cabling of the current root port. apply root guard to all outgoing neighbor interfaces . The priority value for VLAN 50 is set to 4094 on the root while the local switch priority is set to 32768. The engineer decides to force the secondary link to be the desired forwarding root port. Enable Rapid Spanning Tree to converge using the secondary link.

Unless specifically configured. Another Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 174 Which two statements about default FHRP behavior are true? (Choose two) A. Flash memory D. A back up GLBP active virtual gateway can become active only in the current active router fails C. VRRP backup router becomes the master router if its priority is higher than the priority of the current master router. All switches in stack B. enable MSTP and use a different revision number than all other switches Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 173 In a switch stack where is the SDM template stored? A. Standby HSRP router becomes active if it has higher priority than current active router E. Correct Answer: BE Section: (none) Explanation .D. the priority of an HSRP router is 200 D. Pre-emption is enabled by default B. Master switch C.

GLBP uses UDP port 3222 (source an destination) for hello messages.ac0c indicates that default gateway redundancy is provided through GLBP Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 176 Which statement about the current configuration on port GigabitEthernet 2/0/1 is true? A. and VRRP is true? A. B. It is a trunk port and native VLAN is VLAN 700 D. VRRP group communicate using multicast address 224.0c07.Explanation/Reference: QUESTION 175 Which statement about HSRP. It is an access port in VLAN 700 Correct Answer: B .18 C. It is a trunk port and the native VLAN is VLAN 1 C.0. HSRP group members communicate using multicast 224.0.102 D. MAC address 0000. It is an access port configured for a phone and PC B.0.0. GLBP.

Port security sticky exists on the new network switch port B. Which statement the status of the EtherChannel is true? . Port security sticky is disabled on the new network switch port C. Which two factors are possible causes of this issue? (Choose two) A. A network administrator moves a PC from one office desk to another. Port security sticky is still enabled on the older network switch port Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 178 Refer to the exhibit.Section: (none) Explanation Explanation/Reference: QUESTION 177 An enterprise network has port security sticky enabled on all access ports. Port security is still enable on the older network switch port E. After the PC is moved the network administrator clears the port security on the network switch port connection to the PC. but the port keeps going back into err-disabled mode. An engineer has run the show etherchannel summary command the output is displayed. Port security must be disabled on all access ports D.

The first 1005 VLANs in the startup-config file . The EtherChannel is down and configured for LACP D. Untagged frames are forwarded via the default VLAN B. which two VLAN ranges are loaded on the switch? (Choose two) A. The trunk ports is put in err-disable state. Which statement describes what the switch does with untagged frames when it receives on a trunked interface? A. It drops the untagged frames C. Untagged frames are forward via the native vlan Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 180 When a Cisco Catalyst switch that is configured in VTP server mode is first booted. All VLANs are in the VLAN database B. The EtherChannel is down because of a mismatched EtherChannel protocol C. The EtherChannel is operational and is using no etherchannel protocol Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 179 A switch has been configured with the VLAN dot1q tag native command. The EtherChannel is operational and configured for PAGP B. The first 1005 VLANs in the VLAN database file D. VLANs greater than 1005 in the startup config file C. D.A.

Redirect traffic D. It supports the use of AES to encrypt VTP messaging E. It supports the propagation of private VLANs D. It stores the VTP domain password securely in as SHA-1 hash B.E. (Choose two) A. VLANs greater than 1005 in the VLAN database Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 181 Which two options are advantages of deploying VTPv3? (Choose two) A. Shut down Correct Answer: AE Section: (none) . Trap B. It can be configured to allow only one VTP server to make changes to the VTP domain Correct Answer: CE Section: (none) Explanation Explanation/Reference: QUESTION 182 If storm control is enabled on a port and the traffic reaches the configure level. Log E. It adds an FCS field at the end of each VTP frame for consistency checking C. Notify admin C. which two actions can be configured to occur.

On interface Gi5/1. Interface Gi5/1 is using a Cisco proprietary trunking protocol B. all untagged traffic is tagged with VLAN 113 . VTP does not support private VLANs Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 184 Refer to the exhibit.Explanation Explanation/Reference: QUESTION 183 To provide security. Version 3 D. Which version of VTP supports the use of private VLANs? A. Version 2 C. a service provider configures various private VLANS in its backbone network infrastructure to prevent communicating to each other. Version 1 B. Which two statements about SW1 are true? (Choose two) A.

C. Spanning-tree mstp 1 priority 0 B. Which two commands ensure that DSW1 becomes root bridge for VLAN 10 and 20? (Choose two) A. Spanning -tree mst vlan 10.20 priority root . Interface Gi6/2 is the root port for VLAN 36 F. Interface Gi5/1 is using an industry standard trunking protocol E. On interface Gi6/2 all untagged traffic is tagged with VLAN 600 Correct Answer: DF Section: (none) Explanation Explanation/Reference: QUESTION 185 Refer to the exhibit. The device is configured is configured with the default MST region D. Spanning-tree mst 1 root primary C.

Spanning tree cost C. Spanning-tree mst 1 priority 1 F. which two statements correctly indicate when an SNMP trap is set to the switch? (Choose two) . Spanning tree port priority B. Interface description D.) (Which two conditions should match during EtherChannel configuration?) A. Spanning tree mstp vlan 10. Trunk allow vlan (allowed VLANs on the trunk) Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 187 Refer to exhibit. Spanning-tree mst 1 priority 4096 E.D. Trunk mode E.20 root primary Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 186 What condition was matched during a EtherChannel configuration? (Choose two.

Any change in the state of the port generates a TC BDPU B. the EtherChannel protocol on switch 1 is not correct D. When the phone previously on Fa0/2 is now connect to Fa0/5 Correct Answer: CE Section: (none) Explanation Explanation/Reference: QUESTION 188 Refer to the exhibit. based on the output what is the problem? A.A. When a new workstation connects to port F0/1 B. then a TC BDPU is generated . an engineer is configuring an EtherChannel between two switches. the EtherChannel interface of switch 2 is not configured Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 189 Which statement is true about RSTP topology changes? A. the EtherChannel interface of switch 1 is not configured C. If either an edge port or a non-edge port move to a block state. When 61 MAC address are in the switch C. When 61 percent of the address table capacity is used D. When the switch loses power and reboots E. Only non-edge ports moving to the forwarding state generate a TC BDPU C. the EtherChannel on the switch 1 using incorrect member port B. He notices the error message on the switch 2 (error message channel-misconfiguring error).

Any loss of connectivity generates a TC BDPU Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 190 What action should a network administrator take to enable VTP pruning on an entire management domain? A.D. which three statements about HSRP are true? (Choose three) . Disable VTP pruning on a VTP server in the management domain. Enable VTP pruning on any client switch in the domain. Enable VTP pruning on every switch in the domain. Based on the debug output. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 191 Refer to the exhibit. Only edge ports moving to the blocking state generate a TC BPDU E. C. E. B. D. Enable VTP pruning on a VTP server in the management domain. Enable VTP pruning on any switch in the management domain.

16.11. routing should occur at the distribution layer.16. VLANs should be local to a switch E. Routing should occur at the access layer if voice VLANs is utilized. C. Routing may be performed at all layers but is most commonly done at the core and distribution layers. Routing should not be performed between VLANs located on separate switches.16.111 B. D.11. The router with IP address 172.16. Otherwise.16.111 D. The router with IP address 172.16.112 is using default HSRP priority. The router with IP address 172.112 has non-preempt configured F.11.11.11. The IP address 172.11.115 is the virtual HSRP IP address E.A.11.16.111 has preempt configured C. VLANs should be localized to a single switch unless voice VLANs are being utilized.112 is preferred over the router with IP address 172. The final active router is the router with IP address 172. The priority of the router with IP address 172. Correct Answer: ABD Section: (none) Explanation Explanation/Reference: QUESTION 192 Which two statements are true about recommended practices that are to be used in a local VLAN solution design where Layer 2 traffic is to be kept to a minimum? (Choose two) A. Correct Answer: BD Section: (none) . B.

The command enables BPDU filtering on all ports regardless of whether they are configured for BPDU filtering at the interface level. Extended VLANs are only supported in version 3 and not in versions 1 or 2. If BPDUs are received by a port configured for PortFast. when a switch is configured to use VTP versions 1 or 2? A. If BPDUs are received by a port configured for PortFast. B. server D. If BPDUs are received by a port configured for PortFast. transparent B.Explanation Explanation/Reference: QUESTION 193 What is the effect of configuring the following command on a switch? Switch(config)# spanning-tree portfast bdpufilter default A. C. Correct Answer: A Section: (none) Explanation Explanation/Reference: . they are ignored and none are sent. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 194 Which VTP mode is needed to configure an extended VLAN. D. client C. then PortFast is disabled and the BPDUs are processed normally. the port transitions to the forwarding state.

C.) A. E. BPDUs will be sent out every two seconds. The maximum length of time that the BPDU information will be saved is 30 seconds. which two statements about the STP process for VLAN 200 are true? (Choose two. This switch is the root bridge for VLAN 200. D. B. F.QUESTION 195 Based on the show spanning-tree vlan 200 output shown in the exhibit. The time spent in the learning state will be 15 seconds. The time spent in the listening state will be 30 seconds. Correct Answer: BF Section: (none) Explanation Explanation/Reference: . BPDUs will be sent out every 10 seconds.

speak C.QUESTION 196 Which three statements are correct with regard to the IEEE 802. standby Correct Answer: B Section: (none) Explanation Explanation/Reference: First we should review all the HSRP States: .1Q frame uses multicast destination of 0x01-00-0c-00-00 F.1Q standard? (Choose three.) A.) A. active B.1Q frame retains the original MAC destination address Correct Answer: ADF Section: (none) Explanation Explanation/Reference: QUESTION 197 Which of the following HSRP router states does an active router enter when it is pre-empted by a higher priority router? (Select the best answer. The packet is encapsulated with a 26 byte header and a 4 byte FCS C. The IEEE 802. listen E. The IEEE 802. learn D. The protocol uses point-to-point connectivity E. The IEEE 802. The protocol uses point-to-multipoint connectivity D. init F.1Q frame format adds a 4 byte field to a Ethernet frame B.

It enters the initial state. Now it starts sending hello messages containing its priority. Suppose there are 2 routers A and B in the network. If router B does not hear hello messages from router A within the holdtime.shtml QUESTION 198 What happens if you apply this command “vlan dot1q tag native” ? A. it can take over the active role by sending out a hello packet with parameters indicating it wants to take over the active router. Now to our main question! We want router B to become active router so we set a higher priority number than the priority of A and ask router B to take over the role of active router (with the preempt command).2 (which can be heard by all members in that group). packet will be dropped B. Now router A will fall back to the speak state to compete for active or standby state -> it becomes standby router because its priority is now lower than that of router A.cisco. router B goes into speak state to announce its priority to all HSRP members and compete for the active state. (Therefore answer B is correct). In this state. Note: Suppose router A is in active state while router B is in standby state. This is called a coup hello message. Reference: http://www. Now router B is turned on. It also goes through initial and listen state. Then it moves to listen state in which it tries to hear if there are already active or standby routers for this group. it determines to take part in the election by moving to speak state.0. it learns that router A has been already the active router and no other router is taking standby role so it enters speak state to compete for the standby router -> it promotes itself as standby router. But if at some time it receives a message from the active router that has a lower priority than its priority (because the administrator change the priority in either router). When it does not hear a hello message with a higher priority it assumes the role of active router and moves to active state. router A is turned on first. In listen state.0.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a91.Now let’s take an example of a router passing through these states. it continues sending out periodic hello messages. After learning no one take the active or standby state. These messages are sent to the multicast address 224. packet will go to default VLAN .

packet will go to native VLAN D. what can we conclude about interfaces Fa0/13 and Fa0/14? A. That interfaces Fa0/13 and Fa0/14 are down C. That interfaces Fa0/13 and Fa0/14 have a duplex mismatch with another switch . Based upon the output of show vlan on switch CAT2. That interfaces Fa0/13 and Fa0/14 are in VLAN 1 B. That interfaces Fa0/13 and Fa0/14 are trunk interfaces D.C. That interfaces Fa0/13 and Fa0/14 have a domain mismatch with another switch E. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 199 Refer to the exhibit.

Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 200 VLAN maps have been configured on switch R1.0003 is directly connected to the switch port? A. Which of the following actions are taken in a VLAN map that does not contain a match clause? A. Implicit deny feature at end of list B. The host can only connect through a hub/switch where 0002. The host will be refused access. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 201 Given the configuration on a switch interface. Implicit forward feature at start of list.0002 is already connected. what happens when a host with the MAC address of 0003. The host will be allowed to connect. The port will shut down. . C.0003. D. B. Implicit forward feature at end of list D. Implicit deny feature at start of list C.0002.

All ports in VLAN 10 will be in forwarding mode. If the STP configuration is correct.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 202 Refer to the exhibit. B. All ports will be in forwarding mode. C. what will be true about Switch 15? A. Switch 15 is configured as the root switch for VLAN 10 but not for VLAN 20. . All ports in VLAN 10 will be in forwarding mode and all ports in VLAN 20 will be in blocking mode.

They have been configured with the spanning-tree guard root command. They have been configured with the spanning-tree bpdufilter enable command. C. They have been configured with the spanning-tree bpduguard disable command.D. B. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 203 Refer to the exhibit. which statement about interfaces FastEthernet 0/1 and FastEthernet 0/2 is true? A. E. All ports in VLAN 10 will be in forwarding mode and all ports in VLAN 20 will be in standby mode. On the basis of the output of the show spanning-tree inconsistentports command. They have been configured with the spanning-tree guard loop command. They have been configured with the spanning-tree bpdufilter disable command. Correct Answer: F Section: (none) Explanation Explanation/Reference: . D. They have been configured with the spanning-tree bpduguard enable command. F.

R1 and R2. Router R1 is the active router and has been configured as follows: . Which of the following commands should you issue on SwitchA for the port connected to SwitchB? (Select the best answer) A.QUESTION 204 You want to configure a switched intemetwork with multiple VLANs as shown above. switchport trunk native vlan 5 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 205 You administer a network that uses two routers. switchport mode access vlan 5 D. switchport mode trunk B. configured as an HSRP group to provide redundancy for the gateway. switchport access vlan 5 C.

The encapsulation type of both ends of the trunk does not have to match. In 802. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 206 Which statement is correct about 802. The HSRP priority for router R1 will decrease to 50 points when Fa0/2 goes down. Router R1 will become the standby router if the priority drops below 50. Correct Answer: E Section: (none) Explanation Explanation/Reference: . all VLAN packets are tagged on the trunk link. C.1Q trunking? A. Router R1 will wait 50 seconds before attempting to preempt the active router. Both switches must be in the same VTP domain.Which of the following describes the effect the "standby preempt delay minimum 50" command will have on router R1? (Select the best answer.1Q trunking. The native VLAN on both ends of the trunk must be VLAN 1. D. D. E. C. B. B. 802. The HSRP priority for router R1 will increase to 200.) A.1Q trunking can only be configured on a Layer 2 port. except the native VLAN.

The HSRP MAC address will be 0000.ad01. D.ac01. Switch(config-if)#spanning-tree portfast C. Switch(config-if)#switchport mode access Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 208 The following command was issued on a router that is being configured as the active HSRP router.070c. C. The HSRP MAC address will be 0000.0c07. This command will not work because the active parameter is missing Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 209 . B.ac00. E. Which statement is true about this command? A. This command will not work because the HSRP group information is missing. Switch(config-if)#spanning-tree guard root B. The HSRP MAC address will be 0000.0c07. Switch(config-if)#switchport mode trunk D.QUESTION 207 Which of the following commands can be issued without interfering with the operation of loop guard? A.

Routers R1 and R2 are configured for HSRP as shown below: You have configured the routers R1 & R2 with HSRP. What is the most likely cause of this? A. While debugging router R2 you notice very frequent HSRP group state transitions. no spanning tree loops C. use of non-default HSRP timers D. physical layer issues B. failure to set the command standby 35 preempt Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 210 .

the router with the lowest priority in an HSRP group would become the active router. The Standby hold time is 10 seconds. The Standby priority is 100. D.Which two statements about the HSRP priority are true? (Choose two) A. Correct Answer: CDE Section: (none) Explanation Explanation/Reference: The table below shows the default values of popular HSRP parameters: . C. C. F. D. B. Assuming that preempting has also been configured. Correct Answer: CE Section: (none) Explanation Explanation/Reference: The “no standby priority” command will reset the priority to the default value (100) -> C is correct. the standby group—number priority priority-value global configuration command must be used. To assign the HSRP router priority in a standby group. the router with the highest configured IP address will become the active router. B. The no standby priority command assigns a priority of 100 to the router. E.) A. The default priority of a router is zero (0). QUESTION 211 Which three statements are true of a default HSRP configuration? (Choose three. The Standby hello time is 2 seconds. E. The Standby track interface priority decrement is 10. Two HSRP groups are configured. When two routers in an HSRP standby group are configured with identical priorities. The Standby delay is 3 seconds.

with the “standby preempt delay minimum 30” command.com/en/US/docs/switches/lan/catalyst3550/software/release/12. Reference: http://www. Because no decrement value is specified in the standby track command.Note: Standby delay: If router A is the HSRP active router and then loses a link. What is the result of setting GLBP weighting at 105 with lower threshold 90 and upper threshold 100 on this router? . consider this configuration: standby priority 150 standby track serial 0 An HSRP priority of 150 is configured with the standby priority command and HSRP is configured to track the state of interface Serial0.cisco. For example.html QUESTION 212 Refer to the exhibit. it waits for 30 seconds for the router to become active. and then the link comes back. Standby track: For example.1_12c_ea1/configuration/guide/swhsrp. the delay command causes router A to wait before it becomes active again. which causes it to become standby router. the HSRP priority is decremented by the default value of 10 when the tracked interface goes down.

Correct Answer: B Section: (none) Explanation . B. D. Only if both tracked objects are up will this router will be available as an AVF for group 1. Only if the state of both tracked objects goes down will this router release its status as an AVF for group 1. This configuration is incorrect and will not have any effect on GLBP operation. E. If the state of one tracked object goes down then this router will release its status as an AVF for group 1.A. C. but the other remains down. If both tracked objects go down and then one comes up. this router will be available as an AVF for group 1.

Per session using a strict priority scheme D. LinkA is connected and forwarding traffic. Per host using a strict priority scheme B.) . BPDUGuard is enabled on both ports of SwitchA. A new LinkB is then attached between SwitchA and HubA. Which two statements about the possible result of attaching the second link are true? (Choose two. Per host basis using a round robin-scheme F. Initially. Per GLBP group using a round-robin scheme Correct Answer: E Section: (none) Explanation Explanation/Reference: QUESTION 214 Refer to the exhibit. Per session using a round-robin scheme C. Per GLBP group using a strict priority scheme E.Explanation/Reference: QUESTION 213 Which describes the default load balacing scheme used by the Gateway Load Balancing Protocol (GLBP)? A.

C. The switch port attached to LinkB does not transition to up. HSRP C.A. D. IRDP . Both switch ports attached to the hub transitions to the blocking state. E. B. One or both of the two switch ports attached to the hub goes into the err-disabled state when a BPDU is received. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 215 Which protocol will enable a group of routers to form a single virtual router and will use the real IP address of a router as the gateway address? A. Proxy ARP B. A heavy traffic load could cause BPDU transmissions to be blocked and leave a switching loop. The switch port attached to LinkA immediately transitions to the blocking state.

The switch generates a Topology Change Notification BPDU. B.) A. C. by restricting unicast traffic across VTP domains B. VRRP E. The port immediately transitions to the forwarding state. by reducing unnecessary flooding of traffic to inactive VLANs C. The port immediately transitions to the err-disable state. by limiting the spreading of VLAN information D. D.D. by disabling periodic VTP updates Correct Answer: B Section: (none) Explanation . GLBP Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 216 What two things occur when an RSTP edge port receives a BPDU? (Choose two. The port becomes a normal STP switch port. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 217 How does VTP pruning enhance network bandwidth? A.

stack master C. HSRP well-known physical MAC address E.ac0a. all stack members B.ac represent? A. HSRP router number D. flash memory Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 220 Which protocol specified by RFC 2281 provides network redundancy for IP networks. vendor code B. ensuring that user traffic immediately and transparently recovers from . what does 07. where are the templates stored? A.Explanation/Reference: QUESTION 218 In the hardware address 0000. HSRP group number C. HSRP well-known virtual MAC address Correct Answer: E Section: (none) Explanation Explanation/Reference: QUESTION 219 If a switch stack is configured to use SDM templates.0c07. TFTP server D.

first-hop failures in network edge devices or access circuits? A. STP Correct Answer: C Section: (none) Explanation Explanation/Reference: HSRP is a Cisco-proprietary protocol developed to allow several routers or multilayer switches to appear as a single gateway IP address. IRDP C. HSRP D. Which two items are most likely the cause of Switch1 not becoming the active router? (Choose two) . you notice via show commands that Switch2 is the HSRP active router. QUESTION 221 HSRP was implemented and configured on two switches while scheduled network maintenance was performed. This protocol is described in RFC 2281. ICMP B. After the two switches have finished rebooting.

IP redirect is disabled Correct Answer: AD Section: (none) Explanation Explanation/Reference: When two routers are turned on at the same time. IP addressing is incorrect D. What is the most likely cause of this status? . incorrect standby timers F. booting delays B. standby group number does not match VLAN number C.A.In the configuration of Switch1 we don’t see the “preempt” command configured. premption is disabled E. the router completes booting process first will take the active role. Switch1 remains in the HSRP listen state. QUESTION 222 Refer to the exhibit. even a new router with a higher priority cannot take over the active role. Without the “preempt” configured. Three switches are configured for HSRP.

incorrect priority commands E. IP addressing is incorrect D. standby group number does not match VLAN number C.A. this is normal operation B. incorrect standby timers Correct Answer: A Section: (none) Explanation .

It enters the initial state. Idle E. both Switch2 and Switch3 have the “preempt” command so surely Switch3 becomes active router while Switch2 becomes standby router -> Switch1 will be in listen state (Please read the explanation of question 2 to understand more about this state). After learning no one take . which is smaller than that of Switch2 (110) and Switch3 (150). Standby B. Moreover. Suppose there are 2 routers A and B in the network. Established C. QUESTION 223 What are three possible router states of HSRP routers on a LAN? (Choose three) A. Then it moves to listen state in which it tries to hear if there are already active or standby routers for this group. router A is turned on first. Backup F. Active D. Init Correct Answer: ACF Section: (none) Explanation Explanation/Reference: First we should review all the HSRP States: Now let’s take an example of a router passing through these states.Explanation/Reference: Only Switch 1 is not configured with the priority so it will have the default priority of 100.

10.10. Now router A will fall back to the speak state to compete for active or standby state -> it becomes standby router because its priority is now lower than that of router A.0.cisco.0 Switch_B(config-if)#standby 1 priority 200 Switch_B(config-if)#standby 1 preempt Switch_B(config-if)#standby 1 ip 10. it can take over the active role by sending out a hello packet with parameters indicating it wants to take over the active router. In this state. Now it starts sending hello messages containing its priority. Note: Suppose router A is in active state while router B is in standby state.2 255.10.10 Switch_B(config-if)#standby 1 track interface fa 1/1 B.10. router B goes into speak state to announce its priority to all HSRP members and compete for the active state. Now router B is turned on. Which configuration on the HSRP neighboring device ensures that it becomes the active HSRP device in the event that port fa1/1 on Switch_A goes down? A.shtml QUESTION 224 Refer to the exhibit. But if at some time it receives a message from the active router that has a lower priority than its priority (because the administrator change the priority in either router). These messages are sent to the multicast address 224.255. Switch_B(config-if)#ip address 10. It also goes through initial and listen state.255. it continues sending out periodic hello messages.10 C. Now to our main question! We want router B to become active router so we set a higher priority number than the priority of A and ask router B to take over the role of active router (with the preempt command).0 Switch_B(config-if)#standby 1 priority 195 .2 (which can be heard by all members in that group).10.255.255.10. it determines to take part in the election by moving to speak state.10. Switch_B(config-if)#ip address 10.255.0 Switch_B(config-if)#standby 1 priority 200 Switch_B(config-if)#standby 1 ip 10. If router B does not hear hello messages from router A within the holdtime.2 255.10. In listen state. it learns that router A has been already the active router and no other router is taking standby role so it enters speak state to compete for the standby router -> it promotes itself as standby router.10. Reference: http://www.2 255.the active or standby state. This is called a coup hello message.10. (Therefore answer B is correct).com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a91. When it does not hear a hello message with a higher priority it assumes the role of active router and moves to active state. Switch_B(config-if)#ip address 10.255.0.

10.0 Switch_B(config-if)#standby 1 priority 190 Switch_B(config-if)#standby 1 ip 10. what does the “03” represent? . HSRP provides redundancy and load balancing. D. HSRP allows one router to automatically assume the function of the second router if the second router fails. In fact answer D is not totally correct. Note: Answer A is not correct because Switch_B has the same priority value of Switch_A.ac03. C.10. Switch_B(config-if)#standby 1 preempt Switch_B(config-if)#standby 1 ip 10.10. Also Switch_B must have the “preempt” command configured to take over the active state -> C is correct.10.2 255. Correct Answer: ABD Section: (none) Explanation Explanation/Reference: Answer A and B are correct because they are the functions of HSRP.10. Switch_B(config-if)#ip address 10. HSRP provides redundancy and fault tolerance. I just want to mention about answer D. but the Switch_B’s ip address on the HSRP interface is higher (10.10.10 D. But answer D is the only choice left in this question so we have to choose it.10. QUESTION 225 HSRP has been configured between two Company devices.2 is higher than 10.0c07.10 Switch_B(config-if)#standby 1 track interface fa 1/1 Correct Answer: C Section: (none) Explanation Explanation/Reference: Switch_A is not configured standby track priority value so it will use the default track priority of 10 -> When Switch_A goes down. its priority is 200 – 10 = 190 so Switch_B must be configured with a priority higher than 190. HSRP can only load-sharing by configuring some different HSRP groups. B.1) so Switch_B will take over the active state of Switch_A even when Switch_A is still operational.10. HSRP allows one router to automatically assume the function of the second router if the second router starts.10. with the MAC address 0000. Which of the following describe reasons for deploying HSRP? (Choose three) A.255. in SWITCH only GLBP has the load-balancing feature.10. QUESTION 226 Regarding high availability.255.

QUESTION 227 An engineer is configuring EtherChannel between two switches using PAgP. active D. which mode on switch 2 establishes an operational EtherChannel? A. The GLBP group number B. The type of encapsulation C. auto Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 228 When using EtherChannel misconfiguration guard which technology is used to prevent this type of misconfiguration from affecting the network? A. If the EtherChannel mode on switch 1 is configured using auto. STP . PAgP B. The active router number Correct Answer: E Section: (none) Explanation Explanation/Reference: The last two-digit hex value in the MAC address presents the HSRP group number. passive C. The VRRP group number E. desirable B. The HSRP group number F.A. The HSRP router number D.

D. Correct Answer: A Section: (none) Explanation . LACP D. Use only one destination port for each RSPAN session. C. D. B. C. Use a different RSPAN VLAN for each session if configuring RSPAN on multiple switches. The port is removed from the EtherChannel group. B. Define an RSPAN VLAN before configuring an RSPAN source or destination session. The port is put in the errdisabled state and can only be re-enabled manually. Assign access ports to an RSPAN VLAN like any other campus VLAN.C. The operation is not allowed as an EtherChannel member cannot be a SPAN source port. The port forwards traffic in the EtherChannel group and acts as a SPAN source simultaneously. What happens while the same port is configured as a SPAN destination? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 230 Which option is a Cisco recommended RSPAN configuration practice? A. port security Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 229 A physical switch port is part of an EtherChannel group.

error disable Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 232 Which three functions does Dynamic ARP Inspection perform with invalid IP-to MAC address bindings? (Choose three.) A. no change D. logs D. intercepts B. which violation mode is the default? A.Explanation/Reference: QUESTION 231 When port security is configured on a switch. accepts E. bypasses F. deletes Correct Answer: ABC Section: (none) Explanation Explanation/Reference: . logging C. shutdown B. discards C.

trunk . B. UDLD is an IEEE standard that can be configured on non-Cisco devices. Which option must the network engineer consider? A. Switch(config)#spanning-tree root guard C. UDLD aggressively disables the port after eight failed retries to connect to neighbor. C. UDLD works at Layer 1 of the OSI model. Switch(config-if)#spanning-tree guard-root D. Switch(config)#spanning-tree guard root B. Switch(config-if)#spanning-tree guard root E. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 235 In regards to Cisco Virtual Switching System which technology is needed between two switches for them to act as one network element and share control information and data traffic? A.QUESTION 233 Which command enables root guard on a Cisco switch? A. D. Switch(config-if)#spanning-tree root guard Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 234 A network engineer is considering implementing UDLD throughout the network. UDLD is already enabled by default on all ports on Cisco switches.

The SecurityViolation counter is incremented and the port sends an SNMP trap. show ip interface brief . The SecurityViolation counter is incremented and the port sends a critical syslog message to the console. EtherChannel D. D. the port is error disabled.B. virtual switch link Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 236 In which two ways can a port respond to a port-security violation? (Choose two. The port enters the err-disabled state. F. show run interface g0/1 D.) A. E. C. B. virtual port channel C. show log C. show interfaces g0/1 status B. The port triggers an EEM script to notify support staff and continues to forward traffic normally. The port immediately begins to drop all traffic. Correct Answer: CF Section: (none) Explanation Explanation/Reference: QUESTION 237 After you connected a host to switch port G0/1. The port enters the shutdown state. Which command can you enter to determine the reason? A.

) A. but the EtherChannel stays down. Correct Answer: E Section: (none) Explanation Explanation/Reference: QUESTION 239 In which two ways are IEEE STP BPDUs forwarded if VLAN 99 is configured as native? (Choose two. The port remains up.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 238 When EtherChannel guard is enabled and a misconfiguration is detected on a port. D. VLAN 1 STP BPDUs are sent tagged on VLAN 99. B. VLAN 1 STP BPDUs are sent untagged on VLAN 1. VLAN 1 and VLAN 99 BPDUs are sent untagged on VLAN 1. how does the port respond? A. Correct Answer: AD Section: (none) Explanation . F. VLAN 1 STP BPDUs are sent untagged on VLAN 99. D. C. E. The port state remains unchanged. VLAN 1 STP BPDUs are sent tagged on VLAN 1. It enters the channel-error state. It enters the errdisable state. VLAN 1 and VLAN 99 BPDUs are sent tagged on VLAN 1. C. but it is unable to pass traffic. B. It enters the shutdown state. E.

Correct Answer: BD Section: (none) Explanation . If Fa0/0 is shut down. Which two statements can be derived from the output of the show standby command? (Choose two. Router with IP 10.1. C. E. R2 Fa1/0 regains mastership when the link comes back up.) A. R2 becomes the active router after the hold time expires.Explanation/Reference: QUESTION 240 Refer to the exhibit. the HSRP priority on R2 becomes 80. D.3 is active because it has a higher IP address.10. B. R2 is using the default HSRP hello and hold timers.

) A. B. active. the switch with the lowest stack member priority value. passive B. the switch with the lowest stack member ID. What is the effect of the given configuration? . Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 242 Which two combinations of EtherChannel modes support the formation of an EtherChannel? (Choose two. C. desirable. passive C. desirable E. desirable Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 243 Refer to the exhibit. passive D. passive. active. the switch with the highest stack member ID. the switch with the highest stack member priority value.Explanation/Reference: QUESTION 241 Which switch is chosen as the stack master during a stack master election? A. desirable. D.

When it is enabled. It enables extended VLANs. F. It enables the reduced MAC address feature.1q are true? (Choose two. D. B. B. C. Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 245 Which command do you enter so that the default authentication group on a device falls back to the case-sensitive local user database when the initial . it forces a recalculation of the frame-check sequence field. C. It is a Cisco proprietaty protocol. It encapsulates the original Ethernet frame and adds a VLAN identifier. It enables spanning-tree to create dynamic system IDs.) A. It enables the switch to become the spanning-tree root bridge. E. It increases the maximum size of an Ethernet frame to 1594 bytes. It supports 8-byte VLAN identifiers. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 244 Which two statements about 802.A. It adds a 32-bit field to the Ethernet frame between the source MAC address and length. D.

0. It supports MD5 and IP sec authentication.0. It sends advertisements to multicast address 224. It sends advertisements to multicast address 224. D. A SPAN source does not participate in any Layer 2 protocols. C.0. B. .) A.9.0. B. F. Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 247 Which statement about Layer 2 protocol participation of ports involved in a SPAN session is true? A.authentication fails? A. aaa authentication exec default group tacacs+ if-authenticated local Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 246 Which two statements about VRRP are true? (Choose two. Neither a SPAN source nor SPAN destination participates in any Layer 2 protocols.18. aaa authentication login default group tacacs+ radius local B. E. aaa authentication login default group tacacs+ local-case if-authenticated D. aaa authentication exec default group tacacs+ local if-authenticated C. It can use an interface IP address as the virtual IP address. It is a Cisco proprietary protocol. Authentication commands must be entered under the interface.

D.3. B. A SPAN destination does not participate in any Layer 2 protocols. The running configuration displays switch port trunk allowed vlan 1-5 for Fa0/2.C.4 command on FastEthernet0/2 is true? A. D. The command is unsupported on a trunk where VLANs have already been pruned manually. The two workstation stop communicating because they are on VLAN 5. Which is not allowed on the trunk. C. . Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 248 Refer to the exhibit. Both SPAN source and SPAN destination participate in any Layer 2 protocols. The two workstations continue to communicate without a default gateway configured. Which description of the effect of entering the switch port trunk allowed vlan 2.

.Correct Answer: D Section: (none) Explanation Explanation/Reference: This command will delete vlan 5 and configure trunk with allowed vlans 2. Which statement about the interface is true? A. The interface is down. To add vlan command is switchport trunk allowed vlan ADD. B. QUESTION 249 Refer to the exhibit.3. The interface needs no shutdown configured. The switchport command is missing from the configuration. D. The other side of the interface is set as access. C.4.

switch port block C. IP Source Guard B. BPDU Guard Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 251 Which three responses from a RADIUS server are valid? (Choose three.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 250 A network engineer is trying to prevent users from connecting unauthorized equipment to a production network. UPDATE PASSWORD E. private VLAs E. ACCEPT D. CHALLENGE C. CONFIRM Correct Answer: ABC Section: (none) Explanation . REJECT B.) A. Uplink fast D. Which option can be campus-wide to satisfy this requirement? A.

3x flow control setting • MTU The Cisco Nexus 5000 Series switch only supports system level MTU. Cisco NX-OS checks certain interface attributes to ensure that the interface is compatible with the channel group. VLAN Correct Answer: AE Section: (none) Explanation Explanation/Reference: Compatibility Requirements When you add an interface to a channel group. Port cost C. Port mode B. .Explanation/Reference: QUESTION 252 Which two operational attributes can be checked for EtherChannel ports that are in err-disabled state? (Choose two. The compatibility check includes the following operational attributes: • Port mode • Access VLAN • Trunk native VLAN • Allowed VLAN list • Speed • 802. This attribute cannot be changed on an individual port basis. DTP E.) A. Cisco NX-OS also checks a number of operational attributes for an interface before allowing that interface to participate in the port-channel aggregation. • Broadcast/Unicast/Multicast Storm Control setting • Priority-Flow-Control • Untagged CoS Use the show port-channel compatibility-parameters command to see the full list of compatibility checks that Cisco NX-OS uses. Duplex D.

pdf QUESTION 253 Refer to the exhibit. E. Correct Answer: AB Section: (none) Explanation Explanation/Reference: .com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/layer2/421_n2_1/b_Cisco_n5k_layer2_config_gd_rel_421_N2_1/ Cisco_n5k_layer2_config_gd_rel_421_N2_1_chapter7.https://www. On the designated root switch downlinks to the access layer. D. C. On all of non-root switch facing ports of the access layer. which caused a network outage. In which two locations should the Spanning Tree protocol root guard feature be implemented? (Choose two. On the access layers root facing ports. B. Globally on all network switches. A network engineer deployed an older switch with the same spanning-tree priority as the existing root. On Layer 3 boundaries in the distribution layer.cisco.) A.

QUESTION 254 Which three features can be optimized by using SDM templates? (Choose three. interface GigabitEthernet0/0. interface GigabitEthernet0/0 switchport mode access switchport access vlan 915 B.915 switchport mode access switchport access vlan 915 . trunk C. DHCP snooping F.915 encapsulation dot1q 915 E. port security B. VLAN D. interface GigabitEthernet0/0 switchport mode trunk switchport trunk encapsulation dot1q switchport trunk allowed vlan 915 C. routing Correct Answer: CDF Section: (none) Explanation Explanation/Reference: QUESTION 255 Which two configurations can you apply to a port so that it tags traffic with VLAN 915? (Choose two.) A. interface GigabitEthernet0/0 switchport mode access switchport voice vlan 915 switchport access vlan 915 D. access E.) A. interface GigabitEthernet0/0.

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 256
An engineer is configuring an EtherChannel between two switches using PAgP. If the EtherChannel mode on switch 1 is configured to auto, which modes on
switch 2 establish an operational EtherChannel?

A. active
B. auto
C. desirable
D. on
E. passive

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 257
Which feature do you implement so that an interface enters the root inconsistent state if it receives a superior BPDU?

A. DPDU guard
B. root guard
C. BPDU guard
D. loop guard

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 258
A physical switch port is part of an EtherChannel group. What happens while the same port configured as a SPAN destination?

A. The port forwards traffic in the EtherChannel group and acts as a SPAN source simultaneously.
B. The port is removed from the EtherChannel group.
C. The port is put in the errdisabled state and can only be reenabled manually.
D. The operation is not allowed as an EtherChannel member cannot be a SPAN source port.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 259
Which two statements about CDP are true? (Choose two.)

A. CDP uses a TLV to advertise the native VLAN
B. CDP is not supported with SNMP
C. CDP is supported on Frame Relay sub interfaces.
D. CDP runs on OSI Layer 2
E. CDP runs on OSI Layer 1

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 260
Which statements about RSPAN are true? (Choose two.)

A. It supports MAC address learning.

B. RSPAN VLANs can carry RSPAN traffic only.
C. Only one RSPAN VLAN can be configured per device.
D. RSPAN VLANs are exempt from VTP pruning.
E. MAC address learning is not supported.
F. RSPAN uses are GRE tunnel to transmit captured traffic.

Correct Answer: BE
Section: (none)
Explanation

Explanation/Reference:

QUESTION 261
When a private VLAN is configured, which mode must be configured as a router facing port?

A. isolated
B. promiscuous
C. community
D. host

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 262
When a switch is added to a stack, which switch automatically configures the new switch with the correct IOS?

A. master
B. peer
C. adjacent
D. slave

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 263
Which HSRP extension allows groups to share traffic loads?

A. GLBP
B. CHSRP
C. MHSRP
D. CGMP
E. FHRP

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 264
Which mechanism is specific for RSPAN and not for SPAN?

A. source port
B. monitor port
C. reflector port
D. redundant port
E. destination port

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 265
Which three pieces of information about the remote device are reported by Cisco Discovery Protocol? (Choose three.)

A. The routing protocols in use on the device
B. Its spanning-tree state
C. Its hostname
D. Its port number
E. Its configuration register value
F. Its hardware platform

Correct Answer: CDF
Section: (none)
Explanation

Explanation/Reference:

QUESTION 266
Where can NetFlow export data for long term storage and analysis?

A. another network device
B. flat file
C. syslog
D. collector

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 267
Which two types of threshold can you configure for tracking objects? (Choose two.)

A. weight
B. bandwidth
C. MTU
D. percentage
E. administrative distance 15
F. delay

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 268
Refer to the exhibit. Which statement describes the result if a switch that is running PVST+ is added to this network?

A. Spanning tree is disabled automatically on the network
B. Spanning tree continues to operate in Rapid PVST+ on DSW2 and the new switch operates in PVST+
C. Both switches operate in the PVST+ mode
D. Both switches operate in the Rapid PVST+ mode

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 269
A workstation technician moves a PC from one office desk to another. Before the move the PC has network connectivity. After the move as the PC plugged
into the new network port, it loses network connectivity and the network switch port becomes err-disabled. Which option can cause the issue?

A. wrong VLAN
B. wrong switch port mode

C. port security
D. speed issue

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 270
Your manager asked you to make every port on your switch bypass the normal spanning-tree timers which includes your uplink to other switches. What two
commands can you apply on the interfaces? (Choose two.)

A. spanning-tree portfast
B. spanning-tree portfast default
C. spanning-tree portfast access
D. spanning-tree portfast trunk

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 271
Which switchport feature will block the packet with unknown MAC address from sending it via port.

A. switchport protect
B. switchport block unicast
C. switchport portfast
D. packet with unknown MAC will be dropped

Correct Answer: B
Section: (none)

Explanation

Explanation/Reference:

QUESTION 272
Which IOS configuration command is required to configure a VLAN as a private VLAN?

A. switch(config-vlan)# private-vlan common
B. switch(config-vlan)# private-vlan private
C. switch(config-vlan)# private-vlan primary
D. switch(config-vlan)# private-vlan transparent

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 273
If all devices on an EtherChannel are sending traffic to a single MAC address, which two methods of load balancing on the EtherChannel are preferred?
(Choose two.)

A. destination-MAC
B. dest-source-MAC
C. destination-IP
D. source-MAC
E. source-IP

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/channel.html

QUESTION 274
What is the default mode for LACP EtherChannel when configured?

A. on
B. active
C. passive
D. desirable
E. off

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 275
Which layer private VLAN partition the broadcast domain?

A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 4

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 276
What VSS technology allows you to share downstream resources?

A. LACP
B. PAgP

C. MEC
D. EOA

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 277
Which option is the maximum frame size for an 802.1Q frame?

A. 64 bytes
B. 68 bytes
C. 1518 bytes
D. 1522 bytes

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 278
Which option is the minimum frame size for an 802.1Q frame?

A. 64 bytes
B. 68 bytes
C. 1518 bytes
D. 1522 bytes

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 279
Which two statements about HSRP timers are true? (Choose two.)

A. the default hold timer is 15 seconds
B. the default hello timer is 3 seconds.
C. the default hello timer is 5 seconds.
D. the default hold timer is 10 seconds.
E. the default hello timer is 30 seconds.
F. the default hold timer is 30 seconds.

Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 280
During the implementation of a voice solution, which two required items are configured at an access layer switch that will be connected to an IP phone to
provide VoIP communication? (Choose two.)

A. allowed codecs
B. untagged VLAN
C. auxiliary VLAN
D. Cisco Unified Communications Manager IP address
E. RSTP

Correct Answer: BC
Section: (none)
Explanation

Explanation/Reference:

The VLAN carries voice traffic to and from the IP Phone is often called auxiliary VLAN (Port 2 in this case) while the VLAN carries data traffic is often the native VLAN (Port 3 in this case). . In the picture below the auxiliary VLAN is VLAN 30 while the native VLAN is VLAN 20. The ports. which are dedicated connections. * Port 3 connects to a PC or other device. are described as follows: * Port 1 connects to the Catalyst series switch or other device that supports Voice-over-IP (VoIP).An IP phone contains an integrated three-port 10/100 switch. * Port 2 is an internal 10/100 interface that carries the phone traffic. port 2 and port 3 are often placed in two different VLANs. To use the IP Phone these two VLANs will need to be configured on the switch. To enhance the quality of the VoIP traffic.

cisco. .com/en/US/docs/switches/lan/catalyst4000/8.com/en/US/products/hw/switches/ps4324/ products_configuration_example09186a0080722cdb.cisco.To learn how to configure auxiliary VLAN please read: http://www. To learn how to configure voice and data VLAN please read: http://www.html#wp1048863.shtml.1/configuration/guide/ vlans.

They have questions about how these two devices will perform in the event of a device failure. .Simlet .HSRP QUESTION 1 SIMLET .HSRP Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.

.

10. R2-100% D. R1-100% Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Based on the following output. so all outgoing traffic will be forwarded to R1.0/24 subnet is being forwarded through R1? A. QUESTION 2 . we see that R1 is the active standby router for the Ethernet 0/0 link. R2-50% C. R1-50 %.What percentage of the outgoing traffic from the 172. R1-0% B.16.

HSRP Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP. They have questions about how these two devices will perform in the event of a device failure.SIMLET . .

.

HSRP . The interface will have its current priority incremented by 40 for HSRP group 1 D. However.Refer to the exhibit. If router R1 interface Etherne0/0 goes down and recovers. B. QUESTION 3 SIMLET . The interface will have the priority decremented by 60 for HSRP group 1 C. when it comes back up. the standby 1 track decrement command will lower the priority from 130 to 90. The interface will have the priority decremented by 40 for HSRP group 1. it will then increment it by 40 back to 130 for HSRP group 1. which of the statement regarding HSRP priority is true? A. when the Ethernet 0/0 interface goes down. The interface will have its current priority incremented by 60 for HSRP group 1 E. The interface will default to the a priority of 100 for HSRP group 1 Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Here is the HSRP configuration seen on R1: Here.

Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP. They have questions about how these two devices will perform in the event of a device failure. .

.

The HSRP timers mismatch E. The HSRP group priorities are different Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Based on the configuration output.What issue is causing Router R1 and R2 to both be displayed as the HSRP active router for group 2? A. The HSRP group number mismatch B. we see that authentication is configured on R2. The HSRP group authentication is misconfigured C. The HSRP Hello packets are blocked D. but not on R1: .

.This can be further verified by issuing the “show standby” command on each router.

HSRP Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.QUESTION 4 SIMLET . . They have questions about how these two devices will perform in the event of a device failure.

.

4000.0000. 0000.0000.0010 as shown below: . 4000.0000.0c07.0000. 0000.ac01 E.0010 C. 0000.ac02 B.ac02 F.What is the virtual mac-address of HSRP group 1? A. 4000.0c07.0c07.0010 Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is 4000.ac01 D.

.

.

Use the console access to the existing and new switches to configure and verify correct device configuration.VTPv3 You have been asked to install and configure a new switch in a customer network.VTPv3 QUESTION 1 SIMLET .Simlet . .

the switch has been partially configured and you need to complete the rest of configuration to .You are connecting the New_Switch to the LAN topology.

vtp domain CCNP_TEST vtp password cisco123 vtp version 3 vtp mode client interface e0/0 switchport mode access switchport access vlan 200 C. Which of the configuration is correct? A. vtp domain CCNP_TEST vtp password cisco123 vtp version 3 vtp mode server interface e0/0 switchport mode access switch port access vlan 100 B. vtp domain CCNP_TEST vtp password cisco123 vtp version 2 vtp mode client interface e0/0 switchport mode access switchport access vlan 100 D. vtp domain CCNP vtp password cisco vtp version 3 vtp mode client interface e0/0 switchport mode access switchport access vlan 100 E. vtp domain CCNP vtp password cisco vtp version 2 vtp mode transparent interface e0/0 switchport mode access switchport access vlan 200 .enable PC1 communication with PC2.

Note that the VTP versions supported in this network are 1. . This leaves only choice D and E. We also see from the topology diagram that eth 0/0 of the new switch connects to a PC in VLNA 100.Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Within any VTP. Logging in to SW1 and using the “show vtp status” command we see this: So we know that the VTP domain must be CCNP. leaving only choice D as correct. 3 so either VTP version 2 or 3 can be configured on the new switch. So. so we know that this port must be an access port in VLAN 100. 2. the VTP domain name must match. step one is to find the correct VTP name on the other switches.

Use the console access to the existing and new switches to configure and verify correct device configuration.QUESTION 2 SIMLET . .VTPv3 You have been asked to install and configure a new switch in a customer network.

For which configured VLAN are untagged frames sent over trunk between SW1 and SW2? .Refer to the configuration.

VLAN 999 D. . VLAN 200 G. VLAN1 B. VLAN 300 Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The native VLAN is used for untagged frames sent along a trunk. VLAN 40 E.A. By issuing the “show interface trunk” command on SW1 and SW2 we see the native VLAN is 99. VLAN 50 F. VLAN 99 C.

. Use the console access to the existing and new switches to configure and verify correct device configuration.VTPv3 You have been asked to install and configure a new switch in a customer network.QUESTION 3 SIMLET .

You are adding new VLANs. VLAN500 and VLAN600 to the topology in such way that you need to configure SW1 as primary root for VLAN 500 and secondary for VLAN 600 and SW2 as primary root for VLAN 600 and secondary for VLAN 500. Which configuration step is valid? .

Configure VLAN 500 and VLAN 600 on SW2 only D. so we will need to add both VLANs to SW1 and SW2. On SW2.A. but SW4 is a client. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: By issuing the “show vtp status command on SW2. Configure VLAN 500 and VLAN 600 on SW1 . Configure VLAN 500 and VLAN 600 on SW1 only C. Configure VLAN 500 & VLAN 600 on both SW1 & SW2 B.SW2 and SW4 E. . configure back to vtp server mode. SW2. and SW4 we see that both SW1 and SW2 are operating in VTP server mode. configure vtp mode as off and configure VLAN 500 and VLAN 600.

.

.

QUESTION 4 SIMLET .VTPv3 You have been asked to install and configure a new switch in a customer network. Use the console access to the existing and new switches to configure and verify correct device configuration. .

Which of the following configuration steps will allow creating private VLANs? . You are required to configure private VLANs for a new server deployment connecting to the SW4 switch.Examine the VTP configuration.

QUESTION 5 SIMLET . you will need to only disable pruning on the switch that contains the private VLANs. Disable VTP pruning on SW4 only D. In this case. Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: To create private VLANs.A. Disable VTP pruning on SW2. Disable VTP pruning on SW1 only B. Use the console access to the existing and new switches to configure and verify correct device configuration.VTPv3 You have been asked to install and configure a new switch in a customer network. only SW4 will connect to servers in a private VLAN. Disable VTP pruning on SW2 only C. . SW4 and New_Switch E. Disable VTP pruning on New_Switch and SW4 only.

Which configuration step is valid? . VLAN 500 and VLAN 600 to the topology in such way that you need to configure SW1 as primary root for VLAN 500 and secondary for VLAN 600 and SW2 as primary root for VLAN 600 and secondary for VLAN 500.You are adding new VLANs.

the VTP Primary Server will advertise its VLAN database to other VTP clients/servers so in fact answer A is not correct. C. They are: + “Primary ID”: The MAC address of the Primary Server + “Primary Description”: The hostname of the Primary Server The Primary Server is used on VTP version 3 to avoid the bad behavior in version 2. B. a VTP client (or Server) can be taken out of the network. configure vtp mode as off and configure VLAN 500 and VLAN 600. Only a VTP Primary Server can create new VLAN. Then it will advertise these VLANs to other switches. Configure VLAN 500 and VLAN 600 on SW2 only.HINT: VTP Operating Mode is set to Primary Server! A. Correct Answer: B Section: (none) Explanation Explanation/Reference: In VTP version 3. In this question you just need to check if Sw1 or Sw2 is the VTP Primary Server then we can create both VLAN 500 & 600 on it. Configure VLAN 500 & VLAN 600 on both SW1 & SW2. D. When it comes back. there are two additional fields under the output of “show vtp status” command. configure back to vtp server mode. E. Configure VLAN 500 and VLAN 600 on SW1 only. . On SW2. In VTP version 2. After creating new VLAN. This problem no longer exists in VTP version 3 because there is only one VTP Primary Server at a time. Configure VLAN 500 and VLAN 600 on SW1. it can overwrite a VTP Server if its Revision number is higher. SW2 and SW4.

issue the “vtp primary vlan” under privilege exec mode. Configure VLAN 500 & VLAN 600 on both SW1 & SW2 Note: To make a switch a Primary Server.From the output we see Sw1 is the Primary Server so we should configure VLAN 500 & 600 only on this switch. For example: Source: https://www.certprepare.com/vtpv3-sim . Note: If the above output shows the roles of Sw1 and Sw2 are “Server” only (not “Primary Server”) then we should choose: A.

with an enterprise network (access. Troubleshooting has identified several issues. Currently all interfaces are up. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. Using the running configurations and show commands. is a medium sized company. .Simlet .HSRP Ferris Plastics QUESTION 1 Ferris Plastics. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. Inc. you have been asked to investigate and respond to the following question. The distribution switches are configured to use HSRP to provide a high availability solution. unless GigabitEthernet1/0/1 on backup device has also failed.

distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a high availability solution. GigabitEthernet1/0/1 on DSW1 was shut down. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. However. Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: QUESTION 2 Ferris Plastics. Disable preempt in the VLAN 101 HSRP group on DSW2’s. Enable preempt in the VLAN 101 HSRP group on DSW1. . Troubleshooting has identified several issues. What needs to be done to make the group for VLAN 101 function properly? A.During routine maintenance. All other interfaces were up. B. unless GigabitEthernet1/0/1 on backup device has also failed. DSW2 became the active HSRP device for VLAN 101 as desired. decrease the priority value to a value that is less ‘ than the priority value configured in the VLAN 101 HSRP group on DSW2. In the VLAN 101 HSRP group on DSW1. you have been asked to investigate and respond to the following question. is a medium sized company. after GigabitEthemet1/0/1 on DSW1 was reactivated. D. Using the running configurations and show commands. C. Currently all interfaces are up. Decrease the decrement value in the track command for the VLAN 101 HSRP group on U DSWTs to a values less than the value in the track command for the VLAN 101 HSRP group on DSW2. with an enterprise network (access. Inc. DSW1 did not become the active router for VLAN 101 as desired.

E. Correct Answer: C . All other interfaces were up. The decrement value on DSW1 should be greater than 9 and less than 15.During routine maintenance. 0 B. The decrement value on DSW1 should be greater than 5 and less than 15. D. C. The decrement value on DSW1 should be greater than 11 and less than 19. During this time. it became necessary to shut down the GigabitEthernet1/0/1 interface on DSW1. What needs to be done to make the group function properly? A. The decrement value on DSWTs should be greater than 195 and less than 205. You have determined that there is an issue with the decrement value in the track command for the VLAN 102 HSRP group. The decrement value on DSWTs should be greater than 190 and less than 200. DSW1 remained the active device for the VLAN 102 HSRP group.

. unless GigabitEthernet1/0/1 on backup device has also failed. with an enterprise network (access. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. The left Vlan102 is console1 of DS1. Because 200 – 11 = 189 < 190 (priority of Vlan102 on DS2). The distribution switches are configured to use HSRP to provide a high availability solution. QUESTION 3 Ferris Plastics. Using the running configurations and show commands. Currently all interfaces are up. you have been asked to investigate and respond to the following question. Priority value is 200. Inc.Section: (none) Explanation Explanation/Reference: Explanation: Use “show run” command to show. is a medium sized company. we should decrement value in the track command from 11 to 18. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. Troubleshooting has identified several issues.

DSW2 has not become the active device for the VLAN 103 HSRP group. decrease the priority value to a value less than 190 and greater than 150. what can be done to make the group function properly? A. On DSW1. On DSW1.All interfaces are active. increase the priority value to a value greater 200 and less than 250. As related to the VLAN 103 HSRP group. On DSW2. Correct Answer: C Section: (none) Explanation . disable preempt. On DSW2. D. increase the decrement value in the track command to a value greater than 10 and less than 50. B. C.

with an enterprise network (access. . DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. DSW2 is configured to decrement the priority by 50 if this interface goes down. We need to increase the priority of DSW2 to greater than 200. The distribution switches are configured to use HSRP to provide a high availability solution. while the local priority is 190. but less than 250. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. so the correct answer is to increase the priority to more than 200. we see that the active router has a priority of 200. unless GigabitEthernet1/0/1 on backup device has also failed. QUESTION 4 Ferris Plastics. is a medium sized company.Explanation/Reference: Explanation: From the output shown below of the HSRP status of DSW2. but it should be less than 250 so that if the gig 1/0/1 interface goes down. Inc. DSW1 will become active.

B. Using the running configurations and show commands. . During this time. Currently all interfaces are up. During routine maintenance.Troubleshooting has identified several issues. increase the decrement value in the track command to a value greater than 6. decrease the decrement value in the track command to a value less than 1. On DSW2 decrease the priority value to a value less than 150. D. it became necessary to shut down the GigabitEthernet1/0/1 interface on DSW1 and DSW2. On DSW1. All other interfaces were up. what can to be done to make the group function properly? A. DSW1 became the active router for the VLAN 104HSRP group. disable preempt. On DSW1. you have been asked to investigate and respond to the following question. C. On DSW1. As related to the VLAN 104HSRP group.

you will make Vlan104’s HSRP group fail function. is a medium sized company. Vlan104 (left): 150 – 1 = 149. with an enterprise network (access. you have been asked to investigate and respond to the following question. Troubleshooting has identified several issues. unless GigabitEthernet1/0/1 on backup device has also failed. . Vlan104 (left): 150 – 6 = 144. Example: if we are disable preempt on DS1. Result is priority 149 > 145 (Vlan104 on DS1 is active). In this question. The distribution switches are configured to use HSRP to provide a high availability solution. By do that. G0/1/0 on DS1 & DS2 is shutdown. Inc.Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: We should NOT disable preempt on DS1. If increase the decrement in the track value to a value greater than 6 (> or = 6). Using the running configurations and show commands. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. Currently all interfaces are up. QUESTION 5 Ferris Plastics. Result is priority 144 < 145 (vlan104 on DS2 is active). Vlan104 (right): 200 – 155 = 145. DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105 DSW2 – primary device for VLAN 103 and VLAN 104 A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. It can not become active device when G1/0/1 on DS2 fail.

50 B.What is the priority value of the VLAN 105 HSRP group on DSW2? A. 100 C. 150 D. 200 Correct Answer: B Section: (none) Explanation .

is a medium sized company. DSW1 . .primary device for VLAN 103 and VLAN 104 A failure–of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary device. The distribution switches are configured to use HSRP to provide a high availability solution. Using the running configurations and show commands.primary device for VLAN 101 VLAN 102 and VLAN 105 D–W2 . QUESTION 6 Ferris Plastics. Very easy to se“ priority of Vlan1”5 is 100. you have been asked to investigate and respond to the following question. Inc. with an enterprise network (access.Explanation/Reference: Explanation: Use "show standby brief" command on console2. distribution and core switches) that provides LAN connectivity from user PCs to corporate servers. Troubleshooting has identified several issues. unless GigabitEthernet1/0/1 on backup device has also failed. Currently all interfaces are up.

what will be the resulting priority value of the VLAN 105 HSRP group on router DSW2? A. 150 D.If GigabitEthemet1/0/1 on DSW2 is shutdown. 200 Correct Answer: A Section: (none) Explanation . 100 C. 90 B.

and the tracking feature for Gig 1/0/0 is enabled which will decrement the priority by 10 if this interface goes down for a priority value of 90. .Explanation/Reference: Explanation As seen below. the current priority for VLAN 105 is 100.

105.Certprepare – DSW1 (Distribution Switch 1) is the primary device for VLAN 101. . 102.Simlet .HSRP Hotspot Certprepare QUESTION 1 HSRP Hotspot .

The DSW1’s decrement value should be configured with a value from 5 to 15. During this time. Question: During routine maintenance. F. The DSW1’s decrement value should be configured with a value from 195 to less than 205. unless GigabitEthernet 1/0/1 on backup device has also failed. B.– DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104. D. All other interface were up. The DSW1’s decrement value should be configured with a value from 11 to 18. Click on the PC Console1 and PC Console2 to access these switches then use the “show running-config” command on both switches DSW1>enable DSW1#show running-config DSW2>enable DSW2#show running-config . E. The DSW1’s decrement value should be configured with a value from 200 to less than 205. You have determined that there is an issue with the decrement value in the track command in VLAN 102’s HSRP group. it became necessary to shutdown G1/0/1 on DSW1. What need to be done to make the group function properly? A. Correct Answer: C Section: (none) Explanation Explanation/Reference: The question clearly stated that there was an issue with the decrement value in VLAN 102 so we should check VLAN 102 on both DSW1 and DSW2 switches first. The DSW1’s decrement value should be greater than 190 and less 200. – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. DSW1 remained the active device for VLAN 102’s HSRP group. C. The DSW1’s decrement value should be configured with a value from 9 to 15.

QUESTION 2 HSRP Hotspot . the DSW1’s priority is 200 and is higher than that of DSW2 so DSW1 becomes active switch for the group. in this case 5. Therefore C is the correct answer. But this value is still higher than that of DSW2 (190) so DSW1 remains the active switch for the group.As shown in the outputs. Therefore the priority of DSW1 goes down from 200 to 195.Certprepare . To make DSW2 takes over this role. Notice that the interface Gig1/0/1 on DSW1 is being tracked so when this interface goes down. HSRP automatically reduces the router’s priority by a configurable amount. we have to configure DSW1’s decrement value with a value equal or greater than 11 so that its result is smaller than that of DSW2 (200 – 11 < 190).

– DSW1 (Distribution Switch 1) is the primary device for VLAN 101. 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. . 102. unless GigabitEthernet 1/0/1 on backup device has also failed.

B. DSW2 became the active HSRP device for VLAN 101 as desired. However. Disable preempt on DSW1’s VLAN 101 HSRP group. All other interface were up. Enable preempt on DSW1’s VLAN 101 HSRP group.Question: During routine maintenance. Decrease the decrement in the track command for DSW1’s VLAN 101 HSRP group to a value less than the value in the track command for DSW2’s VLAN 101 HSRP group. G1/0/1 on DSW1 was shutdown. C. after G1/0/1 on DSW1 was reactivated. Decrease DSW1’s priority value for VLAN 101 HSRP group to a value that is less than priority value configured on DSW2’s HSRP group for VLAN 101. DSW1 did not become the active HSRP device as desired. D. What need to be done to make the group for VLAN 101 function properly? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: Continue to check VLAN 101 on both switches… .

So we need to enable this command on VLAN 101 of DSW1.Certprepare .We learned that DSW1 doesn’t have the “standby 1 preempt” command so it can’t take over the active role again even if its priority is the highest. QUESTION 3 HSRP Hotspot .

unless GigabitEthernet 1/0/1 on backup device has also failed.– DSW1 (Distribution Switch 1) is the primary device for VLAN 101. 102. . 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device.

D. As related to VLAN 103’s HSRP group. Correct Answer: C Section: (none) Explanation Explanation/Reference: . On DSW2. On DSW1. On DSW2. What can be done to make the group function properly? A.Question: DSW2 has not become the active device for VLAN 103’s HSRP group even though all interfaces are active. C. disable preempt. increase the decrement value in the track command to a value greater than 10 and less than 50. decrease the priority value to a value less than 190 and greater than 150. increase the priority value to a value greater 200 and less than 250. B. On DSW1.

The reason DSW2 has not become the active switch for Vlan103 is because the priority value of DSW1 is higher than that of DSW2. For example. In order to make DSW2 become the active switch. we choose to decrease the priority value on DSW1 to 160 (according to answer B) then DSW2 will become active switch (that is good). the priority of DSW1 will be 160 – 10 = 150 and it is still greater than 140 of DSW2 -> DSW2 cannot retake the active role as the requirement of this . too). the priority of DSW2 will be 190 – 50 = 140 < 160 -> DSW1 will become new active switch (it is good. But when Gi1/0/1 on DSW1 also goes down. But there is another requirement from this question that “A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. This requirement makes answer B incorrect. we need to increase DSW2’s priority (to higher than 200) or decrease DSW1’s priority (to lower than 190) -> B and C are correct. When Gi1/0/1 on DSW2 goes down. unless GigabitEthernet 1/0/1 on backup device has also failed”.

102.question.Certprepare – DSW1 (Distribution Switch 1) is the primary device for VLAN 101. 105 . QUESTION 4 HSRP Hotspot .

150 D. its priority will decrease 55 so. its value will be 150 – 55 = 95.– DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. QUESTION 5 . 95 B. 100 C. 200 Correct Answer: A Section: (none) Explanation Explanation/Reference: Below is the output of VLAN 105: If G1/0/1 on DSW1 is shutdown. what will be the current priority value of the VLAN 105’s group on DSW1? A. Question: If G1/0/1 on DSW1 is shutdown. unless GigabitEthernet 1/0/1 on backup device has also failed.

unless GigabitEthernet 1/0/1 on backup device has also failed.HSRP Hotspot . 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device. 102.Certprepare – DSW1 (Distribution Switch 1) is the primary device for VLAN 101. .

50 B. 150 D.Question: What is the configured priority value of the VLAN 105’s group on DSW2? A. QUESTION 6 HSRP Hotspot .Certprepare . 100 C. 200 Correct Answer: B Section: (none) Explanation Explanation/Reference: Below is the output of VLAN 105 of DSW2: We don’t see the priority of DSW2 so it is using the default value (100).

unless GigabitEthernet 1/0/1 on backup device has also failed.– DSW1 (Distribution Switch 1) is the primary device for VLAN 101. . 102. 105 – DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104 – A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device.

DSW1 became the active device for VLAN 104’s HSRP group. On DSW1. increase the decrement value in the track command to a value greater than 6. B. decrease the priority value to a value less than 150. On DSW1. what can be done to make the group function properly? A. On DSW2. disable preempt. On DSW1. disable track command. D.Question: During routine maintenance. Correct Answer: C Section: (none) Explanation Explanation/Reference: . it became necessary to shutdown G1/0/1 on DSW1 and DSW2. As related to VLAN 104’s HSRP group. All other interface were up. During this time. C.

From the outputs. the priority of DSW1 will be 150 – 1 = 149 and that of DSW2 will be 200 – 55 = 145 -> DSW1 will become the active switch. .The question asks us how to keep the active role of DSW2. we learned that if both interfaces G1/0/1 of DSW1 and DSW2 are shutdown.

or we have to configure the decrement value of DSW1 to a value greater than 6 ( 6 = 150 – 144) -> C is the correct answer.The main point here is that we have to configure so in such a way that when both interfaces G1/0/1 of DSW1 and DSW2 are shutdown. we can disable “preempt” on DSW1 (answer A) so that it will not take over the active role when DSW2 is downed but it also means that VLAN 104 will not have active switch -> VLAN 104 will fail. Notice: To keep the active role of DSW2. . Therefore the priority value of DSW1 should be smaller than 145. the priority of DSW2 is still greater than that of DSW1.

120. Packets from devices in the subnet of 172.40. You must use the available IOS switch features. Corporate polices do not allow Layer 3 functionality to be enabled on the switches.40.0/24. .120. VLAN 20 is a new VLAN that will be used to provide the shipping personnel access to the server. it is necessary to restrict access to VLAN 20 in the following manner: Users connecting to VLAN 20 via port f0/1 on ASW1 must be authenticated before they are given access to the network.Simulation Labs QUESTION 1 SIMULATION . You have been tasked with implementing the above access control as a pre- condition to installing the servers.46 RADIUS key: rad123 Authentication should be implemented as close to the host as possible. The RADIUS server and application servers will be installed at a future date. Filtering should be implemented as close to the serverfarm as possible. Authentication is to be done via a RADIUS server: RADIUS server host: 172.Named ACL) SWITCH.AAA dot1x (Mod 1 . For security reasons.0/24 should be allowed on VLAN 20. The topology diagram indicates their layer 2 mapping. Devices on VLAN 20 are restricted to the subnet of 172.40. DSW1 and ASW1.120.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches. Packets from devices in any other address range should be dropped on VLAN 20.

40.46 key rad123 ASW1(config)#aaa authentication dot1x default group radius ASW1(config)#dot1x system-auth-control .120.Correct Answer: Section: (none) Explanation Explanation/Reference: Console to ASW1 ASW1>enable ASW1#configure terminal ASW1(config)#aaa new-model ASW1(config)#radius-server host 172.

The topology diagram indicates their layer 2 mapping.120. VLAN 20 is a new VLAN that will be used to provide the shipping personnel access to the server.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches. it is necessary to restrict access to VLAN 20 in the following manner: . ASW1(config-if)#switchport access vlan 20 <<check if this is already pre-configured for you.AAA dot1x (Mod 2 .0. Corporate polices do not allow Layer 3 functionality to be enabled on the switches. DSW1 and ASW1. ASW1(config-if)#dot1x port-control auto ASW1(config-if)#exit ASW1#copy run start Console to DSW1 DSW1>enable DSW1#configure terminal DSW1(config)#ip access-list standard 10 DSW1(config-std-nacl)#permit 172. For security reasons.0 0.255 DSW1(config-std-nacl)#exit DSW1(config)#vlan access-map CCNP 10 DSW1(config-access-map)#match ip address 10 DSW1(config-access-map)#action forward DSW1(config-access-map)#exit DSW1(config)#vlan access-map CCNP 20 DSW1(config-access-map)#action drop DSW1(config-access-map)#exit DSW1(config)#vlan filter CCNP vlan-list 20 DSW1(config)#end DSW1#copy run start QUESTION 2 SIMULATION .40.Numbered ACL) SWITCH.0.ASW1(config)#exit ASW1(config)#interface fa0/1 ASW1(config-if)#switchport mode access <<check if this is already pre-configured for you.

40. NAMED ACL IS NOT ALLOWED TO BE USED. Devices on VLAN 20 are restricted to the subnet of 172. You have been tasked with implementing the above access control as a pre- condition to installing the servers. Filtering should be implemented as close to the serverfarm as possible.0/24. Authentication is to be done via a RADIUS server: RADIUS server host: 172.40. Packets from devices in any other address range should be dropped on VLAN 20.0/24 should be allowed on VLAN 20.120.46 RADIUS key: rad123 Authentication should be implemented as close to the host as possible.40. Packets from devices in the subnet of 172.120.120. . The RADIUS server and application servers will be installed at a future date. Users connecting to VLAN 20 via port f0/1 on ASW1 must be authenticated before they are given access to the network. You must use the available IOS switch features.

0.40.40.0.120.255 DSW1(config)#vlan access-map CCNP 10 DSW1(config-access-map)#match ip address 10 DSW1(config-access-map)#action forward DSW1(config-access-map)#exit DSW1(config)#vlan access-map CCNP 20 DSW1(config-access-map)#action drop DSW1(config-access-map)#exit .Correct Answer: Section: (none) Explanation Explanation/Reference: Console to ASW1 ASW1>enable ASW1#configure terminal ASW1(config)#aaa new-model ASW1(config)#radius-server host 172.120.46 key rad123 ASW1(config)#aaa authentication dot1x default group radius ASW1(config)#dot1x system-auth-control ASW1(config)#exit ASW1(config)#interface fa0/1 ASW1(config-if)#switchport mode access <<check if this is already pre-configured for you.0 0. ASW1(config-if)#switchport access vlan 20 <<check if this is already pre-configured for you. ASW1(config-if)#dot1x port-control auto ASW1(config-if)#exit ASW1#copy run start Console to DSW1 DSW1>enable DSW1#configure terminal DSW1(config)#access-list 10 permit 172.

with SwitchA controlling activation. RouterA is currently configured correctly and is providing the routing function for devices on SwitchA and SwitchB. You have been tasked with competing the needed configuring of SwitchA and SwitchB. SwitchA is currently configured correctly. This mode should be done with a non-proprietary protocol. 21. They have just added a new switch (SwitchB) to the existing network as shown in the topology diagram. Configuration Requirements for SwitchB • Vlan 21 Name: Marketing will support two servers attached to fa0/9 and fa0/10 • Vlan 22 Name: Sales will support two servers attached to fa0/13 and fa0/14 • Vlan 23 o Name: Engineering will support two servers attached to fa0/15 and fa0/16 • Access ports that connect to server should transition immediately to forwarding state upon detecting the connection of a device. .DSW1(config)#vlan filter CCNP vlan-list 20 DSW1(config)#end DSW1#copy run start QUESTION 3 SIMULATION . SwitchA and SwitchB use Cisco as the enable password.com. 12.LACP with STP (Modification 1) (FROM CERTPREPARE) You work for SWITCH. 21. • Propagation of unnecessary broadcasts should be limited using manual pruning on this trunk link. • The two trunks between SwitchA and SwitchB need to be configured in a mode that allows for the maximum use of their bandwidth for all vlans. 13. but will need to be modified to support the addition of SwitchB.168. • SwitchB must operate in the same spanning tree mode as SwitchA • No routing is to be configured on SwitchB • Only the SVI vlan 1 is to be configured and it is to use address 192.1. SwitchB has a minimal configuration. • SwitchA needs to be the root switch for vlans 11. 22 and 23. • SwitchB VTP mode needs to be the same as SwitchA. 22 and 23 should tagged when traversing the trunk link. Configuration Requirements for SwitchA The VTP and STP configuration modes on SwitchA should not be modified. All other vlans should be left are their default values.11/24 Inter-switch Connectivity Configuration Requirements • For operational and security reasons trunking should be unconditional and Vlans 1.

Correct Answer: Section: (none) Explanation Explanation/Reference: Switch A SWA(config)#vlan 21 SWA(config-vlan)#name Marketing SWA(config)#vlan 22 SWA(config-vlan)#name Sales .

SWA(config)#vlan 23 SWA(config-vlan)#name Engineering SWA(config-vlan)#exit SWA(config)#spanning-tree vlan 11-13.21-23 root primary SWA(config)#interface range fa0/3 – 4 SWA(config-if)#shutdown SWA(config-if)#no switchport mode access SWA(config-if)#no switchport access vlan 98 SWA(config-if)#channel-group 1 mode active SWA(config-if)#channel-protocol lacp SWA(config-if)#exit SWA(config)#interface port-channel 1 SWA(config-if)#switchport mode trunk SWA(config-if)#switchport trunk native vlan 99 SWA(config-if)#switchport trunk allowed vlan 1.12 & 13 should match with SwitchA. SWB(config)#vlan 11 SWB(config-vlan)#name ADM SWB(config)#vlan 12 SWB(config-vlan)#name BDM SWB(config)#vlan 13 SWB(config-vlan)#name CDM SWB(config)#vlan 21 SWB(config-vlan)#name Marketing SWB(config)#vlan 22 SWB(config-vlan)#name Sales SWB(config)#vlan 23 SWB(config-vlan)#name Engineering SWB(config)#vlan 98 SWB(config-vlan)#name Parking SWB(config)#vlan 99 SWB(config-vlan)#name TrunkNative SWB(config-vlan)#exit .21-23 SWA(config-if)#no shutdown Switch B ***VLAN 11.

168.21-23 SWB(config-if)#no shutdown .255.11 255.SWB(config)#interface range fa0/9 – 10 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 21 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/13 – 14 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 22 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/15 – 16 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 23 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#vtp mode transparent SWB(config)#spanning-tree mode rapid-pvst SWB(config)#interface vlan 1 SWB(config-if)#ip address 192.1.255.0 SWB(config-if)#no shut SWB(config)#ip default-gateway 192.1 SWB(config)#interface range fa0/3 – 4 SWB(config-if)#shutdown SWB(config-if)#channel-group 1 mode passive SWB(config-if)#channel-protocol lacp SWB(config-if)#exit SWB(config)#interface port-channel 1 SWB(config-if)#switchport trunk encapsulation dot1q SWB(config-if)#switchport mode trunk SWB(config-if)#switchport trunk native vlan 99 SWB(config-if)#switchport trunk allowed vlan 1.168.1.

168. You have been tasked with competing the needed configuring of SwitchA and SwitchB. SwitchA and SwitchB use Cisco as the enable password.com.1. If ping is successful. 12. but will need to be modified to support the addition of SwitchB. fa0/3. #show etherchannel summary *** Run on both SWA and SWB Port channel should be up. All other vlans should be left are their default values.LACP with STP (Modification 2) (ETHERCHANNEL MUST BE CONFIGURED ONLY ON THE PHYSICAL INTERFACES) You work for SWITCH. QUESTION 4 SIMULATION . SwitchB has a minimal configuration. They have just added a new switch (SwitchB) to the existing network as shown in the topology diagram.1. 22 and 23. Configuration Requirements for SwitchA The VTP and STP configuration modes on SwitchA should not be modified. • SwitchA needs to be the root switch for vlans 11. SwitchA is currently configured correctly. #ping the router IP from SWB by typing in ping 192. RouterA is currently configured correctly and is providing the routing function for devices on SwitchA and SwitchB. 21. 13.***** Switch A ***** SWA(config)#interface range fa0/3 – 4 SWA(config-if)#no shutdown SWA(config-if)#exit ***** Switch B ***** SWB(config)#interface range fa0/3 – 4 SWB(config-if)#no shutdown SWB(config-if)#exit #show ip interface brief *** Run on both SWA and SWB to see port channel. Configuration Requirements for SwitchB • Vlan 21 Name: Marketing will support two servers attached to fa0/9 and fa0/10 • Vlan 22 Name: Sales will support two servers attached to fa0/13 and fa0/14 • Vlan 23 o Name: Engineering . copy run start on both SWA and SWB. fa0/4 and VLAN 1 should be up/up.

This mode should be done with a non-proprietary protocol. with SwitchA controlling activation. • SwitchB must operate in the same spanning tree mode as SwitchA • No routing is to be configured on SwitchB • Only the SVI vlan 1 is to be configured and it is to use address 192.11/24 Inter-switch Connectivity Configuration Requirements • For operational and security reasons trunking should be unconditional and Vlans 1. • Propagation of unnecessary broadcasts should be limited using manual pruning on this trunk link.1. 21.will support two servers attached to fa0/15 and fa0/16 • Access ports that connect to server should transition immediately to forwarding state upon detecting the connection of a device. • SwitchB VTP mode needs to be the same as SwitchA. . • The two trunks between SwitchA and SwitchB need to be configured in a mode that allows for the maximum use of their bandwidth for all vlans.168. 22 and 23 should tagged when traversing the trunk link.

Correct Answer: Section: (none) Explanation Explanation/Reference: Switch A SWA(config)#vlan 21 SWA(config-vlan)#name Marketing SWA(config)#vlan 22 SWA(config-vlan)#name Sales SWA(config)#vlan 23 .

SWB(config)#vlan 11 SWB(config-vlan)#name ADM SWB(config)#vlan 12 SWB(config-vlan)#name BDM SWB(config)#vlan 13 SWB(config-vlan)#name CDM SWB(config)#vlan 21 SWB(config-vlan)#name Marketing SWB(config)#vlan 22 SWB(config-vlan)#name Sales SWB(config)#vlan 23 SWB(config-vlan)#name Engineering SWB(config)#vlan 98 SWB(config-vlan)#name Parking SWB(config)#vlan 99 SWB(config-vlan)#name TrunkNative SWB(config-vlan)#exit SWB(config)#interface range fa0/9 – 10 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 21 .12 & 13 should match with SwitchA.SWA(config-vlan)#name Engineering SWA(config-vlan)#exit SWA(config)#spanning-tree vlan 11-13.21-23 root primary SWA(config)#interface range fa0/3 – 4 SWA(config-if)#shutdown SWA(config-if)#no switchport mode access SWA(config-if)#no switchport access vlan 98 SWA(config-if)#switchport trunk native vlan 99 SWA(config-if)#switchport trunk allowed vlan 1.21-23 SWA(config-if)#switchport mode trunk SWA(config-if)#channel-group 1 mode active SWA(config-if)#channel-protocol lacp SWA(config-if)#exit Switch B ***VLAN 11.

21-23 SWB(config-if)#switchport mode trunk SWB(config-if)#channel-group 1 mode passive SWB(config-if)#channel-protocol lacp SWB(config-if)#exit ***** Switch A ***** SWA(config)#interface range fa0/3 – 4 SWA(config-if)#no shutdown SWA(config-if)#exit ***** Switch B ***** .255.1.11 255.0 SWB(config-if)#no shut SWB(config)#ip default-gateway 192.168.1 SWB(config)#interface range fa0/3 – 4 SWB(config-if)#shutdown SWB(config-if)#switchport trunk encapsulation dot1q SWB(config-if)#switchport trunk native vlan 99 SWB(config-if)#switchport trunk allowed vlan 1.SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/13 – 14 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 22 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#interface range fa0/15 – 16 SWB(config-if)#switchport mode access SWB(config-if)#switchport access vlan 23 SWB(config-if)#spanning-tree portfast SWB(config-if)#no shut SWB(config)#vtp mode transparent SWB(config)#spanning-tree mode rapid-pvst SWB(config)#interface vlan 1 SWB(config-if)#ip address 192.168.1.255.

250. All routes must be learned via the EIGRP routing protocol. #show etherchannel summary *** Run on both SWA and SWB Port channel should be up.0/24 – 190. All routes must be learned via EIGRP 65010 routing protocol. QUESTION 5 SIMULATION . Note: Due to administrative restrictions and requirements you should not add or delete VLANs.1.10. You do not have access to RouteC. since it was required to apply commands only on physical interface.10.200. copy run start on both SWA and SWB. fa0/3.32/27 – 190.168. RouterC is correctly configured.250. Due to administrative restrictions and requirements you should not add/delete vlans or create trunk links. You need to configure SwitchC so that Hosts H1 and H2 can successfully ping the server S1. #show ip interface brief *** Run on both SWA and SWB to see port channel. If ping is successful. SwitchC uses Cisco as the enable password. The following subnets are available to implement this solution: – 10.MLS EIGRP You have been tasked with configuring multilayer SwitchC. changes VLAN port assignments or create trunks. fa0/4 & VLAN 1 should be up/up. No trunking has been configured on RouterC. #ping the router IP from SWB by typing in ping 192.1. Routing must only be enabled for the specific subnets shown in the diagram. Company policies forbid the use of static or default routing.64/27 Hosts H1 and H2 are configured with the correct IP address and default gateway.SWB(config)#interface range fa0/3 – 4 SWB(config-if)#no shutdown SWB(config-if)#exit Note: No need to apply commands on Port Channel (interface port-channel 1). Routed interfaces should use the lowest host on a subnet when possible. which has a partial configuration and has been attached to RouterC as shown in the topology diagram. Also SwitchC needs to be able to ping server S1. Company policies forbid the use of static or default routing.200. .

We should check the default gateways on H1 & H2. C:\>ipconfig We will get the default gateways as follows: Host1: . No trunking requires. + Only use SwitchC for interVLAN routing without using RouterC. Trunking must be established between RouterC and SwitchC.Correct Answer: Section: (none) Explanation Explanation/Reference: + Use RouterC as a “router on a stick” and SwitchC as a pure Layer2 switch. Click on H1 and H2 and type the “ipconfig” command to get their default gateways. SwitchC should be configured as a Layer 3 switch (which supports ip routing function as a router). The question clearly states “No trunking has been configured on RouterC” so RouterC does not contribute to interVLAN routing of hosts H1 & H2 -> SwitchC must be configured as a Layer 3 switch with SVIs for interVLAN routing.

31 NOTE: THE ROUTER IS CORRECTLY CONFIGURED. Also some reports said the “no auto-summary” command can’t be used in the simulator.64 0. also don’t modify/delete any port just do the above configuration.200.200. the simulator does not let you assign IP address on Gi0/1 interface.200. gi0/11 interfaces were configured as access ports so we don’t need to configure them in this sim.0. Also make sure you use the correct EIGRP AS number (in the configuration above it is 650 but it will change when you take the exam) but we are not allowed to access RouterC so the only way to find out the EIGRP AS is to look at the exhibit above.250. and from the PCs as well.250. SwitchC(config-if)# ip address 10.10.255.250.200.200.224 SwitchC(config-if)# no shutdown SwitchC(config-if)#exit SwitchC(config)# ip routing (Notice: MLS will not work without this command) SwitchC(config)# router eigrp 65010 SwitchC(config-router)# network 10.255.255 SwitchC(config-router)# network 190.0/16 is not used anywhere else in this topology. no neighbor relationship is formed between RouterC and SwitchC.250. SwitchC(config-if)# no shutdown SwitchC(config-if)# exit SwitchC(config)# int vlan 2 SwitchC(config-if)# ip address 190.10.0.255.255.10.32 0. .1 so this is the lowest usable IP address.65 255.250.224 SwitchC(config-if)# no shutdown SwitchC(config-if)# int vlan 3 SwitchC(config-if)# ip address 190.0.33 255.10.0.255.31 SwitchC(config-router)# network 190.255.33 Host2: + Default gateway: 190.+ Default gateway: 190. SwitchC# configure terminal SwitchC(config)# int gi0/1 SwitchC(config-if)#no switchport -> without using this command. you should expect the ping to SERVER to succeed from the MLS.10.200.0 ->RouterC has used IP 10.65 Now we have enough information to configure SwitchC (notice the EIGRP AS in this case is 650) Note: VLAN2 and VLAN3 were created and gi0/10.0 0.0.2 255. so you will not miss within it in the exam.0.10.0.250. in fact it is not necessary because the network 190. In order to complete the lab.200. If you use wrong AS number.

Requirements: You will configure FastEthernet ports 0/12 through 0/24 for users who belong to VLAN 20.0. To prevent network corruption.200.0. It will be necessary to ensure that the switch does not participate in VTP but forwards VTP advertisements that are received on trunk ports. You are required to accomplish the following tasks: 1.32 0.0. But after finishing the configuration. Ensure all non-trunking interfaces (Fa0/1 to Fa0/24) transition immediately to the forwarding state of Spanning-Tree. 4.64 0.Old CCNP SWITCH Labs The headquarter office for a cement manufacturer is installing a temporary Catalyst 3550 in an IDF to connect 24 additional users.250. 3.0″ because it is the nature of distance vector routing protocol like EIGRP: only major networks need to be advertised.200. QUESTION 6 SIMULATION .0 is shown. Because of errors that have been experienced on office computers. Also configure the user ports (all FastEthernet ports) so that the ports are permanently non-trunking. Ensure the switch does not participate in VTP but forwards VTP advertisements received on trunk ports. Correct Answer: Section: (none) Explanation Explanation/Reference: Console into the Switch . we can use “show run” command to verify. we are pretty sure instead of using two commands “network 190. 2.31″ we can use one simple command “network 190. Place FastEthernet interfaces 0/12 through 0/24 in VLAN 20.Spanning-Tree Lab Sim (Certprepare) . only the summarized network 190.250. even without “no auto-summary” command the network still works correctly. just for sure. it is important to have the correct configuration prior to connecting to the production network.31″ and “network 190.0.0.200. all non-trunking interfaces should transition immediately to the forwarding state of Spanning tree. Ensure all FastEthernet interfaces are in a permanent non-trunking mode. But in the exam the sim is just a flash based simulator so we should use two above commands.200.In fact. Also all VLAN and VTP configurations are to be completed in global configuration mode as VLAN database mode is being deprecated by Cisco.0.

com/spanning-tree-lab-sim QUESTION 7 SIMULATION . switch doesn’t participate in the VTP domain. it is necessary to configure interVLAN routing on the distribution layer switch to route traffic between the different VLANs that are configured on the access-layer switches. all VLAN and VTP configurations are to be completed in the global configuration mode. because VLAN database mode is being deprecated by Cisco. By default. all ports on the switch are in VLAN 1. Switch(config-if-range)#spanning-tree portfast <<Enables the PortFast on interface. To change the VLAN associated with a port. The new distribution-layer switch has been installed and a new access-layer switch cabled to it. In this mode. Your task is to configure VTP to share VLAN information from the distribution-layer switch to the access-layer devices. Please reference the following table for the VTP and VLAN information to be configured: .Old CCNP SWITCH Labs The headquarter offices for a book retailer are enhancing their wiring closets with Layer3 switches. Also.VTP Lab 1 Sim (Certprepare) . you need to go to each interface (or a range of interfaces) and tell it which VLAN to be a part of. we need to assign FastEthernet ports 0/12 through 0/24 to VLAN 20. Then. Switch(config-if-range)#interface range fa0/12 – 24 Switch(config-if-range)#switchport access vlan 20 <<Make these ports members of vlan 20 Switch(config-if-range)#exit Next we need to make this switch in transparent mode. but it still forwards VTP advertisements through any configured trunk links.certprepare. Switch(config)#vtp mode transparent Switch(config)#exit Switch#copy running-config startup-config Source: http://www. Switch>enable Switch#configure terminal Switch(config)#interface range fa0/1 – 24 Switch(config-if-range)#switchport mode access <<Make all FastEthernet interfaces into access mode. however. it is not necessary for you to make the specific VLAN port assignments on the access-layer switches. Next.

To configure the switch. Configure the VTP information with the access layer switch as a VTP client. 6. All VLANs and VTP configurations are to completed in the global configuration.Requirements: These are your specific tasks: 1. 4. click on the host icon that is connected to the switch be way of a serial console cable. Configure the VTP information with the distribution layer switch as the VTP server. Correct Answer: . Specific VLAN port assignments will be made as users are added to the access layer switches in the future. 5. 3. Configure inter-VLAN routing on the distribution layer switch. 2. Configure VLANs on the distribution layer switch.

(Console into DLSwitch) To create VLANs on a switch. not CISCO because it is case sensitive.16. (Console into DLSwitch) .132.0 DLSwitch(if-config)#no shutdown DLSwitch(if-config)#exit 4) Configure inter-VLAN routing on the distribution layer switch.255.1 255.Section: (none) Explanation Explanation/Reference: 1) Configure the VTP information with the distribution layer switch as the VTP server.255.255. (Console into ALSwitch) ALSwitch#configure terminal ALSwitch(config)#vtp mode client ALSwitch(config)#vtp domain cisco ALSwitch(config)#exit ALSwitch#copy running-config startup-config 3) Configure VLANs on the distribution layer switch. use the vlan vlanID# command: DLSwitch(config)#vlan 20 DLSwitch(config)#vlan 21 Configure IP addresses for VLANs: DLSwitch(config)#interface vlan 20 DLSwitch(config-if)#ip address 172.255.71. 2) Configure the VTP information with the access layer switch as a VTP client.1 255.0 DLSwitch(config-if)#no shutdown DLSwitch(config-if)#exit DLSwitch(if-config)#interface vlan 21 DLSwitch(if-config)#ip address 172.16. (Console into DLSwitch) DLSwitch#configure terminal DLSwitch(config)#vtp mode server DLSwitch(config)#vtp domain cisco <<use cisco.

Only limited show command access is provided on CORE. DSW1.Old CCNP SWITCH Labs Acme is a small export company that has an existing enterprise network comprised of 5 switches. . . However. ASW1 and ASW2. No access is provided to ASW1 or ASW2.VTP Lab 2 Sim (Certprepare) . – Traffic for VLAN 30 should be forwarding over the gig 1/0/6 trunk port between DSW1 and DSW2. VLAN 40 is currently using gig 1/0/6. You have been tasked with isolating the cause of these issuer and implementing the appropriate solutions. however. Previous configuration attempts have resulted in the following issues: – CORE should be the root bridge for VLAN 20. DSW2. You task is complicated by the fact that you only have full access to DSW1.certprepare.CORE. and DSW2 using the enable 2 level with a password of acme. Your task is complicated by the fact that you only have full access to DSW1. VLAN 30 is currently using gig 1/0/5. with the enable secret password cisco. – Traffic for VLAN 40 should be forwarding over the gig 1/0/5 trunk port between DSW1 and DSW2. No configuration changes will be possible on these routers.com/vtp-lab QUESTION 8 SIMULATION . with isolating the cause of these issues and implementing the appropriate solutions. DSW1 is currently the root bridge for VLAN 20. The topology diagram indicates their desired pre-VLAN spanning tree mapping. DLSwitch(config)#ip routing DLSwitch(config)#exit DLSwitch#copy running-config startup-config Source: http://www. However.

DSW1 is currently the root bridge for VLAN 20. however.Correct Answer: Section: (none) Explanation Explanation/Reference: Console into DSW1 1) CORE should be the root bridge for VLAN 20. We need to make CORE switch the root bridge for VLAN 20. DSW1>enable DSW1#show spanning-tree <<check status "This bridge is the root" via Root ID DSW1#configure terminal DSW(config)#spanning-tree vlan 20 priority 61440 .

Your task is to configure VTP to share VLAN information from the distribution-layer switch to the access-layer devices. because VLAN database mode is being depricated by Cisco. The new distribution-layer switch has been installed and a new access-layer switch cabled to it. VLAN 40 is currently using gig 1/0/6. DSW1(config)#interface g1/0/6 DSW1(config-if)#spanning-tree vlan 30 port-priority 64 DSW1(config-if)#exit 3) Traffic for VLAN 40 should be forwarding over the gig 1/0/5 trunk port between DSW1 and DSW2. However VLAN 30 is currently using gig 1/0/5. DSW1(config)#interface g1/0/5 DSW1(config-if)#spanning-tree vlan 40 cost 1 DSW1(config-if)#end You should re-check to see if everything was configured correctly: DSW1#show spanning-tree Save the configuration: DSW1#copy running-config startup-config Source: http://www.certprepare. all VLAN and VTP configurations are to be completed in the global configuration mode. Also. it is neccessary to configure interVLAN routing on the distribution-layer switch to route traffic between the different VLANs that are configured on the access-layer switches.com/vtp-lab-2 QUESTION 9 SIMULATION . however. However. it is not neccessary for you to make the specific VLAN port assignments on the access-layer switches.VTP Lab: Central Offices (Footwear Distributor) The central offices for a footwear distributor are enhancing their wiring closets with Layer 3 switches.2) Traffic for VLAN 30 should be forwarding over the gig 1/0/6 trunk port between DSW1 and DSW2. Please reference the following table for the VTP and VLAN information to be configured: . Then.

Correct Answer: Section: (none) Explanation Explanation/Reference: VTP Server Configuration switch#configure terminal switch(config)#vtp mode server .1/24 172. Configure inter-VLAN routing in the distribution layer switch 5.16.1/24 These are your specifc tasks: 1.VTP Domain Name: cisco VLAN IDs: 20.16.71. Configure VLANs in the distribution layer switch 4.132. All VLANs and VTP configurations are to be completed in the global configuration To configure the switch. click on the host icon that is connected to the switch using a serial console cable. 6. Configure the VTP information with the access layer switch as a VTP client 3. Configure the VTP information with the distribution layer switch as the VTP server 2. Specifc VLAN port assignments will be made as users are added to the access layer switches in the future.31 IP Addresses 172.

1 255.255.255. it is neccessary to configure interVLAN routing on the distribution-layer switch to route traffic between the different VLANs that are configured on the .64. The new distribution-layer switch has been installed and a new access-layer switch cabled to it.255.0 switch(config-if)#no shutdown switch(config-if)#exit switch(config)#ip routing switch(config)#end switch#copy run start VTP Client Configuration switch#configure terminal switch(config)#vtp mode client switch(config)#vtp domain CISCO switch#copy run start QUESTION 10 SIMULATION . Then. Your task is to configure VTP to share VLAN information from the distribution-layer switch to the access-layer devices.20.0 switch(config-if)#no shutdown switch(config-if)#interface vlan 31 switch(config-if)#ip address 192.1 255. switch(config)#vtp domain CISCO switch(config)#vlan 20 switch(config)#vlan 31 switch(config)#interface vlan 20 switch(config-if)#ip address 172.255.162.31.VTP Lab: Headquarter Offices (Book Retailer) The headquarter offices for a book retailer are enhancing their wiring closets with Layer 3 switches.

Configure VLANs in the distribution layer switch 4. 6. Configure inter-VLAN routing in the distribution layer switch 5.16.1/24 172. Configure the VTP information with the access layer switch as a VTP client 3. Configure the VTP information with the access layer switch TestKing2 as a VTP client .1/24 These are your specifc tasks: 1. click on the host icon that is connected to the switch using a serial console cable. Configure the VTP information with the distribution layer switch TestKing1 as the VTP server 2.132. however. Correct Answer: Section: (none) Explanation Explanation/Reference: These are yiur specifc tasks: 1. it is not neccessary for you to make the specific VLAN port assignments on the access-layer switches. all VLAN and VTP configurations are to be completed in the global configuration mode. Specifc VLAN port assignments will be made as users are added to the access layer switches in the future.31 IP Addresses 172.access-layer switches. because VLAN database mode is being depricated by Cisco.71. Please reference the following table for the VTP and VLAN information to be configured: VTP Domain Name: cisco VLAN IDs: 20. Also. All VLANs and VTP configurations are to be completed in the global configuration To configure the switch.16. Configure the VTP information with the distribution layer switch as the VTP server 2.

255.31.255. Specifc VLAN port assigoments will be made as users are added to the access layer switches in the future. 6. click on the host icon that is connected to the switch using a serial console cable.0 switch(config-if)#no shutdown switch(config-if)#exit switch(config)#ip routing switch(config)#end switch#copy run start VTP Client Configuration switch#configure terminal switch(config)#vtp mode client switch(config)#vtp domain CISCO switch#copy run start .64.0 switch(config-if)#no shutdown switch(config-if)#interface vlan 31 switch(config-if)#ip address 192.1 255.1 255.162.255.3.255. VTP Server Configuration switch#configure terminal switch(config)#vtp mode server switch(config)#vtp domain CISCO switch(config)#vlan 20 switch(config)#vlan 31 switch(config)#interface vlan 20 switch(config-if)#ip address 172. Configure VLANs on the distribution layer switch TestKing 4. Configure inter-VLAN routing on the distribution layer switch TestKing1 5. All VLANs and VTP configurations are to be completed in the global configuration To configure the switch.20.

CDP / LLDP (Official) Drag and drop the characteristic from the left to the matching Layer 2 protocol on the right.Official QUESTION 1 Drag and Drop . Select and Place: Correct Answer: .Drag and Drop .

Select and Place: .Section: (none) Explanation Explanation/Reference: QUESTION 2 Drag and Drop .PortFast / BPDU Guard / BPDU Filter (Official) Drag and drop the characteristic from the left to the matching STP feature on the right.

Correct Answer: .

Section: (none) Explanation .

Select and Place: .Explanation/Reference: QUESTION 3 Drag and Drop .PVST+ / Rapid PVST+ / MSTP (Official) Drag and drop the characteristic from the left to the matching STP mode on the right.

Correct Answer: .

Section: (none) Explanation Explanation/Reference: QUESTION 4 Drag and Drop .STP Components (Official) .

Select and Place: .Drop the STP components from the left onto the correct descriptions on the right.

Correct Answer: Section: (none) Explanation .

Select and Place: .LLDP-MED TLVs (Official) Drag and drop the LLDP-MED TLVs from the left onto the correct statements on the right.Explanation/Reference: QUESTION 5 Drag and Drop .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

Select and Place: .QUESTION 6 Drag and Drop .STP Characteristics (Official) Drag and drop the characteristic from the left to the matching STP category on the right.

Correct Answer: Section: (none) Explanation Explanation/Reference: STP: Switch Priority .

Default value is based on interface speed.value range from 1 .SPAN Source and Destination Ports (Official) Drag and drop the statements about SPAN source and destination ports from the left onto the correct port types on the right.200000000 QUESTION 7 Drag and Drop ..increments of 16 STP: Path Cost .The lowest value is preferred. Select and Place: . STP: Port Priority .default value of 128 .increment of 4096 . .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

HSRP Correct Statements (Official) Drag and drop the correct statements about HSRP from the left into the True column on the right.Its original configuration is overwritten by the SPAN configuration QUESTION 8 Drag and Drop .It can be monitored as a bundled logical port or as individual physical ports .It acts as the monitoring port . Not all options are used.It can be trunk or an access port . Select and Place: .Source Port .It is not supported as part of a VLAN .Multiple VLANs can be included in a single session Destination Port .

Correct Answer: .

.Section: (none) Explanation Explanation/Reference: True .HSRPv1 and HSRPv2 use different multicast addresses for hello packets.

It can share a virtual MAC or IP address among a group of routers. QUESTION 9 Drag and Drop .It supports authentication.. .It is a Cisco-proprietary implementation of FHRP. Select and Place: .VRRP Version 2 and VRRP Version 3 / VRRP Version 3 (Official) Drag and drop the description of VRRP from the left onto the correct versions of VRRP on the right. .

STP Timers .Correct Answer: Section: (none) Explanation Explanation/Reference: QUESTION 10 Drag and Drop .

Select and Place: Correct Answer: .

Section: (none) Explanation .

Guard Root / Guard Loop Select and Place: Correct Answer: .Explanation/Reference: QUESTION 11 Drag and Drop .

Switch Stack Process Select and Place: .Section: (none) Explanation Explanation/Reference: QUESTION 12 Drag and Drop .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

LACP vs PAGP Select and Place: Correct Answer: .QUESTION 13 Drag and Drop .

VSS vs STACK Select and Place: .Section: (none) Explanation Explanation/Reference: QUESTION 14 Drag and Drop .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

QUESTION 15 Drag and Drop .RSPAN True and False (5th March 2018) Select and Place: Correct Answer: .

Section: (none) Explanation Explanation/Reference: True .Supports only VTP .Supports only STP .MAC address learning is disabled .

Uses VLAN ID 2-1024 .False .Uses VLAN ID 2-1001 .

LLDP-TLV (Concepts Only) LLDP-MED Capabilities TLV Network Policy TLV Select and Place: .Concepts QUESTION 1 Drag and Drop .Drag and Drop .

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 2 Drag and Drop .LLDP-TLV (Concepts Only) Power Management TLV Inventory Management TLV Location TLV Select and Place: .

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 3 Drag and Drop .STP Timer Delay (Concepts Only) Diameter of the STP Domain (dia) Bridge Transit Delay (transit delay) BPDU Transmission Delay (bpdu_delay) Select and Place: .

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 4 Drag and Drop .STP Timer Delay (Concepts Only) Message Age Increment Overestimate (msg_overestimate) Lost Message (lost_msg) Transmit Halt Delay (Tx_halt_delay) Select and Place: .

Correct Answer: .

Section: (none) Explanation .

Explanation/Reference: QUESTION 5 Drag and Drop .STP Timer Delay (Concepts Only) Medium Access Delay (med_access_delay) End-to-end BPDU Propagation Delay Maximum Transmission Halt Delay Select and Place: .

.

Correct Answer: .

.

CONCEPT ONLY (UNOFFICIAL) Select and Place: .Section: (none) Explanation Explanation/Reference: QUESTION 6 Drag and Drop .RSPAN Steps (Concept 1) .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

QUESTION 7 Drag and Drop .CONCEPT ONLY (UNOFFICIAL) Select and Place: .RSPAN Steps (Concept 2) .

Correct Answer: .

Section: (none) Explanation Explanation/Reference: .

– Step 2: Associate an RSPAN source session number with source ports or VLANs.VRRPv2 vs VRRPv3 (Concept 1) . – Step 3: Associate an RSPAN destination session number with the RSPAN VLAN. – Step 4: Associate an RSPAN source session number with the RSPAN VLAN. – Step 5: Associate an RSPAN destination session number with the destination port.CONCEPT ONLY (UNOFFICIAL) Select and Place: . https://www.– Step 1: Configure a VLAN as an RSPAN VLAN.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/swspan.pdf QUESTION 8 Drag and Drop .cisco.

.

Correct Answer: .

.

Section: (none) Explanation Explanation/Reference: QUESTION 9 Drag and Drop .HSRPv1 vs HSRPv2 (Concept 1) .CONCEPT ONLY (UNOFFICIAL) Select and Place: .

.

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 10
Drag and Drop - RSPAN (True & False) - CONCEPT ONLY

Select and Place:

Correct Answer:

Section: (none)

Explanation

Explanation/Reference:

QUESTION 11
Drag and Drop - Stack Master Election Process (CONCEPT ONLY)

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Stack Master Election

1. The switch that is currently the stack master.
2. The switch with the highest stack member priority value.
3. The switch that uses the non-default interface-level configuration.
4. The switch with the higher Hardware/Software priority.
5. The switch with the longest system up-time.
6. The switch with the lowest MAC address.

Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-switch-stks.html#anc10

QUESTION 12
Drag and Drop - DHCP Snooping Process (Concept 1) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Correct Answer:

Enable Dynamic ARP Inspection (DAI) Step 4 .Section: (none) Explanation Explanation/Reference: Step 1 .Enable DHCP snooping globally Step 2 .Enable DHCP snooping on selected VLANs Step 3 .Enable ARP inspection on selected VLANs QUESTION 13 .

RADIUS vs TACACS+ (Concept 1) .Drag and Drop .CONCEPT ONLY (UNOFFICIAL) Select and Place: .

.

Correct Answer: .

.

Encrypts the entire body of the packet .Encrypts only the password in access-request packet from client to server .com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.RADIUS vs TACACS+ (Concept 2) .Section: (none) Explanation Explanation/Reference: RADIUS .Is a client-server model .Uses UDP port 1812 TACACS+ .Uses TCP port 49 Reference: https://www.html QUESTION 14 Drag and Drop .CONCEPT ONLY (UNOFFICIAL) Select and Place: .cisco.Separates AAA and performs three-way challenge .Does offer Multiprotocol support .Does not offer Multiprotocol support .Cisco proprietary .Combines authentication and authorization .

Correct Answer: .

Section: (none) .

Authenticated through the use of a shared secret . UNIX login and other authentication mechanisms TACACS+ .Does not allow users to control which commands can be executed on a router . PAP.Port Priorities (CONCEPT ONLY) Port Cost / Switch Port Priority / Port Priority Select and Place: .Provides two methods to control authorization of router commands on a per-user or per-group basis Reference: https://www.Allow router verify whether if the user is authorized at specified privilege level .Explanation Explanation/Reference: RADIUS . CHAP.html QUESTION 15 Drag and Drop .cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.Supports PPP.Explicitly specify on a per-user or per-group basis of which commands are allowed .Assign privilege levels to commands .Is not as useful for router management or as flexible for terminal services .

Correct Answer: .

Section: (none) Explanation .

Switch Port Priorities (CONCEPT ONLY) Port Priority / Switch Priority / Path Cost Select and Place: .Explanation/Reference: QUESTION 16 Drag and Drop .

Correct Answer: .

Section: (none) .

VRRPv2 & VRRPv3 vs VRRPv3 Comparison (8th March 2018) .CONCEPT ONLY Select and Place: Correct Answer: .Explanation Explanation/Reference: QUESTION 17 Drag and Drop .

0.18 – Something about IGMP – Supports VTP .0.Section: (none) Explanation Explanation/Reference: VRRP v2 and VRRP v3 – Assign IP address in the Layer 3 Ethernet – Send hello messages to multicast address 224.

VRRP v3 – Supports IPv6 – Timers in millisecond .

Contribute QUESTION 1 What happens if an interface within channel group is configured as SPAN destination? A. will operate normal Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 2 EtherChannel guard misconfig is configured on a switch. PagP C. The switch that is currently the stack master .MCQs April 2017 . which technology supports that? A. will not be operational C. STP D. Portchannel will forward traffic to source span B. Port Security Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 3 Which will identify the master switch in stackwise? A. LACP B. the link will be in error-disable D.

The switch that uses the non-default interface-level configuration D. The switch with the lower priority stack member priority value Correct Answer: B Section: (none) Explanation Explanation/Reference: . The switch with the highest stack member priority value C.B.

1Q? A.Contribute QUESTION 1 What is the Ethernet frame size for 802.MCQs May 2017 . 128 C. 1518 D. 64 B. 1522 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 2 How will the traffic reach the core switch from AS switch to DS core switch? .

(Based on a topology shown with one core. ASW1 to DSW2 to DSW1 to core Correct Answer: B Section: (none) Explanation Explanation/Reference: . ASW1 to DSW1 to DSW2 to core D. ASW1 to DWS1 to core B. with redundant links and bandwidth mentioned. ASW1 to DWS2 to core C.) A. two distribution and two access switches on each distribution switch.

0000-070C-AC2D D. 00-00-0C-07-AC-2D B.) A.QUESTION 3 If HSRP group number is 45 what would be the MAC address? (Basically conversion of digit to hexadecimal with group of 16. 0000-0C07-AC45 C. 0000-C004-ACD2 Correct Answer: A Section: (none) Explanation Explanation/Reference: HSRP vMAC: 0000-0C07-AC?? -> 0000-0C07-AC2D .

Spanning Tree portfast feature must be disabled per interface basis C. B.) A. just take a good look a t a few valid VRRP configuration examples so that you will be able to recognize invalid ones.x. The number 1 is the group number.x.. standby [group number] preempt Correct Answer: ABC Section: (none) Explanation Explanation/Reference: You can eliminate configurations with the word ‘standby’. not VRRP..html QUESTION 5 Select a valid VRRP configuration from a list of possible configurations. Enable this feature by using the (config)# spanning-tree etherchannel guard misconfig global configuration command. I think the options that put things like vrrp group 1 ip x.CISCO_ID : HSRP_ID : GROUP_ID 2D=45 QUESTION 4 A question on EtherChannel misconfiguration. Enable this feature by using the (config-if)# spanning-tree etherchannel guard misconfig command Correct Answer: A Section: (none) Explanation Explanation/Reference: Enabling EtherChannel Misconfiguring Guard – http://www. vrrp [group-number] priority [priority] C. as that would be HSRP. This command is not available in Cisco Switches D..cisco. ..com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/ configuration/guide/3750xscg/swstpopt. vrrp [group-number] ip [ip-address] B. You don’t need the word ‘group’ in the configuration line.x are wrong. (Choose three. standby [group number] priority [priority] E. Also.. Anyway. vrrp [group-number] preempt D. A..

shutdown both interface ports B. A. community B.what is the process to configure EtherChannel. Don't need to shutdown the ports Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 8 A question about spanning-tree port-priority.QUESTION 6 Private VLANs (PVLANs) have two secondary VLAN types. isolated C. promiscuous D. 127 B. Shutdown is necessary if the ports are in err-disable D. shutdown the interface on one side only C. 129 . A. A. host Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 7 EtherChannel .

com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/ guide/3750xscg/swstpopt. 128 D.. 0000-0C07-AC37 C.C. what would be the vMAC (virtual MAC) address? A. QUESTION 9 Question about EtherChannel based on STP EtherChannel misconfig. 4096 Correct Answer: A Section: (none) Explanation Explanation/Reference: If all priorities are default the value is 128. A. (config)# spanning-tree etherchannel guard misconfig B. 0000-C007-AC37 Correct Answer: A . the only one answer who has the less value in this case is 127.. (config)# spanning-tree etherchannel misconfig guard D.html QUESTION 10 If HSRP group number is 37. (config-if)# spanning-tree etherchannel misconfig guard Correct Answer: A Section: (none) Explanation Explanation/Reference: Enabling EtherChannel Guard – http://www. (config-if)# spanning-tree etherchannel guard misconfig C... Lesser is better in this case.. 0000-C007-AC25 D.cisco. 00-00-0C07-AC25 B.

.Section: (none) Explanation Explanation/Reference: HSRP vMAC: 0000-0C07-ACXX Converting 37 Decimal to hexadecimal = 25 HSRP vMAC = 0000-0C07-AC25 QUESTION 11 What is the default value for spanning-tree port-priority? A. 1024 Correct Answer: A Section: (none) Explanation Explanation/Reference: https://www.cisco. should be? A. 32 D.. 64 C. isolated B..html QUESTION 12 When you configure PVLAN to the portal facing to the router what kind of . promiscuous C.. community Correct Answer: B Section: (none) Explanation .com/c/m/en_us/techdoc/dc/reference/cli/n5k/commands/spanning-tree-port-priority. host D. 128 B.

multicast Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 15 Question about what would be. trunk port will be immediately . router C. 0x888E C. 0x0806 B. 0x8100 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 14 MAC address filter? A. CPU-destined B. 0x0800 D.1Q tag? A.Explanation/Reference: QUESTION 13 Which option TPI 802. if write command “switchport mode trunk portfast”? (I don’t remember properly) A. unicast D.

Allow two root bridges in a network D. Root Guard puts the port into root-inconsistent C. All ports of the new switch are changed to listening state Correct Answer: B Section: (none) Explanation Explanation/Reference: https://www. BDPU turn this port to err-disabled D. (config-if)#spanning-tree guard loop E. (config)#spanning-tree loop guard default B.B.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10588-74. (config)#spanning-tree loop-guard default D. BDPU turn this port to shutdown Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 16 What statement is true if a new switch with a lower bridge ID is introduced in a network with root guard enhancement? A. trunk port can be portfast mode C. (config-if)#spanning-tree loop C. Prevent unknown switch be a root port B.html QUESTION 17 How to configure loop guard in a Cisco switch IOS? A. (config-if)#spanning-tree guard Correct Answer: D .cisco.

B. tag is removed and packet is forwarded to the VLAN mentioned in the tag. None until the port VLAN is determined. VLAN 1 is the default VLAN. C. B. Per default the port has to participate in a VLAN election to determine which VLAN a port is assigned. tag is removed and packet is forwarded on the VLAN of the access port. D. C. A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 19 Question about the behavior of an access port when a tagged packet is received. tag is removed and packet is forwarded on the VLAN of the trunk port. All VLANs are permitted in a dynamic access port link. packet is dropped. D.Section: (none) Explanation Explanation/Reference: spanning-tree guard loop Router(config)#interface gigabitEthernet 1/1 Router(config-if)# spanning-tree guard loop QUESTION 18 Which statement is true about dynamic access port? A. Correct Answer: B Section: (none) Explanation Explanation/Reference: .

vlan 510 remote span C. PAGP . vlan 4029 span Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 21 A question about configuring spanning-tree port-priority based on a diagram where all port-priorities are default. A. A.QUESTION 20 A question about RSPAN configuration in VTPv2. (config-if)# spanning-tree port-priority 129 Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 22 A question on EtherChannel misconfiguration. A. PortFast B. vlan 510 span D. (config-if)# spanning-tree port-priority 127 C. vlan 4029 remote span B. (config)# spanning-tree port-priority 127 B. (config)# spanning-tree port-priority 129 D.

) A. storm control B. You can set user privileged levels D. (Choose two. Consoling to network devices is not possible Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 24 Three reasons for err-disable. configuration ports into EtherChannel D. security violation C. Console is a backup authentication method B. BPDUguard E. Console is the only backup authentication method C. LACP D. VRRP F. VSS Correct Answer: ABD . (Choose three) A.C. STP Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 23 A question on local database for consoling to network devices.

Port Aggregation Protocol (PAgP) flap .Address Resolution Protocol (ARP) inspection . The reason can be: .Port channel misconfiguration .A cable that is out of specification (either too long.BPDU guard violation . or defective) .Security violation . CDP or LLDP must be enable on switch D.Inline power . Traffic in network is doubled C.Link-flap detection .Duplex mismatch .UniDirectional Link Detection (UDLD) condition .Layer 2 Tunneling Protocol (L2TP) guard .Bad network interface card (NIC) card (with physical problems or driver problems) .Port duplex misconfiguration .Late-collision detection . the wrong type.DHCP snooping rate-limit .Section: (none) Explanation Explanation/Reference: There are various reasons for the interface to go into errdisable.Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable . The traffic is cached in NVRAM Correct Answer: A Section: (none) Explanation Explanation/Reference: . Destination port is unusable for normal use B.Storm Control QUESTION 25 What can happen after a RSPAN configuration in a Cisco switch? A.

(config)# spanning-tree loopguard enable D.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10596-84. (Choose two.) A.QUESTION 26 A question on local user database for login to network devices. Local user dbs is used after 3 unsuccessful logins via RADIUS server E.cisco. (config-if)# spanning-tree loopguard default E. Local user dbs is the only backup authentication method C. AAA authentication must be implemented on switch Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 27 What are the two ways to configure loop guard? A. what does the switch do when it receives a packet with option 82? . Local user dbs can be main and also backup authentication method B. (config)# spanning-tree loopguard default B.html#loop_guard QUESTION 28 What happens if a switch with dhcp snooping and ip source guard enabled globally. You can set user privileged levels D. (config-if)# spanning-tree guard loop C. (config)# spanning-tree guard loop Correct Answer: AB Section: (none) Explanation Explanation/Reference: https://www.

) A. http://www.html QUESTION 29 Which two statements are true about Option 82? (Choose two. Layer 3 egress C. Proxy ARP D. Layer 4 ingress Correct Answer: AB Section: (none) Explanation Explanation/Reference: Layer 2 ingress – “Enters interface configuration mode. Layer 2 ingress B. Layer 4 egress F. where slot/port is the interface for which you want to enable or disable subnet broadcast support for the DHCP relay agent.” (see “Enabling or Disabling Option 82 User Defined Data Insertion and Removal”) <<ingress (in) Layer 3 egress – this sounds right "Enters interface configuration mode. Drop B. where slot/port is the Layer 2 Ethernet ingress interface where you want to configure the option 82 string. Layer 2 egress E.A.cisco. Layer 3 ingress D. Nothing Correct Answer: B Section: (none) Explanation Explanation/Reference: The switch removes the option-82 field and forwards the packet to the switch port that connects to the DHCP client that sent the DHCP request. Remove 82 and forward C.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/ b_sec_3se_3850_cg_chapter_01100. (see "Enabling or Disabling Subnet Broadcast Support for the DHCP Relay Agent on a Layer 3 Interface") <<egress (out) .

com/c/en/us/td/docs/switches/datacenter/nexus3548/sw/security/6-x/b_N3548_Security_Config_602_A11/ b_N3548_Security_Config_602_A11_chapter_01011.) A.http://www.cisco. show interfaces trunk C. (Choose two. show access ports B. show vlan native trunk Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 31 Question about voice VLAN. show trunk D. . Disabled by default B. Enters on untrusted port C. Default CoS value of 5 for untagged.html QUESTION 30 Which command is used to verify trunk native VLANs? A.

F. port state is determined by spanning tree. B. DSW1: change bridge priority but value is 0. Needs manual enable of PortFast. E. E. DSW1: change bridge priority to 4096 (lowest). UDLD tries to reestablish link once before declaring the link down. (Choose two. C.D. DSW1: change port priority but in global configuration mode. DSW2: change bridge priority to 61440 (highest). UDLD messages are sent every 15 seconds. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 33 Diagram is: with 1 core. UDLD sends messages four times the message interval by default. 2 DSW connected with EtherChannel.) A.) A. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 32 Question about UDLD aggressive. When unidirectional fail is detected. When unidirectional fail is detected. port is turned to errdisable. UDLD automatically sends message interval based on configured timers. D. D. B. Per diagram current root for VLAN 10 is DSW2. . (Choose two. 2 PCs per ALSW. 2 ALSW. DSW1: change bridge priority but command is priority root. C. Question is how to make DSW1 the primary root for VLAN 10.

html QUESTION 35 What keyword in macro command is used to configure a root bridge and automatically adjust STP timers? A.cisco. (config-if)# ip arp inspection vlan C. reflector D. (config)# ip arp inspection vlan B. diameter C. (config)# arp inspection default D.html .cisco. root primary B. STP bridge root Correct Answer: B Section: (none) Explanation Explanation/Reference: Source: https://www.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/19120-122.Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 34 How to configure dynamic ARP inspection on a VLAN? A. (config-if)# inspection arp vlan Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.

Trunk port will be immediately B. disable RSTP and uses bpdu type 4 B. http://www.1D) 2. BPDU Type: 1 byte (0x00 Config BPDU.QUESTION 36 Question about interoperability between MST and RSTP. disable RSTP and uses bpdu type 2 D. Trunk port can be portfast mode C. Protocol ID: 2 bytes (0x0000 IEEE 802. The port is removed from trunk Correct Answer: B Section: (none) Explanation . 0x80 TCN BPDU.1aq BPDUs have the following format: 1. Version ID: 1 byte (0x00 Config & TCN / 0x02 RST / 0x03 MSTP / 0x04 SPT BPDU) 3.1w BPDU (Version 2). enable RSTP and uses bpdu type 4 C.1D and IEEE 802.cisco. if write command “spanning-tree portfast trunk”? A. BDPU turn this port to err-disabled D. 0x02 RST BPDU) 4.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/CLIConfigurationGuide/MST.html#40909 Bridge Protocol Data Unit fields[edit] IEEE 802. A. Flags: 1 byte QUESTION 37 Question about what would be. enable RSTP and uses bpdu type 2 Correct Answer: D Section: (none) Explanation Explanation/Reference: 802. MST interoperates with Rapid PVST+ with no need for user configuration.

Private VLANs doesn't have to be assigned in MAC address table.wordpress. D. master B. NVRAM D. B. Long path cost is 64 bits . slave C. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 40 What statements about STP path cost are true? (Choose two.) A.com/2009/01/20/enabling-portfast-on-trunks/ QUESTION 38 Where is SDM template stored in a Stackwise configuration? A. Extended VLANs doesn’t have VLAN assigned in MAC address table. Static bindings can't be removed from MAC address table. flash Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 39 What statement about MAC address table is true? A. C. Every entry in MAC address table has VLAN assigned.Explanation/Reference: Source: https://cciepursuit.

Can't be used for POE negotiation . Short path cost is 32 bits C. Which technology is it using? A.B.com/c/en/us/products/collateral/switches/catalyst-6500-virtual-switching-system1440/prod_qas0900aecd806ed74b. MST uses long path cost D. VSL Protocol (Virtual Switch Link) D. LACP Correct Answer: C Section: (none) Explanation Explanation/Reference: Source: https://www. LLDP multicast address is 0100-0CCC-CCCC E. DSW1 and DSW2 need to communicate with each other to determine the role. RSPAN C. They have equal path cost by default Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 41 In a Virtual Switching System.cisco.html QUESTION 42 Which two statements about frame LLDP is true? (Choose two. Frame has CRC C.) A. Default path cost is short E. LLDP frame is compatible with CDP v2 D. STP B. Frame has destination multicast address B.

Correct Answer: AB Section: (none) Explanation Explanation/Reference: Source: https://wiki. Source ports SPAN work on L2 (Layer 2). Destination and source port SPAN don't work on L2 (Layer 2). remove 55 B. D. switchport trunk allowed vlan add 3. Destination ports SPAN work on L2 (Layer 2). switchport remove vlan 55 E. C. switchport trunk allowed vlan except 55 D.) A.wireshark.org/LinkLayerDiscoveryProtocol QUESTION 43 Which statement about frame SPAN is true? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 44 Which two commands is used to remove VLAN 55 from the trunk port? (Choose two. B. switchport trunk allowed vlan remove 55 C. Destination and source port SPAN works on L2 (Layer 2). switchport trunk remove vlan 55 Correct Answer: BC Section: (none) Explanation Explanation/Reference: .

D. aaa authorization exec default group radius B. On a switch there can be only one RSPAN VLAN . RSPAN VLAN carries only RSPAN traffic B. Which statement is true? A. LACP priority is used to determine which port is put in standby mode. aaa authentication default group login C. C. aaa authorization group default radius D. A. B. aaa authentication exec default group radius Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 46 Question about LACP priority. LACP priority is used to determine which port is used to form the EtherChannel. LACP priority is removed from EtherChannel. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 47 Which information is true about RSPAN? A. There was a command about LACP priority.QUESTION 45 AAA question about the command used to login a user and set immediate access to privilege mode.

0x8b45 D. Rapid PVST+ is the default STP mode on Cisco switches C. RSPAN can be enable only in a Layer 3 switch Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 48 What statement is true about PVST? A.C. PVST+ is the default STP mode on Cisco switches B. RSPAN VLAN carries RSPAN traffic along multiple switches D. Is the default mode on Cisco switches D. STP is the default mode on Cisco switches Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 49 What is the value of the TPID/tag protocol identifier in dot1q? A. 0x8200 Correct Answer: A Section: (none) Explanation . 0x8a88 C. 0x8100 B.

There is an EtherChannel trunk between DSW1 and DSW2. 0x8200 Correct Answer: A Section: (none) Explanation Explanation/Reference: The outer tag is the one closer/closest to the Ethernet header. DSW1: interface g1/0 C. Change in port priority so traffic goes through DSW1 to DSW2. 0x8b45 D. 0x8100 C. DSW1: spanning-tree port priority 16 B. PC1 is connected to DSW1 and DSW2 root bridge. Core switch is connected to 2 distribution switches which are connected to 2 access switches. About port priority.Explanation/Reference: C-TAG (Customer tag. 0x8a88 (or 0x88a8 ???) B. (Choose two. with ethertype 0x8100) QUESTION 50 What is the value of the TPID/tag protocol identifier of QinQ? A. DSW1: spanning-tree port priority 0 Correct Answer: AB Section: (none) Explanation Explanation/Reference: . Default port priority is configured.) A. ethertype 0x88a8) QUESTION 51 EXHIBIT INCLUDED. DSW2: spanning-tree port priority 16 D. DSW2: interface g1/0 E. its name is S-TAG (Service tag. Link connected from PC1 to DSW2 is 4Gbps and DSW1 is 10gbps.

. interface encapsulation native vlan E. interface with access and voice VLAN configured to 116 D.) A. How can the port be brought back to operational status? A. switchport mode on Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 54 EtherChannel load balancing with an exhibit. interface gi 0/1. trunk allowed vlan 116 C.QUESTION 52 Exhibit included which it had BPDU guard configured and received BPDU. With the command: UDLD reset D. Rebooting the switch Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 53 Which two configurations cause the frames to be tagged? (Choose two. Now admin has entered “no bpdu guard enable” command. With the command: disable autorecovery BPDU guard C. With the command: shutdown + no shutdown B.116 encapsulation dot1q B.

Which EtherChannel load balancing algorithm should be used to optimize the EtherChannel links between switches? A. Destination IP D. Source-dest MAC C. Destination MAC Correct Answer: A Section: (none) Explanation Explanation/Reference: . Source MAC B.

VLAN Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 57 Which statement is true about GLBP? . switchport trunk remove vlan 100 Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 56 What is the link called between a VSS? (CONCEPT ONLY) A.switchport trunk allowed vlan 1. DCSP D.) EXHIBIT . switchport trunk allowed vlan remove vlan 100 B. SVI C.99-250 A. VSL (Virtual Switch Link) B.QUESTION 55 Which two commands will remove VLAN 100 from the allowed VLAN list? (Choose two. switchport trunk allowed vlan 1-80.99. switchport trunk allowed vlan except vlan 100 D.80.101-250 C.

0. VRRP uses multicast address 224.2 with TCP port 3222.102 with TCP port 3222.0. C.0. GLBP supports 8 AVGs per group Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www.0.0.9 and uses UCP port 112 .html QUESTION 59 Which statement is true about VRRP? A.cisco.cisco. VRRP uses multicast address 224.0.0.0.0.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp. Only one AVG can be elected on a switch B. VRRP uses multicast address 224.18 and uses TCP port 112 E.0.0.18 and uses IP Protocol 112 B.0.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp. D.0. VRRP uses multicast address 224. GLBP uses multicast address 224.0. GLBP uses multicast address 224. B.0. GLBP uses multicast address 224. Two AVG could be elected on a switch C.0.18 with UDP port 3222 Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www. GLBP uses multicast address 224.0.0.28 and uses UDP port 112 C.html QUESTION 58 How many Active Virtual Gateways (AVG) can be used in a GLBP protocol? A.A.2 and uses IP Protocol port 3222 D. VRRP uses multicast address 224.102 with UDP port 3222. Two AVG just could be elected in GLBP v2 D.

D.0. HSRP uses multicast address 224. B.22 with TCP port 1122 C. HSRP uses broadcast address 224.22 with UDP port 32229 Correct Answer: A Section: (none) Explanation Explanation/Reference: Source: https://www.html QUESTION 61 A question about the priority of a Stackwise switch.0.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 60 Which statement is true about HSRP? A.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/9234-hsrpguidetoc. Master member is selected based on member’s priority. Master member does not completely exist.cisco. Master member will never be selected based on member’s priority. B.2 and uses UDP port 1985. HSRP uses multicast address 224.2 with UDP port 1985 D. Master member is based on user aggression. C.0.0. Correct Answer: A Section: (none) Explanation Explanation/Reference: .0.0. (CONCEPT ONLY) A. HSRP uses broadcast address 224.0.0.

B. UDLD reset D. which is true? (There's an exhibit that shows f0/7 receive BPDU. provides backup for fiber B. Protocol used was IEEE. determines switch path Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 63 When no spanning-tree bpdu guard enable is configured in f0/7. Have to use errdisable recovery. (Choose two) A. help in preventing loops C. We have to configure shutdown and no shutdown. B. The command spanning-tree mode IEEE was implemented. removes loops D. .) A.QUESTION 62 What is the benefit of UDLD? A. C. The spanning-tree mode is IEEE. Network administrator must disable spanning-tree protocol Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 64 An exhibit with spanning-tree.

The protocol is supported per MEC basis.2 D.C. The protocol is Cisco proprietary.0. Other interface will recover .0. E. 224. udld setting udld setting int f0/5 udld setting aggressive What happens if interface f0/5 has been damaged? A.1.102 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 66 A question about UDLD.1 C.0. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 65 What is the multicast address for HSRP? A.0. The protocol does not supported by switches that utilizes EtherChannel.1.1. 127. 224. 224. D.102 B.1.

C. Destination Port Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 68 What will be the behavior of an access port when a tagged packet is received.B. Link stays up D. Reset interface Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 67 Question about the difference between RSPAN and SPAN. All links go down C. The tag is removed and packet is forwarded to a VLAN of access port. Monitor Port B. Forwarding Port D. Access Port C. with a VLAN ID of an access port? A. The tag is not removed and packet is forwarded of the VLAN mentioned in the tag. A. The tag is removed and packet is forwarded of the VLAN mentioned in the tag. D. Correct Answer: A Section: (none) . Packet is dropped. B.

which technology is used to PREVENT this type of misconfiguration from affecting the network? A. ASW1 were connected to DSW2 B. DSW1 connected to DSW2 with 10G link and to ASW1 with 10G link also DSW2 connected to ASW1 with 1G link What is the path for traffic sourced from a PC connected to ASW1 to reach DSW1? A. ASW1 were connected to ASW2 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 70 When using EtherChannel misconfiguration guard.Explanation Explanation/Reference: QUESTION 69 STP Topology Exhibit Included. DSW1 were connected to loopback interface D. DSW1 were connected to ASW1 C. LACP .

B. PAgP Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 71 When using EtherChannel misconfiguration guard. Port security C. Disable VTP and manually configure the customer VLAN Correct Answer: A Section: (none) . What configuration is required to isolate the customer's traffic on the network? A. Configure transparent mode B. PAgP Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 72 An engineer needs to add a customer private VLAN to the network. which technology is used to SUPPORT this type of misconfiguration from affecting the network? A. STP D. Configure VTP in server mode D. LACP B. Enable VTP v3 C. STP D. Port security C.

Source IP B. Question about the best load balancing method with an exhibit.Explanation Explanation/Reference: QUESTION 73 What SPAN configuration is required to enable on a switch? A. Destination MAC-Source D. Disable VTP pruning on trunk links. A. C. Source MAC C. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 74 EXHIBIT INCLUDED. B. LLDP must be enable in an interface. D. A monitor VLAN is created for the SPAN traffic. Configure a source and destination port. Source Port Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 75 What is the behavior of an access port when a tagged packet is received other than the access VLAN value? .

It will not working between two switches. Which statement is true? . Tag is removed and packet is forwarded of the VLAN mentioned in the tag. the new switch will communicate exist switch with Rapid-PVST D.(Picture was showing from CLI “show spanning-tree vlan xx” that running on mode rapid-pvst). Packet is dropped Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 76 Refer to the exhibit. B. the new switch will communicate exist switch with PVST+ C. which statement is true? A. It will work. the new switch will communicate exist switch with MSTP Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 77 About VRRP configuration. .A. B. Not available D. If you have a new switch (that runs spanning-tree mode pvst+) connect to the exist switch. It will work. C. Tag is removed and packet is forwarded on the VLAN of the access port. It will work.

1.0 Switch-A(config-if)# vrrp 2 ip 192. What method / feature / functions you need to enable to prevent initial / potential broadcast of internal information / topology? (forgot the correct wording) A.168.255.168.1.0 Switch-A(config-if)# vrrp 1 ip 192. Switch-A(config)# interface vlan 1 Switch-A(config-if)# ip address 192.10 255.1.10 255.1.10 255.1. Switch-A(config)# interface vlan 2 Switch-A(config-if)# ip address 192.10 Switch-A(config-if)# vrrp 1 priority 200 D.[Question just short like this because in each option will have CLI for config 1 group of VRRP] A. Switch-A(config)# interface vlan 1 Switch-A(config-if)# ip address 192.1 Switch-A(config-if)# vrrp 1 priority 200 B.168.168.168.168.255. BPDU Filter .255.0 Switch-A(config-if)# vrrp 1 ip 192.255.255.255.0 Switch-A(config-if)# vrrp 1 ip 192.10 Switch-A(config-if)# vrrp 1 priority 100 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 78 Your company wants to connect an internal switch to the uplink provider switch.1.255.11 255.1.1.168.168. Switch-A(config)# interface vlan 2 Switch-A(config-if)# ip address 192.255.1 Switch-A(config-if)# vrrp 2 priority 100 C.

BPDU Bridge Correct Answer: A Section: (none) Explanation Explanation/Reference: .B. BPDU Guard C. BPDU Loop D.

E. C. EtherChannel will discard the port used.MCQs June 2017 . B. C. The EtherChannel will shutdown. The EtherChannel will not be operational because the port cannot be used as SPAN destination. Subordinate switches keep their own spanning trees for each VLAN that they support. B. EtherChannel will operate as normal. Store running configuration on all the switches. Subordinate switches keep entire VLAN database.Contribute QUESTION 1 There was an EtherChannel configured and one of the port was used as SPAN destination. What will be the result? A. The EtherChannel will no longer exist. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 2 What do subordinate switches in a switch stack keep? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 3 Which two statements apply to topology-based switching? (Choose two.) . Subordinate switches does not keep their own spanning trees. D. D.

SDM templates are defined by the switch model and can't be changed .) A. It runs on the network layer. D. It is the preferred switching mode in Cisco multilayer switches. It is not enabled by default on Cisco devices. Disabled by default. E. C. Hold-time is 100 seconds on Cisco devices Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 5 Which two statements about SDM templates are true? (Choose two. Multi-vendor Protocol Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 4 Which two statements apply to LLDP? (Choose two. C. B. B. They are used to allocate system resources. You can verify the SDM template that is in use with the show sdm prefer command.A. E. D. D.) A. Changing the SDM template will not disturb switch operation. C. B. It runs on the data link layer. It is functionally equivalent to Cisco Express Forwarding. Enabled on Cisco devices by default. It uses loop free protocol for switching.

Normal STP VLAN 1 BPDU travel across VLAN 99 untagged B.) A. none B. Normal STP VLAN 1 BPDU travel across VLAN 1 untagged D. trap D. shutdown C. (Choose two. PVST+ VLAN 1 BPDU travel across VLAN 99 tagged C. enabled Correct Answer: B Section: (none) Explanation Explanation/Reference: .E. PVST+ VLAN 99 BPDU travel across VLAN 99 tagged Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 7 What is the default violation status of port security? A. SDM templates changes don't require switch to be rebooted Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 6 Question about the behavior of VLAN 1 BPDUs in a situation where the native VLAN configured as VLAN 99 and the native VLAN is tagged.

Enabled by multicast only Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 9 What happens when a destination SPAN port that is configured as EtherChannel receives traffic? A. Err-disable C. Shutdown B. Nothing D.QUESTION 8 What is the storm control violation defined by default on a Cisco switch? A. VRRP uses TCP IP protocol 20 . Broadcast threshold is doubled in an interface Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 10 A question regarding to redundancy protocol (or VRRP). Enabled C. Enabled by broadcast only D. Disabled B. VRRP uses UDP port number something (or IP protocol 112) B. A.

An IP protocol does not exist Correct Answer: A Section: (none) Explanation Explanation/Reference: .C. VRRP uses UDP protocol 200 D.

The device on which the interface resides is acting as a standby router.Contribute QUESTION 1 Refer to the exhibit.351 seconds. D. Correct Answer: AC Section: (none) Explanation Explanation/Reference: Answer A is correct because skew time-> (256-configured priority)/256-configured. The configured VRRP priority of the interface is 105. The configured VRRP priority of the interface is 120. The Skew time is .) A. Which two statements about the network environment of the interface that generated this output are true? (Choose two. . Answer C is correct because there was priority 105 in exhibit but there was also line: Track object 1 state “down” decrement 15 -> so the configured priority is 120.MCQs August 2017 . B.531 seconds. E. C. If the priority of another router is higher than the priority of the master router. it becomes the master router after 3.

351 instead of 3.) A. channel-protocol pagp channel-group 1 mode on D. Correct Answer: BD Section: (none) Explanation . channel-protocol lacp channel-group 1 mode passive C. C. Cisco Express Forwarding must be disabled globally. channel-protocol lacp channel-group 1 mode auto B. An IP address must be configured on the interface. channel-protocol lacp channel-group 1 mode active Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 3 Which two prerequisites for HSRP to become active on an interface are true? (Choose two. E. A Virtual-MAC address must be configured on the interface. channel-protocol pagp channel-group 1 mode auto E. The VIP must be in the same subnet as the primary IP address.? (Choose two.. D. B.Answer E is NOT correct because even though the hello interval in the exhibit is 1s (hold interval is 3x hello + skew time (0.531. PIM routing must be disabled on the interface.351)) but notice that there was hold down timer 3.. QUESTION 2 Which two commands sequences must you enter on a pair switches so that they negotiate an EtherChannel using an IEEE-standard.) A.

Correct It’s obvious. you can’t destinate a port or vlan that’s doens’t exist on the local switch or stack. A switch can support only one local SPAN session at a time. CHAP C. B.) A. A SPAN session can support multiple destination ports only if they are on the same VLAN.Explanation/Reference: QUESTION 4 Which two authentication types does VRRP support? (Choose two. It can monitor only traffic that ingresses or egresses on the source interface or VLAN. PAP D. Correct Answer: AB Section: (none) Explanation Explanation/Reference: A. Each SPAN session supports only one source VLAN or interface.1x E. “The destination port used in one SPAN session cannot also be used as the destination port for another SPAN session. The source and destination ports must reside in the same switch or switch stack. E. C. 802. MD5 Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 5 Which two limitations of local SPAN are true? (Choose two.) A.” . D. Plain-text B.

Incorrect “You can also create a SPAN session to monitor multiple VLAN sources and choose only VLANs of interest to transmit on multiple destination ports. Template maximises system resources for access control lists. C.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3/system_management/configuration/guide/ n1000v_system/n1000v_system_9span. Template maximises system resources for unicast routing. B. Incorrect “You can also create a SPAN session to monitor multiple VLAN sources and choose only VLANs of interest to transmit on multiple destination ports. A.B. Template disables routing and supports the maximum number of unicast MAC addresses. Correct C. B. Incorrect “You can create up to 64 total SPAN sessions (Local SPAN plus ERSPAN) on your local device. . The port is moved into the spanning-tree blocking state. you can configure SPAN on a trunk port and monitor traffic from different VLANs on different destination ports. D. A routing loop can occur on the network.” Source: https://www.html#pgfId-1054894 QUESTION 6 Which statement about the default switch database management template is true? A. Template gives balance to all functions. For example. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 7 Which results happens when a nontrunking port that is configured with BPDU guard is connected to a device that is transmitting…. you can configure SPAN on a trunk port and monitor traffic from different VLANs on different destination ports. Their port is error-disabled.” E. C.cisco. For example.” D.

C. The LAN client traffic is handled by the active AVF only. D. The AVF assigns virtual MAC addresses to GLBP group members. C. D. B. The LLDP hold time is 60 seconds.D. Correct Answer: CE Section: (none) . The port transitions to the connected state. The LLDP global state is disabled. The LLDP reinitialisation delay is 5 seconds.) A. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 9 Which two statements about GLBP are true? (Choose two. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 8 Which two settings are part of a default LLDP configuration? (Choose two. E. The AVF responds to ARP request for the virtual IP address.) A. The LLDP timer is 60 seconds. B. E. The AVG assigns virtual MAC addresses to GLBP group members. The LLDP interface state is enabled. The AVG responds to ARP requests for the virtual IP address.

Traffic on VLANs 1 through 9 is flooded to all switches in the network. which statement about the VLANs network is true? A.Explanation Explanation/Reference: QUESTION 10 Refer to the exhibit. If switch SW6 is operating VTP server and the other devices have the same configuration as SW4. .

You have configured routers R1 and R2 with VRRP for load sharing as shown.B. Native VLAN-ID Correct Answer: BF Section: (none) Explanation Explanation/Reference: QUESTION 12 Refer to the exhibit.) A. Routing Protocol D.) . D. VLANs 1 through 101 are operational on all switch trunks. Processor Type B. Memory Usage E. VTP Domain Name C. Which two effects of this configuration are true? (Choose two. Spanning-Tree Mode F. VLANs 1 through 9 are pruned on the link between SW1 and SW4. C. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 11 Which two pieces of information are carried in a Cisco Discovery Protocol advertisement? (Choose two. VLANs 1 through 101 are pruned on the link between SW1 and SW2.

.0.1 and router R2 is the primary gateway for 10.0.1 and Router R1 is the primary gateway for 10. which forward traffic to router R2 as necessary. The four PCs send all request to router R1. D.1. Correct Answer: DE Section: (none) Explanation Explanation/Reference: The exhibit (goo. C.1. B. E. The four PCs send packets round-robin between routers R1 and R2.A.gl/5tZwUm) is not correct.10.1.10. F.0. Router R1 is the primary gateway for 10. Router R2 is the primary gateway for 10.0. PC2 and PC4 use router R1 as the primary gateway. PC1 and PC3 use router R1 as the primary gateway.1.

10. This mean that R1 is primary for group 1 and R2 is primary for group 2. Dynamic Auto and Dynamic Auto D.0.The client 1 and 3 have default gateway 10.3.1.1 and client 2 and 4 has default gateway 10. The PC1 and PC3 uses R1 as primary gateway.1.) A.0.0. Dynamic Desirable and Dynamic Auto B. Which two statements about the network environment of the device that generated this output are true? (Choose two. Nonegotiate and Trunk E.) . QUESTION 13 Which two DTP negotiated interface mode combinations negotiate to form an access port? (Choose two.2 and R2 has 10. The interfaces on the routers have IP as per question-> R1 as 10.1. Dynamic Desirable and Access C.0. Dynamic Auto and Trunk Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 14 Refer to the exhibit.1.

Answer C is NOT correct because the priority value wasn’t 1. The standby router can take the active HSRP if it fails to receive a hello packet from the active router within 1. C.There were timers: 3s hello and 10s hold. Answer A is correct .616 is time when the router will send the next hello message. Correct Answer: AE Section: (none) Explanation Explanation/Reference: There was a show standby brief exhibit. Answer B is NOT correct because 1. . E. Answer D is NOT correct because there was nothing line HSRP version 2.A. The exhibit hello and hold timer values are in use. D.616 seconds. The standby router can take the active HSRP role if it fails to receive a hello packet from the active router within 10 seconds. B. The priority value of the HSRP group is 1. HSRP version 2 is in use.

It performs consistency checks only when a new VLAN is manually added. Consistency Checks: In VTP version 2. C. E.This also mean that after 10 second the standby router will take the active role because is there as 3 missing hello messages. Reference: https://www. It can be enabled on a per-interface basis. If extended VLANs are configured. It supports the use of multiple instances. Reference: https://www. D. You cannot convert from VTP version 3 to VTP version 2 if extended VLANs are configured in the domain.cisco. VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI or SNMP. A separate instance of the VTP protocol runs for each application that uses VTP -> Only VTPv3 supports multiple VTP instances -> Answer A is not correct. you cannot convert from VTP version 3 to version 1 or 2. version 3 can propagate Multiple Spanning Tree (MST) protocol database information.html QUESTION 16 Which three options of VLAN IDs are in extended range? (Choose three. Therefore Answer D is not correct.Answer E is correct . Correct Answer: B Section: (none) Explanation Explanation/Reference: VTPv3 offers support for extended range VLAN (VLANs 1006 to 4094) database propagation. VTP version 1 and version 2 support only normal-range VLANs (VLAN IDs 1 to 1005). Extended range VLANs (VLANs 1006 to 4094) are supported only in VTP version 3. B. Consistency checks are not performed when new information is obtained from a VTP message or when information is read from NVRAM. VTP versions 1 and 2 propagate only VLANs 1 to 1005. E are not correct. It can be enabled on a per-port basis.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp. It propagates VLANs 1 – 1005 only.) .html#wp1316856 In addition to propagating VTP information. Only VTPv3 allows to turn on/off per-port basis -> Answers C. QUESTION 15 Which statement about the VTPv2 is true? A. VTP version 3 supports the entire VLAN range (VLANs 1 to 4094).com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/ swvtp.cisco.

cisco. 1001 D. Loop Guard Correct Answer: C Section: (none) Explanation Explanation/Reference: Source: https://supportforums.A. 99 B. 4021 Correct Answer: DEF Section: (none) Explanation Explanation/Reference: Source: https://www.cisco.. BPDU Filter B.html QUESTION 17 A question about security and the choices were. 1006 E.com/c/en/us/td/docs/ios/12_4t/12_4t15/ht_xvlan. Loop Guard . Root Guard D.. BPDU Guard C. 999 C. (Which of these options supports to maintain the network architechture and stability of the root bridge in a spanning-tree service?) A.com/t5/network-infrastructure-documents/importance-of-bpdu-guardand-bpdu-filter/ta-p/3120465 QUESTION 18 Which STP feature used to monitor BPDU traffic and enable STP to transition between states? A. 3003 F. Root Guard B.

html The first and second underlined sentences are very contradictory. This usually happens because one of the ports of a physically redundant topology (not necessarily the STP blocking port) no longer receives STP BPDUs. If BPDUs are not received on a non-designated port. In its operation. Eventually. How about BPDU Filter? At the global level. and loop guard is enabled. it will lose its PortFast feature and return to a normal switching port (with STP enabled).C.cisco. the STP conceives that the topology is loop free. This command prevents interfaces that are in a Port Fast-operational state from sending or receiving BPDUs. you can enable BPDU filtering on Port Fast-enabled interfaces by using the spanning-tree portfast bpdufilter default global configuration command. When one of the ports in a physically redundant topology no longer receives BPDUs. Without the loop guard feature. STP relies on continuous reception or transmission of BPDUs based on the port role. the interface loses its Port Fast-operational status. Reference: http://www. So all three features above do not support STP to transition between states. Loop Guard feature provides additional protection against STP loops. BPDU Guard Correct Answer: C Section: (none) Explanation Explanation/Reference: BPDU Guard feature allows STP to shut an access port in the event of receiving a BPDU. You should globally enable BPDU filtering on a switch so that hosts connected to these interfaces do not receive BPDUs. the port assumes the designated port role. BPDU filtering is disabled! The fact is this command will prevent an interface from sending BPDUs only. the blocking port from the alternate or backup port becomes designated and moves to a forwarding state. Root Guard ensures that the port on which root guard is enabled is the designated port. No traffic is forwarded across this port. There are two ways to configure BPDU filtering feature. The designated port transmits BPDUs. The port moves to the STP forwarding state and creates a loop. The loop guard feature makes additional checks. This situation creates a loop. and the non-designated port receives BPDUs. The first one says it prevents an interface from receiving BPDUs while the second one says when it receives BPDUs. instead of the listening/learning/forwarding state. root guard moves this port to a root-inconsistent STP state (which is equal to STP listening state).com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_55_se/configuration/guide/3560_scg/swstpopt. the root guard enforces the position of the root bridge. BPDU Filter D. If the bridge receives superior BPDUs on a root guard-enabled port. and BPDU filtering is disabled. that port is moved into the STP loop-inconsistent blocking state. one in global configuration mode and one under a specific interface: Configuring BPDU filter globally: . But if it receives BPDUs. An STP loop is created when an STP blocking port in a redundant topology erroneously transitions to the forwarding state. If a BPDU is received on a Port Fast-enabled interface. The interfaces still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. In this way.

Encrypts the whole payload D. they will be dropped) Therefore in this question we can only think about the BPDU Filter under global configuration mode. IP Source-destination E. Supports backwards compatible with TACACS+ B. Separates authentication and authorization Correct Answer: CDF Section: (none) Explanation Explanation/Reference: QUESTION 20 Which two possible EtherChannel load balancing mechanisms are based on Layer 3? (Choose two. BPDU filtering is disabled. QUESTION 19 A question about TACACS+ with three choices. MAC Source B.) A. MAC Source-destination C.Switch(config)#spanning-tree portfast bpdufilter default Configure BPDU Filter on the interface: Switch(config-if)#spanning-tree bpdufilter enable (this overrides the global bpdufilter command above) But the effect of these two commands are different and you should remember: + When BPDU filtering is enabled globally. Utilizes TCP port E. MAC Destination . the port loses its PortFast status. and if BPDUs are seen.) A. IP Source D. Utilizes UDP port F. Encrypts the header C. In this mode the port can transit between STP states. it prevents this port from sending or receiving BPDUs (so if BPDUs are seen. the port returns to normal state + When BPDU filtering is enabled on a specific port. (Choose three.

QUESTION 22 VRRP authentication. No authentication D. SHA-124 B. Plain text authentication F. SIP B. CDP D. MD5 Correct Answer: CEF Section: (none) .Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 21 A question about what carries voice VLAN to a Cisco phone? A. LLDP C. SKINNY E. RSPAN Correct Answer: C Section: (none) Explanation Explanation/Reference: You must enable CDP on the switch port connected to the Cisco IP Phone to send the configuration to the phone (which includes the Voice VLAN to be used). WAP E. SHA-254 C. (Choose three.) A.

It supports one STP instance per VLAN. dynamic desirable + dynamic desirable = trunk D.Explanation Explanation/Reference: QUESTION 23 DTP question was about how to form an access port. All VLANs must reside in a single MST region. E. D. It can map multiple VLANs to a single STP instance. dynamic auto + dynamic desirable = trunk C. dynamic auto + dynamic auto = access B. It is vendor neutral. C. Correct Answer: CE Section: (none) Explanation .) (CONCEPT ONLY) A. (Choose two.) A. dynamic auto or dynamic desirable + access = access Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 24 Which two statements about MST are true? (Choose two. It can operate without a root bridge. dynamic auto or dynamic desirable + trunk = trunk E. B.

E. Reference: https://www. it provides a virtual MAC address and an IP address that is shared among a group of configured routers. This feature filters outgoing ICMP redirect messages through HSRP. When HSRP is configured on a network or segment. In a group of router interfaces. D. ICMP provides diagnostic functions. make sure hosts do not discover the interface (or real) MAC addresses of routers in the HSRP group. HSRP allows two or more HSRP-configured routers to use the MAC address and IP network address of a virtual router -> Answer D is correct. You must manually configure ICMP redirect messages on HSRP interfaces.pdf . If a host is redirected by ICMP to the real MAC address of a router and that router later fails.Explanation/Reference: QUESTION 25 Which two statements about HSRP are true? (Choose two.cisco.com/c/en/us/td/docs/switches/metro/me3600x_3800x/software/release/12-2_52_ey/configuration/guide/3800x3600xscg/ swhsrp. such as sending and directing error packets to the host. in which the next hop IP address might be changed to an HSRP virtual IP address. the standby router is the router that takes over the routing duties when an active router fails or when preset conditions are met -> Answer C is not correct. the active router is the router of choice for routing packets. it does not depend on the number of router/switch. When the switch is running HSRP. Correct Answer: BD Section: (none) Explanation Explanation/Reference: ICMP (Internet Control Message Protocol) redirect messages are automatically enabled on interfaces configured with HSRP (therefore answer A is not correct). B. So its support depends on VLAN or interface only. Primary and secondary HSRP switches forward traffic in a round-robin style. C. ICMP is a network layer Internet protocol that provides message packets to report errors and other information relevant to IP processing. HSRP can be configured on a maximum of 32 VLAN or routing interfaces. It is supported on switch virtual interfaces and routed ports. including routed ports and switch virtual interfaces (SVIs) on the switch -> Answer B is correct.) A. The interfaces in a HSRP group share a virtual MAC address. An HSRP group can support a maximum of eight switches. Routers in an HSRP group can be any router interface that supports HSRP. packets from the host are lost.

Voice VLAN D. The voice VLAN feature enables access ports to carry IP voice traffic from an IP phone.) A. transparent D. PortFast C. client B. server C.QUESTION 26 Which VTPv2 mode does the switch operate without participating in VTP? A. 802. This feature instructs the port to skip listening and learning state and move to forwarding state immediately. The simple example below shows how to configure voice VLAN on an interface: . QinQ B.1q Correct Answer: BC Section: (none) Explanation Explanation/Reference: The Portfast feature can be configured on both access or trunk port. STP Mode E. off Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 27 Which two features can you configure on a access port? (Choose two.

no cdp run in global configuration C. (Choose two. QUESTION 28 How to disable CDP? (Choose two. no cdp enable on interface E.Note: This is not a trunk port (although two VLANs are configured on an interface). no cdp enable in global configuration Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 29 Storm control options apart from the default one. shutdown C. cdp disable on interface D. trap D. log B. let admin know Correct Answer: BC Section: (none) Explanation . err-disable E.) A.) A. no cdp run on interface B. Cisco calls this a Multi-VLAN access port.

Can have 128 AVFs on an interface B. Correct Answer: BE Section: (none) Explanation Explanation/Reference: Source: https://www. GLBP supports up to 1024 virtual routers per group. Support for multiple protocols E.Explanation/Reference: QUESTION 30 Which two statements about GLBP is true? (Choose two.) . Uses client server model C.) A.) A. Can work with dual active AVGs D.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10. Is compatible with TACACS+ Correct Answer: BC Section: (none) Explanation Explanation/Reference: https://www. Maximum 4 AVFs allowed in a group C. (Choose two. Uses UDP to exchange traffic D. Can have 6 AVFs in a group E.html QUESTION 31 Which of these two options are true about RADIUS? (Choose two. Uses TCP port 49 B.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.cisco.cisco.pdf (page 2) QUESTION 32 A question on TACACS+.

A.) (NOTE: Original question similar to this asks for two (2) answers. More secure then RADIUS as it uses UDP. but this is just a concept only based on exhibit. Has support for multiple protocols other than IP. Backward compatible with TACACS. D.pdf (pages 3 and 4) QUESTION 33 Refer to the exhibit. Separates authentication and authorization. C. . Encrypts just the header. B.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10. E. Correct Answer: CD Section: (none) Explanation Explanation/Reference: https://www. Which three statements about the network environment of the interface that generated the exhibit is true? (Choose three.) A. The configured VRRP priority of the interface is 120.

D. The Skew time 0.B. because the Tracked Object is down in the exhibit and decrement value was 15 and the current priority is 105. The Down Interval is 3 seconds + Skew Time. If the priority of another router is higher than the priority of the master router. correlate IP to domain name D. We can also confirm the configured priority by manually calculating the Skew Time.531 seconds. Correct Answer: ACE Section: (none) Explanation Explanation/Reference: Original question was to choose only two (2) answers. resource not available in 12. drops all traffic outside the domain E. limit traffic from untrusted C.com/vrrp-skew-time-and-always-be-learning/ We can determine that the configured priority was 120. E. (120 . (Choose two. it becomes the master router. limit / intercept messages from untrusted B.531 (this is the Skew Time) In the exhibit.) A.2 IOS Correct Answer: AB Section: (none) Explanation .531 sec.15 = 105). The formula for the Skew Time is (256 . 256 — 120 = 136. QUESTION 34 A question about DHCP snooping feature.configured priority) / 256. The device on which the interface resides is acting as a standby router. we saw Master Down interval is 3. The configured VRRP priority of the interface is 105. 136/256 = 0. Explanation about the Skew Time can be found here: https://|khill. C.

) A. send periodic broadcast D. Err-disable auto recovery C.) A. disabled when native VLAN mismatched B.) A. (Choose two. switchport trunk native vlan x . can be disable on interface only C. UDLD reset B.Explanation/Reference: QUESTION 35 A question about how to recover err-disable. Shut and restart D. send periodic multicast Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 37 A question about how to tag native VLAN X. UDLD recovery Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 36 A question about which is true about CDP? (Choose two. (Choose two.

Cisco proprietary D. D. uses extended. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 39 A question about AAA with TACACS+ (Choose three. uses UDP 49 C. Config#…. Err-disabled when max allowed mac B. uses TCP 49 B..B... ??? E.) A. (Choose two. uses standard. ??? D.. E. Config#…. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 38 A question about port security (mac)..) A. . encapsulation dot1q native vlan x C.. ??? C..

no cdp run on global configuration B. Which action do you take to correct the problem? .) A. no cdp run on enable mode Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 41 Refer to the exhibit.Correct Answer: ACD Section: (none) Explanation Explanation/Reference: QUESTION 40 A question about how to disable CDP. no cdp run on sub-interface D. You can change the SDM template to maximize the number of supported MAC addresses. You noticed that the switch routing performance has been significantly degraded. no cdp enable to disable per interface C. no cdp enable to shutdown per interface E. (Choose two.

It is a Cisco proprietary implementation. QUESTION 42 Which three characteristics of AAA with RADIUS are true? (Choose three. Configure sdm prefer routing C. Execute clear ip route command to reset the routing table. E. .A. It uses standards-based implemented. D. Configure sdm prefer vlan B. It runs on UDP port 1812. Configure sdm prefer default Correct Answer: D Section: (none) Explanation Explanation/Reference: Answer D is correct cause the question asks to maximize supported MAC address. B. It runs on TCP port 49. It uses a client-server architecture. D. C.) A.

Correct Answer: A Section: (none) Explanation . E.) A. To use space in MAC address table. They require VTP. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 44 Why the network administration can want to to disable MAC address learning on the router? A. Frame on the voice VLAN are tagged with a Layer 2 CoS value. B. Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 43 Which two statements about an access port with voice VLAN are true? (Choose two. D. To free up space in MAC address table. They can be configured on VLANs 1 through 1001. It uses a client-private cloud architecture. C. D. To wipe space in MAC address table. C. They support a single VLAN for data traffic.F. They can be configured on trunk ports and access ports. B. There was a security violation.

from the client to the server. It separates authentication and authorization Correct Answer: BEF Section: (none) Explanation Explanation/Reference: RADIUS encrypts only the password in the access-request packet. Per switch port. It encrypted the whole transition F.pdf QUESTION 46 Which three advantages of TACACS+ are true? (Choose three. D. Correct Answer: A Section: (none) Explanation Explanation/Reference: To re-enable MAC address learning on an interface or VLAN. It encrypted the passwords E. It integrates authentication and authorization B.) A. On the VLAN interface. use the default mac address-table learning global configuration command. A VLAN filter template is necessary.Explanation/Reference: QUESTION 45 Where can you disable MAC address learning on the switch? A.cisco. It controls access to endpoint devices D. Other .com/c/en/us/td/docs/wireless/mwr_2941_dc/software_config/guide/3_3/2941_33_Config_Guide/mac_lrn. https://www. With the global command mac-address disable. C. B. The remainder of the packet is unencrypted. It controls access to network devices C.

and accounting. However. QUESTION 47 Which two restrictions of the port security feature are true? (Choose two. the body of the packet is fully encrypted for more secure communications. EtherChannel E. during normal operation. encapsulation dot1q native vlan 99 C. For debugging purposes. private VLANs Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 48 How to tag native VLAN 99? A.) A. can be captured by a third party.information. it is useful to have the body of the packets unencrypted. authorized services. trunk ports B. SPAN ports C. tunnel ports D. Within the header is a field that indicates whether the body is encrypted or not. such as username. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. switchport vlan native 99 Correct Answer: A Section: (none) Explanation Explanation/Reference: . switchport trunk native vlan 99 B. switchport mode trunk native vlan 99 D.

Switches can be stack with port-channel. Disable TACACS+ authentication B. . B. Disable RADIUS authentication C. It's a last resource (or resort) login D. Need to disable CDP. C. Need to enable LLDP. B. (Choose two. Can be configured on the same port and keep CoS. Multiple switch can be stack.QUESTION 49 A question about voice VLAN. Need to be configured on a separated VLAN.) A. E. D. Is the prefer logging method in Cisco switches Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 51 Which one is related to Stackwise technology? A. Not available Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 50 What happens if we add "line" on AAA command? A.

storm control D. After initial boot (I think another switch). Due to UDLD normal mode. D. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 53 Which technique will control broadcast. STP C. the other switch didn't get the BPDU message. Due to port security configuration. D. Master switch and backup switch is listed in line. port security B. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 52 A switch which was connected with 2 fiber cable attached to another switch. What was the reason for that? A. Due to UDLD aggressive mode. Due to STP. B. one of the link get error-disable or shutdown.C. SPAN Correct Answer: C Section: (none) . C. multicast and unicast problem? A. ProStack with mix switch. the other switch didn't get the BPDU message.

UDLD reset B. (config-if)# no cdp run E.CONCEPT A. (config)# no cdp run B. UDLD recovery Correct Answer: AB Section: (none) Explanation Explanation/Reference: .Explanation Explanation/Reference: QUESTION 54 A question about how to disable CDP? (Choose two. (config)# no cdp enable Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 55 How to recover err-disable after an UDLD failure? (CONCEPT) A.) . Shut and no shutdown (restart) D. (config-if)# cdp disable F. Reboot the switch E. (config)# cdp disable C. Err-disable auto recovery C. (config-if)# no cdp enable D.

Ensure that DHCP server is connected in a trusted interface D. Define and configure a DHCP server B. restrict C. shutdown D. Enable DHCP snooping globally F. Enable DHCP snooping on at least one VLAN C. Prevent DHCP server from connecting to a trusted interface Correct Answer: ABCDE Section: (none) Explanation Explanation/Reference: Concepts: – Define and configure a DHCP server . sticky B. Configure DHCP snooping DB agent E. Redirect DHCP snooping locally G.) . protect Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 57 How to configure DHCP snooping and DAI (Dynamic ARP Inspection) in VLAN? (Choose all that apply.QUESTION 56 Which configuration do you apply to an interface so that it port security to learn and commit the first MAC address? (CONCEPT) A. Disable DHCP snooping on at least one VLAN H.CONCEPT ONLY A.

LAN Base B.CONCEPT ONLY A.html#wp1114907 QUESTION 58 Which three feature sets are used in Stackwise technology? (Choose three. you cannot mix software feature sets. C. etc.– Enable DHCP snooping on at least one VLAN – Ensure that DHCP server is connected in a trusted interface – Configure DHCP snooping DB agent – Enable DHCP snooping globally https://www. D. a broadcast storm would occur.) .CONCEPT ONLY A. QUESTION 59 Which statement is true about Stackwise? . These reports are integral for meeting compliance needs. IP Services E. WAN Services D. LAN Agent Correct Answer: ABD Section: (none) Explanation Explanation/Reference: The switch port monitor provides data on network switches by port in use. B. When building a Switch stack. When building a Switch stack.cisco. Correct Answer: A Section: (none) Explanation . As a best practice for safeguarding your network from security risks. memory used. When building a switch stack. you can mix software feature sets. IP Base C. ARP Base F.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. accurate information on unused switch ports helps the administrator keep these ports closed. You can even drill down into specific port data to obtain active and historical port utilization information. performance will be degraded. When building a switch stack. CPU load.

C. Accurate information on unused switch ports is not neccessary. When building a Switch stack. you cannot have some switches with LAN Base and some with IP Services. QUESTION 61 Refer to the exhibit. For example.CONCEPT ONLY A.Explanation/Reference: There are three main software feature sets: LAN Base. QUESTION 60 Which three statements about SPAN and RSPAN are true? (Choose three. memory used. E. CPU load and memory used. These reports are integral for meeting compliance needs. CPU load. etc. You can even drill down into specific port data to obtain active and historical port utilization information. Correct Answer: ABC Section: (none) Explanation Explanation/Reference: The switch port monitor provides data on network switches by port in use. IP Base. As a best practice for safeguarding your network from security risks. Which two statements about the flag of the EtherChannel is true? (Choose two. Does not provide specific port data to obtain active and historical port utilization information. It provides specific port data to obtain active and historical port utilization information.) . Accurate information on unused switch ports helps the administrator keep these ports closed for security risk best practices. D. accurate information on unused switch ports helps the administrator keep these ports closed. you cannot mix software feature sets. The switch port monitor provides data on network switches by port in use. IP Services.) . B.

C. E. Flag R indicates Layer 2 is operational. Flag S indicates Layer 2 is operational. Correct Answer: AB Section: (none) Explanation Explanation/Reference: . Flag H indicates EtherChannel is operational. Flag U indicates EtherChannel is operational. Flag U indicates Layer 2 is operational.A. D. B.

DSW2(config-if)# spanning-tree port priority 0 Correct Answer: ABC Section: (none) Explanation . DSW1(config)# interface g1/0 C. DSW1(config-if)# spanning-tree port priority 16 B. DSW2(config-if)# spanning-tree port priority 16 D. Which three actions you need to perform to make the traffic goes through DSW1 to DSW2? (Choose three. DSW2(config)# interface g1/0 E.) .CONCEPT ONLY A.QUESTION 62 Refer to the exhibit.

Port-Channel protocol is Cisco proprietary. Which three statements about the flag of the EtherChannel is true? (Choose three. Port-Channel is bundled in Group 10.Explanation/Reference: QUESTION 63 Refer to the exhibit. . Flag U indicates EtherChannel is operational. C. Flag S indicates Layer 2 is operational.) .CONCEPT ONLY (BASED ON THE ORIGINAL WITH 2 ANSWERS) A. D. B.

Flag SU indicates the EtherChannel is suspended.E. Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 64 Refer to exhibit: How to make DSW1 the primary root for VLAN 10.CONCEPT ONLY . (Choose two.) .

A. Change DSW2 bridge priority to VLAN 20 to 61440 B. Change DSW1 bridge priority to VLAN 10 to 4096 .

Change DSW1 bridge priority to VLAN 20 for 4096 D. D. The LLDP reinitialisation delay is 5 seconds. Change DSW1 bridge priority to VLAN 10 for 1 E. E.C. DHCP snooping database C. The LLDP hold time is 120 seconds. Correct Answer: ABD . B. The LLDP interface state is enabled. Routing information Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 66 Which three settings are part of a default LLDP configuration? (Choose three. C. Spanning trees information D. The LLDP global state is disabled. The LLDP timer is 60 seconds. Change DSW1 bridge priority to VLAN 10 with the command priority root Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 65 Which information does the subordinate switch in a switch stack keep for all the VLANs that are configured on it? (CONCEPT ONLY) A. VLAN database B.) A.

Inventory Management TLV E. none D. Native VLAN TLV Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 68 Which fallback method can you configure to allow all AAA authorization requests to be granted if the other methods do not respond or return an error? A. RADIUS C.Section: (none) Explanation Explanation/Reference: QUESTION 67 Which two TLVs are included in Cisco Discovery Protocol advertisements? (Choose two.) A. enable B. TACACS+ Correct Answer: C Section: (none) Explanation Explanation/Reference: . System Name TLV D. VTP Management Domain TLV C. Network Policy TLV B.

E. B. It can be configured to prevent the override of the VLAN database. E. by design it does this no configuration is necessary.I believe true . QUESTION 70 Which two statements about VRRP advertisements are true? (Choose two. Correct Answer: AE Section: (none) Explanation Explanation/Reference: http://brbccie. They are sent every three seconds by default.) A.wordpress.com/2014/07/vtp-v3. VLANs in the extended range are now eligible to participate in VTP. They are sent from the master router and standby routers.4094) VTP can now be turned off completely. D.QUESTION 69 Which two new features are included in VTPv3? (Choose two. They include VRRP timer information.html Supports extended VLANs (1006 . They are sent only from the master router. as opposed to just transparent mode Fixes the bane of VTP v1/2.com/2015/08/07/virtual-router-redundancy-protocol/#_jmp0_ a. D. VTP now supports MD5 passwords. VLANs configured for token ring are now eligible to participate in VTP.) A. C. C.blogspot. VTPs can now be configured in off mode. the accidental-high-configuration-revision-wipes-out-your-network issue. They include priority information. they are sent from the master router and standby routers . Correct Answer: AD Section: (none) Explanation Explanation/Reference: https://yurmagccie. B.

then Local router changes its state to Master. When you enable VRRP on interface router goes from Init to Backup state.is true because of the above e.False because: There are three possible states of VRRP router: Init.cisco. 802. In Backup state Local router sends and listens to VRRP Advertisement messages from other routers. SNMP settings Correct Answer: DE Section: (none) Explanation Explanation/Reference: https://www. If there are no VRRP Advertisement messages with higher priority value or with same priority value and higher IP address. and SNMP settings—that apply to all stack members • Stack member interface-specific configuration settings.pdf Switch Stack Configuration Files The configuration files record these settings: • System-level (global) configuration settings—such as IP.b. then Local router stays in Backup state. they include priority information .com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_40_se/configuration/guide/scg1/swstack. speed/duplex settings C. Backup. which are specific for each stack member QUESTION 72 A question about the effective way to handle unknown traffic? . QUESTION 71 Which two StackWise configuration setting types are applied at the system level? (Choose two. d. they include VRRP timer information . The router in VRRP group will ignore VRRP advertisement messages with timer values that do not match to local timer values c.False because: All routers in a VRRP group must use the same timer values. hold time 3. VLAN settings E. port-security settings D. they are sent only from the master router . If Local router receives VRRP Advertisement message with higher priority value or with same priority value but higher IP address. VLAN.False because: Defaults: Hello time 1 sec. they are sent very three seconds by default .) A. STP.6 sec. Master.1x settings B.

) A. DSCP Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 74 Which command can you enter to set the time between BPDUs in an MST environment by route bridge? A. spanning-tree mst max-age 20 . spanning-tree mst 1 cost 5 B. IP address D. VLAN ID E. MAC address B. ARP Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 73 Which three values can Cisco IOS device use as the basis for EtherChannel load-balancing? (Choose three. spanning-tree mst hello-time 2 D. port number C. broadcast storm B. spanning-tree mst mst forward-time 5 C. IP precedence F. multicast storm D. unicast storm C.A.

configure no switchport on physical interface B. Port security must be enabled on the port level C. Port must be in interface VLAN mode D. configure EtherChannel directly on the interface C.) A. Port security must be disabled on the port level E. Port must be in access mode B.Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 75 Which two tasks must you perform on a device to ensure that an Etherchannel operate at Layer 3? (Choose two. Port must be in encapsulation mode Correct Answer: AB Section: (none) Explanation .) A. configure switchport mode access Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 76 Which two configuration requirements for port security are true? (Choose two. switchport mode trunk D. configure switchport on E.

Correct Answer: AB Section: (none) Explanation Explanation/Reference: This article is very helpful.) A. C. (Choose two. Skip STP (802. Edge devices D. B. Local only devices F. PortFast just can be connected to a workstation or server. The port is put in err-disable if connected in a trunk port.html QUESTION 78 Which two ISP devices should have trust Port-Statement with DHCP Snooping feature? (Choose two. D.) A.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/stp_enha.1D) timers. E.cisco.Explanation/Reference: QUESTION 77 A question about how PortFast works in access and trunk ports. State does not immediately bypassing the listening and learning states. Network devices E. https://www. Only ISP edge devices C. State immediately bypassing the listening and learning states. User responsible to control ISP edge devices B. Nobody is responsible to control ISP edge devices Correct Answer: AB Section: (none) Explanation .

Explanation/Reference: QUESTION 79 A question about dymanic MAC address learning. D.) A. Dynamic MAC address learning is not possible on a Ethernet switch. It is not possible to enable and disable dynamic MAC address learning only on VLAN.) . Stack works like a single device. (Choose two. Stack works with multicast only addresses. (Choose two. A. Dynamic MAC address learning is not a standard function in Ethernet networks. C. Dynamic MAC address learning is standard function in Ethernet networks. D. E. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 80 A question about StackWise. Stack does not work with single management IP. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 81 A question about using CDP and LLDP at the same time on one switch. E. B. Stack works with single management console to monitor. You can enable and disable dynamic MAC address learning only on VLAN. C. Stack works with single management IP. B.

LLDP use unicast advertisement Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 82 A question about voice LAN port. Can use CDP and LLDP at the same time B. Voice needs their own VLAN B.) A. LLDP use multicast advertisement F. Port must be trust Correct Answer: ABD Section: (none) Explanation Explanation/Reference: QUESTION 83 A question about port security violation.A. QoS works with QoS queue if the port state is set to trust E. Interface should be trunk or access D. Traffic tagged or untagged C. Port must be untrust F. (Choose three. Always shutdown by violations . Only LLDP E. Only CDP D. Can not use at the same time C. A.

Correct Answer: CD Section: (none) Explanation Explanation/Reference: Same trunking protocol (dot1q or ISL) should be used on all ports. D. Always trap by violations E. show errdisable recovery C. All ports should be a part of SPAN source and destination session. C. Ports should be contiguous. error-disable notifications/traps are active by default.B. Always disable by violations Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 84 Which two requirements are required to form a Layer 2 EtherChannel? (Choose two.) . Same trunking protocol should be used on all ports. show errdisable detect B. error-disable notifications/traps are disabled by default. The ports can be source of a SPAN session but not destination. Always error-disable by violations C. B. No port should be a part of SPAN destination session.) A.CONCEPT ONLY A. D. QUESTION 85 Which two port err-disabled recovery options are used to detect the reason? (Choose two. Always log by violations D. Ports should be in same module of switch stack. . E.

Correct Answer: AB Section: (none) Explanation Explanation/Reference: . error-disable notifications/traps is never possible.E.

the switch with the highest stack member priority value B. A. the switch with the lowest stack member priority value C. QUESTION 2 Which switch is chosen as the stack master during a stack master election or re-election? A. the switch with the highest stack member ID D. show sdm prefer vlan (config)# sdm prefer vlan B. show sdm prefer (config)# sdm prefer routing D. show sdm prefer (config)# sdm prefer default Correct Answer: D Section: (none) Explanation Explanation/Reference: Default SDM gives balance to all functions. the switch with the lowest stack member ID Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 3 . show sdm prefer routing (config)# sdm prefer routing C.Contribute QUESTION 1 A question about a Layer 2 switch has been moved over to a Layer 2 and Layer 3 environment but high CPU spike during work hours.MCQs Sept-Oct-Nov 2017 .

) . (config)# ip dhcp snooping C. (config)# interface ethernet 0/0 (config-if)# ip dhcp snooping trust (config-if)# ip arp inspection trust F. (config)# interface ethernet 0/0 (config-if)# ip dhcp arp inspect-snoop trust Correct Answer: BCDE Section: (none) Explanation Explanation/Reference: QUESTION 4 A question about storm control based on optimal storm-control configuring. storm-control broadcast level 10 20 D. (config)# ip dhcp snooping vlan 10 D. storm-control broadcast level 10bps B.Which of the following commands are valid to configure DHCP snooping with Dynamic ARP Inspection for a VLAN? (Choose all that apply.CONCEPT ONLY A. storm-control broadcast enable Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 5 A question related to security violation mode which drop unknown packets and then sends trap. (config)# ip dhcp snooping vlan arp trust B. . storm-control broadcast level 10pps C. A. (config)# ip arp inspection vlan 10 E.

1 B.A. VTP version 3 stores extended-range VLAN in VLAN database. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 7 How many VLANs can be assigned to a user access port configured for VoIP? A. D. They support pruning. Created in VTP server mode in VTP version 3. C. 3 . VTP version 1 and 2 stores extended-range VLAN in VLAN database. 2 C. Created when switch is in VTP server mode. shutdown E. inhibit B. protect Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 6 Which two statements about extended-range VLANs are true? (Choose two.) A. drop C. restrict D. B. E.

) A. 802. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 9 Which three authentication methods does VRRP use? (Choose three. No authentication E. B.) A. unlimited Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 8 A question about port security violation occur in which two circumstances? (Choose two. When sticky MAC address learning is enabled and the port has a link down condition. SHA-256 authentication D. When a port with secure MAC address attempt to use a different port in same VLAN. Cipher authentication C. D. Plain text authentication F. When the same MAC addresses enters a port more than once. When the port has received more MAC address than allowed. MD5 authentication Correct Answer: DEF .1x authentication B. C.D. E. When the CAM table overflows with dynamically learned MAC address.

Section: (none) Explanation Explanation/Reference: VRRP has three authentication schemes: No authentication Plain text authentication MD5 authentication Reference: https://www.) .com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-vrrp. Single Sign On authentication B. Plain text authentication E. MD5 authentication C.cisco. DCSP authentication F.html#GUID-B1CB24C0-2526-4790- A701-0105FDA69FC8 QUESTION 10 Which three authentication methods does GLBP use? (Choose three.html QUESTION 11 Which two authentication methods does HSRP use? (Choose two. No authentication D.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-glbp. 6-to-4 authentication Correct Answer: BCD Section: (none) Explanation Explanation/Reference: GLBP has three authentication schemes: No authentication Plain text authentication MD5 authentication Reference: https://www.) A.cisco.

Plain text authentication E. Resign . WPA2 authentication B. MD5 authentication D.) A. it sends a coup message. Hello . err-disabled B. hold E.The hello message conveys to other HSRP routers the HSRP priority and state information of the router. resign Correct Answer: BEF Section: (none) Explanation Explanation/Reference: Coup .A router that is the active router sends this message when it is about to shut down or when a router that has a higher priority sends a hello or coup .cisco.When a standby router wants to assume the function of the active router.A. coup C.html QUESTION 12 Which three HSRP exchange states are used in multicast messages? (Choose three.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-hsrp. SHA-128 authentication C. Teredo F. inherit D. hello F. No authentication methods do exist Correct Answer: CD Section: (none) Explanation Explanation/Reference: HSRP has two authentication schemes: Plain text authentication MD5 authentication Reference: https://www.

B. . The standby follow command configures an HSRP group to become a slave of another HSRP group.html#GUID-0C469257-64CB-4779- B9FC-964A2E051789 QUESTION 13 Which two tasks can be accomplished to configure multiple HSRP client groups? (Choose two. Reference: https://www. random delay so that all client groups do not change at the same time. E. Use the standby mac-refresh <seconds> command to change the refresh interval of the HSRP client group. Use the standby follow command to configure an HSRP group to become a slave of another HSRP group.) A. C. D. Use the standby mac-refresh seconds command to directly change the HSRP client group refresh interval. Use the standby mac-resurrect <seconds> command to change the refresh interval of the HSRP client group. Correct Answer: BD Section: (none) Explanation Explanation/Reference: Perform this task to configure multiple HSRP client groups.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-hsrp.cisco. Use the standby track command to configure an HSRP group to become a primary HSRP group. The default interval is 10 seconds and can be configured to as much as 255 seconds. HSRP client groups follow the master HSRP with a slight. Use the standby priority command to configure an HSRP group to become a backup of another HSRP group.message.

RSPAN VLAN prevents from carrying traffic. C.) A. B. RSPAN VLAN can not be a private primary VLAN or secondary VLAN. All RSPAN VLAN traffic is flooded. RSPAN VLAN does not support Spanning-Tree Protocol.Reference: https://www. F. RSPAN VLAN traffic only flows on trunk ports.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-hsrp. Correct Answer: ACD Section: (none) Explanation . RSPAN VLAN traffic only flows on access ports. D. E.cisco.html#GUID-EBDA2930-B8E5-4E54- 9ECC-F9F232EC2955 QUESTION 14 Which three statements about RSPAN VLAN are true? (Choose three.

It has these special characteristics: All traffic in the RSPAN VLAN is always flooded. except for SPAN destination ports. The RSPAN VLAN ID separates the sessions. multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session. RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command. For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP). you must manually configure all intermediate switches. RSPAN VLAN traffic only flows on trunk ports. Correct Answer: AB Section: (none) Explanation Explanation/Reference: The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions.cisco.html QUESTION 15 Which two statements about RSPAN VLAN are true? (Choose two. C. No MAC address learning occurs on the RSPAN VLAN. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094). . RSPAN VLAN trunks can handle Spanning-Tree protocol. STP can run on RSPAN VLAN trunks but not on SPAN destination ports. the VLAN ID and its associated RSPAN characteristic are propagated by VTP. Reference: https://www. It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session.Explanation/Reference: The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. D. No MAC address learning occurs on the RSPAN VLAN. It has these special characteristics: All traffic in the RSPAN VLAN is always flooded. E. RSPAN VLAN traffic does not get flooded. RSPAN VLAN must be configured in VLAN configuration mode using the remote-span command. RSPAN VLAN access ports can handle Spanning-Tree protocol in conjunction with SPAN destination ports. RSPAN VLAN does not support any protocols. It is also possible to have multiple RSPAN destination sessions throughout the network. B. monitoring the same RSPAN VLAN and presenting traffic to the user.) A. That is.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/ swspan. An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

It helps build the route table. E.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/ swspan. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094). such as dynamic ARP inspection (DAI). Builds and maintains the DHCP snooping binding database. Correct Answer: AD Section: (none) Explanation Explanation/Reference: DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. It rate-limits DHCP traffic from trusted and untrusted sources. It correlates IP address to hostnames. It listens to multicast messages between senders and receiver. B. D.) A. STP can run on RSPAN VLAN trunks but not on SPAN destination ports. For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP). The DHCP snooping feature performs the following activities: Validates DHCP messages received from untrusted sources and filters out invalid messages. . the VLAN ID and its associated RSPAN characteristic are propagated by VTP. It is also possible to have multiple RSPAN destination sessions throughout the network. It filters invalid messages from untrusted sources. Reference: https://www. Other security features. That is. C.cisco.html QUESTION 16 Which two functions of DHCP snooping are true? (Choose two. An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN. Rate-limits DHCP traffic from trusted and untrusted sources. also use information stored in the DHCP snooping binding database. RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command. you must manually configure all intermediate switches. multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session. monitoring the same RSPAN VLAN and presenting traffic to the user. It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session. The RSPAN VLAN ID separates the sessions. Utilizes the DHCP snooping binding database to validate subsequent requests from untrusted hosts. RSPAN VLAN traffic only flows on trunk ports. which contains information about untrusted hosts with leased IP addresses.

A single device can learn a maximum of three sticky MAC addresses. . Therefore. Reference: https://www. Configure the switchport switch-port security violation restrict 1 command. Correct Answer: AC Section: (none) Explanation Explanation/Reference: Port Security Guidelines and Restrictions Follow these guidelines when configuring port security: A secure port cannot be a trunk port.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp. D. A secure port cannot belong to an EtherChannel port-channel interface.cisco. Static port MAC address assignments are not supported.html QUESTION 17 Which two restrictions of the port security feature are true? (Choose two. Reference: https://www. C.) A. The DHCP snooping feature is implemented in software on the route processor (RP).DHCP snooping is enabled on a per-VLAN basis. A secure port and static MAC address configuration are mutually exclusive. B.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec. the feature is inactive on all VLANs. It is not supported on EtherChannel port-channel interfaces. By default. E. A secure port cannot be a destination port for Switch Port Analyzer (SPAN). all DHCP messages for enabled VLANs are intercepted in the PFC and directed to the RP for processing. You can enable the feature on a single VLAN or a range of VLANs. It is not supported on PVLAN ports.pdf (see page 32-3) QUESTION 18 Which configuration do you apply to an interface so that it uses port security to learn and commit the first MAC address? A. It is supported on destination SPAN ports.

port-channel load-balance src-ip Correct Answer: CD Section: (none) Explanation .com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec. Configure the switch for port-security aging type inactivity command. Disable the sticky MAC addresses feature.cisco. Enable the static secure MAC addresses feature. C. E. Enable the sticky MAC addresses feature. port-channel load-balance dst-ip B.pdf (see page 62-9) QUESTION 19 Which two commands can you enter to configure load-balancing at Layer 2? (Choose two. Reference: https://www. F. Correct Answer: E Section: (none) Explanation Explanation/Reference: Here is a concept example on how to learn and commit MAC addresses. port-channel load-balance src-mac D. D. Configure the switchport port-security maximum 1 command.B.) A. port-channel load-balance src-dest-mac E. port-channel load-balance src-dst-ip C.

channel-protocol pagp channel-group 1 mode on Correct Answer: BD Section: (none) . It can be disabled only at the interface level.) A. D. C. VTP relies on Cisco Discovery Protocol to carry VTP domain information. channel-protocol lacp channel-group 1 mode active D. Devices with Cisco Discovery Protocol configured send advertisement messages to a multicast address on a periodic basis. channel-protocol pagp channel-group 1 mode desirable E. B. channel-protocol pagp channel-group 1 mode auto C.Explanation/Reference: QUESTION 20 Which two statements about CDP are true? (Choose two. channel-protocol lacp channel-group 1 mode on B. Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 21 Which two command sequences must you enter on a pair of switches so that they negotiate an EtherChannel using the Cisco proprietary port-aggregation protocol? (Choose two. Devices with Cisco Discovery Protocol configured send advertisement messages to a broadcast address on a periodic basis. It is disabled when switches have mismatched native VLANs.) A. E.

) A. Enter the cdp disable command to disable it on an individual interface. Enter the no cdp run command to disable it in the global configuration. C.Explanation Explanation/Reference: QUESTION 22 Which two ways can you use to disable Cisco Discovery Protocol? (Choose two. Enter the no cdp enable command to disable it on a device. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 23 Which two statements about errdisable recovery are true? (Choose two. D. E. Errdisabled autorecovery is enabled by default. E.) A. You can use the show errdisable recovery command to view the reason a port was error-disabled. Enter the no cdp enable command to disable it on an individual interface. D. Enter the no cdp run command to disable it on an individual interface. B. Errdisable detection is enabled by default on ports with port security enabled. Errdisabled detection is disabled by default on ports with port security enabled. Correct Answer: AB Section: (none) Explanation Explanation/Reference: . C. B. You can use the show errdisable detect command to view the reason a port was error-disabled.

The virtual IP address is prohibited to be in the same subnet as the interface IP address under IPv4. E.QUESTION 24 What are the prerequisite for HSRP interface to come up? (Choose two.) A. C. B. Configure HSRP version 2 to interoperate with HSRP version 1. VIP on a separate subnet. (Choose two. The virtual IP address must be in the same subnet as the interface IP address.) . D. It requires to configure more than one first-hop redundancy protocol on the same interface. E. B. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 25 Which two prerequisites are required for an HSRP interface to come up? (Choose two. Configure an physical IP address for the interface and enable that interface before HSRP becomes active. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 26 A question based on MAC address table. There are no prerequisites required to configure HSRP. C. Physical IP address must be set.CONCEPT ONLY A.) . Virtual MAC address need to be configured. D. VIP on same subnet.

x. Fa0/3 can communicate Layer 2 switch. B. Two MAC address aaa. Fa0/2 cannot communicate in Layer 2 switch. E. Fa0/3 cannot communicate in Layer 2 switch. C. Fa0/1. ??? C. A. Fa0/1. Two MAC address aaa.aaa.aaa.A.x.aaa must be in same VLAN. ??? D. D.x in routing table. Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 27 A question about HSRP that have these options.aaa. B. ??? Correct Answer: A . R1 have x.aaa.aaa must be in different VLAN. Fa0/2.

x.x. Which two statements about the network environment are true? (Choose two.aaaa MAC address entries must be from different VLANs. Interface fa0/1 and fa0/3 cannot communicate via Layer 2 switching. A. When both R1 and R2 lose route to 10.x. D.x then either R1 or R2 will take mastership because it will be decrement of 10 the priority of R1 is 110. D. The two aaaa. B. When R1 lose route to 10. Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 29 A question with two VRRP routers and there is an IP reachability. The two aaaa. When R2 lose route to 10.x then R1 will take mastership because it will be increment of 20 the priority of R1 is 130 – minus 20 = 110 and the R1 is on .x.aaaa.Section: (none) Explanation Explanation/Reference: QUESTION 28 Refer to the exhibit.x then R1 will take mastership because it will be increment of 20 the priority of R2 is 120. E. B.x. C.aaaa. Interface fa0/1 and fa0/2 cannot communicate via Layer 2 switching.) A.x then R2 will take mastership because it will be decrement of 20 the priority of R1 is 110 – minus 20 = 90 and the R2 is on default priority (100). Interface fa0/2 and fa0/3 can communicate via Layer 2 switching. C.x.x.aaaa MAC address entries must be from the same VLANs. When R2 lose route to 10.x.

switchport trunk native vlan 99 B. default priority (90). switchport vlan native trunk 99 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 31 Which type of packet does DHCP snooping continuously check in a production network? (What kind of packets is DHCP snooping continuously check in a production network? . DHCP Acknowledge E.contributed in Certprepare) A. switchport vlan 99 native F. DHCP Snooping B. switchport native vlan 99 trunk D. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 30 How can you set VLAN 99 on a trunk to become a native VLAN? A. switchport native trunk vlan 99 E. switchport trunk vlan 99 native C. DHCP Relay C. DHCP Request D. DHCP Reply .

aaaa. . switchport access vlan 99 B.aaaa.aaaa with a show mac-address output based on Layer 3. how to untagged trunk VLAN 99? .F. It shows a show mac-address output.contributed in Certprepare) A.contributed in Certprepare) . switchport vlan 99 allow access D.) (New question with the MAC aaaa. switchport vlan 99 access C.aaaa. switchport allow access vlan 99 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 33 A question with the MAC address aaaa. (Choose two. DHCP Allow Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 32 If VLAN 99 is set to trunk. how can you set it to untagged from trunk VLAN 99? (If VLAN 99 trunk is set.

Fa0/1 and Fa0/3 cannot communicate without a Layer 3 switch. Fa0/1 and Fa0/2 are in the same VLAN. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 34 A question related to a MAC address output. D. E. C.aaaa. Device with MAC address of aaaa. Fa0/1 and Fa0/2 cannot communicate via Layer 3 switch. B.aaaa is connected to different VLAN.A. Fa0/1 and Fa0/3 can communicate without a Layer 3 switch.aaaa. B. (Choose two. . Device with MAC address of aaaa.aaaa is connected to the same VLAN.) (ANOTHER CONTRIBUTED VARIATION FROM CERTPREPARE) A. Fa0/1 and Fa0/2 are not in the same VLAN.

Fa0/1 and Fa0/3 can not communicate on the Layer 2 switch. IGMP Snooping C. Communication between VRRP members is encrypted using MD5. ARP Inspection D.C. R1 has a route to 10.1.10. DHCP Inspection Correct Answer: D . Fa0/3 and Fa0/2 can communicate on the Layer 2 switch. B.R1 is the VRRP master virtual router. Fa0/1 and Fa0/2 can not communicate on the Layer 2 switch. IGMP ??? B. R2 becomes master if R1 reboots or track in R1 does not fail. A. R2 does not have a route to 10. C.10. E. D.1/32 in routing table.1/32 in routing table.1. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 36 A question related to constant checking of DHCP messages and filtering. DHCP Snooping E. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 35 EXHIBIT INCLUDED . which statement is true about R1 and R2? A. D.

Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 38 Which feature rate-limits DHCP traffic? A. StackWise manages like a hybrid device.Section: (none) Explanation Explanation/Reference: QUESTION 37 Which two statements are true about StackWise? (Choose two. E. D.) A. DHCP Snooping B. C. DHCP Acknowledge C. DHCP Spoofing Correct Answer: A Section: (none) Explanation Explanation/Reference: . It can use multiple IP address. It looks like a multiple device. DHCP Request D. B. It looks like one device. It can use one IP address.

C. D.cisco. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 41 Which command configures VLAN 99 as an untagged VLAN on a trunk? A. All ports in the EtherChannel must be on the same module. B. SPAN must be disabled on the ports. C. B. LAN ports in the EtherChannel must be contiguous.html QUESTION 40 Which two conditions must be met to establish a Layer 2 EtherChannel? (Choose two. The trunking protocol must be the same for all links in the EtherChannel.) A. Correct Answer: BE Section: (none) Explanation Explanation/Reference: https://www. All ports in the EtherChannel must operate in half duplex.) A. switchport access vlan 99 . It enables multiple switch ports to share a single master configuration. It allows multiple switches to operate as a single switch. It monitors multiple switches from a central console. E. E. D. It groups multiple switch ports as a single EtherChannel.QUESTION 39 Which two statements are true about StackWise? (Choose two. It can use one IP address to communicate with n/w (network).com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/prod_white_paper09186a00801b096a.

switchport trunk allowed vlan 99 D. switchport trunk pruning vlan except 99 C. switchport trunk native vlan 99 Correct Answer: D Section: (none) Explanation Explanation/Reference: .B.

ciscopress.asp?p=2181837&seqNum=7 QUESTION 42 Refer to the exhibit.) .Reference: http://www. Which two statements about the network environment of the device that generated this output are true? (Choose two.com/articles/article.

B. D. If the router with a higher IP address and same HSRP priority as the active router becomes available. Currently. The local device has higher priority setting that the active router.1.1. The virtual IP address of the HSRP group is 10.A. If the local device fails to receive a hello from the active router for more than 5 seconds. The hello and hold timers are set to custom values. Which statement about the VRRP configuration on R1 and R2 is true? . R1 is the VRRP master virtual router. E. that router becomes the new active router 5 seconds later. Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 43 Refer to the exhibit. C.1. it can become the active router.

C.11/32 in its routing table. R2 does not have a route to 10.1/32 in its routing table. .10.A. R2 becomes master if R1 reboots or track in R1 does not fail. D.1.10. R1 has a route to 10. B. Communication between VRRP members is encrypted using MD5.1.

CGMP binding D. DHCP inspection F. IGMP snooping B. DHCP snooping E.Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 44 Which feature actively validates DHCP messages and drops invalid messages? A. Dynamic ARP inspection Correct Answer: D Section: (none) Explanation Explanation/Reference: . DHCP host tracking C.

They become active if any of the existing forwarding switches fail. .MCQs Dec 2017_Feb-March 2018 . listen C. They become restricted if any of the existing forwarding switches fail. D. one of the primary virtual forwarders in the listen state assumes responsibility for the virtual MAC address. Unused bandwidth is never utilized. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 2 In which state does the standby virtual gateway take election? A. init D. They communicate under TCP port 3222 for both source and destination. If an AVF has failed. B. C. reply Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 3 Which statement is true when one of its virtual gateway redundancy with an AVF has failed? A. learn B.Contribute QUESTION 1 Which statement about GLBP is true? A.

If an AVF has failed. one of the secondary virtual forwarders in the listen state assumes responsibility for the virtual MAC address. one of the primary virtual forwarders in the listen state will also fail. 2 and 4 . one of the secondary virtual forwarders in the listen state will also fail. 3. Broadcast D. Multicaccess B. and 7 C. C. 5. FDDI Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 5 Which hot standby groups numbers are used in a HSRP token ring? A.) A. 0 and 1 D.B. Token Ring F. D. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 4 Which three design types of capable Ethernet LANs does HSRP support? (Choose three. Unicast E. Multicast C. If an AVF has failed. 1 and 2 B. 0. If an AVF has failed.

VLAN D. (config)# spanning-tree guard root C. MAC address C. Token ring E.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 6 Which component does the GLBP client cache stores for each host of a particular GLBP group? A. (config)# spanning-tree root guard Correct Answer: A Section: (none) Explanation . (config if)# spanning-tree guard root B. IP address B. (config-if)# spanning-tree root guard D. DCSP Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 7 Which command is required for root guard for Cisco device to place ID:2071948x? (Where x is the last digit ID) A.

Chassis ID B. Access Switch. Access Switch D. Port ID C. ??? F. Core Switch Correct Answer: B Section: (none) Explanation Explanation/Reference: A Catalyst switch can detect an IP phone via CDP and can instruct the phone to extend a trust boundary to its auxiliary data port. Reference: CCNP BCMSN Exam Certification Guide: CCNP Self-study QUESTION 9 Which two TLVs are mandatory? (Choose two. ??? E. Multiple Layers PC B. also showing endpoint (host). ??? Correct Answer: AB Section: (none) Explanation . IP Phone. Core Switch and Data Centre Aggregation switch)? A. ??? D. Distribution Switch. The voice traffic from the phone should be implicitly trusted because the phone is both a Cisco device and a small switch that can be configured and controlled.) A. IP Phone C.Explanation/Reference: QUESTION 8 What will extend a trust boundary (There is a switch interface configuration with separate voice VLAN and data VLAN to. Distribution Switch E.

Port VLAN ID TLV (IEEE 802.cisco. Management address TLV F. Isolated address TLV G.com/c/en/us/td/docs/switches/metro/me3400/software/release/12-2_58_se/configuration/guide/ME3400_scg/swlldp.1 organizationally specific TLVs) B. Source and destination capabilities TLV Correct Answer: ABCDE Section: (none) Explanation Explanation/Reference: The switch supports these basic management TLVs. System capabilities TLV E. • Port description TLV • System name TLV • System description • System capabilities TLV • Management address TLV Source: https://www.) . MAC/PHY configuration/status TLV (IEEE 802. System description D.) .3 organizationally specific TLVs) C.Explanation/Reference: QUESTION 10 Which of the following mandatory TLVs are valid for basic management? (Choose five. Port description TLV B.CONCEPT ONLY A.CONCEPT ONLY A. These are mandatory LLDP TLVs.pdf (page 24- 2) QUESTION 11 Which two of the following organizationally specific LLDP TLVs are also advertised to support LLDP-MED? (Choose two. IP Address TLV (IEEE 802.9 organizationally specific TLVs) . System name TLV C.

??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: The switch supports these basic management TLVs.cisco.com/c/en/us/td/docs/switches/metro/me3400/software/release/12-2_58_se/configuration/guide/ME3400_scg/swlldp. • Port VLAN ID TLV ((IEEE 802. System name C. (Choose two. ??? E.1 organizationally specific TLVs) • MAC/PHY configuration/status TLV(IEEE 802.D.5 organizationally specific TLVs) Correct Answer: AB Section: (none) Explanation Explanation/Reference: These organizationally specific LLDP TLVs are also advertised to support LLDP-MED.3 organizationally specific TLVs) Source: https://www. These are mandatory LLDP TLVs.3 organizationally specific TLVs) E. ??? D. DSCP TLV (IEEE 802. Descriptive TLV (IEEE 802. • Port description TLV • System name TLV • System description • System capabilities TLV • Management address TLV .pdf (page 24- 2) QUESTION 12 A question about LLDP TLVs with two choices. System description B.) A.

com/c/en/us/td/docs/switches/metro/me3400/software/release/12-2_58_se/configuration/guide/ME3400_scg/swlldp. VLAN ID F.pdf (page 24- 2) QUESTION 13 Which two mandatory TLV types does LLDP advertise? (Choose two.) A. Port ID D. Native VLAN TLV B. Network TLV D. Description ID Correct Answer: ABCD Section: (none) Explanation .CONCEPT ONLY A.cisco. Time To Live E.Source: https://www. Platform TLV C. End of LLDPDU B. Port ID TLV F. Chassis ID TLV Correct Answer: EF Section: (none) Explanation Explanation/Reference: QUESTION 14 Which four mandatory TLVs are valid? (Choose four. Hostname TLV E. Chassis ID C. System name ID G.) .

CONCEPT ONLY A.) . Port description TLV B. System name TLV C. System capabilities TLV E. B. System description TLV D. C. maximum 16 instances to be used. Correct Answer: A Section: (none) Explanation Explanation/Reference: . Source ID TLV H. Specific TLVs G. maximum 16 instances to be used. Management address TLV F. Disables RSTP and use BPDU type 4. what happens? A. Enables RSTP and use BPDU type 2. Native hostname TLV Correct Answer: ABCDEF Section: (none) Explanation Explanation/Reference: QUESTION 16 When you enable MST on the switch. D. Enables RSTP and use BPDU type 4. maximum 16 instances to be used. maximum 16 instances to be used. Disables RSTP and use BPDU type 2.Explanation/Reference: QUESTION 15 Which six optional TLVs are valid? (Choose six.

(config-if)# ip dhcp snooping information option allow-untrusted C. (config)# interface FastEthernet 0/1 (config-if) ip dhcp snooping granted (config-if)# do show ip dhcp snooping | enable pps C. (config-if)# ip dhcp snooping trust-allow information E. (config)# interface FastEthernet 0/1 (config-if)# ip dhcp snooping trust (config-if)# do show ip dhcp snooping | begin pps B.CONCEPT ONLY A. (config)# ip dhcp snooping information option (config)# do show ip dhcp snooping | include 82 (config)# ip dhcp snooping information option allow-untrusted B. (config)# ip dhcp untrusted-allow information D. (config)# dhcp allow-untrusted option information Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 18 Which of the following commands to configure a DHCP trust is valid? . (config)# interface FastEthernet 0/1 (config-if) ip dhcp snooping allowed-enable (config-if)# do show ip dhcp snooping | start pps D. (config)# interface FastEthernet 0/1 (config-if)# ip dhcp snooping enable (config-if)# ip dhcp show snoop | begin pps Correct Answer: A Section: (none) .QUESTION 17 Which two methods are used to configure a trusted option 82? (Choose two.CONCEPT ONLY A.) .

B. A. Both R1 and R2 will still become active and does not require a reboot. It is not possible for either R1 or R2 to take the priority when both rebooted. which command do you enter on SW1 interface to make it the root bridge for all VLANs? A. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 20 If switch SW1 is connected in a mesh with four other switches and all switches retain the default configuration. SW1(config)#spanning-tree port-priority 127 C. C. SW1(config)#spanning-tree port-priority 129 B. SW1(config-if)#spanning-tree port-priority 127 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 21 . D. R2 will become active when reboot.Explanation Explanation/Reference: QUESTION 19 What will happen if R1 or R2 reboot which will take the priority. R1 will become active when reboot. SW1(config-if)#spanning-tree port-priority 129 D.

0.9. It is assigned multicast address 224. It supports both MD5 and SHA1 authentication. Its IP address number is 115.) A. spanning-tree priority D. storm control action default .0. switchport mode B. C. B. D. storm control action shutdown B. F. E. It is assigned multicast address 224. The TTL for VRRP packets must be 255. Three versions of the VRRP protocol have been defined.0. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 22 Which two attributes must match across the member ports.) A.8. spanning-tree cost C. VLAN membership Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 23 Which tool can error-disable an interface if the storm control threshold is exceeded? A. when a Layer 2 EtherChannel is configured? (Choose two.Which two statements about VRRP are true? (Choose two.0.

storm control enable D. Hence source traffic. storm control action trap Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 24 A switch has a pair of fiber and it has been damaged. It would be up for 15 minutes after fiber is fixed. It would be in shutdown mode until fiber is replaced. .. Which two statements is true about the configuration below? (Choose two. The port would try to actively repair the damaged fiber after 15 seconds. (???). B.) A. C. D. C. It would double the source traffic..C. On every source port configured. It would prevent loops.. Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 25 Which statement is true about SPAN on a switch? A. B.. there would be another port that can not be used normally..

) A. Stop the Option 82 and replace the source MAC address. It is mostly used when connecting to workstations and servers. Forward it C. It skips the learning state. D.1. F. E.254? A.254. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 26 What would happen if a switch gets a packet with Option 82 with the IP address of 192. Stop the Option 82 and make an proxy ARP request for the IP address 192.D.1.168. and forward it (with its own source MAC address). B. Stop the Option 82 and replace the source IP address to the switch management IP address and forward it. Drop it B. Correct Answer: CD Section: (none) . Only when the port is active when it moves to the forwarding state. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 27 Which two statements about PortFast is true? (Choose two. It will skip all spanning-tree states. C. Stop the Option 82 and forward it. D.168.

It supports VLANs 1-1001. It must have the same VIP address in all groups.Explanation Explanation/Reference: QUESTION 28 Which two statements about HSRP is true? (Choose two. It can be configured in VTP transparent. B. It must have an IP address that is active. C. It can have different VLANs with the same VLAN ID. B. It supports extended VLAN. but must have the same name. Correct Answer: BE Section: (none) Explanation Explanation/Reference: QUESTION 30 .) A. It must have the same virtual MAC address for all groups. D. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 29 Which two statements about VLAN database is true? (Choose two. Information about VLANs are stored in the configuration. C. It required all the groups to have the same routing protocols. E. but must be in the VLAN database mode.) A. D.

but they all work independently. C. VLAN 99 tagged as 1 D. ??? D. C.) A. the link of the switch light goes to solid orange. When the port goes to err-disabled. It uses proprietary modules. ??? D. It is using one IP address to manage all switches. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 32 What would happen if IEEE was VLAN 99 as native? (Choose two. VLAN 1 untagged as 99 C. VLAN 1 tagged as 99 B. It is on auto when port-security is on. B.Which two statements about err-disable is true? (Choose two. VLAN 99 untagged as 1 . ??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 31 Which two statements about stack is true? (Choose two.) A.) A. B. It shares one IP address in all switches.

On the interface configuration mode. (config-if)# ip dhcp snooping granted E. On the global configuration mode. (config)# ip dhcp snooping information option allow-untrusted C. ip dhcp snooping option replace D. On the interface configuration mode. (config-if)# ip dhcp snooping information option allow-untrusted D. ip dhcp snooping information option allow-untrusted Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 34 Which three commands are valid to configure DHCP snooping for Option 82? (Choose three. (config)# ip dhcp snooping information option enable-untrusted . dhcp snooping information option untrust C. On the interface configuration mode. (config-if)# ip dhcp snooping trust B. dhcp snooping trust B. On the global configuration mode.Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 33 Which command is used to configure DHCP snooping for Option 82? A.) .CONCEPT ONLY A.

) (2 advantages of LLDP over CDP) A. E.F. It supports checksum. (config-if)# ip dhcp snooping information option enable-untrusted Correct Answer: ABC Section: (none) Explanation Explanation/Reference: QUESTION 35 Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC address binding? A. It supports ATM. C. D. Port Security B. It supports topology change notification. Dynamic ARP Inspection Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 36 Which two advantages of LLDP are used over CDP? (Choose two. It supports FrameRelay . IP Source Guard C. It supports vendor-agnostic. B. On the interface configuration mode. DHCP Snooping D.

At least one access port must be configured in the RSPAN VLAN. D. Only the source switch in a session must support RSPAN. VLANs 1006-4094 D. modify or delete on a switch? (Choose two.Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 37 Which statement about RSPAN session is true? A. The same RSPAN VLAN is used for a RSPAN session on all switches. VLANs 2-1001 E. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 38 Which two VLAN ranges can you add. RSPAN support by default monitors at Layer 2. VLANs 1-1001 B. B.) A. VLANs 1005-4094 C. C. VLANs 2-4094 Correct Answer: CD Section: (none) Explanation Explanation/Reference: .

txt file. ??? E. RSPAN should be a trunk. C. B. The information is saved to the vlan. RSPAN port will not learn MAC address.) .) A. The information is saved to the vlan. Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 41 Which two statements are true in regards to normal and extended range VLANs? (Choose two.QUESTION 39 Which two statements in relation to RSPAN are true? (Choose two. ??? D. B.dat file. ??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 40 Where does the VLAN information get saved to? A. C. D. The information is saved to the running configuration file. The information is saved to the vlan.) (Which of the 2 below answers are related to RSPAN.conf file.

dat.dat file. Extended range VLANs from 1006-4096 are stored in the startup configuration. VLANs 1005-2030 C. VLANs 2006-6096 C. C.dat configuration file? A. VLANs 2094-4094 D. VLANs 1005-2060 . VLANs 4094-8030 Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 43 Which extended VLAN range are valid and is stored in the startup configuration? A. VLANs 1-1005 D. Normal range VLANs from 1-1005 are stored in the startup configuration. B. Normal range VLANs from 1-1005 are stored in vlan. Both normal and extended VLANs are stored in vlan. E. D. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 42 Which normal VLAN range are valid and is stored in the vlan. VLANs 1006-4096 B. Extended range VLANs from 1006-4096 are stored in vlan. VLANs 1-1005 B.dat.A.

The hello and hold timers are set to custom values. The virtual IP address if the HSRP group is 10.1. E. D. Which two statements abiout the network environment of the device that generated this output are true? (Choose two.) A. it can become the active router. If the local device fails to receive a hello from the active router for more than 5 seconds.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 44 Refer to the exhibit. Correct Answer: BC Section: (none) . The local device has a higher priority setting than the active router. B.1. that router becomes the new active router 5 seconds later.1. If a router with a higher IP address and same HSRP priority as the active router becomes available. C.

router C. BPDU filtering Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 47 Which two StackWise configuration setting types are applied at the system level? (Choose two.) . CPU-destined Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 46 Which feature prevents from sending BPDUs on a portfast enabled port? A. root guard D. multicast D. BPDU guard B.Explanation Explanation/Reference: QUESTION 45 Which type of MAC address can be dropped by a switch that is configured for MAC address filtering? A. unicast B. PortFast C.

It is not supported on EtherChannel port-channel interfaces. port-security settings B. 802. It is not supported on destination SPAN ports.1k settings Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 48 Which two restrictions of the port security feature are true? (Choose two. It is not supported on PVLAN ports. B.) A. loop disable C. loop guard B.A. D. A single device can learn a maximum of three stick MAC addresses. VLAN settings C. root guard . Static port MAC address assignments are not supported. speed/duplex settings D. E. SNMP settings E. C. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 49 Which feature do you implement so that a physical port enter the loop inconsistent state if it fails to receive BPDUs? A.

loop guard B. community C. loop block Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 50 Which feature places a port in an err-disabled state when it receives an unanticipated BPDU? A.D. BPDU ignore F. BPDU filtering Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 51 On which PVLAN type can host ports communicate with promiscuous ports? A. root guard C. flex links E. BPDU guard D. isolated Correct Answer: C Section: (none) . primary B. promiscuous D.

D. 00:00:0c:07:ac:25 C. All VLANs in the trunk are monitored. C0. C0:00:00:37:00:00 D. provided the SPAN destination port is a trunk. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 53 Which virtual MAC address does HSRP group 37 use with default configuration? A. Only VLANs that are configured individually as SPAN sources are monitored. All VLANs in the trunk are monitored. 00:00:00c:07:ac:37 Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 54 Which configuration do you apply to a device to place interface GigabitEthernet0/0 info VRRP group 10? . The trunk is errdisabled automatically.00:00:255:00:00 B. C. B.Explanation Explanation/Reference: QUESTION 52 Which statement about the configuration of a trunk port as the source of a SPAN session is true? A.

250.2 255.254 255.A.16.255.0 standby 10 ip 172.0 vrrp 10 priority 120 vrrp 10 preempt F.16.13.2 265 255. interface GigabitEthernet0/0 description to Executive Offices A 08-38338 ip address 172.0 vrrp group 10 ip 172.2 255. interface GigabitEthernet0/0 ip address 172.13.13.255.2 265.255. interface GigabitEthernet0/0 ip address 172.16.0 standby 10 priority 120 standby 10 preempt B.13.254 vrrp 10 priority 120 vrrp 10 preempt E.13.13.254 255.0 vrrp group 10 priority 120 D.255.255.255.13.255.0 vrrp 10 ip 172.255.255.254 255.255.254 256.16.13.0 vrrp 10 active C.13.254 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 55 .2 255.0 vrrp 10 ip 172.2 255. interface GigabitEthernet0/0 ip address 172.255.16.16.16.16.0 vrrp 10 ip 172.255.16.256. interface GigabitEthernet0/0 ip address 172.13.16.16.255.255.13.255.16.255. interface GigabitEthernet0/0 description to Executive Offices A 08-38338 ip address 172.255.13.0 standby 10 ip 172.

all monitored packets are captured without the IEEE 802. Spanning Tree uses only the member ports for forwarding. . MAC addresses are associated with a VLAN. MAC addresses are not learned on extended VLANs.1Q tag that they had on the source port F. all monitored packets include the IEEE 802. By default.Which two statements about the monitored traffic in a SPAN session are true? (Choose two. Sources can be ports or VLANs or any combination in the same session E. MAC addresses are aged out of the MAC table after 600 seconds. Spanning Tree uses the port channel for forwarding. You cannot configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs B. MAC address filtering is enabled on trunk ports. Ingress SPAN monitors packets received by the source interface before any QoS modifications Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 56 Which statement about the default behavior of a Cisco switch MAC address table is true? A. B. B. D. By default.1Q tag C. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 57 When a Layer 2 EtherChannel is configured. Egress SPAN monitors packets sent by the source interface before any QoS modifcations D. C. which statement about interaction with the Spanning Tree Protocol is true? A.) A.

HSRP supports up to 255 groups in the same switch or router. switchport block unicast Correct Answer: A Section: (none) . E. and VRRP are true? (Choose two. GLBP. VRRP is a Cisco proprietary protocol. HSRP is the preferred protocol to be used in multivendor environments. switchport port-fast D. Spanning Tree does not use port channels in loop prevention. D. GLBP allows for a maximum of four MAC addresses per group. switchport protected B.) A. It is not forwarded if the destination MAC address is unknown. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 58 Which two statements about HSRP.C. D. Spanning Tree uses the port channel and member ports for forwarding. C. C. one standby router. and many listening routers. Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 59 Which command can be used to block a frame with an unknown destination MAC address from being forwarded out of an interface? A. VRRP has one master router. B.

Each physical port in the EtherChannel must have the same speed and duplex settings. Correct Answer: AC Section: (none) Explanation Explanation/Reference: . D. E. to configure a VLAN as an SVI B. They use an MD5 hash for equal load balancing.) A. F. They require Cisco Discovery Protocol. to implement port security D. to reduce flooding in the network Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 61 Which two statements about manually-configured LACP EtherChannels are true? (Choose two. to free up space in the MAC address table C. LACP negotiation must be disabled on one device in the EtherChannel. LACP negotiation must be disabled on both devices in the EtherChannel. the ports are placed into the errdisabled state. B. If the physical port configurations on the two devices are different.Explanation Explanation/Reference: QUESTION 60 For which reason does an administrator disable MAC address learning within a VLAN? A. C.

aaaa. It uses dual active AVGs for redundancy. .aaaa MAC address entries must be from the same VLAN. E. It supports up to 128 virtual routers per physical interface. It can load-share LAN traffic across up to four AVFs in a GLBP group. It can automatically adjust group weighting when an interface goes down. Interfaces Fa0/1 and Fa0/2 cannot communicate via Layer 2 switching. C.) A. D. Interfaces Fa0/1 and Fa0/3 cannot communicate via Layer 2 switching. B. LAN traffic can be distributed to up to six routers in a GLBP group. Which two statements about the network environment are true? (Choose two. B.) A.QUESTION 62 Which two statements correctly describe the benefits of GLBP? (Choose two. Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 63 Refer to the exhibit. C. The two aaaa.

which two attributes must match across the member ports? (Choose two. spanning-tree cost C.) A.D. Dynamic ARP Inspection B. ??? D. interface description B. ??? .aaaa MAC address entries must be from different VLANs. E. The two aaaa. allowed VLANs E.) A. Correct Answer: CD Section: (none) Explanation Explanation/Reference: QUESTION 64 When a Layer 2 trunking EtherChannel is configured. and the method to prevent it. trunking mode Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 65 Which method is used to prevent from ARP poisoning? (The question is about ARP poisoning. Interfaces Fa0/2 and Fa0/3 can communicate via Layer 2 switching.aaaa. DHCP Snooping C. spanning-tree priority D.

D. Spanning tree blocks EtherChannel formation on the device. C. The native VLAN can be changed on a per port basis.) A. The switch port continues to negotiate an EtherChannel even when there are configuration discrepancies between the two ports. Only one VLAN can be the native VLAN on a device. The switch port error disables when a port attempts to form an EtherChannel with a port that has a different configuration. Cisco Discovery Protocol versions 1 and 2 can carry native VLAN information. Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 67 Refer to the exhibit. Which effect of this configuration is true? A. C. B. D. VLAN 1 and VLAN 1001 are native VLANs by default. The native VLAN is untagged over trunks. Correct Answer: C Section: (none) . E. B.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 66 Which two statements about native VLANs are true? (Choose two. Spanning tree is disabled if the switch port establishes an EtherChannel.

cost D. SW1(config)# ip arp inspection vlan 15 Correct Answer: D Section: (none) Explanation Explanation/Reference: . SW1(config-vlan)# ip arp inspection trust C.Explanation Explanation/Reference: QUESTION 68 Which keyword can be applied to the spanning-tree priority command that allows the IT department to adjust the timers based on the number of switches between any two end stations? A. diameter E. SW1(config-vlan)# ip arp inspection vlan 15 B. hello-time Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 69 Which command do you enter to enable Dynamic ARP Inspection for VLAN 15? A. SW1(config-if)# ip arp-inspection trust D. priority C. root primary B.

C. SW1(config-vlan)# ip arp inspection trust C. E. SW1(config)# ip arp inspection vlan 15 Correct Answer: CD Section: (none) Explanation Explanation/Reference: Refer page 8 https://www.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_20_se/configuration/guide/3560scg/swdynarp.) A. B. SW1(config-vlan)# ip arp inspection vlan 15 B. Static MAC address assignments are not supported.) A.pdf This example shows how to configure dynamic ARP inspection on Switch A in VLAN 1. Correct Answer: ABC Section: (none) Explanation .QUESTION 70 Which command do you enter to enable Dynamic ARP Inspection for VLAN 15? (If this question asks for two answers. SW1(config-if)# ip arp-inspection trust D. It is not supported on PVLAN ports. A single device supports up to two sticky MAC addresses. You would perform a similar procedure on Switch B: Switch(config)# ip arp inspection vlan 1 Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip arp inspection trust QUESTION 71 Which three restrictions of port security features are true? (Choose three. D. It is not supported on destination SPAN ports. It is not supported on EtherChannel port-channel interfaces.cisco.

<-Answer A secure port cannot belong to an EtherChannel port-channel interface. STP C.Explanation/Reference: Port Security Guidelines and Restrictions Follow these guidelines when configuring port security: A secure port cannot be a trunk port.) A.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec. <-Answer Reference: https://www. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 73 Which two types of protocols use VLAN 1 as the default? (Choose two.cisco.html QUESTION 72 Which type of attack does dynamic ARP mitigates? A. A secure port cannot be a destination port for Switch Port Analyzer (SPAN). ??? E. <-Answer A secure port and static MAC address configuration are mutually exclusive. ??? E. VTP D. Virus D. CDP B. DDoS attack C. Man-in-the-middle B. ??? Correct Answer: AC .

It allows multiple switches to be managed by a single management address. It allows multiple switches to operate independently while sharing a single management address. Only RSPAN supports STP on multiple switches across a campus. C. Only RSPAN devices can monitor traffic on other device. D. Only RSPAN can log traffic on a VLAN that spans multiple switches. It supports single-chassis EtherChannel mode option. B. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 76 . C. RSPAN provides more complete monitoring of the traffic on a single switch. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 75 Which benefit of Stackwise is true? A. It enables a Layer 2 switch to be converted to a Layer 3 switch when additional switches are added to the stack.Section: (none) Explanation Explanation/Reference: QUESTION 74 For which reason would you configure RSPAN instead of SPAN on your network? A. D. B.

When a port is error-disabled. They can be recovered only by resetting the interface. C. the interface recovers within 15 minutes. it may continue to pass management traffic. One pair of fibre that is connected to Gi0/1 has been damaged. What is likely to happen? A.) A. Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 77 Which two statements about error-disabled ports are true? (Choose two. D. The interface is prevented from causing spanning-tree loops. error-disabled ports automatically recover once the issue is resolved. B. E. The interfaces actively tries to fix the damaged fiber link. B. The interface is shut down until the fiber pair is replaced.Refer to the exhibit. C. D. After the fiber pair is replaced. all traffic on the port stops. When a port is error-disabled. When a port is error-disabled. By default. the port LED changes to solid orange. Correct Answer: BD Section: (none) Explanation Explanation/Reference: QUESTION 78 .

B. Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 79 Which two statements about PortFast are true? (Choose two. It is most appropriate for ports that provide connectivity to individual workstations or servers. D. Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 80 Which configuration do you apply to an interface so that a host can be placed into VLAN 593? A. The port moves immediately to the forwarding state when a device is connected. C. SPAN blocks for normal use on one additional port for each configured source port. If not carefully planned. It allows the port to skip the learning state only. D.593 encapsulation dot1q 593 switchport access vlan 593 . B. E. SPAN doubles traffic internally. C. interface GigabitEthernet0/0. It forces the port to skip all spanning-tree states. SPAN halves the capacity of the source port. SPAN can lead to loops between source and destination ports.Which statement describes the result of configuring SPAN on a Cisco device? A.) A. The port is error-disabled if it attempts to move into the listening or learning states.

interface GigabitEthernet0/0 switchport mode trunk switchport trunk allowed vlan 593 D. interface GigabitEthernet0/0 switchport mode access switchport access vlan 593 switchport host Correct Answer: B Section: (none) Explanation Explanation/Reference: .B. interface GigabitEthernet0/0 switchport trunk encapsulation dot1q switchport trunk native vlan 593 switchport access vlan 593 C.

Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 3 Which four multicast addresses for HSRP. The voice VLAN must be on a different VLAN database. B.) . The voice VLAN must be configured on a trusted port. B.MCQs April 2018 . D. It only has every single protocol as the point of management to be used.) (Question about the voice VLAN. It only has one single point of management and IP address. The voice VLAN must be on the same VLAN database. C. GLBP and VRRP are valid? (Choose four. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 2 A question about the advantage of of VSS. It only has one multiple point of management and IP address.Contribute QUESTION 1 A question about voice VLAN with the possibility of two answers. It only has one single point of management and MAC address.) A. C. A. (Choose two. The voice VLAN must be configured on an untrusted port. D.

HSRP version 1 uses the multicast IP address of 224. ??? Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 5 Which three of these VLANs are a valid extended VLAN? (Choose three. The port is set to shutdown because STP.2. GLBP uses the multicast IP address using the loopback IP address of 127.0.0.0. C. D.) A. A. 4094 D. HSRP version 2 uses the multicast IP address of 224.0. C. E.0. GLBP uses the multicast IP address of 224.0.0. F.102. 3000 .0. VRRP uses the multicast IP address of 224. 4095 B.0. It shows a picture of 7 times and UDLD is set to aggressive mode.0. 4096 C..102. The port is set to shutdown because UDLD is set to aggressive mode.18 with IP protocol 112.0. The port is set to shutdown error-disabled.. B. ??? D. HSRP versions 1 and 2 both use the multicast IP address of 224.A question about UDLD.0.A. B.102.1. Correct Answer: ABCD Section: (none) Explanation Explanation/Reference: QUESTION 4 EXHIBIT INCLUDED .

B. C. D. C.) A. It offers better administrative control over which device is allowed to update other devices view of VLAN topology.) A. Use the ip dhcp snooping information command to enable data. Correct Answer: ABC . E. B.. The functionality of the VLAN environment has been expanded. It supports up to VLAN range of 2094.. ??? Correct Answer: BC Section: (none) Explanation Explanation/Reference: QUESTION 7 Which three new features of VTPv3 are true? (Choose three. D. 1006 F. ??? E. The functionality of the VLAN environment has reduced for improvement. Use the ip dhcp snooping information command to enable DHCP Option 82. Use the ip dhcp snooping information option allow-untrusted command to enable DHCP Option 82. 1005 Correct Answer: CDE Section: (none) Explanation Explanation/Reference: QUESTION 6 Which two commands are used to configure a trusted DHCP Option 82 for untrusted-host? (Choose two.E. Unintended and disruptive changes are reduced and availability has increased.

html QUESTION 8 Which two beneficial features are used for VTPv3? (Choose two. . and availability is increased.Section: (none) Explanation Explanation/Reference: Key Benefits of VTP Version 3 Much work has gone into improving the usability of VTP version 3 in three major areas: The new version of VTP offers better administrative control over which device is allowed to update other devices' view of the VLAN topology.1Q VLAN range up to 4095. It can transfer information based on PVLAN structure. The reduced risk of unintended changes will ease the change process and help speed deployment. B. Correct Answer: AB Section: (none) Explanation Explanation/Reference: Functionality for the VLAN environment has been significantly expanded. Reference: https://www. Reference: https://www.cisco. It supports the whole IEEE 802. the new version supports the whole IEEE 802.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010. It can transfer information based on CDP structure. C. B. It supports databases other than VLAN. Two enhancements are most beneficial for today's networks: In addition to supporting the earlier ISL VLAN range from 1 to 1001. D.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010. VTP version 3 can transfer information regarding Private VLAN (PVLAN) structures.) A.html QUESTION 9 Which major feature is supported using VTPv3? A. Functionality for the VLAN environment has been significantly expanded. In addition to supporting the concept of normal VLANs. The chance of unintended and disruptive changes is significantly reduced. It supports the whole IEEE 802.1Q VLAN range up to 1005.cisco.1Q VLAN range up to 4095. It supports databases other than FDDI.

It supports single point of management. Virtual Router Redundancy Protocol (VRRP). – Removes the need for Hot Standby Router Protocol (HSRP).0 can be used to centrally manage a Cisco Catalyst 6500 virtual switch as a single entity.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010. It supports Multichassis EtherChannel.) A. It supports flexible deployment options.html QUESTION 10 Which three feature advantages are supported in VSS? (Choose three.cisco. D. • Multichassis EtherChannel® (MEC) is a Layer 2 multipathing technology that creates simplified loop-free topologies. It support Singlechassis EtherChannel. Correct Answer: ABC Section: (none) Explanation Explanation/Reference: VSS increases operational efficiency by simplifying the network. which can still be activated to protect strictly against any user misconfiguration. D. C. – Only one gateway IP address is required per VLAN. B. Removes the need to configure redundant switches twice with identical policies. MST). and routing instance for the Cisco Catalyst 6500 virtual switch – Single configuration file and node to manage. • Single point of management. It supports databases other than DLCI. Correct Answer: A Section: (none) Explanation Explanation/Reference: The third area of major improvement is support for databases other than VLAN (for example. reducing switch management overhead by at least 50 percent. instead of the three IP addresses per VLAN used today. MAC address and routing instance for virtual switches. IP address and routing instance for virtual switches. and Gateway Load Balancing Protocol (GLBP) – CiscoWorks LAN Management System (LMS) 3. Reference: https://www. E. IP address. It supports multiple point of management. eliminating the dependency on Spanning Tree Protocol. . It supports databases other than DSCP.C.

D.com/c/en/us/products/collateral/switches/catalyst-6500-virtual-switching-system-1440/prod_qas0900aecd806ed74b. the switches can be located up to 40 km apart.cisco. D. It mirrors traffic from a source port to a destination port on the same switch only. SPAN destinations participate in spanning-tree instances. E. Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 12 Which two tasks must you perform on a device to ensure that an EtherChannel operates at Layer 3? (Choose two. Reference: https://www. B. with X2-10GB-ER 10 Gigabit Ethernet optics. Configure EtherChannel directly on the interface. The underlying physical switches do not have to be colocated. Configure the switchport mode trunk command on the device. Configure the no switchport command on the physical interface(s). Configure the channel-group 10 mode on command on the port channel. E. For example. C.• Flexible deployment options. Configure the switchport mode access command on the device. B.html QUESTION 11 Which statement about SPAN are true? A. Correct Answer: BD Section: (none) Explanation Explanation/Reference: . It is an industry-standard protocol for mirroring traffic. SPAN destinations also can be SPAN sources. The two physical switches are connected with standard 10 Gigabit Ethernet interfaces and as such can be located any distance based on the distance limitation of the chosen 10 Gigabit Ethernet optics. It uses a specific VLAN to transfer mirrored traffic. C.) A.

The spanning-tree operation mode for this switch is PVST. The spanning-tree operating mode for this switch is IEEE.) A. E. Only the source switch in a session must support RSPAN. RSPAN supports by default the monitoring of Layer 2 switch protocols.QUESTION 13 Which two statements about the spanning-tree operation of this switch are true? (Choose two. (Choose two. C. B.) A. The switch is operating in the default Cisco spanning-tree mode. D. B. ??? Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 15 A question about HSRP with two answers. C. The spanning-tree operation mode for this switch is PVST+. Correct Answer: DE Section: (none) Explanation Explanation/Reference: QUESTION 14 Which statement about configuring an RSPAN session is true? A. HSRP uses a shared VIP among HSRP group. The spanning-tree mode stp ieee command was entered on this switch. The same RSPAN VLAN is used for a RSPAN session on all the switches. D. .

??? Correct Answer: AD Section: (none) Explanation Explanation/Reference: QUESTION 17 Which command do you use to configure EtherChannel guard feature? (How you configure etherchannel guard feature?) A. SW(config)# spanning-tree etherchannel guard misconfig B. E. C. SW(config-if)# spanning-tree etherchannel guard misconfig . D. LLDP frame has its own CRC. SW(config-if)# portchannel etherchannel guard misconfig D. SW(config)# portchannel etherchannel guard misconfig C.B. HSRP uses a single address among HSRP group member. ??? Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 16 Which two statements about LLDP frames are true? (Choose two. C. LLDP frame sends to multicast address. LLDP frame contains unicast address within its fields. ??? D. LLDP frame consists of sequence of TLVs.) A. B.

UDLD puts the port in STP inconsistent port mode.Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 18 A question about root path election. B. the administrator must enter err-disable recovery cause udld command to recover disabled interfaces. When a link is repaired. D. interface bandwidth B. reliability D. ??? Correct Answer: C Section: (none) Explanation Explanation/Reference: . When a link is repaired. A. interface usage Correct Answer: A Section: (none) Explanation Explanation/Reference: QUESTION 19 EXHIBIT INCLUDED . A. C.A question about UDLD port disable. load C. the admistrator must enter udld reset command to recover disabled interfaces.

NVRAM: vlan. encapsulation dot1q 99 native Correct Answer: BE Section: (none) Explanation Explanation/Reference: . vlan dot1q tag native vlan 99 C.txt D. FLASH: vlan. vlan dot1q tag native B.) A. encapsulation dot1q tag native vlan 99 E.dat F. FLASH: vlan.dat Correct Answer: F Section: (none) Explanation Explanation/Reference: QUESTION 21 Which two commands or combination of commands make native VLAN 99 tagged? (Choose two. FLASH: vlan.xml C.QUESTION 20 In which place does all VLANs get stored? (In which place all VLAN are stored?) A.xml B. interface fa0/1 switchport trunk native vlan 99 D. NVRAM: vlan. NVRAM: vlan.txt E.

B. D. switch(config-if)# spanning-tree loopguard E. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 23 Which two commands enable loop guard on a Cisco switch? (Choose two.) . It learned a new MAC address. C. The switch incurred a port security violation.) A. switch(config-if)# spanning-tree guard loop B. switch(config)# spanning-tree loop guard default D. E. switch(config)# spanning-tree loopguard default Correct Answer: AE Section: (none) Explanation Explanation/Reference: QUESTION 24 Which two statements about VTP modes are true? (Choose two. It is connected to a host with an NIC that is unable to recognize. It detected a peer with a matching duplex. It detected a collision.) A. switch(config-if)# spanning-tree loop guard default C.QUESTION 22 Which two circumstances can cause a port to errdisable? (Choose two.

Private VLANs are supported on devices that run any version of VTP in server mode. it is enabled for the entire management domain. B. Correct Answer: AC Section: (none) Explanation Explanation/Reference: QUESTION 25 Which two statements about Cisco StackWise are true? (Choose two. source and destination MAC address B. D. When VTP pruning is enabled on a VTP server. source IP address . It supports both homogeneous and mixed stacks. Each stack identifier (or identifies) a stack master and a backup stack master. It supports multiple switches in a stack. C. Private VLANs are supported on devices that run VTP version 2 in transparent mode.) A. Stacks running the LAN base feature set support Layer 3 features. E. C. Extended VLANs are supported only on devices that run VTP version 3 in client mode. Correct Answer: AB Section: (none) Explanation Explanation/Reference: QUESTION 26 A single server in a company is connected via EtherChannel to a single upstream switch. E. The LAN base feature set is supported on mixed stacks. destination MAC address C. Extended VLANs are supported only on devices that run VTP version 3 in server mode. B. Which EtherChannel load balancing method on the switch makes optimal use of the redundant links as traffic flows from the router to the server? A. D.A.

D. source MAC address Correct Answer: A Section: (none) Explanation Explanation/Reference: .