300-115.examcollection.premium.exam.

631q

Number: 300-115
Passing Score: 800
Time Limit: 120 min
File Version: 14.0

300-115

Implementing Cisco IP Switched Networks

Version 14.0

Sections
1. Layer 2 Technologies
2. Infrastructure Security
3. Infrastructure Services
4. Mix Questions
Exam A

QUESTION 1
What is the maximum number of switches that can be stacked using Cisco StackWise?

A. 4
B. 5
C. 8
D. 9
E. 10
F. 13

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Up to 9 Cisco Catalyst switches can be stacked together to build single logical StackWise switch since Cisco IOS XE
Release 3.3.0SE. Prior to Cisco IOS XE Release3.3.0SE, up to 4 Cisco Catalyst switches could be stacked together.

Reference: http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-series-switches/qa_c67-722110.html

QUESTION 2
A network engineer wants to add a new switch to an existing switch stack. Which configuration must be added to the new
switch before it can be added to the switch stack?

A. No configuration must be added.

B. stack ID
C. IP address
D. VLAN information
E. VTP information

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Switch Stack Offline Configuration
You can use the offline configuration feature to provision (to supply a configuration to) a new switch before it joins the
switch stack. You can configure in advance the stack member number, the switch type, and the interfaces associated with
a switch that is not currently part of the stack. The configuration that you create on the switch stack is called the provisioned
configuration . The switch that is added to the switch stack and that receives this configuration is called the provisioned
switch.
You manually create the provisioned configuration through the switch stack-member-number provision type global
configuration command. The provisioned configuration is automatically created when a switch is added to a switch stack
and when no provisioned configuration exists.
When you configure the interfaces associated with a provisioned switch (for example, as part of a VLAN), the switch stack
accepts the configuration, and the information appears in the running configuration. The interface associated with the
provisioned switch is not active, operates as if it is administratively shut down, and the no shutdown interface configuration
command does not return it to active service. The interface associated with the provisioned switch does not appear in the
display of the specific feature; for example, it does not appear in the show vlan user EXEC command output.
The switch stack retains the provisioned configuration in the running configuration whether or not the provisioned switch is
part of the stack. You can save the provisioned configuration to the startup configuration file by entering the copy running-
config startup-config privileged EXEC command. The startup configuration file ensures that the switch stack can reload
and can use the saved information whether or not the provisioned switch is part of the switch stack.
Effects of Adding a Provisioned Switch to a Switch Stack
When you add a provisioned switch to the switch stack, the stack applies either the provisioned configuration or the default
configuration. Table 5-1 lists the events that occur when the switch stack compares the provisioned configuration with the
provisioned switch.
Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swstack.html

QUESTION 3
What percentage of bandwidth is reduced when a stack cable is broken?

A. 0
B. 25
C. 50
D. 75
E. 100

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Physical Sequential Linkage
The switches are physically connected sequentially, as shown in Figure 3. A break in any one of the cables will result in the
stack bandwidth being reduced to half of its full capacity. Subsecond timing mechanisms detect traffic problems and
immediately institute failover. This mechanism restores dual path flow when the timing mechanisms detect renewed activity
on the cable.
Figure 3. Cisco StackWise Technology Resilient Cabling

Reference: http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/
prod_white_paper09186a00801b096a.html

QUESTION 4
Refer to the exhibit.

Which set of configurations will result in all ports on both switches successfully bundling into an EtherChannel?

A. switch1
channel-group 1 mode active
switch2
 channel-group 1 mode auto
B. switch1
channel-group 1 mode desirable
switch2
channel-group 1 mode passive
C. switch1
channel-group 1 mode on
switch2
channel-group 1 mode auto
D. switch1
channel-group 1 mode desirable
switch2
channel-group 1 mode auto

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The different etherchannel modes are described in the table below:

Both the auto and desirable PAgP modes allow interfaces to negotiate with partner interfaces to determine if they can form
an EtherChannel based on criteria such as interface speed and, for Layer 2 EtherChannels, trunking state and VLAN
numbers.
Interfaces can form an EtherChannel when they are in different PAgP modes as long as the modes are compatible. For
example:
An interface in the desirable mode can form an EtherChannel with another interface that is in the desirable or auto
mode.
An interface in the auto mode can form an EtherChannel with another interface in the desirable mode.
An interface in the auto mode cannot form an EtherChannel with another interface that is also in the auto mode because
neither interface starts PAgP negotiation.
An interface in the on mode that is added to a port channel is forced to have the same characteristics as the already
existing on mode interfaces in the channel.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_13_ea1/configuration/
guide/3550scg/swethchl.html

QUESTION 5
Refer to the exhibit.
How can the traffic that is mirrored out the GigabitEthernet0/48 port be limited to only traffic that is received or transmitted
in VLAN 10 on the GigabitEthernet0/1 port?

A. Change the configuration for GigabitEthernet0/48 so that it is a member of VLAN 10.

B. Add an access list to GigabitEthernet0/48 to filter out traffic that is not in VLAN 10.
C. Apply the monitor session filter globally to allow only traffic from VLAN 10.
D. Change the monitor session source to VLAN 10 instead of the physical interface.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
To start a new flow-based SPAN (FSPAN) session or flow-based RSPAN (FRSPAN) source or destination session, or to
limit (filter) SPAN source traffic to specific VLANs, use the monitor session filter global configuration command.
Usage Guidelines
You can set a combined maximum of two local SPAN sessions and RSPAN source sessions. You can have a total of 66
SPAN and RSPAN sessions on a switch or switch stack.
You can monitor traffic on a single VLAN or on a series or range of ports or VLANs. You select a series or range of VLANs
by using the [ , | -] options.
If you specify a series of VLANs, you must enter a space before and after the comma. If you specify a range of VLANs, you
must enter a space before and after the hyphen ( -).
VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By default, all VLANs
are monitored on trunk source ports. You can use the monitor session session_number filter vlan vlan-id command to limit
SPAN traffic on trunk source ports to only the specified VLANs.
VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering cannot be enabled. If
VLAN filtering is configured, a VLAN cannot become a source.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/network_management/
command_reference/b_nm_3se_3850_cr/b_nm_3se_3850_cr_chapter_010.html#wp3875419997

QUESTION 6
Refer to the exhibit.
A network engineer wants to analyze all incoming and outgoing packets for an interface that is connected to an access
switch. Which three items must be configured to mirror traffic to a packet sniffer that is connected to the distribution switch?
(Choose three.)

A. A monitor session on the distribution switch with a physical interface as the source and the remote SPAN VLAN as the
destination
B. A remote SPAN VLAN on the distribution and access layer switch
C. A monitor session on the access switch with a physical interface source and the remote SPAN VLAN as the destination
D. A monitor session on the distribution switch with a remote SPAN VLAN as the source and physical interface as the
destination
E. A monitor session on the access switch with a remote SPAN VLAN source and the physical interface as the destination
F. A monitor session on the distribution switch with a physical interface as the source and a physical interface as the
destination

Correct Answer: BCD

Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy of the traffic to
another port on the switch or on another switch that has been connected to a network analyzer or other monitoring or
security device. SPAN copies (or mirrors) traffic received or sent (or both) on source ports or source VLANs to a destination
port for analysis.
RSPAN supports source ports, source VLANs, and destination ports on different switches (or different switch stacks),
enabling remote monitoring of multiple switches across your network. The traffic for each RSPAN session is carried over a
user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. The RSPAN traffic from
the source ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports carrying the RSPAN VLAN to a
destination session monitoring the RSPAN VLAN. Each RSPAN source switch must have either ports or VLANs as RSPAN
sources. The destination is always a physical port.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swspan.html

QUESTION 7
After an EtherChannel is configured between two Cisco switches, interface port channel 1 is in the down/down state.
Switch A is configured with channel-group 1 mode active, while Switch B is configured with channel-group 1 mode
desirable. Why is the EtherChannel bundle not working?

A. The switches are using mismatched EtherChannel negotiation modes.

B. The switch ports are not configured in trunking mode.
C. LACP priority must be configured on both switches.
D. The channel group identifier must be different for Switch A and Switch B.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Here we have a situation where one switch is using active mode, which is an LACP mode, and the other is using desirable,
which is a PAGP mode. You can not mix the LACP and PAGP protocols to form an etherchannel. Here is a summary of the
various etherchannel modes:

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/
guide/scg_2960/swethchl.html

QUESTION 8
An EtherChannel bundle has been established between a Cisco switch and a corporate web server. The network
administrator noticed that only one of the EtherChannel links is being utilized to reach the web server. What should be done
on the Cisco switch to allow for better EtherChannel utilization to the corporate web server?

A. Enable Cisco Express Forwarding to allow for more effective traffic sharing over the EtherChannel bundle.
B. Adjust the EtherChannel load-balancing method based on destination IP addresses.
C. Disable spanning tree on all interfaces that are participating in the EtherChannel bundle.
D. Use link-state tracking to allow for improved load balancing of traffic upon link failure to the server.
E. Adjust the EtherChannel load-balancing method based on source IP addresses.

Correct Answer: E
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
EtherChannel load balancing can use MAC addresses, IP addresses, or Layer 4 port numbers, and either source mode,
destination mode, or both. The mode you select applies to all EtherChannels that you configure on the switch. Use the
option that provides the greatest variety in your configuration. For example, if the traffic on a channel only goes to a single
MAC address (which is the case in this example, since all traffic is going to the same web server), use of the destination
MAC address results in the choice of the same link in the channel each time. Use of source addresses or IP addresses can
result in a better load balance.

Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html

QUESTION 9
Interface FastEthernet0/1 is configured as a trunk interface that allows all VLANs. This command is configured globally:
monitor session 2 filter vlan 1 – 8, 39, 52

What is the result of the implemented command?

A. All VLAN traffic is sent to the SPAN destination interface.

B. Traffic from VLAN 4 is not sent to the SPAN destination interface.
C. Filtering a trunked SPAN port effectively disables SPAN operations for all VLANs.
D. The trunk’s native VLAN must be changed to something other than VLAN 1.
E. Traffic from VLANs 1 to 8, 39, and 52 is replicated to the SPAN destination port.

Correct Answer: E
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The “monitor session filter” command is used to specify which VLANS are to be port mirrored using SPAN. This example
shows how to monitor VLANs 1 through 5 and VLAN 9 when the SPAN source is a trunk interface:
Switch(config)# monitor session 2 filter vlan 1 – 5 , 9

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/span.html/
index.html#wp1066836

QUESTION 10
A network engineer notices inconsistent Cisco Discovery Protocol neighbors according to the diagram that is provided. The
engineer notices only a single neighbor that uses Cisco Discovery Protocol, but it has several routing neighbor
relationships. What would cause the output to show only the single neighbor?

A. The routers are connected via a Layer 2 switch.

B. IP routing is disabled on neighboring devices.
C. Cisco Express Forwarding is enabled locally.
D. Cisco Discovery Protocol advertisements are inconsistent between the local and remote devices.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
If all of the routers are connected to each other using a layer 2 switch, then each router will only have the single switch port
that it connects to as its neighbor. Even though multiple routing neighbors can be formed over a layer 2 network, only the
physical port that it connects to will be seen as a CDP neighbor. CDP can be used to determine the physical topology, but
not necessarily the logical topology.

QUESTION 11
After the implementation of several different types of switches from different vendors, a network engineer notices that
directly connected devices that use Cisco Discovery Protocol are not visible. Which vendor-neutral protocol could be used
to resolve this issue?

A. Local Area Mobility

B. Link Layer Discovery Protocol
C. NetFlow
D. Directed Response Protocol

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by
network devices for advertising their identity, capabilities, and neighbors on an IEEE 802 local area network, principally
wired Ethernet. LLDP performs functions similar to several proprietary protocols, such as the Cisco Discovery Protocol
(CDP).

Reference: http://en.wikipedia.org/wiki/Link_Layer_Discovery_Protocol

QUESTION 12
Several new switches have been added to the existing network as VTP clients. All of the new switches have been
configured with the same VTP domain, password, and version. However, VLANs are not passing from the VTP server
(existing network) to the VTP clients. What must be done to fix this?

A. Remove the VTP domain name from all switches with "null" and then replace it with the new domain name.
B. Configure a different native VLAN on all new switches that are configured as VTP clients.
C. Provision one of the new switches to be the VTP server and duplicate information from the existing network.
D. Ensure that all switch interconnects are configured as trunks to allow VTP information to be transferred.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP allows switches to advertise VLAN information between other members of the same VTP domain. VTP allows a
consistent view of the switched network across all switches. There are several reasons why the VLAN information can fail
to be exchanged.
Verify these items if switches that run VTP fail to exchange VLAN information:
VTP information only passes through a trunk port. Make sure that all ports that interconnect switches are
configured as trunks and are actually trunking.
Make sure that if EtherChannels are created between two switches, only Layer 2 EtherChannels propagate VLAN
information.
Make sure that the VLANs are active in all the devices.
One of the switches must be the VTP server in a VTP domain. All VLAN changes must be done on this switch in order
to have them propagated to the VTP clients.
The VTP domain name must match and it is case sensitive. CISCO and cisco are two different domain names.
Make sure that no password is set between the server and client. If any password is set, make sure that the password is
the same on both sides.

Reference: http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613.shtml

QUESTION 13
After implementing VTP, the extended VLANs are not being propagated to other VTP switches. What should be configured
for extended VLANs?

A. VTP does not support extended VLANs and should be manually added to all switches.
B. Enable VTP version 3, which supports extended VLAN propagation.
C. VTP authentication is required when using extended VLANs because of their ability to cause network instability.
D. Ensure that all switches run the same Cisco IOS version. Extended VLANs will not propagate to different IOS versions
when extended VLANs are in use.

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP version 1 and VTP version 2 do not propagate configuration information for extended-range VLANs (VLAN
numbers 1006 to 4094). You must configure extended-range VLANs manually on each network device.
VTP version 3 supports extended-range VLANs (VLAN numbers 1006 to 4094). If you convert from VTP version 3 to
VTP version 2, the VLANs in the range 1006 to 4094 are removed from VTP control.
Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.1SY/config_guide/sup2T/vtp.pdf

QUESTION 14
Refer to the exhibit.

Switch A, B, and C are trunked together and have been properly configured for VTP. Switch C receives VLAN information
from the VTP server Switch A, but Switch B does not receive any VLAN information. What is the most probable cause of
this behavior?

A. Switch B is configured in transparent mode.

B. Switch B is configured with an access port to Switch A, while Switch C is configured with a trunk port to Switch B.
C. The VTP revision number of the Switch B is higher than that of Switch A.
D. The trunk between Switch A and Switch B is misconfigured.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP transparent switches do not participate in VTP. A VTP transparent switch does not advertise its VLAN configuration
and does not synchronize its VLAN configuration based on received advertisements, but transparent switches do forward
VTP advertisements that they receive out their trunk ports in VTP Version 2.

Reference: http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080094c52.shtml

QUESTION 15
Refer to the exhibit.

Switch A, B, and C are trunked together and have been properly configured for VTP. Switch B has all VLANs, but Switch C
is not receiving traffic from certain VLANs. What would cause this issue?

A. A VTP authentication mismatch occurred between Switch A and Switch B.

B. The VTP revision number of Switch B is higher than that of Switch A.
C. VTP pruning is configured globally on all switches and it removed VLANs from the trunk interface that is connected to
Switch C.
D. The trunk between Switch A and Switch B is misconfigured.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links that the traffic must use
to reach the destination devices. Without VTP pruning, a switch floods broadcast, multicast, and unknown unicast traffic
across all trunk links within a VTP domain even though receiving switches might discard them. VTP pruning is disabled by
default.
VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in the pruning-eligible list. The best
explanation for why switch C is not seeing traffic from only some of the VLANs, is that VTP pruning has been configured.

QUESTION 16
After the recent upgrade of the switching infrastructure, the network engineer notices that the port roles that were once
“blocking” are now defined as “alternate” and “backup.” What is the reason for this change?

A. The new switches are using RSTP instead of legacy IEEE 802.1D STP.
B. IEEE 802.1D STP and PortFast have been configured by default on all newly implemented Cisco Catalyst switches.
C. The administrator has defined the switch as the root in the STP domain.
D. The port roles have been adjusted based on the interface bandwidth and timers of the new Cisco Catalyst switches.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
RSTP works by adding an alternative port and a backup port compared to STP. These ports are allowed to immediately
enter the forwarding state rather than passively wait for the network to converge.
RSTP bridge port roles:
* Root port – A forwarding port that is the closest to the root bridge in terms of path cost
* Designated port – A forwarding port for every LAN segment
* Alternate port – A best alternate path to the root bridge. This path is different than using the root port. The alternative port
moves to the forwarding state if there is a failure on the designated port for the segment.
* Backup port – A backup/redundant path to a segment where another bridge port already connects. The backup port
applies only when a single switch has two links to the same segment (collision domain). To have two links to the same
collision domain, the switch must be attached to a hub.
* Disabled port – Not strictly part of STP, a network administrator can manually disable a port

Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html

QUESTION 17
An administrator recently configured all ports for rapid transition using PortFast. After testing, it has been determined that
several ports are not transitioning as they should. What is the reason for this?

A. RSTP has been enabled per interface and not globally.

B. The STP root bridge selection is forcing key ports to remain in non-rapid transitioning mode.
C. STP is unable to achieve rapid transition for trunk links.
D. The switch does not have the processing power to ensure rapid transition for all ports.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
RSTP can only achieve rapid transition to the forwarding state on edge ports and on point-to-point links, not on trunk links.
The link type is automatically derived from the duplex mode of a port. A port that operates in full-duplex is assumed to be
point-to-point, while a half-duplex port is considered as a shared port by default. This automatic link type setting can be
overridden by explicit configuration. In switched networks today, most links operate in full-duplex mode and are treated as
point-to-point links by RSTP. This makes them candidates for rapid transition to the forwarding state.
Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html

QUESTION 18
Which technique automatically limits VLAN traffic to only the switches that require it?

A. access lists
B. DTP in nonegotiate
C. VTP pruning
D. PBR

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP pruning enhances network bandwidth use by reducing unnecessary flooded traffic, such as broadcast, multicast,
unknown, and flooded unicast packets to only the switches that require it. VTP pruning increases available bandwidth by
restricting flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. By default,
VTP pruning is disabled.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
vtp.html#wp1020444

QUESTION 19
What effect does the mac address-table aging-time 180 command have on the MAC address-table?

A. This is how long a dynamic MAC address will remain in the CAM table.
B. The MAC address-table will be flushed every 3 minutes.
C. The default timeout period will be 360 seconds.
D. ARP requests will be processed less frequently by the switch.
E. The MAC address-table will hold addresses 180 seconds longer than the default of 10 minutes.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
You can configure the amount of time that an entry (the packet source MAC address and port that packet ingresses)
remain in the MAC table.
To configure the aging time for all MAC addresses, perform this task:

This example shows how to set the aging time for entries in the MAC address table to 600 seconds (10 minutes):
switch# configure terminal
switch(config)# mac-address-table aging-time 600

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/
CLIConfigurationGuide/MACAddress.html#wp1126206

QUESTION 20
While working in the core network building, a technician accidently bumps the fiber connection between two core switches
and damages one of the pairs of fiber. As designed, the link was placed into a non-forwarding state due to a fault with
UDLD. After the damaged cable was replaced, the link did not recover. What solution allows the network switch to
automatically recover from such an issue?

A. macros
B. errdisable autorecovery
C. IP Event Dampening
D. command aliases
E. Bidirectional Forwarding Detection

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
There are a number of events which can disable a link on a Catalyst switch, such as the detection of a loopback, UDLD
failure, or a broadcast storm. By default, manual intervention by an administrator is necessary to restore the interface to
working order; this can be done by issuing shutdown followed by no shutdown on the interface. The idea behind requiring
administrative action is so that a human engineer can intercede, assess, and (ideally) correct the issue. However, some
configurations may be prone to accidental violations, and a steady recurrence of these can amount to a huge time sink for
the administrative staff.
This is where errdisable autorecovery can be of great assistance. We can configure the switch to automatically re-enable
any error-disabled interfaces after a specified timeout period. This gives the offending issue a chance to be cleared by the
user (for example, by removing an unapproved device) without the need for administrative intervention.

Reference: http://packetlife.net/blog/2009/sep/14/errdisable-autorecovery/

QUESTION 21
A network engineer deployed a switch that operates the LAN base feature set and decides to use the SDM VLAN template.
The SDM template is causing the CPU of the switch to spike during peak working hours. What is the root cause of this
issue?

A. The VLAN receives additional frames from neighboring switches.

B. The SDM VLAN template causes the MAC address-table to overflow.
C. The VLAN template disables routing in hardware.
D. The switch needs to be rebooted before the SDM template takes effect.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
SDM Template Notes:
All templates are predefined. There is no way to edit template category individual values.
The switch reload is required to use a new SDM template.
The ACL merge algorithm, as opposed to the original access control entries (ACEs) configured by the user, generate
the number of TCAM entries listed for security and QoS ACEs.
The first eight lines (up to Security ACEs) represent approximate hardware boundaries set when a template is used. If
the boundary is exceeded, all processing overflow is sent to the CPU which can have a major impact on the
performance of the switch.
Choosing the VLAN template will actually disable routing (number of entry for unicast or multicast route is zero) in
hardware.
Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/44921-swdatabase-3750ss-
44921.html

QUESTION 22
An access switch has been configured with an EtherChannel port. After configuring SPAN to monitor this port, the network
administrator notices that not all traffic is being replicated to the management server. What is a cause for this issue?

A. VLAN filters are required to ensure traffic mirrors effectively.

B. SPAN encapsulation replication must be enabled to capture EtherChannel destination traffic.
C. The port channel can be used as a SPAN source, but not a destination.
D. RSPAN must be used to capture EtherChannel bidirectional traffic.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
A source port or EtherChannel is a port or EtherChannel monitored for traffic analysis. You can configure both Layer 2 and
Layer 3 ports and EtherChannels as SPAN sources. SPAN can monitor one or more source ports or EtherChannels in a
single SPAN session. You can configure ports or EtherChannels in any VLAN as SPAN sources. Trunk ports or
EtherChannels can be configured as sources and mixed with nontrunk sources. A port-channel interface (an EtherChannel)
can be a SPAN source, but not a destination.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
span.html#wp1040905

QUESTION 23
Refer to the exhibit.

What is the result of the configuration?

A. The EtherChannels would not form because the load-balancing method must match on the devices.
B. The EtherChannels would form and function properly even though the load-balancing and EtherChannel modes do not
match.
C. The EtherChannels would form, but network loops would occur because the load-balancing methods do not match.
D. The EtherChannels would form and both devices would use the dst-ip load-balancing method because Switch1 is
configured with EtherChannel mode active.
Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
An etherchannel will form if one end is active and the other is passive. The table below summarizes the results for LACP
channel establishment based on the configuration of each side of a link:

LACP Channel Establishment

Load balancing can only be configured globally. As a result, all channels (manually configured, PagP, or LACP) use the
same load-balancing. This is true for the switch globally, although each switch involved in the etherchannel can have non
matching parameters for load balancing.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/
channel.html#wp1020804

QUESTION 24
A network engineer tries to configure storm control on an EtherChannel bundle. What is the result of the configuration?

A. The storm control settings will appear on the EtherChannel, but not on the associated physical ports.
B. The configuration will be rejected because storm control is not supported for EtherChannel.
C. The storm control configuration will be accepted, but will only be present on the physical interfaces.
D. The settings will be applied to the EtherChannel bundle and all associated physical interfaces.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
After you configure an EtherChannel, any configuration that you apply to the port-channel interface affects the
EtherChannel; any configuration that you apply to the physical interfaces affects only the interface where you apply the
configuration.
Storm Control is an exception to this rule. For example, you cannot configure Storm Control on some of the members of an
EtherChannel; Storm Control must be configured on all or none of the ports. If you configure Storm Control on only some of
the ports, those ports will be dropped from the EtherChannel interface (put in suspended state). Therefore, you should
configure Storm Control at the EtherChannel Interface level, and not at the physical interface level.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/
channel.html

QUESTION 25
What is the function of NSF?

A. forward traffic simultaneously using both supervisors

B. forward traffic based on Cisco Express Forwarding
C. provide automatic failover to back up supervisor in VSS mode
D. provide nonstop forwarding in the event of failure of one of the member supervisors

Correct Answer: D
Section: Layer 2 Technologies
Explanation
Explanation/Reference:
Explanation:
VSS is network system virtualization technology that pools multiple Cisco Catalyst 6500 Series Switches into one virtual
switch, increasing operational efficiency, boosting nonstop communications, and scaling system bandwidth capacity to 1.4
Tbps. Switches would operate as a single logical virtual switch called a virtual switching system 1440 (VSS1440). VSS
formed by two Cisco Catalyst 6500 Series Switches with the Virtual Switching Supervisor 720-10GE.
In a VSS, the data plane and switch fabric with capacity of 720 Gbps of supervisor engine in each chassis are active at the
same time on both chassis, combining for an active 1400-Gbps switching capacity per VSS. Only one of the virtual switch
members has the active control plane. Both chassis are kept in sync with the inter-chassis Stateful Switchover (SSO)
mechanism along with Nonstop Forwarding (NSF) to provide nonstop communication even in the event of failure of one of
the member supervisor engines or chassis.

Reference: http://ciscorouterswitch.over-blog.com/article-cisco-catalyst-6500-series-vss-1440-124536783.html

QUESTION 26
After UDLD is implemented, a Network Administrator noticed that one port stops receiving UDLD packets. This port
continues to reestablish until after eight failed retries. The port then transitions into the errdisable state. Which option
describes what causes the port to go into the errdisable state?

A. Normal UDLD operations that prevent traffic loops.

B. UDLD port is configured in aggressive mode.
C. UDLD is enabled globally.
D. UDLD timers are inconsistent.

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
With UDLD aggressive mode enabled, when a port on a bidirectional link that has a UDLD neighbor relationship
established stops receiving UDLD packets, UDLD tries to reestablish the connection with the neighbor. After eight failed
retries, the port is disabled.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/udld.html

QUESTION 27
After reviewing UDLD status on switch ports, an engineer notices that the switch LEDs are green. Which statement
describes what this indicates about the status of the port?

A. The port is fully operational and no known issues are detected.

B. The bidirectional status of “unknown” indicates that the port will go into the disabled state because it stopped receiving
UDLD packets from its neighbor.
C. UDLD moved into aggressive mode after inconsistent acknowledgements were detected.
D. The UDLD port is placed in the “unknown” state for 5 seconds until the next UDLD packet is received on the interface.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
By default, UDLD is disabled on all interfaces. We can enable UDLD globally on the device, or individually on specific
interfaces with the command udld port. This enables UDLD in normal mode.
It would be prohibitively difficult to coordinate the configuration of UDLD on both ends of a link at the same time, so when
UDLD is first enabled and does not detect a neighbor the link state is considered unknown, which is not necessarily an
error condition. The port will remain operational during this time. When UDLD is finally enabled on the other end, the status
will transition to bidirectional.

References: http://packetlife.net/blog/2011/mar/7/udld/
QUESTION 28
Pilot testing of the new switching infrastructure finds that when the root port is lost, STP immediately replaces the root port
with an alternative root port. Which spanning-tree technology is used to accomplish backup root port selection?

A. PVST+
B. PortFast
C. BackboneFast
D. UplinkFast
E. Loop Guard
F. UDLD

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
I f a switch loses connectivity, it begins using the alternate paths as soon as the spanning tree selects a new root port. By
enabling UplinkFast with the spanning-tree uplinkfast global configuration command, you can accelerate the choice of a
new root port when a link or switch fails or when the spanning tree reconfigures itself. The root port transitions to the
forwarding state immediately without going through the listening and learning states, as it would with the normal spanning-
tree procedures.
UplinkFast provides fast convergence after a direct link failure and achieves load balancing between redundant Layer 2
links using uplink groups. An uplink group is a set of Layer 2 interfaces (per VLAN), only one of which is forwarding at any
given time. Specifically, an uplink group consists of the root port (which is forwarding) and a set of blocked ports, except for
self-looping ports. The uplink group provides an alternate path in case the currently forwarding link fails.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/
guide/scg_2960/swstpopt.html

QUESTION 29
A network engineer must adjust the STP interface attributes to influence root port selection. Which two elements are used
to accomplish this? (Choose two.)

A. port-priority
B. cost
C. forward-timers
D. link type
E. root guard

Correct Answer: AB
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Spanning tree forces redundant data paths into a standby (blocked) state. If a network segment in the spanning tree fails
and a redundant path exists, the spanning-tree algorithm recalculates the spanning-tree topology and activates the standby
path. Switches send and receive spanning-tree frames, called bridge protocol data units (BPDUs), at regular intervals. The
switches do not forward these frames but use them to construct a loop-free path. BPDUs contain information about the
sending switch and its ports, including switch and MAC addresses, switch priority, port priority, and path cost. Spanning
tree uses this information to elect the root switch and root port for the switched network and the root port and designated
port for each switched segment.
When two ports on a switch are part of a loop, the spanning-tree port priority and path cost settings control which port is put
in the forwarding state and which is put in the blocking state. The spanning-tree port priority value represents the location of
a port in the network topology and how well it is located to pass traffic. The path cost value represents the media speed.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swstp.html

QUESTION 30
A network engineer must set the load balance method on an existing port channel. Which action must be done to apply a
new load balancing method?

A. Configure the new load balancing method using port-channel load-balance.

B. Adjust the switch SDM back to “default”.
C. Ensure that IP CEF is enabled globally to support all load balancing methods.
D. Upgrade the PFC to support the latest load balancing methods.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Example:
EtherChannel balances the traffic load across the links in a channel through the reduction of part of the binary pattern that
the addresses in the frame form to a numerical value that selects one of the links in the channel. EtherChannel load
balancing can use MAC addresses or IP addresses, source or destination addresses, or both source and destination
addresses. The mode applies to all EtherChannels that are configured on the switch. You configure the load balancing and
forwarding method with use of the port-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-
mac} global configuration command.

Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html

QUESTION 31
Refer to the exhibit.

A network engineer investigates a recent network failure and notices that one of the interfaces on the switch is still down.
What is causing the line protocol on this interface to be shown as down?

A. There is a layer 1 physical issue.

B. There is a speed mismatch on the interface.
C. The interface is configured as the target of the SPAN session.
D. The interface is configured as the source of the SPAN session.
E. There is a duplex mismatch on the interface.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
With the SAPN destination port, the state of the destination port is up/down by design. The interface shows the port in this
state in order to make it evident that the port is currently not usable as a production port. This is the normal operational
state for SPAN destinations.

Reference: http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

QUESTION 32
While doing network discovery using Cisco Discovery Protocol, it is found that rapid error tracking is not currently enabled.
Which option must be enabled to allow for enhanced reporting mechanisms using Cisco Discovery Protocol?

A. Cisco Discovery Protocol version 2

B. Cisco IOS Embedded Event Manager
C. logging buffered
D. Cisco Discovery Protocol source interface
E. Cisco Discovery Protocol logging options

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
CDP Version 1 — This is the first version of CDP which was used for the discovery of Cisco devices in the network. This
version is mainly used for backward compatibility.
CDP Version 2 — This is the most recent version of CDP which has enhanced features such as rapid reporting
mechanism, which is used to track down errors and minimize costly downtime. It allows you to track instances even if
the native VLAN ID or port duplex states do not match between connecting devices. This is the default version on all
switches.

Reference: http://sbkb.cisco.com/CiscoSB/GetArticle.aspx?
docid=0ed03cbac49b446ab390a657917d817c_Cisco_Discovery_Protocol_CDP__Properties_Settings_on_Sx500_S.xml&
pid=2&converted=0

QUESTION 33
Which technique allows specific VLANs to be strictly permitted by the administrator?

A. VTP pruning
B. transparent bridging
C. trunk allowed VLANs
D. VLAN access-list
E. L2P tunneling

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
By default, a trunk port sends traffic to and receives traffic from all VLANs. All VLAN IDs, 1 to 4094, are allowed on each
trunk. However, you can remove VLANs from the allowed list, preventing traffic from those VLANs from passing over the
trunk. To restrict the traffic a trunk carries, use the “switchport trunk allowed vlan remove vlan-list” interface configuration
command to remove specific VLANs from the allowed list.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/
swvlan.html

QUESTION 34
For security reasons, the IT manager has prohibited users from dynamically establishing trunks with their associated
upstream switch. Which two actions can prevent interface trunking? (Choose two.)

A. Configure trunk and access interfaces manually.

B. Disable DTP on a per interface basis.
C. Apply BPDU guard and BPDU filter.
D. Enable switchport block on access ports.

Correct Answer: AB
Section: Layer 2 Technologies
Explanation
Explanation/Reference:
Explanation:
The Dynamic Trunking Protocol (DTP) is used to negotiate forming a trunk between two Cisco devices. DTP causes
increased traffic, and is enabled by default, but may be disabled. To disable DTP, configure “switchport nonegotiate.” This
prevents the interface from generating DTP frames. You can use this command only when the interface switchport mode is
access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link,
otherwise the link will be a non-trunking link.

Reference: http://www.ciscopress.com/articles/article.asp?p=2181837&seqNum=8

QUESTION 35
Which two protocols can be automatically negotiated between switches for trunking? (Choose two.)

A. PPP
B. DTP
C. ISL
D. HDLC
E. DLCI
F. DOT1Q

Correct Answer: CF
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Switches such as the Catalyst 3550 that are capable of either 802.1Q or ISL trunking encapsulation, the switchport trunk
encapsulation [dot1q | isl | negotiate] interface command must be used prior to the switchport mode trunk command.

Reference: https://learningnetwork.cisco.com/servlet/JiveServlet/previewBody/14792-102-1-57313/Dynamic%20Trunking%
20Protocol.PDF

QUESTION 36
A network is running VTPv2. After verifying all VTP settings, the network engineer notices that the new switch is not
receiving the list of VLANs from the server. Which action resolves this problem?

A. Reload the new switch.

B. Restart the VTP process on the new switch.
C. Reload the VTP server.
D. Verify connected trunk ports.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP should never need to have the switch reloaded or the VTP process to restart in order for it to work. The first thing that
should be done is to verify that the trunk ports are connected and up.

QUESTION 37
After configuring new data VLANs 1020 through 1030 on the VTP server, a network engineer notices that none of the VTP
clients are receiving the updates. What is the problem?

A. The VTP server must be reloaded.

B. The VTP version number must be set to version 3.
C. After each update to the VTP server, it takes up to 4 hours propagate.
D. VTP must be stopped and restarted on the server.
E. Another switch in the domain has a higher revision number than the server.
Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP version 3 supports these features that are not supported in version 1 or version 2:
Enhanced authentication—You can configure the authentication as hidden or secret. When hidden, the secret key from
the password string is saved in the VLAN database file, but it does not appear in plain text in the configuration. Instead,
the key associated with the password is saved in hexadecimal format in the running configuration. You must reenter the
password if you enter a takeover command in the domain. When you enter the secret keyword, you can directly
configure the password secret key.
Support for extended range VLAN (VLANs 1006 to 4094) database propagation. VTP versions 1 and 2 propagate
only VLANs 1 to 1005. If extended VLANs are configured, you cannot convert from VTP version 3 to version 1 or
2.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_52_se/configuration/guide/
swvtp.html#wp1316856

QUESTION 38
A network engineer is extending a LAN segment between two geographically separated data centers. Which enhancement
to a spanning-tree design prevents unnecessary traffic from crossing the extended LAN segment?

A. Modify the spanning-tree priorities to dictate the traffic flow.

B. Create a Layer 3 transit VLAN to segment the traffic between the sites.
C. Use VTP pruning on the trunk interfaces.
D. Configure manual trunk pruning between the two locations.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Pruning unnecessary VLANs from the trunk can be performed with one of two methods:
Manual pruning of the unnecessary VLAN on the trunk—This is the best method, and it avoids the use of the spanning
tree. Instead, the method runs the pruned VLAN on trunks.
VTP pruning—Avoid this method if the goal is to reduce the number of STP instances. VTP-pruned VLANs on a trunk
are still part of the spanning tree. Therefore, VTP-pruned VLANs do not reduce the number of spanning tree port
instances.
Since the question asked for the choice that is an enhancement to the STP design, VTP pruning is the best choice.

Reference: http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613.shtml

QUESTION 39
The network manager has requested that several new VLANs (VLAN 10, 20, and 30) are allowed to traverse the switch
trunk interface. After the command switchport trunk allowed vlan 10,20,30 is issued, all other existing VLANs no longer
pass traffic over the trunk. What is the root cause of the problem?

A. The command effectively removed all other working VLANs and replaced them with the new VLANs.
B. VTP pruning removed all unused VLANs.
C. ISL was unable to encapsulate more than the already permitted VLANs across the trunk.
D. Allowing additional VLANs across the trunk introduced a loop in the network.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The “switchport trunk allowed vlan” command will only allow the specified VLANs, and overwrite any others that were
previously defined. You would also need to explicitly allow the other working VLANs to this configuration command, or use
the “issue the switchport trunk allowed vlan add vlan-list” command instead to add these 3 VLANS to the other defined
allowed VLANs.

Reference: https://supportforums.cisco.com/document/11836/how-define-vlans-allowed-trunk-link

QUESTION 40
When you design a switched network using VTPv2, how many VLANs can be used to carry user traffic?

A. 1000
B. 1001
C. 1024
D. 2048
E. 4095
F. 4096

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP versions 1 and 2 Supports normal VLAN numbers (1-1001). Only VTP version 3 supports extended VLANs (1-4095).

Reference: http://cciememo.blogspot.com/2012/11/difference-between-vtp-versions.html

QUESTION 41
What does the command vlan dot1q tag native accomplish when configured under global configuration?

A. All frames within the native VLAN are tagged, except when the native VLAN is set to 1.
B. It allows control traffic to pass using the non-default VLAN.
C. It removes the 4-byte dot1q tag from every frame that traverses the trunk interface(s).
D. Control traffic is tagged.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The “vlan dot1q tag native” will tag all untagged frames, including control traffic, with the defined native VLAN.

QUESTION 42
A network engineer has just deployed a non-Cisco device in the network and wants to get information about it from a
connected device. Cisco Discovery Protocol is not supported, so the open standard protocol must be configured. Which
protocol does the network engineer configure on both devices to accomplish this?

A. IRDP
B. LLDP
C. NDP
D. LLTD

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by
network devices for advertising their identity, capabilities, and neighbors on an IEEE 802 local area network, principally
wired Ethernet. LLDP performs functions similar to several proprietary protocols, such as the Cisco Discovery Protocol
(CDP).

Reference: http://en.wikipedia.org/wiki/Link_Layer_Discovery_Protocol

QUESTION 43
A manager tells the network engineer to permit only certain VLANs across a specific trunk interface. Which option can be
configured to accomplish this?

A. allowed VLAN list

B. VTP pruning
C. VACL
D. L2P tunneling

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
When a trunk link is established, all of the configured VLANs are allowed to send and receive traffic across the link. VLANs
1 through 1005 are allowed on each trunk by default. However, VLAN traffic can be removed from the allowed list. This
keeps traffic from the VLANs from passing over the trunk link.
Note: The allowed VLAN list on both the ends of the trunk link should be the same.
For Integrated Cisco IOS Software based switches, perform these steps:
1. To restrict the traffic that a trInk carries, issue the switchport trunk vlan-Iist interface configuration command.
This removes specific VLANs from the allowed list.

Reference: https://supportforums.cisco.com/document/11836/how-define-vlans-allowed-trunk-link

QUESTION 44
For client server failover purposes, the application server team has indicated that they must not have the standard 30
second delay before their switchport enters a forwarding state. For their disaster recovery feature to operate successfully,
they require the switchport to enter a forwarding state immediately. Which spanning-tree feature satisfies this requirement?

A. Rapid Spanning-Tree
B. Spanning-Tree Timers
C. Spanning-Tree FastPort
D. Spanning-Tree PortFast
E. Spanning-Tree Fast Forward

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
In order to allow immediate transition of the port into forwarding state, enable the STP PortFast feature. PortFast
immediately transitions the port into STP forwarding mode upon linkup. The port still participates in STP. So if the port is to
be a part of the loop, the port eventually transitions into STP blocking mode.
Example configuration:
Switch-C# configure terminal
Switch-C(config)# interface range fa0/3 - 24
Switch-C(config-if-range)# sp–nning-tree portfast

Reference: http://www.informit.com/library/content.aspx?b=CCNP_Studies_Switching&seqNum=36

QUESTION 45
Which command does a network engineer use to verify the spanning-tree status for VLAN 10?

A. switch# show spanning-tree vlan 10

B. switch# show spanning-tree bridge
C. switch# show spanning-tree brief
D. switch# show spanning-tree summary
E. switch# show spanning-tree vlan 10 brief

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:

Example output:
SW2#show spanning-tree vlan 10

VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 24586
Address 0014.f2d2.4180
Cost 9
Port 216 (Port-channel21)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32778 (priority 32768 sys-id-ext 10)

Address 001c.57d8.9000
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- ---------------------------
Po21 Root FWD 9 128.216 P2p
Po23 Altn BLK 9 128.232 P2p

Reference: http://www.cisco.com/en/US/docs/ios/lanswitch/command/reference/lsw_s2.html

QUESTION 46
A new network that consists of several switches has been connected together via trunking interfaces. If all switches
currently have the default VTP domain name "null", which statement describes what happens when“a do”ain name is
configured on one of the switches?

A. The switch with the non-default domain name restores back to "null" upon reboot.
B. Switches with higher revisio“ num”ers does not accept the new domain name.
C. VTP summary advertisements are sent out of all ports with the new domain name.
D. All other switches with the default domain name become VTP clients.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
By default, a switch will have a domain name of NULL and no password. If the switch hears a VTP advertisement it will
automatically learn the VTP domain name, VLANs, and the configuration revision number.
Summary advertisements – sent out every 300 seconds and every time a change occurs on the VLAN database. Contained
in a summary advertisement:
VTP version
Domain name
 Configuration revision number
Time stamp
MD5 encryption hash code

Reference: https://rowell.dionicio.net/configuring-cisco-vtp/

QUESTION 47
A network engineer is setting up a new switched network. The network is expected to grow and add many new VLANs in
the future. Which Spanning Tree Protocol should be used to reduce switch resources and managerial burdens that are
associated with multiple spanning-tree instances?

A. RSTP
B. PVST
C. MST
D. PVST+
E. RPVST+

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Multiple Spanning Tree (MST) extends the IEEE 802.1w RST algorithm to multiple spanning trees. The main purpose of
MST is to reduce the total number of spanning-tree instances to match the physical topology of the network and thus
reduce the CPU cycles of a switch. PVRST+ runs STP instances for each VLAN and does not take into consideration the
physical topology that might not require many different STP topologies. MST, on the other hand, uses a minimum number
of STP instances to match the number of physical topologies present.
Figure 3-15 shows a common network design, featuring an access Switch A, connected to two Building Distribution
submodule Switches D1 and D2. In this setup, there are 1000 VLANs, and the network administrator typically seeks to
achieve load balancing on the access switch uplinks based on even or odd VLANs—or any other scheme deemed
appropriate.

Figure 3-15: VLAN Load Balancing

Figure 3-15 illustrates two links and 1000 VLANs. The 1000 VLANs map to two MST instances. Rather than maintaining
1000 spanning trees, each switch needs to maintain only two spanning trees, reducing the need for switch resources.

Reference: http://ciscodocuments.blogspot.com/2011/05/chapter-03-implementing-spanning-tree_19.html

QUESTION 48
Which statement about the use of SDM templates in a Cisco switch is true?

A. SDM templates are used to configure system resources in the switch to optimize support for specific features,
depending on how the switch is used in the network.
B. SDM templates are used to create Layer 3 interfaces (switch virtual interfaces) to permit hosts in one VLAN to
communicate with hosts in another VLAN.
C. SDM templates are used to configure ACLs that protect networks and specific hosts from unnecessary or unwanted
traffic.
D. SDM templates are used to configure a set of ACLs that allows the users to manage the flow of traffic handled by the
route processor.
E. SDM templates are configured by accessing the switch using the web interface.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
You can use SDM templates to configure system resources in the switch to optimize support for specific features,
depending on how the switch is used in the network. You can select a template to provide maximum system usage for
some functions; for example, use the default template to balance resources, and use access template to obtain maximum
ACL usage. To allocate hardware resources for different usages, the switch SDM templates prioritize system resources to
optimize support for certain features.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/
configuration/guide/swsdm.pdf

QUESTION 49
Which SDM template disables routing and supports the maximum number of unicast MAC addresses?

A. VLAN
B. access
C. default
D. routing

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
To allocate ternary content addressable memory (TCAM) resources for different usages, the switch SDM templates
prioritize system resources to optimize support for certain features. You can select SDM templates to optimize these
features:
Access — The access template maximizes system resources for access control lists (ACLs) to accommodate a large
number of ACLs.
Default — The default template gives balance to all functions.
Routing — The routing template maximizes system resources for Ipv4 unicast routing, typically required for a router or
aggregator in the center of a network.
VLANs — The VLAN template disables routing and supports the maximum number of unicast MAC addresses.
It would typically be selected for a Layer 2 switch.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/
swsdm.pdf

QUESTION 50
Which SDM template is the most appropriate for a Layer 2 switch that provides connectivity to a large number of clients?

A. VLAN
B. default
C. access
D. routing

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
To allocate ternary content addressable memory (TCAM) resources for different usages, the switch SDM templates
prioritize system resources to optimize support for certain features. You can select SDM templates to optimize these
features:
 Access—The access template maximizes system resources for access control lists (ACLs) to accommodate a large
number of ACLs.
Default—The default template gives balance to all functions.
Routing—The routing template maximizes system resources for Ipv4 unicast routing, typically required for a router or
aggregator in the center of a network.
VLANs—The VLAN template disables routing and supports the maximum number of unicast MAC addresses
(clients). It would typically be selected for a Layer 2 switch.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/
swsdm.pdf

QUESTION 51
In a Cisco switch, what is the default period of time after which a MAC address ages out and is discarded?

A. 100 seconds
B. 180 seconds
C. 300 seconds
D. 600 seconds

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
To configure the aging time for all MAC addresses, perform this task:

Reference: http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/MACAddress.html

QUESTION 52
If a network engineer applies the command mac-address-table notification mac-move on a Cisco switch port, when is a
syslog message generated?

A. A MAC address or host moves between different switch ports.

B. A new MAC address is added to the content-addressable memory.
C. A new MAC address is removed from the content-addressable memory.
D. More than 64 MAC addresses are added to the content-addressable memory.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
mac-address-table notification mac-move
To enable MAC-move notification, use the mac-address-table notification mac-move command in global configuration
mode. To disable MAC-move notification, use the no form of this command.
Mac-address-table notification mac-move [counter [syslog]]
no mac-address-table notification mac-move [counter [syslog]]
Syntax Description

Usage Guidelines
MAC-move notification generates a syslog message whenever a MAC address or host moves between different switch
ports.

Reference: http://www.cisco.com/en/US/docs/ios/lanswitch/command/reference/lsw_m1.html

QUESTION 53
Which option is a possible cause for an errdisabled interface?

A. routing loop
B. cable unplugged
C. STP loop guard
D. security violation

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
There are various reasons for the interface to go into errdisable. The reason can be:
Duplex mismatch
Port channel misconfiguration
BPDU guard violation
UniDirectional Link Detection (UDLD) condition
Late-collision detection
Link-flap detection
Security violation
Port Aggregation Protocol (PAgP) flap
Layer 2 Tunneling Protocol (L2TP) guard
DHCP snooping rate-limit
Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable
Address Resolution Protocol (ARP) inspection
Inline power

Reference: http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b.shtml

QUESTION 54
What is the default value for the errdisable recovery interval in a Cisco switch?

A. 30 seconds
B. 100 seconds
C. 300 seconds
D. 600 seconds

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
After you fix the root problem, the ports are still disabled if you have not configured errdisable recovery on the switch. In this
case, you must reenable the ports manually. Issue the shutdown command and then the no shutdown interface mode
command on the associated interface in order to manually reenable the ports.
The errdisable recovery command allows you to choose the type of errors that automatically reenable the ports after a
specified amount of time. The show errdisable recovery command shows the default error-disable recovery state for all
the possible conditions.
cat6knative#show errdisable recovery
ErrDisable Reason Timer Status
----------------- --------------
udld Disabled
bpduguard Disabled
security-violatio Disabled
channel-misconfig Disabled
pagp-flap Disabled
dtp-flap Disabled
link-flap Disabled
l2ptguard Disabled
psecure-violation Disabled
gbic-invalid Disabled
dhcp-rate-limit Disabled
mac-limit Disabled
unicast-flood Disabled
arp-inspection Disabled

Timer interval: 300 seconds

Interfaces that will be enabled at the next timeout:

Note: The default timeout interval is 300 seconds and, by default, the timeout feature is disabled.

Reference: http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b.shtml

QUESTION 55
Which statement about LLDP-MED is true?

A. LLDP-MED is an extension to LLDP that operates between endpoint devices and network devices.
B. LLDP-MED is an extension to LLDP that operates only between network devices.
C. LLDP-MED is an extension to LLDP that operates only between endpoint devices.
D. LLDP-MED is an extension to LLDP that operates between routers that run BGP.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
LLDP for Media Endpoint Devices (LLDP-MED) is an extension to LLDP that operates between endpoint devices such as
IP phones and network devices such as switches. It specifically provides support for voice over IP (VoIP) applications and
provides additional TLVs for capabilities discovery, network policy, Power over Ethernet, and inventory management.

Reference: http://www.cisco.com/en/US/docs/switches/metro/me3400/software/release/12.2_58_se/configuration/guide/
swlldp.pdf

QUESTION 56
Which statement about Cisco devices learning about each other through Cisco Discovery Protocol is true?

A. Each device sends periodic advertisements to multicast address 01:00:0C:CC:CC:CC.

B. Each device broadcasts periodic advertisements to all of its neighbors.
C. Each device sends periodic advertisements to a central device that builds the network topology.
D. Each device sends periodic advertisements to all IP addresses in its ARP table.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Cisco devices send periodic CDP announcements to the multicast destination address 01-00-0c-cc-cc-cc, out each
connected network interface. These multicast packets may be received by Cisco switches and other networking devices
that support CDP into their connected network interface.

Reference: http://network.spravcesite.net/subdom/network/index.php?id=cdp

QUESTION 57
Which option lists the information that is contained in a Cisco Discovery Protocol advertisement?

A. native VLAN IDs, port-duplex, hardware platform

B. native VLAN IDs, port-duplex, memory errors
C. native VLAN IDs, memory errors, hardware platform
D. port-duplex, hardware platform, memory errors

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Type-Length-Value fields (TLVs) are blocks of information embedded in CDP advertisements. Table 21 summarizes the
TLV definitions for CDP advertisements.

Reference: http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf015.html

QUESTION 58
Which option describes a limitation of LLDP?

A. LLDP cannot provide information about VTP.

B. LLDP does not support TLVs.
C. LLDP can discover only Windows servers.
D. LLDP can discover up to two devices per port.

Correct Answer: A
Section: Layer 2 Technologies
Explanation
Explanation/Reference:
Explanation:
LLDP Versus Cisco Discovery Protocol TLV Comparison

Reference: http://www.cisco.com/en/US/technologies/tk652/tk701/technologies_white_paper0900aecd804cd46d.html

QUESTION 59
Which statement about the UDLD protocol is true?

A. UDLD is a Cisco-proprietary Layer 2 protocol that enables devices to monitor the physical status of links and detect
unidirectional failures.
B. UDLD is a Cisco-proprietary Layer 2 protocol that enables devices to advertise their identity, capabilities, and neighbors
on a local area network.
C. UDLD is a standardized Layer 2 protocol that enables devices to monitor the physical status of links and detect
unidirectional failures.
D. UDLD is a standardized Layer 2 protocol that enables devices to advertise their identity, capabilities, and neighbors on
a local area network.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The Cisco-proprietary UDLD protocol monitors the physical configuration of the links between devices and ports that
support UDLD. UDLD detects the existence of unidirectional links. When a unidirectional link is detected, UDLD puts the
affected port into the errdisabled state and alerts the user.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/udld.html

QUESTION 60
Which option lists the modes that are available for configuring UDLD on a Cisco switch?

A. normal and aggressive

B. active and aggressive
C. normal and active
D. normal and passive
E. normal and standby

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The Cisco-proprietary UDLD protocol monitors the physical configuration of the links between devices and ports that
support UDLD. UDLD detects the existence of unidirectional links. When a unidirectional link is detected, UDLD puts the
affected port into the errdisabled state and alerts the user. UDLD can operate in either normal or aggressive mode.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/udld.html

QUESTION 61
What is the default interval at which Cisco devices send Cisco Discovery Protocol advertisements?

A. 30 seconds
B. 60 seconds
C. 120 seconds
D. 300 seconds

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Cisco Discovery Protocol is a Layer 2, media-independent, and network-independent protocol that networking applications
use to learn about nearby, directly connected devices. Cisco Discovery Protocol is enabled by default. Each device
configured for Cisco Discovery Protocol advertises at least one address at which the device can receive messages and
sends periodic advertisements (messages) to the well-known multicast address 01:00:0C:CC:CC:CC. Devices discover
each other by listening at that address. They also listen to messages to learn when interfaces on other devices are up or go
down.
Advertisements contain time-to-live information, which indicates the length of time a receiving device should hold Cisco
Discovery Protocol information before discarding it. Advertisements supported and configured in Cisco software are
sent, by default, every 60 seconds.

Reference: http://www.cisco.com/en/US/docs/ios-xml/ios/cdp/configuration/15-mt/nm-cdp-discover.html

QUESTION 62
Which statement about Cisco Discovery Protocol configuration on a Cisco switch is true?

A. CDP is enabled by default and can be disabled globally with the command no cdp run.
B. CDP is disabled by default and can be enabled globally with the command cdp enable.
C. CDP is enabled by default and can be disabled globally with the command no cdp enable.
D. CDP is disabled by default and can be enabled globally with the command cdp run.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
CDP is enabled on your router by default, which means the Cisco IOS software will receive CDP information. CDP also is
enabled on supported interfaces by default. To disable CDP on an interface, use the “no cdp enable interface” configuration
command. To disable it globally, use the “no cdp run” command.

Reference: http://www.cisco.com/en/US/docs/ios/12_2/configfun/command/reference/frf015.html#wp1017573
QUESTION 63
Which VTP mode is needed to configure an extended VLAN, when a switch is configured to use VTP versions 1 or 2?

A. transparent
B. client
C. server
D. Extended VLANs are only supported in version 3 and not in versions 1 or 2.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP version 1 and version 2 support VLANs 1 to 1000 only. Extended-range VLANs are supported only in VTP version 3. If
converting from VTP version 3 to VTP version 2, VLANs in the range 1006 to 4094 are removed from VTP control.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vtp.html

QUESTION 64
What is the size of the VLAN field inside an 802.1q frame?

A. 8-bit
B. 12-bit
C. 16-bit
D. 32-bit

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The VLAN field is a 12-bit field specifying the VLAN to which the frame belongs. The hexadecimal values of 0x000 and
0xFFF are reserved. All other values may be used as VLAN identifiers, allowing up to 4,094 VLANs

Reference: http://en.wikipedia.org/wiki/IEEE_802.1Q

QUESTION 65
What is the maximum number of VLANs that can be assigned to an access switchport without a voice VLAN?

A. 0
B. 1
C. 2
D. 1024

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
A standard (non-voice VLAN port) access switch port can belong to only a single VLAN. If more than one VLAN is needed,
the port should be configured as a trunk port.

QUESTION 66
Refer to the exhibit.
Which option shows the expected result if a show vlan command is issued?

A.

B.

C.
D.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
In this case, the port has been configured both as a trunk and as a switchport in data vlan 10. Obviously, a port can not be
both, so even though Cisco IOS will accept both, the port will actually be used as a trunk, ignoring the switchport access
VLAN 10 command.

QUESTION 67
Which feature is automatically enabled when a voice VLAN is configured, but not automatically disabled when a voice
VLAN is removed?

A. portfast
B. port-security
C. spanning tree
D. storm control

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Voice VLAN Configuration Guidelines
You should configure voice VLAN on switch access ports.
The voice VLAN should be present and active on the switch for the IP phone to correctly communicate on the voice
VLAN. Use the show vlan privileged EXEC command to see if the VLAN is present (listed in the display).
The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port
Fast feature is not automatically disabled.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_22_ea11x/configuration/
guide/swvoip.html

QUESTION 68
In which portion of the frame is the 802.1q header found?

A. within the Ethernet header

B. within the Ethernet payload
C. within the Ethernet FCS
D. within the Ethernet source MAC address

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Frame format

Insertion of 802.1Q tag in an Ethernet frame

802.1Q does not encapsulate the original frame. Instead, for Ethernet frames, it adds a 32-bit field between the source
MAC address and the EtherType/length fields of the original frame
Reference: http://en.wikipedia.org/wiki/IEEE_802.1Q

QUESTION 69
Which VLAN range is eligible to be pruned when a network engineer enables VTP pruning on a switch?

A. VLANs 1-1001
B. VLANs 1-4094
C. VLANs 2-1001
D. VLANs 2-4094

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP pruning should only be enabled on VTP servers, all the clients in the VTP domain will automatically enable VTP
pruning. By default, VLANs 2 – 1001 are pruning eligible, but VLAN 1 can’t be pruned because it’s an administrative VLAN.
Both VTP versions 1 and 2 supports pruning.

Reference: http://www.orbit-computer-solutions.com/VTP-Pruning.php

QUESTION 70
Which feature must be enabled to eliminate the broadcasting of all unknown traffic to switches that are not participating in
the specific VLAN?

A. VTP pruning
B. port-security
C. storm control
D. bpdguard

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
VTP ensures that all switches in the VTP domain are aware of all VLANs. However, there are occasions when VTP can
create unnecessary traffic. All unknown unicasts and broadcasts in a VLAN are flooded over the entire VLAN. All switches
in the network receive all broadcasts, even in situations in which few users are connected in that VLAN. VTP pruning is a
feature that you use in order to eliminate or prune this unnecessary traffic.

Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/10558-21.html#vtp_pruning

QUESTION 71
Refer to the exhibit.

The users in an engineering department that connect to the same access switch cannot access the network. The network
engineer found that the engineering VLAN is missing from the database. Which action resolves this problem?

A. Disable VTP pruning and disable 802.1q.

B. Update the VTP revision number.
C. Change VTP mode to server and enable 802.1q.
D. Enable VTP pruning and disable 802.1q.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Only VTP servers can add new VLANs to the switched network, so to enable vlan 10 on this switch you will first need to
change the VTP mode from client to server. Then, you will need to enable 802.1Q trunking to pass this new VLAN along to
the other switches.

QUESTION 72
Refer to the exhibit.
The network switches for two companies have been connected and manually configured for the required VLANs, but users
in company A are not able to access network resources in company B when DTP is enabled. Which action resolves this
problem?

A. Delete vlan.dat and ensure that the switch with lowest MAC address is the VTP server.
B. Disable DTP and document the VTP domain mismatch.
C. Manually force trunking with switchport mode trunk on both switches.
D. Enable the company B switch with the vtp mode server command.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Since the number of existing VLANs differ on the switches (9 on A and 42 on B) we know that there is a problem with VTP
or the trunking interfaces. The VTP domain names do match and they are both VTP servers so there are no issues there.
The only viable solution is that there is a DTP issues and so you must instead manually configure the trunk ports between
these two switches so that the VLAN information can be sent to each switch.

QUESTION 73
A network engineer must implement Ethernet links that are capable of transporting frames and IP traffic for different
broadcast domains that are mutually isolated. Consider that this is a multivendor environment. Which Cisco IOS switching
feature can be used to achieve the task?

A. PPP encapsulation with a virtual template

B. Link Aggregation Protocol at the access layer
C. dot1q VLAN trunking
D. Inter-Switch Link

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Here the question asks for transporting “frames and IP traffic for different broadcast domains that are mutually isolated”
which is basically a long way of saying VLANs so trunking is needed to carry VLAN information. There are 2 different
methods for trunking, 802.1Q and ISL. Of these, only 802.1Q is supported by multiple vendors since ISL is a Cisco
proprietary protocol.

QUESTION 74
Which statement about using native VLANs to carry untagged frames is true?

A. Cisco Discovery Protocol version 2 carries native VLAN information, but version 1 does not.
B. Cisco Discovery Protocol version 1 carries native VLAN information, but version 2 does not.
C. Cisco Discovery Protocol version 1 and version 2 carry native VLAN information.
D. Cisco Discovery Protocol version 3 carries native VLAN information, but versions 1 and 2 do not.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Cisco Discovery Protocol (CDP) version 2 passes native VLAN information between Cisco switches. If you have a native
VLAN mismatch, you will see CDP error messages on the console output.

Reference: http://www.ciscopress.com/articles/article.asp?p=29803&seqNum=3
QUESTION 75
Refer to the exhibit.

A multilayer switch has been configured to send and receive encapsulated and tagged frames. VLAN 2013 on the
multilayer switch is configured as the native VLAN. Which option is the cause of the spanning-tree error?

A. VLAN spanning-tree in SW-2 is configured.

B. spanning-tree bpdu-filter is enabled.
C. 802.1q trunks are on both sides, both with native VLAN mismatch.
D. VLAN ID 1 should not be used for management traffic because its unsafe.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Here we see that the native VLAN has been configured as 2013 on one switch, but 1 (the default native VLAN) on the other
switch. If you use 802.1Q trunks, you must ensure that you choose a common native VLAN for each port in the trunk.
Failure to do this causes Cisco switches to partially shut down the trunk port because having mismatched native VLANs
can result in spanning-tree loops. Native VLAN mismatches are detected via spanning tree and Cisco Discovery Protocol
(CDP), not via DTP messages. If spanning tree detects a native VLAN mismatch, spanning tree blocks local native VLAN
traffic and the remote switch native VLAN traffic on the trunk; however, the trunk still remains up for other VLANs.

Reference: http://www.informit.com/library/content.aspx?b=CCNP_Studies_Switching&seqNum=25

QUESTION 76
A network engineer must improve bandwidth and resource utilization on the switches by stopping the inefficient flooding of
frames on trunk ports where the frames are not needed. Which Cisco IOS feature can be used to achieve this task?

A. VTP pruning
B. access list
C. switchport trunk allowed VLAN
D. VLAN access-map

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Cisco advocates the benefits of pruning VLANs in order to reduce unnecessary frame flooding. The “vtp pruning” command
prunes VLANs automatically, which stops the inefficient flooding of frames where they are not needed.

Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/24330-185.html

QUESTION 77
Which action allows a network engineer to limit a default VLAN from being propagated across all trunks?

A. Upgrade to VTP version 3 for advanced feature set support.

B. Enable VTP pruning on the VTP server.
C. Manually prune default VLAN with switchport trunk allowed vlans remove.
D. Use trunk pruning vlan 1.
Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Manaully pruning the default VLAN (1) can only be done with the “switchport trunk allowed vlans remove” command. VLAN
1 is not VTP pruning eligible so it cannot be done via VTP pruning. The “trunk pruning vlan 1” option is not a valid
command.

QUESTION 78
What is required for a LAN switch to support 802.1q Q-in-Q encapsulation?

A. Support less than 1500 MTU

B. Support 1504 MTU or higher
C. Support 1522 layer 3 IP and IPX packet
D. Support 1547 MTU only

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The default system MTU for traffic on Catalyst switches is 1500 bytes. Because the 802.1Q tunneling (Q-in-Q) feature
increases the frame size by 4 bytes when the extra tag is added, you must configure all switches in the service-provider
network to be able to process maximum frames by increasing the switch system MTU size to at least 1504 bytes.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/
swtunnel.html

QUESTION 79
Refer to the exhibit.

How many bytes are added to each frame as a result of the configuration?

A. 4-bytes except the native VLAN

B. 8-bytes except the native VLAN
C. 4-bytes including native VLAN
D. 8-bytes including native VLAN

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
In 802.1Q trunking, all VLAN packets are tagged on the trunk link, except the native VLAN. A VLAN tag adds 4 bytes to the
frame. Two bytes are used for the tag protocol identifier (TPID), the other two bytes for tag control information (TCI).

QUESTION 80
A network engineer configured a fault-tolerance link on Gigabit Ethernet links G0/1, G0/2, G0/3, and G0/4 between two
switches using Ethernet port-channel. Which action allows interface G0/1 to always actively forward traffic in the port-
channel?
A. Configure G0/1 as half duplex and G0/2 as full duplex.
B. Configure LACP port-priority on G0/1 to 1.
C. Configure LACP port-priority on G0/1 to 65535.
D. LACP traffic goes through G0/4 because it is the highest interface ID.

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
A LACP port priority is configured on each port using LACP. The port priority can be configured automatically or through the
CLI. LACP uses the port priority with the port number to form the port identifier. The port priority determines which ports
should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating. The
higher the number, the lower the priority. The valid range is from 1 to 65535. The default is 32768.

Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/gigeth.html#wp1081491

QUESTION 81
Which statement about the use of PagP link aggregation on a Cisco switch that is running Cisco IOS Software is true?

A. PagP modes are off, auto, desirable, and on. Only the combinations auto-desirable, desirable-desirable, and on-on
allow the formation of a channel.
B. PagP modes are active, desirable, and on. Only the combinations active-desirable, desirable-desirable, and on-on allow
the formation of a channel.
C. PagP modes are active, desirable, and on. Only the combinations active-active, desirable-desirable, and on-on allow
the formation of a channel.
D. PagP modes are off, active, desirable, and on. Only the combinations auto-auto, desirable-desirable, and on-on allow
the formation of a channel.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
PagP modes are off, auto, desirable, and on. Only the combinations auto-desirable, desirable-desirable, and on-on will
allow a channel to be formed.
The PagP modes are explained below.
1. on: PagP will not run. The channel is forced to come up.
2. off: PagP will not run. The channel is forced to remain down.
3. auto: PagP is running passively. The formation of a channel is desired; however, it is not initiated.
4. desirable: PagP is running actively. The formation of a channel is desired and initiated.

Only the combinations of auto-desirable, desirable-desirable, and on-on will allow a channel to be formed. If a device on
one side of the channel does not support PagP, such as a router, the device on the other side must have PagP set to on.

Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/21041-131.html

QUESTION 82
Refer to the exhibit.
Which EtherChannel negotiation protocol is configured on the interface f0/13 – f0/15?

A. Link Combination Control Protocol

B. Port Aggregation Protocol
C. Port Combination Protocol
D. Link Aggregation Control Protocol

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
PAgP modes are off, auto, desirable, and on. Only the combinations auto-desirable, desirable-desirable, and on-on will
allow a channel to be formed. .
1. on: PAgP will not run. The channel is forced to come up.
2. off: PAgP will not run. The channel is forced to remain down.
3. auto: PAgP is running passively. The formation of a channel is desired; however, it is not initiated.
4. desirable: PAgP is running actively. The formation of a channel is desired and initiated.

The Link Aggregate Control Protocol (LACP) trunking supports four modes of operation:
On: The link aggregation is forced to be formed without any LACP negotiation .In other words, the switch neither sends
the LACP packet nor processes any inbound LACP packet. This is similar to the on state for PAgP.
Off: The link aggregation is not formed. We do not send or understand the LACP packet. This is similar to the off state
for PAgP.
Passive: The switch does not initiate the channel but does understand inbound LACP packets. The peer (in active state)
initiates negotiation (when it sends out an LACP packet) which we receive and answer, eventually to form the
aggregation channel with the peer. This is similar to the auto mode in PAgP.
 Active: We can form an aggregate link and initiate the negotiation. The link aggregate is formed if the other end runs in
LACP active or passive mode. This is similar to the desirable mode of PAgP.
In this example, we see that fa 0/13, fa0/14, and fa0/15 are all in Port Channel 12, which is operating in desirable mode,
which is only a PAgP mode.

QUESTION 83
Refer to the exhibit.

Users of PC-1 experience slow connection when a webpage is requested from the server. To increase bandwidth, the
network engineer configured an EtherChannel on interfaces Fa1/0 and Fa0/1 of the server farm switch, as shown here:

Server_Switch#sh etherchannel load-balance

EtherChannel Load-Balancing Operational State (src-mac):
Non-IP: Source MAC address
IPv4: Source MAC address
IPv6: Source IP address
Server_Switch#

HoweIer, traffic is still slow. Which action can the engineer take to resolve this issue?

A. Disable EtherChannel load balancing.

B. Upgrade the switch IOS to IP services image.
C. Change the load-balance method to dst-mac.
D. Contact Cisco TAC to report a bug on the switch.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Since this traffic is coming from PC-1, the source MAC address will always be that of PC-1, and since the load balancing
method is source MAC, traffic will only be using one of the port channel links. The load balancing method should be
changed to destination MAC, since the web server has two NICs traffic will be load balanced across both MAC addresses.

QUESTION 84
A network engineer changed the port speed and duplex setting of an existing EtherChannel bundle that uses the PAgP
protocol. Which statement describes what happens to all ports in the bundle?

A. PAgP changes the port speed and duplex for all ports in the bundle.
B. PAgP drops the ports that do not match the configuration.
C. PAgP does not change the port speed and duplex for all ports in the bundle until the switch is rebooted.
D. PAgP changes the port speed but not the duplex for all ports in the bundle.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
PAgP aids in the automatic creation of EtherChannel links. PAgP packets are sent between EtherChannel-capable ports in
order to negotiate the formation of a channel. Some restrictions are deliberately introduced into PAgP. The restrictions are:
PAgP does not form a bundle on ports that are configured for dynamic VLANs. PAgP requires that all ports in the
channel belong to the same VLAN or are configured as trunk ports. When a bundle already exists and a VLAN of a port
is modified, all ports in the bundle are modified to match that VLAN.
PAgP does not group ports that operate at different speeds or port duplex. If speed and duplex change when a
bundle exists, PAgP changes the port speed and duplex for all ports in the bundle.
PAgP modes are off, auto, desirable, and on. Only the combinations auto-desirable, desirable-desirable, and on-on
allow the formation of a channel. The device on the other side must have PAgP set to on if a device on one side of the
channel does not support PAgP, such as a router.

Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html

QUESTION 85
Which statement about using EtherChannel on Cisco IOS switches is true?

A. A switch can support up to eight compatibly configured Ethernet interfaces in an EtherChannel. The EtherChannel
provides full-duplex bandwidth up to 800 Mbps only for Fast EtherChannel or 8 Gbps only for Gigabit EtherChannel.
B. A switch can support up to 10 compatibly configured Ethernet interfaces in an EtherChannel. The EtherChannel
provides full-duplex bandwidth up to 1000 Mbps only for Fast EtherChannel or 8 Gbps only for Gigabit EtherChannel.
C. A switch can support up to eight compatibly configured Ethernet interfaces in an EtherChannel. The EtherChannel
provides full-duplex bandwidth up to 800 Mbps only for Fast EtherChannel or 16 Gbps only for Gigabit EtherChannel.
D. A switch can support up to 10 compatibly configured Ethernet interfaces in an EtherChannel. The EtherChannel
provides full-duplex bandwidth up to 1000 Mbps only for Fast EtherChannel or 10 Gbps only for Gigabit EtherChannel.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
An EtherChannel consists of individual Fast Ethernet or Gigabit Ethernet links bundled into a single logical link. The
EtherChannel provides full-duplex bandwidth up to 800 Mbps (Fast EtherChannel) or 8 Gbps (Gigabit EtherChannel)
between your switch and another switch or host. Each EtherChannel can consist of up to eight compatibly configured
Ethernet interfaces. All interfaces in each EtherChannel must be the same speed, and all must be configured as either
Layer 2 or Layer 3 interfaces.

Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html

QUESTION 86
Refer to the exhibit.
Which statement about switch S1 is true?

A. Physical port Fa0/13, Fa0/14, and Fa0/15 successfully formed a Layer 2 port-channel interface using an open standard
protocol.
B. Logical port Fa0/13, Fa0/14, and Fa0/15 successfully formed a Layer 2 physical port-channel interface using a Cisco
proprietary protocol.
C. Physical port Fa0/13, Fa0/14, and Fa0/15 successfully formed a Layer 3 port-channel interface using a Cisco
proprietary protocol.
D. Logical port Fa0/13, Fa0/14, and Fa0/15 successfully formed a Layer 3 physical port-channel interface using an open
standard protocol.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
These three ports show that they are in Port Channel 1, and the (SU) means they are in use and operating at layer 2. The
protocol used for this port channel shows as LACP, which is a standards based protocol, as opposed to PagP, which is
Cisco proprietary.

QUESTION 87
What happens on a Cisco switch that runs Cisco IOS when an RSTP-configured switch receives 802.1d BPDU?

A. 802.1d does not understand RSTP BPDUs because they are different versions, but when a RSTP switch receives an
802.1d BPDU, it responds with an 802.1d BPDU and eventually the two switches run 802.1d to communicate.
B. 802.1d understands RSTP BPDUs because they are the same version, but when a RSTP switch receives a 802.1d
BPDU, it responds with a 802.1d BPDU and eventually the two switches run 802.1d to communicate.
C. 802.1d does not understand RSTP BPDUs because they are different versions, but when a RSTP switch receives a
802.1d BPDU, it does not respond with a 802.1d BPDU.
D. 802.1d understands RSTP BPDUs because they are the same version, but when a RSTP switch receives a 802.1d
BPDU, it does not respond with a 802.1d BPDU and eventually the two switches run 802.1d to communicate.
Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
For backward compatibility with 802.1D switches, RSTP selectively sends 802.1D configuration BPDUs and TCN BPDUs
on a per-port basis.
When a port is initialized, the migrate-delay timer is started (specifies the minimum time during which RSTP BPDUs are
sent), and RSTP BPDUs are sent. While this timer is active, the switch processes all BPDUs received on that port and
ignores the protocol type.
If the switch receives an 802.1D BPDU after the port migration-delay timer has expired, it assumes that it is connected to
an 802.1D switch and starts using only 802.1D BPDUs. However, if the RSTP switch is using 802.1D BPDUs on a port and
receives an RSTP BPDU after the timer has expired, it restarts the timer and starts using RSTP BPDUs on that port.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
spantree.html

QUESTION 88
When two MST instances (MST 1 and MST 2) are created on a switch, what is the total number of spanning-tree instances
running on the switch?

A. 1
B. 2
C. 3
D. 4

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Unlike other spanning tree protocols, in which all the spanning tree instances are independent, MST establishes and
maintains IST, CIST, and CST spanning trees:
An IST is the spanning tree that runs in an MST region.
Within each MST region, MST maintains multiple spanning tree instances. Instance 0 is a special instance for a
region, known as the IST. All other MST instances are numbered from 1 to 4094. In the case for this question, there
will be the 2 defined MST instances, and the special 0 instance, for a total of 3 instances.
The IST is the only spanning tree instance that sends and receives BPDUs. All of the other spanning tree instance
information is contained in MSTP records (M-records), which are encapsulated within MST BPDUs. Because the MST
BPDU carries information for all instances, the number of BPDUs that need to be processed to support multiple spanning
tree instances is usernamcantly reduced.
All MST instances within the same region share the same protocol timers, but each MST instance has its own topology
parameters, such as root bridge ID, root path cost, and so forth. By default, all VLANs are assigned to the IST.
An MST instance is local to the region; for example, MST instance 1 in region A is independent of MST instance 1 in region
B, even if regions A and B are interconnected.
A CIST is a collection of the ISTs in each MST region.
The CST interconnects the MST regions and single spanning trees.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
spantree.html

QUESTION 89
Refer to the exhibit.
f1/0 and f1/1 have the same end-to-end path cost to the designated bridge. Which action is needed to modify the Layer 2
spanning-tree network so that traffic for PC1 VLAN from switch SW3 uses switchport f1/1 as a primary port?

A. Modify the spanning-tree port-priority on SW1 f1/1 to 0 and f1/0 to 16.

B. Modify the spanning-tree port-priority on SW1 f1/1 to 16 and f1/0 to 0.
C. Modify the spanning-tree port-priority on SW2 f1/1 to 0 and f1/0 to 16.
D. Modify the spanning-tree port-priority on SW2 f1/1 to 16 and f1/0 to 0.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
If a loop occurs, STP considers port priority when selecting a LAN port to put into the forwarding state. You can assign
higher priority values to LAN ports that you want STP to select first and lower priority values to LAN ports that you want
STP to select last. If all LAN ports have the same priority value, STP puts the LAN port with the lowest LAN port number in
the forwarding state and blocks other LAN ports. The possible priority range is 0 through 240 (default 128), configurable in
increments of 16. A lower path cost represents higher-speed transmission and is preferred.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/configuration/guide/
swstp.html#wp1105354

QUESTION 90
Refer to the exhibit.
Why would the switch be considered as a root bridge?

A. The bridge priority is 1 and all ports are forwarding.

B. The switch priority for VLAN 1 and the macro specifies “This Bridge is the root”.
C. The bridge priority is 128.19 and all ports are forwarding.
D. The switch priority value is zero, it has the lowest priority value for VLAN 1.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
For priority, the range is 0 to 61440 in increments of 4096; the default is 32768. The lower the number, the more likely the
switch will be chosen as the root switch.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/configuration/guide/
swstp.html#wp1020666

QUESTION 91
Refer to the exhibit.
All ports are members of VLAN 10. Considering the default cost of upstream bridges to the root bridge is equal, which
option will be the new root port for VLAN 10?

A. interface f0/13
B. interface f0/14
C. interface f0/15
D. interface f0/21

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Root Port election on each bridge
Each (non-Root) bridge has exactly one Root Port, which represents the best path to the Root Bridge.
Total Path Cost to root - lowest prevails (local Root Port cost added upon receipt of Configuration – PDUs on that port,
from the direction of Root Bridge)
Connected Bridge ID - lowest prevails
Connected Port ID (Port Priority + Port#) - lowest prevail–
Local Port ID - lowest prevails
In this case, fa0/21 has the lowest cost, so it will be the root port.

Reference: https://community.extremenetworks.com/extreme/topics/802_1d_spanning_tree_election_rules

QUESTION 92
A network engineer is trying to deploy a PC on a network. The engineer observes that when the PC is connected to the
network, it takes 30 to 60 seconds for the PC to see any activity on the network interface card. Which Layer 2 enhancement
can be used to eliminate this delay?

A. Configure port duplex and speed to auto negotiation.

B. Configure port to duplex full and speed 1000.
C. Configure spanning-tree portfast.
D. Configure no switchport.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
When first powered on, each port goes through 4 states to ensure that there are no physical loops in the layer 2 broadcast
domain. These steps are outlined as follows. With the initial version of spanning tree, this process could take from 30-60
seconds.
1.Blocking – A port that would cause a switching loop, no user data is sent or received but it may go into forwarding
mode if the other links in use were to fail and the spanning tree algorithm determines the port may transition to the
forwarding state. BPDU data is still received in blocking state.
2.Listening – The switch processes BPDUs and awaits possible new information that would cause it to return to the
blocking state.
3.Learning – While the port does not yet forward frames (packets) it does learn source addresses from frames received
and adds them to the filtering database (switching database)
4.Forwarding – A port receiving and sending data, normal operation. STP still monitors incoming BPDUs that would
indicate it should return to the blocking state to prevent a loop.
STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately,
bypassing the listening and learning states.

Reference: http://net.cmed.us/Home/ethernet-and-ip/spanning-tree-protocol

QUESTION 93
A network engineer configured an Ethernet switch using these commands.

Switchone(config) # Spanning-tree portfast bpdufilter default

Which statement about the spanning-tree portfast feature on the switch is true?

A. If an interface is enabled for portfast receives BDPU, the port goes through the spanning-tree listening, learning, and
forwarding states.
B. If an interface is enabled for portfast receives BDPU, the port does not go through the spanning-tree listening, learning,
and forwarding states.
C. If an interface is enabled for portfast receives BDPU, the port is shut down immediately.
D. If an interface is enabled for portfast receives BDPU, the port goes into the spanning-tree inconsistent state.

Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately,
bypassing the listening and learning states. However, the “Spanning-tree portfast bpdufilter default” command specifies that
if a BPDU is received on that port, then the default action of STP of listening, learning, and forwarding states should be
used.

QUESTION 94
Which statement describes what happens when a port configured with root guard receives a superior BPDU?

A. The port goes into errdisabled state and stops forwarding traffic.
B. The port goes into BPDU-inconsistent state and stops forwarding traffic.
C. The port goes into loop-inconsistent state and stops forwarding traffic.
D. The port goes into root-inconsistent state and stops forwarding traffic.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The root guard ensures that the port on which root guard is enabled is the designated port. Normally, root bridge ports are
all designated ports, unless two or more ports of the root bridge are connected together. If the bridge receives superior STP
Bridge Protocol Data Units (BPDUs) on a root guard-enabled port, root guard moves this port to a root-inconsistent STP
state. This root-inconsistent state is effectively equal to a listening state. No traffic is forIarded across this port. In this way,
the root guard enforces the position of the root bridge.
Reference: http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00800ae96b.shtml

QUESTION 95
Which statement about restrictions for multichassis LACP is true?

A. It is available only on a Cisco Catalyst 6500 Series chassis.

B. It does not support 1Gb links.
C. Converting a port channel to mLACP can cause a service disruption.
D. It is not available in VSS.

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
When configuring mLACP for Server Access, follow these guidelines and restrictions:
PFC3A mode does not support the mLACP for server access feature.
VSS mode does not support the mLACP for server access feature.
No more than 100 VLANs can be active on a switch configured as a PoA.
mLACP does not support half-duplex links.
mLACP does not support multiple neighbors.
Converting a port channel to mLACP can cause a service disruption.
The DHD system priority must be lower (higher numerically) than the PoA system priority.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/
mlacp_server_support.html

QUESTION 96
What is the maximum number of 10 Gigabit Ethernet connections that can be utilized in an EtherChannel for the virtual
switch link?

A. 4
B. 6
C. 8
D. 12

Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The VSS is made up of the following:
Virtual switch members: Cisco Catalyst 6500 Series Switches (up to two switches with initial release) deployed with the
Virtual Switching Supervisor 720 10GE
Virtual switch link (VSL): 10 Gigabit Ethernet connections (up to eight using EtherChannel) between the virtual
switch members.

Reference: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html

QUESTION 97
Which statement describes what happens if all VSL connections between the virtual switch members are lost?

A. Both virtual switch members cease to forward traffic.

B. The VSS transitions to the dual active recovery mode, and both virtual switch members continue to forward traffic
independently.
C. The virtual switch members reload.
D. The VSS transitions to the dual active recovery mode, and only the new active virtual switch continues to forward traffic.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Q. What happens if all VSL connections between the virtual switch members are lost?
A. VSLs can be configured with up to eight links between the two switches across any combination of line cards or
supervisor ports to provide a high level of redundancy. If for some rare reason all VSL connections are lost between the
virtual switch members leaving both the virtual switch members up, the VSS will transition to the dual active recovery mode.
The dual active state is detected rapidly (subsecond) by any of the following three methods:
Enhancement to PagP used in MEC with connecting Cisco switches
L3 Bidirectional Forwarding Detection (BFD) configuration on a directly connected link (besides VSL) between virtual
switch members or through an L2 link through an access layer switch
L2 Fast-Hello Dual-Active Detection configuration on a directly connected link (besides VSL) between virtual switch
members (supported with 12.2(33)SXI)

In the dual active recovery mode, all interfaces except the VSL interfaces are in an operationally shut down state in the
formerly active virtual switch member. The new active virtual switch continues to forward traffic on all links.

Reference: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html

QUESTION 98
Which statement describes what happens when a switch enters dual active recovery mode?

A. The switch shuts down and waits for the VSL link to be restored before sending traffic.
B. All interfaces are shut down in the formerly active virtual switch member, but the new active virtual switch forwards
traffic on all links.
C. The switch continues to forward traffic out all links and enables spanning tree on VSL link and all other links to prevent
loops.
D. The VSS detects which system was last in active state and shuts down the other switch.

Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
In the dual active recovery mode, all interfaces except the VSL interfaces are in an operationally shut down state in the
formerly active virtual switch member. The new active virtual switch continues to forward traffic on all links.

Reference: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html

QUESTION 99
SIMULATION
Scenario:
You work for SWITCH.com. They have just added a new switch (SwitchB) to the existing network as shown in the topology
diagram.
RouterA is currently configured correctly and is providing the routing function for devices on SwitchA and SwitchB. SwitchA
is currently configured correctly, but will need to be modified to support the addition of SwitchB. SwitchB has a minimal
configuration. You have been tasked with competing the needed configuring of SwitchA and SwitchB. SwitchA and SwitchB
use Cisco as the enable password.

All commands must be entered at the physical interface level.

Configuration Requirements for SwitchA

The VTP and STP configuration models on Switch A should not be modified.
SwitchA needs to be the root switch for vlans 11, 12, 13, 21, 22, and 23. All other vlans should be left at their default
values.

Configuration Requirements for SwitchB

Vlan21
- Name: Marketing
- will support two servers attached to fa0/9 and fa0/10
 Vlan22
- Name: Sales
- will support two servers attached to fa0/13 and fa0/14
Vlan23
- Name: Engineering
- will support two servers attached to fa0/15 and fa0/16
Access ports that connect to server should transition immediately to forwarding state upon detecting the connection of a
device
SwitchB VTP mode needs to be the same as SwitchA.
SwitchB must operate in the same spanning tree mode as SwitchA.
No routing is to be configured on SwitchB.
Only the SVI Vlan 1 is to be configured and it is to use address 192.168.1.11/24.

Inter-switch Connectivity Configuration Requirements

For operational and security reasons trunking should be unconditional and Vlans 1, 21, 22 and23 should be tagged
when traversing the trunk link.
The two trunks between SwitchA and SwitchB need to be configured in a mode that allows for the maximum use of their
bandwidth for all vlans. This mode should be done with a non-proprietary protocol, with SwitchA controlling activation.
Propagation of unnecessary broadcasts should be limited using manual pruning on this trunk link.
Correct Answer: Here are steps
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Initial Configuration (some lines have been removed)
Solution
SW-A (close to router)
Note: If Sw-A does not have Vlan 11, 12, 13 we have to create them first with command “SW-A(config)#vlan 11,12,13”
SW-A(config)#spanning-tree vlan 11-13,21-23 root primary
SW-A(config)#vlan 21
SW-A(config-vlan)#name Marketing
SW-A(config-vlan)#exit
SW-A(config)#vlan 22
SW-A(config-vlan)#name Sales
SW-A(config-vlan)#exit
SW-A(config)#vlan 23
SW-A(config-vlan)#name Engineering
SW-A(config-vlan)#exit
SW-A(config)#interface range fa0/3 – 4
SW-A(config-if-range)#no switchport mode access
SW-A(config-if-range)#no switchport access vlan 98 (These two commands must be deleted to form a trunking link)
SW-A(config-if-range)#channel-group 1 mode active
SW-A(config-if-range)#channel-protocol lacp
SW-A(config-if-range)#no shutdown
SW-A(config-if)#interface port-channel 1
SW-A(config-if)#switchport mode trunk
SW-A(config-if)#switchport trunk native vlan 99 //this command will prevent the “Native VLAN mismatched” error on both
switches
SW-A(config-if)#switchport trunk allowed vlan 1,21-23
SW-A(config-if)#no shut
Note: When you apply commands under “interface port-channel 1”, the same commands will be automatically applied to
the physical member interfaces (of port-channel 1) so you don’t need to type them under physical member interfaces again.
——————————————————————————————–
SW-B (far from router)
SW-B(config)#vlan 21
SW-B(config-vlan)#name Marketing
SW-B(config-vlan)#exit
SW-B(config)#vlan 22
SW-B(config-vlan)#name Sales
SW-B(config-vlan)#exit
SW-B(config)#vlan 23
SW-B(config-vlan)#name Engineering
SW-B(config-vlan)#exit
SW-B(config)#vlan 99
SW-B(config-vlan)#name TrunkNative // not necessary to name it but just name it same as SwitchA
SW-B(config-vlan)#exit
SW-B(config)#interface range fa0/9 – 10
SW-B(config-if-range)#switchport mode access
SW-B(config-if-range)#switchport access vlan 21
SW-B(config-if-range)#spanning-tree portfast
SW-B(config-if-range)#no shutdown
SW-B(config-if-range)#exit
SW-B(config)#interface range fa0/13 – 14
SW-B(config-if-range)#switchport mode access
SW-B(config-if-range)#switchport access vlan 22
SW-B(config-if-range)#spanning-tree portfast
SW-B(config-if-range)#no shutdown
SW-B(config-if-range)#exit
SW-B(config)#interface range fa0/15 – 16
SW-B(config-if-range)#switchport mode access
SW-B(config-if-range)#switchport access vlan 23
SW-B(config-if-range)#spanning-tree portfast
SW-B(config-if-range)#no shutdown
SW-B(config-if-range)#exit
SW-B(config)#vtp mode transparent
SW-B(config)#spanning-tree mode rapid-pvst //Same as Sw-A
SW-B(config)#ip default-gateway 192.168.1.1 (you can get this IP from SW-A with command show cdp neighbour detail)
SW-B(config)#interface vlan 1
SW-B(config-if)#ip address 192.168.1.11 255.255.255.0
SW-B(config-if)#no shutdown
SW-B(config-if)#exit
SW-B(config)#interface range fa0/3 – 4
SW-B(config-if-range)#channel-group 1 mode passive //mode passive because “SwitchA controlling activation”
SW-B(config-if-range)#channel-protocol lacp
SW-B(config-if-range)#no shutdown
SW-B(config-if)#interface port-channel 1
SW-B(config-if)#switchport trunk encapsulation dot1q
SW-B(config-if)#switchport mode trunk
SW-B(config-if)#switchport trunk native vlan 99 //this command will prevent the “Native VLAN mismatched” error on both
switches
SW-B(config-if)#switchport trunk allowed vlan 1,21-23
SW-B(config-if)#no shut
Note: For Sw-B we have to set the 802.1q trunking protocol (switchport trunk encapsulation dot1q) before converting it into
a trunk because it is a 3500 series (or higher) switch which supports both ISL and 802.1Q and we have to explicitly set
which trunking protocol to be used. Sw-A is a 2900x series (or lower) switch and does not support ISL trunking protocol
(802.1Q is the only supported trunking protocol) so we can apply “switchport mode trunk” directly.
———————————————————
Some guidelines for configuring SwitchA & SwitchB:
Configuration Requirements for SwitchA
Configuration Requirements for SwitchB

Inter-switch Connectivity Configuration Requirements:

Some notes for this sim:
+ You should check the initial status of both switches with these commands: show vtp status (transparent mode on
switchA and we have to set the same mode on switchB), show spanning-tree [summary] (rapid-pvst mode on switchA
and we have to set the same mode on switchB), show vlan (check the native vlan and the existence of vlan99), show
etherchannel 1 port-channel and show ip int brief(check if Port-channel 1 has been created and make sure it is
up),show run (to check everything again).
+ When using “int range f0/x – y” command hit space bar before and after “-” otherwise the simulator does not accept it.
+ You must create vlan 99 for the switchB. SwitchA already have vlan 99 configured.
+ At the end, you can try to ping from SwitchB to RouterA (you can get the IP on RouterA via the show cdp neighbors detail
on SwitchA), not sure if it can ping or not. If not, you can use the “ip default-gateway 192.168.1.1” on SwitchB.
+ The name of SwitchA and SwitchB can be swapped or changed so be careful to put your configuration into appropriate
switch.

QUESTION 100
SIMULATION
You have been tasked with configuring multilayer SwitchC, which has a partial configuration and has been attached to
RouterC as shown in the topology diagram.

You need to configure SwitchC so that Hosts H1 and H2 can successfully ping the server S1. Also SwitchC needs
to be able to ping server S1.

Due to administrative restrictions and requirements you should not add/delete vlans or create trunk links. Company policies
forbid the use of static or default routing. All routes must be learned via EIGRP 65010 routing protocol.

You do not have access to RouteC. RouterC is correctly configured. No trunking has been configured on RouterC.

Routed interfaces should use the lowest host on a subnet when possible. The following subnets are available to implement
this solution:

– 10.10.10.0/24
– 190.200.250.32/27
– 190.200.250.64/27

Hosts H1 and H2 are configured with the correct IP address and default gateway.
SwitchC uses Cisco as the enable password.

Routing must only be enabled for the specific subnets shown in the diagram.

Note: Due to administrative restrictions and requirements you should not add or delete VLANs, changes VLAN port
assignments or create trunks. Company policies forbid the use of static or default routing. All routes must be learned via the
EIGRP routing protocol.
Correct Answer: See the solution below
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
There are two ways to configure interVLAN routing in this case:
+ Use RouterC as a “router on a stick” and SwitchC as a pure Layer2 switch. Trunking must be established between
RouterC and SwitchC.
+ Only use SwitchC for interVLAN routing without using RouterC, SwitchC should be configured as a Layer 3 switch (which
supports ip routing function as a router). No trunking requires.

The question clearly states “No trunking has been configured on RouterC” so RouterC does not contribute to interVLAN
routing of hosts H1 & H2 -> SwitchC must be configured as a Layer 3 switch with SVIs for interVLAN routing.
We should check the default gateways on H1 & H2. Click on H1 and H2 and type the “ipconfig” command to get their
default gateways.

Answer:
\>ipconfig
We will get the default gateways as follows:
Host1:
+ Default gateway: 190.200.250.33
Host2:
+ Default gateway: 190.200.250.65
Now we have enough information to configure SwitchC (notice the EIGRP AS in this case is 650)
Note: VLAN2 and VLAN3 were created and gi0/10, gi0/11 interfaces were configured as access ports so we don’t need to
configure them in this sim.
SwitchC# configure terminal
SwitchC(config)# int gi0/1
SwitchC(config-if)#no switchport -> without using this command, the simulator does not let you assign IP address on
Gi0/1 interface.
SwitchC(config-if)# ip address 10.10.10.2 255.255.255.0 ->RouterC has used IP 10.10.10.1 so this is the lowest usable IP
address.
SwitchC(config-if)# no shutdown
SwitchC(config-if)# exit
SwitchC(config)# int vlan 2
SwitchC(config-if)# ip address 190.200.250.33 255.255.255.224
SwitchC(config-if)# no shutdown
SwitchC(config-if)# int vlan 3
SwitchC(config-if)# ip address 190.200.250.65 255.255.255.224
SwitchC(config-if)# no shutdown
SwitchC(config-if)#exit
SwitchC(config)# ip routing (Notice: MLS will not work without this command)
SwitchC(config)# router eigrp 65010
SwitchC(config-router)# network 10.10.10.0 0.0.0.255
SwitchC(config-router)# network 190.200.250.32 0.0.0.31
SwitchC(config-router)# network 190.200.250.64 0.0.0.31

NOTE: THE ROUTER IS CORRECTLY CONFIGURED, so you will not miss within it in the exam, also don’t modify/delete
any port just do the above configuration. Also some reports said the “no auto-summary” command can’t be used in the
simulator, in fact it is not necessary because the network 190.200.0.0/16 is not used anywhere else in this topology.
In order to complete the lab, you should expect the ping to SERVER to succeed from the MLS, and from the PCs as well.
Also make sure you use the correct EIGRP AS number (in the configuration above it is 650 but it will change when you take
the exam) but we are not allowed to access RouterC so the only way to find out the EIGRP AS is to look at the exhibit
above. If you use wrong AS number, no neighbor relationship is formed between RouterC and SwitchC.
In fact, we are pretty sure instead of using two commands “network 190.200.250.32 0.0.0.31″ and “network 190.200.250.64
0.0.0.31″ we can use one simple command “network 190.200.0.0″ because it is the nature of distance vector routing
protocol like EIGRP: only major networks need to be advertised; even without “no auto-summary” command the network
still works correctly. But in the exam the sim is just a flash based simulator so we should use two above commands, just for
sure. But after finishing the configuration, we can use “show run” command to verify, only the summarized network
190.200.0.0 is shown.

QUESTION 101
Instructions

Enter IOS commands on the device to verify network operation and answer the multiple-choice questions.
THIS TASK DOES NOT REQUIRE DEVICE CONFIGURATION.
Click on SW1, SW2, New_Switch or SW4 to gain access to the consoles of these devices. No console or enable
passwords are required.
To access the multiple-choice questions, click on the numbered boxes on the left of the top panel.
There are four multiple-choice questions with this task. Be sure to answer all four questions before selecting the Next
button

Scenario

You have been asked to install and configure a new switch in a customer network. Use the console access to the existing
and new switches to configure and verify correct device configuration.

Topology
You are connecting the New_Switch to the LAN topology; the switch has been partially configured and you need to
complete the rest of configuration to enable PC1 communication with PC2. Which of the configuration is correct?

A.

B.
C.

D.

E.

Correct Answer: D
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
Within any VTP, the VTP domain name must match. So, step one is to find the correct VTP name on the other switches.
Logging in to SW1 and using the “show vtp status” command we see this:
So we know that the VTP domain must be CCNP. This leaves only choice D and E. We also see from the topology diagram
that eth 0/0 of the new switch connects to a PC in VLNA 100, so we know that this port must be an access port in VLAN
100, leaving only choice D as correct. Note that the VTP versions supported in this network are 1, 2, 3 so either VTP
version 2 or 3 can be configured on the new switch.

QUESTION 102
Instructions

Enter IOS commands on the device to verify network operation and answer the multiple-choice questions.
THIS TASK DOES NOT REQUIRE DEVICE CONFIGURATION.
Click on SW1, SW2, New_Switch or SW4 to gain access to the consoles of these devices. No console or enable
passwords are required.
To access the multiple-choice questions, click on the numbered boxes on the left of the top panel.
There are four multiple-choice questions with this task. Be sure to answer all four questions before selecting the Next
button

Scenario

You have been asked to install and configure a new switch in a customer network. Use the console access to the existing
and new switches to configure and verify correct device configuration.

Topology
Refer to the configuration. For which configured VLAN are untagged frames sent over trunk between SW1 and SW2?

A. VLAN1
B. VLAN 99
C. VLAN 999
D. VLAN 40
E. VLAN 50
F. VLAN 200
G. VLAN 300
Correct Answer: B
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
The native VLAN is used for untagged frames sent along a trunk. By issuing the “show interface trunk” command on SW1
and SW2 we see the native VLAN is 99.

QUESTION 103
Instructions

Enter IOS commands on the device to verify network operation and answer the multiple-choice questions.
THIS TASK DOES NOT REQUIRE DEVICE CONFIGURATION.
Click on SW1, SW2, New_Switch or SW4 to gain access to the consoles of these devices. No console or enable
passwords are required.
To access the multiple-choice questions, click on the numbered boxes on the left of the top panel.
There are four multiple-choice questions with this task. Be sure to answer all four questions before selecting the Next
button

Scenario

You have been asked to install and configure a new switch in a customer network. Use the console access to the existing
and new switches to configure and verify correct device configuration.

Topology
You are adding new VLANs. VLAN500 and VLAN600 to the topology in such way that you need to configure SW1 as
primary root for VLAN 500 and secondary for VLAN 600 and SW2 as primary root for VLAN 600 and secondary for VLAN
500. Which configuration step is valid?

A. Configure VLAN 500 & VLAN 600 on both SW1 & SW2
B. Configure VLAN 500 and VLAN 600 on SW1 only
C. Configure VLAN 500 and VLAN 600 on SW2 only
D. Configure VLAN 500 and VLAN 600 on SW1, SW2 and SW4
E. On SW2; configure vtp mode as off and configure VLAN 500 and VLAN 600; configure back to vtp server mode.
Correct Answer: A
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
By issuing the “show vtp status command on SW2, SW2, and SW4 we see that both SW1 and SW2 are operating in VTP
server mode, but SW4 is a client, so we will need to add both VLANs to SW1 and SW2.
QUESTION 104
Instructions

Enter IOS commands on the device to verify network operation and answer the multiple-choice questions.
 THIS TASK DOES NOT REQUIRE DEVICE CONFIGURATION.
Click on SW1, SW2, New_Switch or SW4 to gain access to the consoles of these devices. No console or enable
passwords are required.
To access the multiple-choice questions, click on the numbered boxes on the left of the top panel.
There are four multiple-choice questions with this task. Be sure to answer all four questions before selecting the Next
button

Scenario

You have been asked to install and configure a new switch in a customer network. Use the console access to the existing
and new switches to configure and verify correct device configuration.

Topology
Examine the VTP configuration. You are required to configure private VLANs for a new server deployment connecting to
the SW4 switch. Which of the following configuration steps will allow creating private VLANs?

A. Disable VTP pruning on SW1 only

B. Disable VTP pruning on SW2 only
C. Disable VTP pruning on SW4 only
D. Disable VTP pruning on SW2, SW4 and New_Switch
E. Disable VTP pruning on New_Switch and SW4 only.
Correct Answer: C
Section: Layer 2 Technologies
Explanation

Explanation/Reference:
Explanation:
To create private VLANs, you will need to only disable pruning on the switch that contains the private VLANs. In this case,
only SW4 will connect to servers in a private VLAN.

QUESTION 105
A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database. What is the solution to
avoid the snooping database from being rebuilt after every device reboot?

A. A DHCP snooping database agent should be configured.

B. Enable DHCP snooping for all VLANs that are associated with the switch.
C. Disable Option 82 for DHCP data insertion.
D. Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting.
E. Apply ip dhcp snooping trust on all interfaces with dynamic addresses.

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Minimum DHCP Snooping Configuration
The minimum configuration steps for the DHCP snooping feature are as follows:
1. Define and configure the DHCP server.
2. Enable DHCP snooping on at least one VLAN.
By default, DHCP snooping is inactive on all VLANs.
3. Ensure that DHCP server is connected through a trusted interface.
By default, the trust state of all interfaces is untrusted.
4. Configure the DHCP snooping database agent.
This step ensures that database entries are restored after a restart or switchover.
5. Enable DHCP snooping globally.
The feature is not active until you complete this step.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/
snoodhcp.html#wp1090479

QUESTION 106
Which portion of AAA looks at what a user has access to?

A. authorization
B. authentication
C. accounting
D. auditing

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
AAA consists of the following three elements:
Authentication: Identifies users by login and password using challenge and response methodology before the user even
gains access to the network. Depending on your security options, it can also support encryption.
Authorization: After initial authentication, authorization looks at what that authenticated user has access to do.
RADIUS or TACACS+ security servers perform authorization for specific privileges by defining attribute-value (AV)
pairs, which would be specific to the individual user rights. In the Cisco IOS, you can define AAA authorization with a
named list or authorization method.
Accounting: The last "A" is for accounting. It provides a way“o” collecting security information that you can use for billing,
 auditing, and reporting. You can use accounting to see what users do once they are authenticated and authorized. For
example, with accounting, you could get a log of when users logged in and when they logged out.

Reference: http://www.techrepublic.com/blog/data-center/what-is-aaa-and-how-do-you-configure-it-in-the-cisco-ios/

QUESTION 107
Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the
local user database?

A. (config)# aaa authentication login default radius local

B. (config)# aaa authentication login login radius local
C. (config)# aaa authentication login default local radius
D. (config)# aaa authentication login radius local

Correct Answer: B
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
In the command “aaa authentication login login radius local” the second login is the name of the AAA method. It also lists
radius first then local, so it will primarily use RADIUS for authentication and fail over to the local user database only if the
RADIUS server is unreachable.

QUESTION 108
A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP snooping. For more
protection against malicious attacks, the network team is considering enabling dynamic ARP inspection alongside DHCP
snooping. Which solution ensures that the server maintains network reachability in the future?

A. Disable DHCP snooping information option.

B. Configure a static DHCP snooping binding entry on the switch.
C. Trust the interface that is connected to the server with the ip dhcp snooping trust command.
D. Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify mac-address command.

Correct Answer: B
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Dynamic ARP inspection is a security feature that validates ARP packets in a network. It intercepts, logs, and discards ARP
packets with invalid IP-to-MAC address bindings. This capability protects the network from certain man-in-the-middle
attacks.
Dynamic ARP inspection ensures that only valid ARP requests and responses are relayed. The switch performs these
activities:
Intercepts all ARP requests and responses on untrusted ports
Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating the local ARP
cache or before forwarding the packet to the appropriate destination.
Drops invalid ARP packets
Dynamic ARP inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a
trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is
enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the
packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid. To ensure network
reachability to the server, configure a static DHCP snooping binding entry on the switch.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/
guide/scg3750/swdynarp.html

QUESTION 109
A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. Which configuration must be
made before the private VLAN is configured?
A. Disable VTP and manually assign VLANs.
B. Ensure all switches are configured as VTP server mode.
C. Configure VTP Transparent Mode.
D. Enable VTP version 3.

Correct Answer: C
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
You must configure VTP to transparent mode before you can create a private VLAN. Private VLANs are configured in the
context of a single switch and cannot have members on other switches. Private VLANs also carry TLVs that are not known
to all types of Cisco switches.

Reference: http://www.ciscopress.com/articles/article.asp?p=29803&seqNum=6

QUESTION 110
DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. The
IP address of one of the workstations does not match any entries found in the DHCP binding database. Which statement
describes the outcome of this scenario?

A. Packets from the workstation will be rate limited according to the default values set on the switch.
B. The interface that is connected to the workstation in question will be put into the errdisabled state.
C. Traffic will pass accordingly after the new IP address is populated into the binding database.
D. The packets originating from the workstation are assumed to be spoofed and will be discarded.

Correct Answer: D
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
The IP source binding table has bindings that are learned by DHCP snooping or are manually configured (static IP source
bindings). An entry in this table has an IP address, its associated MAC address, and its associated VLAN number. The
switch uses the IP source binding table only wIen IP source guard is enabled.
You can configure IP source guard with source IP address filtering, or with source IP and MAC address filtering. When IP
source guard is enabled with this option, IP traffic is filtered based on the source IP address. The switch forwards IP traffic
when the source IP address matches an entry in the DHCP snooping binding database or a binding in the IP source
binding table. When IP source guard is enabled with this option, IP traffic is filtered based on the source IP and MAC
addresses. The switch forwards traffic only when the source IP and MAC addresses match an entry in the IP source
binding table. If there is no match, the packets are assumed to be spoofed and will be discarded.

Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-
catl3fixed.html#ipsourceguard

QUESTION 111
A DHCP configured router is connected directly to a switch that has been provisioned with DHCP snooping. IP Source
Guard with the ip verify source port-security command is configured under the interfaces that connect to all DHCP clients
on the switch. However, clients are not receiving an IP address via the DHCP server. Which option is the cause of this
issue?

A. The DHCP server does not support information option 82.

B. The DHCP client interfaces have storm control configured.
C. Static DHCP bindings are not configured on the switch.
D. DHCP snooping must be enabled on all VLANs, even if they are not utilized for dynamic address allocation.

Correct Answer: A
Section: Infrastructure Security
Explanation
Explanation/Reference:
Explanation:
When you enable both IP Source Guard and Port Security, using the ip verify source port-security interface configuration
command, there are two caveats:

The DHCP server must support option 82, or the client is not assigned an IP address.
The MAC address in the DHCP packet is not learned as a secure address. The MAC address of the DHCP client is
learned as a secure address only when the switch receives non-DHCP data traffic.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/
guide/3550SCG/swdhcp82.html#wp1069615

QUESTION 112
A switch is added into the production network to increase port capacity. A network engineer is configuring the switch for
DHCP snooping and IP Source Guard, but is unable to configure ip verify source under several of the interfaces. Which
option is the cause of the problem?

A. The local DHCP server is disabled prior to enabling IP Source Guard.

B. The interfaces are configured as Layer 3 using the no switchport command.
C. No VLANs exist on the switch and/or the switch is configured in VTP transparent mode.
D. The switch is configured for sdm prefer routing as the switched database management template.
E. The configured SVIs on the switch have been removed for the associated interfaces.

Correct Answer: B
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
IP source guard is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering traffic based
on the DHCP snooping binding database and on manually configured IP source bindings. You can use IP source guard to
prevent traffic attacks caused when a host tries to use the IP address of its neighbor.
You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. After IP source guard is
enabled on an interface, the switch blocks all IP traffic received on the interface, except for DHCP packets allowed by
DHCP snooping. A port access control list (ACL) is applied to the interface. The port ACL allows only IP traffic with a source
IP address in the IP source binding table and denies all other traffic.
The IP source binding table has bindings that are learned by DHCP snooping or are manually configured (static IP source
bindings). An entry in this table has an IP address, its associated MAC address, and its associated VLAN number. The
switch uses the IP source binding table only when IP source guard is enabled.
IP source guard is supported only on Layer 2 ports, including access and trunk ports. You can configure IP source
guard with source IP address filtering or with source IP and MAC address filtering.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/
guide/3550SCG/swdhcp82.html#wp1069615

QUESTION 113
The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail
server. In which three ways does this command impact the traffic? (Choose three.)

A. SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold.
B. The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth.
C. The switch resumes forwarding broadcasts when they are below 65% of bandwidth.
D. Only broadcast traffic is limited by this particular storm control configuration.
E. Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface bandwidth.
F. The switch drops broadcasts when they reach 75% of bandwidth.

Correct Answer: CDF

Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:

In this case, the broadcast keyword was used so only broadcast traffic is limited.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-2_25_see/configuration/
guide/3550SCG/swtrafc.html

QUESTION 114
After port security is deployed throughout an enterprise campus, the network team has been overwhelmed with port reset
requests. They decide to configure the network to automate the process of re-enabling user ports. Which command
accomplishes this task?

A. switch(config)# errdisable recovery interval 180

B. switch(config)# errdisable recovery cause psecure-violation
C. switch(config)# switchport port-security protect
D. switch(config)# switchport port-security aging type inactivity
E. switch(config)# errdisable recovery cause security-violation

Correct Answer: B
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
When a secure port is in the error-disabled state, you can bring it out of this state automatically by configuring the
errdisable recovery cause psecure-violation global configuration command or you can manually reenable it by entering the
shutdown and no shut down interface configuration commands. This is the default mode. If a port is in per-VLAN errdisable
mode, you can also use clear errdisable interface name vlan range command to re-enable the VLAN on the port.
You can also customize the time to recover from the specified error disable cause (default is 300 seconds) by entering the
errdisable recovery interval interval command.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/53SG/configuration/config/port_sec.pdf

QUESTION 115
The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server. Which
two commands help trace this PC when the MAC address is known? (Choose two.)

A. switch# show mac address-table

B. switch# show port-security
C. switch# show ip verify source
D. switch# show ip arp inspection
E. switch# show mac address-table address <mac address>
Correct Answer: AE
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
These two commands will show the MAC address table, including the switch port that the particular host is using. Here is
an example output:
Switch> show mac-address-table

Dynamic Addresses Count: 9

Secure Addresses (User-defined) Count: 0
Static Addresses (User-defined) Count: 0
System Self Addresses Count: 41
Total MAC addresses: 50
Non-static Address Table:
Destination Address Address Type VLAN Destination Port
------------------- ------------ ---- --------------------
0010.0de0.e289 Dynamic 1 FastEthernet0/1
0010.7b00.1540 Dynamic 2 FastEthernet0/5
0010.7b00.1545 Dynamic 2 FastEthernet0/5

QUESTION 116
While troubleshooting a network outage, a network engineer discovered an unusually high level of broadcast traffic coming
from one of the switch interfaces. Which option decreases consumption of bandwidth used by broadcast traffic?

A. storm control
B. SDM routing
C. Cisco IOS parser
D. integrated routing and bridging
E. Dynamic ARP Inspection

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Storm control prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast storm on a port. A LAN
storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the
protocol-stack implementation, mistakes in network configuration, or users issuing a denial-of-service attack can cause a
storm.
Storm control is configured for the switch as a whole but operates on a per-port basis. By default, storm control is disabled.
Storm control uses rising and falling thresholds to block and then restore the forwarding of broadcast, unicast, or multicast
packets. You can also set the switch to shut down the port when the rising threshold is reached.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_22ea/SCG/scg/
swtrafc.html

QUESTION 117
Which command globally enables AAA on a device?

A. aaa new-model
B. aaa authentication
C. aaa authorization
D. aaa accounting

Correct Answer: A
Section: Infrastructure Security
Explanation
Explanation/Reference:
Explanation:
To configure AAA authentication, enable AAA by using the aaa new-model global configuration command. AAA features
are not available for use until you enable AAA globally by issuing the aaa new-model command.

Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathen.html

QUESTION 118
Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

A. network
B. IP mobile
C. EXEC
D. auth-proxy

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Method lists for authorization define the ways that authorization will be performed and the sequence in which these
methods will be performed. A method list is simply a named list describing the authorization methods to be queried (such as
RADIUS or TACACS+), in sequence. Method lists enable you to designate one or more security protocols to be used for
authorization, thus ensuring a backup system in case the initial method fails. Cisco IOS software uses the first method
listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS software selects the
next method listed in the method list. This process continues until there is successful communication with a listed
authorization method, or all methods defined are exhausted.
Method lists are specific to the authorization type requested:
Auth-proxy — Applies specific security policies on a per-user basis. For detailed information on the authentication proxy
feature, refer to the chapter "Configuring Authentication Proxy" in the "Traffic Filtering“and Firewalls" part of this book”
Comma“ds — Applies to the EXEC mode com”ands a user issues. Command authorization attempts authorization for all
EXEC mode commands, including global configuration commands, associated with a specific privilege level.
EXEC — Applies to the attributes associated with a user EXEC terminal session.
Network — Applies to network connections. This can include a PPP, SLIP, or ARAP connection.
Reverse Access — Applies to reverse Telnet sessions.
When you create a named method list, you are defining a particular list of authorization methods for the indicated
authorization type.

Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathor.html

QUESTION 119
Which authentication service is needed to configure 802.1x?

A. RADIUS with EAP Extension

B. TACACS+
C. RADIUS with CoA
D. RADIUS using VSA

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
With 802.1x, the authentication server — performs the actual authentication of the client. The authentication server
validates the identity of the client and notifies the switch whether or not the client is authorized to access the LAN and
switch services. Because the switch acts as the proxy, the authentication service is transparent to the client. The Remote
Authentication Dial-In User Service (RADIUS) security system with Extensible Authentication Protocol (EAP)
extensions is the only supported authentication server.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2940/software/release/12-1_19_ea1/configuration/
guide/2940scg_1/sw8021x.pdf

QUESTION 120
Refer to the exhibit.

Which login credentials are required when connecting to the console port in this output?

A. none required
B. username cisco with password cisco
C. no username with password linepass
D. login authentication default

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Here the console has been configured with the NO_AUTH name, which lists none as the authentication method. None
means no authentication, meaning that credentials are not required and all sessions are allowed access immediately.

QUESTION 121
Refer to the exhibit.

When a network administrator is attempting an SSH connection to the device, in which order does the device check the
login credentials?

A. RADIUS server, local username, line password

B. RADIUS server, line password, local username
C. Line password, local username, RADIUS server
D. Line password, RADIUS server, local username

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
sessions use the vty lines, where the configured authentication method is named “default.” The AAA default login
preference is stated in order from first to last, so here the “aaa authentication login default group radius local line” means to
use RADIUS first, then if that fails use the local user database. Finally, if that fails use the line password.

QUESTION 122
Which type of information does the DHCP snooping binding database contain?

A. untrusted hosts with leased IP addresses

B. trusted hosts with leased IP addresses
C. untrusted hosts with available IP addresses
D. trusted hosts with available IP addresses

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. The
DHCP snooping feature performs the following activities:
Validates DHCP messages received from untrusted sources and filters out invalid messages.
Rate-limits DHCP traffic from trusted and untrusted sources.
Builds and maintains the DHCP snooping binding database, which contains information about untrusted hosts
with leased IP addresses.
Utilizes the DHCP snooping binding database to validate subsequent requests from untrusted hosts.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
snoodhcp.pdf

QUESTION 123
Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database?

A. Dynamic ARP Inspection

B. storm control
C. VTP pruning
D. DHCP snooping

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Dynamic ARP inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a
trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is
enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the
packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid.

Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-
catl3fixed.html
QUESTION 124
Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server?

A. ip dhcp snooping trust

B. ip dhcp snooping
C. ip dhcp trust
D. ip dhcp snooping information

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
When configuring DHCP snooping, follow these guidelines:
DHCP snooping is not active until you enable the feature on at least one VLAN, and enable DHCP globally on the
switch.
Before globally enabling DHCP snooping on the switch, make sure that the devices acting as the DHCP server and the
DHCP relay agent are configured and enabled.
If a Layer 2 LAN port is connected to a DHCP server, configure the port as trusted by entering the “ip dhcp
snooping trust” interface configuration command.
If a Layer 2 LAN port is connected to a DHCP client, configure the port as untrusted by entering the no ip dhcp snooping
trust interface configuration command.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
snoodhcp.html

QUESTION 125
Which private VLAN access port belongs to the primary VLAN and can communicate with all interfaces, including the
community and isolated host ports?

A. promiscuous port
B. isolated port
C. community port
D. trunk port

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
The types of private VLAN ports are as follows:
Promiscuous — A promiscuous port belongs to the primary VLAN. The promiscuous port can communicate with all
interfaces, including the community and isolated host ports, that belong to those secondary VLANs associated to
the promiscuous port and associated with the primary VLAN. You can have several promiscuous ports in a primary
VLAN. Each promiscuous port can have several secondary VLANs, or no secondary VLANs, associated to that port.
You can associate a secondary VLAN to more than one promiscuous port, as long as the promiscuous port and
secondary VLANs are within the same primary VLAN. You may want to do this for load-balancing or redundancy
purposes. You can also have secondary VLANs that are not associated to any promiscuous port.
Isolated — An isolated port is a host port that belongs to an isolated secondary VLAN. This port has complete isolation
from other ports within the same private VLAN domain, except that it can communicate with associated promiscuous
ports. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received from an
isolated port is forwarded only to promiscuous ports. You can have more than one isolated port in a specified isolated
VLAN. Each port is completely isolated from all other ports in the isolated VLAN.
Community — A community port is a host port that belongs to a community secondary VLAN. Community ports
communicate with other ports in the same community VLAN and with associated promiscuous ports. These interfaces
are isolated from all other interfaces in other communities and from all isolated ports within the private VLAN domain.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/
CLIConfigurationGuide/PrivateVLANs.html
QUESTION 126
Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional traffic upstream from
the hosts toward the promiscuous ports and the gateway?

A. isolated VLAN
B. primary VLAN
C. community VLAN
D. promiscuous VLAN

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Understanding Primary, Isolated, and Community Private VLANs
Primary VLANs and the two types of secondary VLANs (isolated and community) have these characteristics:
Primary VLAN — The primary VLAN carries traffic from the promiscuous ports to the host ports, both isolated and
community, and to other promiscuous ports.
Isolated VLAN — An isolated VLAN is a secondary VLAN that carries unidirectional traffic upstream from the
hosts toward the promiscuous ports. You can configure multiple isolated VLANs in a private VLAN domain; all the
traffic remains isolated within each one. Each isolated VLAN can have several isolated ports, and the traffic from each
isolated port also remains completely separate.
Community VLAN — A community VLAN is a secondary VLAN that carries upstream traffic from the community ports to
the promiscuous port and to other host ports in the same community. You can configure multiple community VLANs in a
private VLAN domain. The ports within one community can communicate, but these ports cannot communicate with
ports in any other community or isolated VLAN in the private VLAN.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/
CLIConfigurationGuide/PrivateVLANs.html

QUESTION 127
Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC address binding?

A. DHCP snooping database

B. dynamic ARP database
C. dynamic routing database
D. static ARP database

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Information About Dynamic ARP Inspection
DAI is used to validate ARP requests and responses as follows:
Intercepts all ARP requests and responses on untrusted ports.
Verifies that a packet has a valid IP-to-MAC address binding before updating the ARP cache or forwarding the packet.
Drops invalid ARP packets.
DAI can determine the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a DHCP
snooping binding database. This database is built by DHCP snooping when it is enabled on the VLANs and on the
device. It may also contain static entries that you have created.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/hyperv/sw/5_2_1_s_m_1_5_2/
troubleshooting/configuration/guide/n1000v_troubleshooting/n1000v_trouble_19dhcp.html

QUESTION 128
When IP Source Guard with source IP filtering is enabled on an interface, which feature must be enabled on the access
VLAN for that interface?

A. DHCP snooping
B. storm control
C. spanning-tree portfast
D. private VLAN

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
IP Source Guard Configuration Guidelines
• You can configure static IP bindings only on nonrouted ports. If you enter the ip source binding mac-address vlan vlan-id
ip-address interface interface-id global configuration command on a routed interface, this error message appears:
Static IP source binding can only be configured on switch port.
When IP source guard with source IP filtering is enabled on an interface, DHCP snooping must be enabled on
the access VLAN for that interface.
If you are enabling IP source guard on a trunk interface with multiple VLANs and DHCP snooping is enabled on all the
VLANs, the source IP address filter is applied on all the VLANs.
You can enable this feature when 802.1x port-based authentication is enabled.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/
configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01110.html

QUESTION 129
Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or broadcast traffic?

A. storm control
B. port security
C. VTP pruning
D. VLAN trunking

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
A traffic storm occurs when packets flood the LAN, which creates excessive traffic and degrades network performance. The
traffic storm control feature prevents LAN ports from being disrupted by a broadcast, multicast, or unicast traffic storm on
physical interfaces from either mistakes in network configurations or from users issuing a DoS attack.

Reference: http://3c3cc.com/c/en/us/td/docs/routers/7600/ios/122SR/configuration/guide/swcg/dos.pdf

QUESTION 130
Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected?

A. router(config-if)#storm-control action shutdown

B. router(config-if)#storm-control action trap
C. router(config-if)#storm-control action error
D. router(config-if)#storm-control action enable

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Configuring the Traffic Storm Control Shutdown Mode
To configure the traffic storm control shutdown mode on an interface, perform this task:
Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/storm.html

QUESTION 131
A network engineer configures port security and 802.1x on the same interface. Which option describes what this
configuration allows?

A. It allows port security to secure the MAC address that 802.1x authenticates.
B. It allows port security to secure the IP address that 802.1x authenticates.
C. It allows 802.1x to secure the MAC address that port security authenticates.
D. It allows 802.1x to secure the IP address that port security authenticates.

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
802.1X and Port Security
You can configure port security and 802.1X on the same interfaces. Port security secures the MAC addresses that 802.1X
authenticates. 802.1X processes packets before port security processes them, so when you enable both on an interface,
802.1X is already preventing inbound traffic on the interface from unknown MAC addresses.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-
cfg/sec_portsec.html

QUESTION 132
Which feature describes MAC addresses that are dynamically learned or manually configured, stored in the address table,
and added to the running configuration?

A. sticky
B. dynamic
C. static
D. secure

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
With port security, you can configure MAC addresses to be sticky. These can be dynamically learned or manually
configured, stored in the address table, and added to the running configuration. If these addresses are saved in the
configuration file, the interface does not need to dynamically relearn them when the switch restarts. Although sticky secure
addresses can be manually configured, it is not recommended.
Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/
port_sec.pdf

QUESTION 133
On which interface can port security be configured?

A. static trunk ports

B. destination port for SPAN
C. EtherChannel port group
D. dynamic access ports

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
Port Security and Port Types
You can configure port security only on Layer 2 interfaces. Details about port security and different types of interfaces or
ports are as follows:
Access ports — You can configure port security on interfaces that you have configured as Layer 2 access ports. On an
access port, port security applies only to the access VLAN.
Trunk ports — You can configure port security on interfaces that you have configured as Layer 2 trunk ports. VLAN
maximums are not useful for access ports. The device allows VLAN maximums only for VLANs associated with the
trunk port.
SPAN ports — You can configure port security on SPAN source ports but not on SPAN destination ports.
Ethernet Port Channels — Port security is not supported on Ethernet port channels.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-
cfg/sec_portsec.html

These are some other guidelines for configuring port security:

Port security can only be configured on static access ports. A secure port cannot be a dynamic access port or a trunk port.
A secure port cannot be a destination port for Switch Port Analyzer (SPAN). A secure port cannot belong to an
EtherChannel port group. A secure port cannot be an 802.1X port. You cannot configure static secure MAC addresses in
the voice VLAN.
Reference: https://supportforums.cisco.com/t5/network-infrastructure-documents/unable-to-configure-port-security-on-a-
catalyst-2940-2950-2955/ta-p/3133064

QUESTION 134
When you configure private VLANs on a switch, which port type connects the switch to the gateway router?

A. promiscuous
B. community
C. isolated
D. trunked

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
There are mainly two types of ports in a Private VLAN: Promiscuous port (P-Port) and Host port. Host port further divides in
two types – Isolated port (I-Port) and Community port (C-port).
Promiscuous port (P-Port): The switch port connects to a router, firewall or other common gateway device. This port can
communicate with anything else connected to the primary or any secondary VLAN. In other words, it is a type of a port
that is allowed to send and receive frames from any other port on the VLAN.
Host Ports:
- Isolated Port (I-Port): Connects to the regular host that resides on isolated VLAN. This port communicates only with
P-Ports.
 - Community Port (C-Port): Connects to the regular host that resides on community VLAN. This port communicates
with P-Ports and ports on the same community VLAN.

Reference: http://en.wikipedia.org/wiki/Private_VLAN

QUESTION 135
When you configure a private VLAN, which type of port must you configure the gateway router port as?

A. promiscuous port
B. isolated port
C. community port
D. access port

Correct Answer: A
Section: Infrastructure Security
Explanation

Explanation/Reference:
Explanation:
There are mainly two types of ports in a Private VLAN: Promiscuous port (P-Port) and Host port. Host port further divides in
two types – Isolated port (I-Port) and Community port (C-port).
Promiscuous port (P-Port): The switch port connects to a router, firewall or other common gateway device. This port can
communicate with anything else connected to the primary or any secondary VLAN. In other words, it is a type of a port
that is allowed to send and receive frames from any other port on the VLAN.
Host Ports:
- Isolated Port (I-Port): Connects to the regular host that resides on isolated VLAN. This port communicates only with
P-Ports.
- Community Port (C-Port): Connects to the regular host that resides on community VLAN. This port communicates
with P-Ports and ports on the same community VLAN.

Reference: http://en.wikipedia.org/wiki/Private_VLAN

QUESTION 136
SIMULATION
SWITCH.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches; DSW1 and
ASW1. The topology diagram indicates their layer 2 mapping. VLAN 20 is a new VLAN that will be used to provide the
shipping personnel access to the server. Corporate polices do not allow layer 3 functionality to be enabled on the switches.
For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:

Users connecting to VLAN 20 via port f0/1 on ASW1 must be authenticated before they are given access to the network.
Authentication is to be done via a Radius server:
- Radius server host: 172.120.40.46
- Radius key: rad123
- Authentication should be implemented as close to the host as possible.
Devices on VLAN 20 are restricted to the subnet of 172.120.40.0/24.
- Packets from devices in the subnet of 172.120.40.0/24 should be allowed on VLAN 20.
- Packets from devices in any other address range should be dropped on VLAN 20.
- Filtering should be implemented as close to the server farm as possible.

The Radius server and application servers will be installed at a future date. You have been tasked with implementing the
above access control as a pre-condition to installing the servers. You must use the available IOS switch features.

Note: Named access list is not supported.

Correct Answer: Here is the solution below
Section: Infrastructure Security
Explanation

Explanation/Reference:
Step1: Console to ASW1 from PC console 1
ASW1(config)#aaa new-model
ASW1(config)#radius-server host 172.120.39.46 key rad123
ASW1(config)#aaa authentication dot1x default group radius
ASW1(config)#dot1x system-auth-control
ASW1(config)#inter fastEthernet 0/1
ASW1(config-if)#switchport mode access
ASW1(config-if)#dot1x port-control auto
ASW1(config-if)#exit
ASW1#copy run start
Step2: Console to DSW1 from PC console 2
DSW1(config)#ip access-list standard 10
DSW1(config-ext-nacl)#permit 172.120.40.0 0.0.0.255
DSW1(config-ext-nacl)#exit
DSW1(config)#vlan access-map PASS 10
DSW1(config-access-map)#match ip address 10
DSW1(config-access-map)#action forward
DSW1(config-access-map)#exit
DSW1(config)#vlan access-map PASS 20
DSW1(config-access-map)#action drop
DSW1(config-access-map)#exit
DSW1(config)#vlan filter PASS vlan-list 20
DSW1#copy run start

QUESTION 137
Which configuration command ties the router hot standby priority to the availability of its interfaces?

A. standby group
B. standby priority
C. backup interface
D. standby track

Correct Answer: D
Section: Infrastructure Services
Explanation
Explanation/Reference:
Explanation:
The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and
is useful for tracking interfaces that are not configured for HSRP. When a tracked interface fails, the hot standby priority on
the device on which tracking has been configured decreases by 10. If an interface is not tracked, its state changes do not
affect the hot standby priority of the configured device. For each interface configured for hot standby, you can configure a
separate list of interfaces to be tracked.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/
swhsrp.html

QUESTION 138
What is the default HSRP priority?

A. 50
B. 100
C. 120
D. 1024

Correct Answer: B
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/
swhsrp.html#wp1044327

QUESTION 139
Which option is a benefit of using VSS?

A. reduces cost
B. simplifies configuration
C. provides two independent supervisors with two different control planes
D. removes the need for a First Hop Redundancy Protocol

Correct Answer: D
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation: First Hop Redundancy Protocols (FHRPs) such as VRRP and HSRP were designed to allow for a highly
available first IP route hop for host systems. FHRPs allow two (or more) distinct routers to share a common IP address
providing a redundant Layer-3 default gateway for end nodes. The VSS system creates a single logical router at Layer 3.
This VSS routing instance fulfills this first-hop role without the need for a dedicated protocol. The VSS IP route is highly
available due to MEC and the resiliency of the VSS system. VSS eliminates the need for FHRP at the aggregation layer of
the data center.

Reference: http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/vssdc_integrate.html

QUESTION 140
Which First Hop Redundancy Protocol is an IEEE Standard?

A. GLBP
B. HSRP
C. VRRP
D. OSPF

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
A comparison of the three First Hop Redundancy Protocols are listed below:
Reference: http://cciethebeginning.wordpress.com/2008/08/23/router-high-availability-protocol-comparison-2/

QUESTION 141
What is the default amount by which the hot standby priority for the router is decremented or incremented when the
interface goes down or comes back up?

A. 1
B. 5
C. 10
D. 15

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and
is useful for tracking interfaces that are not configured for HSRP. When a tracked interface fails, the hot standby
priority on the device on which tracking has been configured decreases by 10. If an interface is not tracked, its state
changes do not affect the hot standby priority of the configured device. For each interface configured for hot standby, you
can configure a separate list of interfaces to be tracked.

Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/
swhsrp.html

QUESTION 142
What is the maximum number of virtual MAC addresses that GLBP allows per group?

A. 2
B. 4
C. 6
D. 8

Correct Answer: B
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
GLBP Virtual MAC Address Assignment
A GLBP group allows up to four virtual MAC addresses per group. The AVG is responsible for assigning the virtual MAC
addresses to each member of the group. Other group members request a virtual MAC address after they discover the AVG
through hello messages. Gateways are assigned the next MAC address in sequence. A virtual forwarder that is assigned a
virtual MAC address by the AVG is known as a primary virtual forwarder. Other members of the GLBP group learn the
virtual MAC addresses from hello messages. A virtual forwarder that has learned the virtual MAC address is referred to as
a secondary virtual forwarder.

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039651

QUESTION 143
Which gateway role is responsible for answering ARP requests for the virtual IP address in GLBP?

A. active virtual forwarder

B. active virtual router
C. active virtual gateway
D. designated router

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
GLBP Active Virtual Gateway
Members of a GLBP group elect one gateway to be the active virtual gateway (AVG) for that group. Other group members
provide backup for the AVG in the event that the AVG becomes unavailable. The AVG assigns a virtual MAC address to
each member of the GLBP group. Each gateway assumes responsibility for forwarding packets sent to the virtual MAC
address assigned to it by the AVG. These gateways are known as active virtual forwarders (AVFs) for their virtual MAC
address.
The AVG is responsible for answering Address Resolution Protocol (ARP) requests for the virtual IP address. Load
sharing is achieved by the AVG replying to the ARP requests with different virtual MAC addresses.

Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html

QUESTION 144
Which VRRP router is responsible for forwarding packets that are sent to the IP addresses of the virtual router?

A. virtual router master

B. virtual router backup
C. virtual router active
D. virtual router standby

Correct Answer: A
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
VRRP Definitions

VRRP Router A router running the Virtual Router Redundancy

Protocol. It may participate in one or more
virtual routers.

Virtual Router An abstract object managed by VRRP that acts

as a default router for hosts on a shared LAN.
It consists of a Virtual Router Identifier and
a set of associated IP address(es) across a
common LAN. A VRRP Router may backup one or
more virtual routers.

IP Address Owner The VRRP router that has the virtual router's
IP address(es) as real interface address(es’.
This is the router that, when up, will respond
to packets addressed to one of these IP
addresses for ICMP pings, TCP connections,
etc.

Primary IP Address An IP address selected from the set of real

interface addresses. One possible selection
algorithm is to always select the first
address. VRRP advertisements are always sent
using the primary IP address as the source of
the IP packet.

Virtual Router Master The VRRP router that is assuming the

responsibility of forwarding packets sent to
the IP address(es) associated with the virtual
router, and answering ARP requests for these
IP addresses. Note that if the IP address
owner is available, then it will always become
the Master.

Reference: http://www.ietf.org/rfc/rfc3768.txt

QUESTION 145
Which command correctly configures standby tracking for group 1 using the default decrement priority value?
A. standby 1 track 100
B. standby 1 track 100 decrement 1
C. standby 1 track 100 decrement 5
D. standby 1 track 100 decrement 20

Correct Answer: A
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
The default decrement value for HSRP standby tracking is 10. There is no need to explicitly state the value if the desired
value is the default value.

QUESTION 146
Which command configures an HSRP group to become a slave of another HSRP group?

A. standby slave
B. standby group track
C. standby follow
D. standby group backup

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
Perform this task to configure multiple HSRP client groups.
The “standby follow” command configures an HSRP group to become a slave of another HSRP group.
HSRP client groups follow the master HSRP with a slight, random delay so that all client groups do not change at the same
time.

Reference: http://www.cisco.com/en/US/docs/ios-xml/ios/ipapp_fhrp/configuration/15-mt/fhp-hsrp-mgo.html

QUESTION 147
Refer to the exhibit.

Which option describes the reason for this message in a GLBP configuration?

A. Unavailable GLBP active forwarder

B. Incorrect GLBP IP address
C. HSRP configured on same interface as GLBP
D. Layer 2 loop

Correct Answer: D
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
This section provides information you can use to troubleshoot your configuration.

%GLBP-4-DUPADDR: Duplicate address

The error message indicates a possible layer2 loop and STP configuration issues.
In order to resolve this issue, issue the show interface command to verify the MAC address of the interface. If the MAC
address of the interface is the same as the one reported in the error message, then it indicates that this router is receiving
its own hello packets sent. Verify the spanning-tree topology and check if there is any layer2 loop. If the interface MAC
address is different from the one reported in the error message, then some other device with a MAC address reports this
error message.
Note: GLBP members communicate between each other through hello messages sent every 3 seconds to the multicast
address 224.0.0.102 and User Datagram Protocol (UDP) port 3222 (source and destination). When configuring the
multicast boundary command, permit the Multicast address by permit 224.0.0.0 15.255.255.255.

Reference: http://www.cisco.com/en/US/products/hw/switches/ps708/
products_configuration_example09186a00807d2520.shtml#dr

QUESTION 148
ABC, Inc. is a medium sized company, with an enterprise network (access, distribution and core switches) that provides
LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a
high availability solution.
DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105
DSW2 – primary device for VLAN 103 and VLAN 104
A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary
device, unless GigabitEthernet1/0/1 on backup device has also failed.
Troubleshooting has identified several issues. Currently all interfaces are up. Using the running configurations and show
commands, you have been asked to investigate and respond to the following question.
During routine maintenance, GigabitEthernet1/0/1 on DSW1 was shut down. All other interfaces were up. DSW2 became
the active HSRP device for VLAN 101 as desired. However, after GigabitEthemet1/0/1 on DSW1 was reactivated, DSW1
did not become the active router for VLAN 101 as desired. What needs to be done to make the group for VLAN 101
function properly?

A. Enable preempt in the VLAN 101 HSRP group on DSW1.

B. Disable preempt in the VLAN 101 HSRP group on DSW2’s.
C. In the VLAN 101 HSRP group on DSW1, decrease the priority value to avaluethatis less ‘ than the priority value
 configured in the VLAN 101 HSRP group on DSW2.
D. Decrease the decrement value in the track command for the VLAN 101 HSRP group on U DSWTs to a values less than
the value in the track command for the VLAN 101 HSRP group on DSW2.

Correct Answer: A
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:

A is correct. All other answers are incorrect. Because Vlan101 on DS1 ( left ) disable preempt. We need enable preempt to
after it reactive, it will be active device. If not this command, it never become active device.

QUESTION 149
ABC, Inc. is a medium sized company, with an enterprise network (access, distribution and core switches) that provides
LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a
high availability solution.
DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105
DSW2 – primary device for VLAN 103 and VLAN 104
A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary
device, unless GigabitEthernet1/0/1 on backup device has also failed.
Troubleshooting has identified several issues. Currently all interfaces are up. Using the running configurations and show
commands, you have been asked to investigate and respond to the following question.
During routine maintenance, it became necessary to shut down the GigabitEthernet1/0/1 interface on DSW1. All other
interfaces were up. During this time, DSW1 remained the active device for the VLAN 102 HSRP group. You have
determined that there is an issue with the decrement value in the track command for the VLAN 102 HSRP group. What
needs to be done to make the group function properly?

A. The decrement value on DSW1 should be greaterthan 5 and less than 15. 0
B. The decrement value on DSW1 should be greaterthan 9 and less than 15.
C. The decrement value on DSW1 should be greaterthan 11 and less than 19.
D. The decrement value on DSWTs should be greaterthan 190 and less than 200.
E. The decrement value on DSWTs should be greaterthan 195 and less than 205.

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:

Use “show run” command to show. The left Vlan102 is console1 of DS1. Priority value is 200, we should decrement value
in the track command from 11 to 18. Because 200 – 11 = 189 < 190 (priority of Vlan102 on DS2).

QUESTION 150
ABC, Inc. is a medium sized company, with an enterprise network (access, distribution and core switches) that provides
LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a
high availability solution.
DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105
 DSW2 – primary device for VLAN 103 and VLAN 104
A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary
device, unless GigabitEthernet1/0/1 on backup device has also failed.
Troubleshooting has identified several issues. Currently all interfaces are up. Using the running configurations and show
commands, you have been asked to investigate and respond to the following question.
All interfaces are active. DSW2 has not become the active device for the VLAN 103 HSRP group. As related to the VLAN
103 HSRP group, what can be done to make the group function properly?

A. On DSW1, disable preempt.

B. On DSW1, decrease the priority value to a value less than 190 and greater than 150.
C. On DSW2, increase the priority value to a value greater 200 and less than 250.
D. On DSW2, increase the decrement value in the track command to a value greater than 10 and less than 50.
Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
From the output shown below of the HSRP status of DSW2, we see that the active router has a priority of 200, while the
local priority is 190. We need to increase the priority of DSW2 to greater than 200, but it should be less than 250 so that if
the gig 1/0/1 interface goes down, DSW1 will become active. DSW2 is configured to decrement the priority by 50 if this
interface goes down, so the correct answer is to increase the priority to more than 200, but less than 250.

QUESTION 151
ABC, Inc. is a medium sized company, with an enterprise network (access, distribution and core switches) that provides
LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a
high availability solution.
DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105
DSW2 – primary device for VLAN 103 and VLAN 104
A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary
device, unless GigabitEthernet1/0/1 on backup device has also failed.
Troubleshooting has identified several issues. Currently all interfaces are up. Using the running configurations and show
commands, you have been asked to investigate and respond to the following question.
During routine maintenance, it became necessary to shut down the GigabitEthernet1/0/1 interface on DSW1 and DSW2. All
other interfaces were up. During this time, DSW1 became the active router for the VLAN 104HSRP group. As related to the
VLAN 104HSRP group, what can to be done to make the group function properly?

A. On DSW1, disable preempt.

B. On DSW2 decrease the priority value to a value less than 150.
C. On DSW1, increase the decrement value in the track command to a value greater than 6.
D. On DSW1, decrease the decrement value in the track command to a value less than 1.

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:

We should NOT disable preempt on DS1. By do that, you will make Vlan104’s HSRP group fail function. Example: if we are
disable preempt on DS1. It can not become active device when G1/0/1 on DS2 fail. In this question, G0/1/0 on DS1 & DS2
is shutdown. Vlan104 (left): 150 – 1 = 149. Vlan104 (right): 200 – 155 = 145. Result is priority 149 > 145 (Vlan104 on DS1
is active). If increase the decrement in the track value to a value greater than 6 (> or = 6). Vlan104 (left): 150 – 6 = 144.
Result is priority 144 < 145 (vlan104 on DS2 is active).

QUESTION 152
ABC, Inc. is a medium sized company, with an enterprise network (access, distribution and core switches) that provides
LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a
high availability solution.
 DSW1 – primary device for VLAN 101 VLAN 102 and VLAN 105
DSW2 – primary device for VLAN 103 and VLAN 104
A failure of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary
device, unless GigabitEthernet1/0/1 on backup device has also failed.
Troubleshooting has identified several issues. Currently all interfaces are up. Using the running configurations and show
commands, you have been asked to investigate and respond to the following question.
What is the priority value of the VLAN 105 HSRP group on DSW2?

A. 50
B. 100
C. 150
D. 200

Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
Use "show standby brief" command on console2. Very easy to see that the priority of Vlan105 is 150.

QUESTION 153
ABC, Inc. is a medium sized company, with an enterprise network (access, distribution and core switches) that provides
LAN connectivity from user PCs to corporate servers. The distribution switches are configured to use HSRP to provide a
high availability solution.
DSW1 - primary device for VLAN 101 VLAN 102 and VLAN 105
D–W2 - primary device for VLAN 103 and VLAN 104
A failure–of GigabitEthemet1/0/1 on primary device should cause the primary device to release its status as the primary
device, unless GigabitEthernet1/0/1 on backup device has also failed.
Troubleshooting has identified several issues. Currently all interfaces are up. Using the running configurations and show
commands, you have been asked to investigate and respond to the following question.
If GigabitEthemet1/0/1 on DSW2 is shutdown, what will be the resulting priority value of the VLAN 105 HSRP group on
router DSW2?

A. 90
B. 100
C. 150
D. 200

Correct Answer: A
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation
As seen below, the current priority for VLAN 105 is 100, and the tracking feature for Gig 1/0/0 is enabled which will
decrement the priority by 10 if this interface goes down for a priority value of 90.
QUESTION 154
Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.
They have questions about how these two devices will perform in the event of a device failure. Click on the devices or the
tabs at the bottom of the screens to access the CLI to answer their questions.
What percentage of the outgoing traffic from the 172.16.10.0/24 subnet is being forwarded through R1?

A. R1-0%
B. R1-50 %, R2-50%
C. R2-100%
D. R1-100%

Correct Answer: D
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
Based on the following output, we see that R1 is the active standby router for the Ethernet 0/0 link, so all outgoing traffic will
be forwarded to R1.

QUESTION 155
Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.
They have questions about how these two devices will perform in the event of a device failure. Click on the devices or the
tabs at the bottom of the screens to access the CLI to answer their questions.
Refer to the exhibit. If router R1 interface Etherne0/0 goes down and recovers, which of the statement regarding HSRP
priority is true?

A. The interface will have the priority decremented by 40 for HSRP group 1.
B. The interface will have the priority decremented by 60 for HSRP group 1
C. The interface will have its current priority incremented by 40 for HSRP group 1
D. The interface will have its current priority incremented by 60 for HSRP group 1
E. The interface will default to the a priority of 100 for HSRP group 1
Correct Answer: C
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
Here is the HSRP configuration seen on R1:

Here, when the Ethernet 0/0 interface goes down, the standby 1 track decrement command will lower the priority from 130
to 90. However, when it comes back up, it will then increment it by 40 back to 130 for HSRP group 1.

QUESTION 156
Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.
They have questions about how these two devices will perform in the event of a device failure. Click on the devices or the
tabs at the bottom of the screens to access the CLI to answer their questions.
What issue is causing Router R1 and R2 to both be displayed as the HSRP active router for group 2?

A. The HSRP group number mismatch

B. The HSRP group authentication is misconfigured
C. The HSRP Hello packets are blocked
D. The HSRP timers mismatch
E. The HSRP group priorities are different

Correct Answer: B
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
Based on the configuration output, we see that authentication is configured on R2, but not on R1:

This can be further verified by issuing the “show standby” command on each router.

QUESTION 157
Your customer has asked you to come in and verify the operation of routers R1 and R2 which are configured to use HSRP.
They have questions about how these two devices will perform in the event of a device failure. Click on the devices or the
tabs at the bottom of the screens to access the CLI to answer their questions.
What is the virtual mac-address of HSRP group 1?

A. 0000.0c07.ac02
B. 4000.0000.0010
C. 0000.0c07.ac01
D. 4000.0000.ac01
E. 4000.0000.ac02
F. 0000.0c07.0010
Correct Answer: B
Section: Infrastructure Services
Explanation

Explanation/Reference:
Explanation:
Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is
4000.0000.0010 as shown below:

QUESTION 158
Refer to the exhibit.
When troubleshooting a network problem, a network analyzer is connected to Port f0/1 of a LAN switch. Which command
can prevent BPDU transmission on this port?

A. spanning-tree portfast bpduguard enable

B. spanning-tree bpduguard default
C. spanning-tree portfast bpdufilter default
D. no spanning-tree link-type shared

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 159
Which four LACP components are used to determine which hot-standby links become active after an interface failure within
an EtherChannel bundle? (Choose four.)

A. LACP system priority

B. LACP port priority
C. interface MAC address
D. system ID
E. port number
F. hot-standby link identification number
G. interface bandwidth

Correct Answer: ABDE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 160
RSPAN has been configured on a Cisco Catalyst switch; however, traffic is not being replicated to the remote switch. Which
type of misconfiguration is a cause?

A. The RSPAN designated VLAN is missing the remote span command.

B. The local and remote RSPAN switches are configured using different session IDs.
C. The local RSPAN switch is replicating only Rx traffic to the remote switch.
D. The local switch is overloaded with the amount of sourced traffic that must be replicated to the remote switch.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 161
How can you set VLAN 99 on a trunk to become a native VLAN?

A. switchport trunk native vlan 99

B. switchport trunk vlan 99 native
C. switchport native vlan 99 trunk
D. switchport native trunk vlan 99
E. switchport vlan 99 native
F. switchport vlan native trunk 99

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 162
To follow the Layer 2 switching guidelines, a network engineer decides to create a separate spanning tree for every group
of 10 VLANs. Which version of spanning tree is appropriate to meet the company policy?

A. MST
B. PVST+
C. RSTP
D. RPVST+
E. STP

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 163
A network engineer is installing a switch for temporary workers to connect to. The engineer does not want this switch
participating in Spanning Tree with the rest of the network; however, end user connectivity is still required. Which spanning-
tree feature accomplishes this?

A. BPDUblock
B. BPDUfilter
C. BPDUignore
D. BPDUguard
E. BPDUdisable

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 164
Refer to the exhibit.
What is the result of the SPAN configuration on a Cisco switch?

A. Configure a SPAN session to monitor the received traffic on interface g0/4 only for VLAN 3.
B. Configure a SPAN session to monitor the received traffic on interface g0/4 for all VLANs except VLAN 3.
C. Configure a SPAN session to monitor the received traffic on interface g0/5 only for VLAN 3.
D. Configure a SPAN session to monitor the received traffic on interface g0/5 for all VLANs except VLAN 3.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 165
When SDM templates are configured, which action must be performed for the configuration to take effect?

A. reload
B. shutdown
C. write memory
D. backup config

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 166
Which statement about the MAC address sticky entries in the switch when the copy run start command is entered is true?

A. A sticky MAC address is retained when the switch reboots.

B. A sticky MAC address can be a unicast or multicast address.
C. A sticky MAC address is lost when the switch reboots.
D. A sticky MAC address ages out of the MAC address table after 600 seconds.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 167
Enablement of which feature puts the port into err-disabled state when the port has PortFast enabled and it receives
BPDUs?

A. BPDU filtering
B. BackboneFast
C. EtherChannel
D. BPDU guard

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 168
Refer to the exhibit.

Which configuration ensures that the Cisco Discovery Protocol packet update frequency sent from DSW1 to ALS1 is half of
the default value?

A. DSW1(config)#cdp timer 90
B. DSW1(config-if)#cdp holdtime 60
C. DSW1(config)#cdp timer 30
D. DSW1(config)#cdp holdtime 90
E. DSW1(config-if)#cdp holdtime 30
F. DSW1(config-if)#cdp timer 60

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 169
Interfaces are assigned to a VLAN, and then the VLAN is deleted. Which state are these interfaces in after the VLAN is
deleted?

A. They remain up, but they are reassigned to the default VLAN.
B. They go down until they are reassigned to a VLAN.
C. They go down, but they are reassigned to the default VLAN.
D. They remain up, but they are reassigned to the native VLAN.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 170
Which feature is automatically configured when an administrator enables a voice VLAN?

A. 802.1Q trunking
B. PortFast
C. QoS
D. private VLANs

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 171
Which statement describes one major issue that VTP can cause in an enterprise network when a new switch is introduced
in the network in VTP mode server?

A. It can cause network access ports to go into err-disabled state.

B. It can cause a network-wide VLAN configuration change if the revision number on the new switch is higher.
C. It can cause a network-wide VLAN configuration change if the revision number on the new switch is lower.
D. It can cause routing loops.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 172
A network administrator configures 10 extended VLANs ranging from VLANs 3051 to 3060 in an enterprise network. Which
version of VTP supports these extended VLANs?

A. version 1
B. version 2
C. version 3
D. VTP does not recognize extended VLANs.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 173
An engineer is configuring an EtherChannel between two switches using LACP. If the EtherChannel mode on switch 1 is
configured to active, which two modes on switch 2 establish an operational EtherChannel? (Choose two.)

A. active
B. auto
C. desirable
D. on
E. passive

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 174
When a Layer 2 EtherChannel is configured, which statement about placement of the IP address is true?

A. The IP address is placed on the highest numbered member port.

B. The IP address is placed on the port-channel logical interface.
C. The IP address is placed on the lowest numbered member port.
D. The IP address is assigned via DHCP only.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 175
Which option is valid for EtherChannel load balancing?

A. source MAC address and source IP address

B. destination MAC address and destination IP address
C. source MAC address and destination IP address
D. source MAC address and destination MAC address

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 176
Refer to the exhibit.
An engineer is configuring EtherChannel between two switches and notices the console message on switch 2. Based on
the output, which option describes the reason for this error?

A. Switch 1 does not have enough member ports configured.

B. Switch 2 has too many member ports configured.
C. The port channel interface numbers do not match.
D. The EtherChannel protocols do not match.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 177
Refer to the exhibit.
DSW1 should share the same MST region with switch DSW2. Which statement is true?

A. Configure DSW1 with the same version number, and VLAN-to-instance mapping as shown on DSW2.
B. DSW2 uses the VTP server mode to automatically propagate the MST configuration to DSW1.
C. DSW1 automatically inherits MST configuration from DSW2 because they have the same domain name.
D. Configure DSW1 with the same region name, revision number, and VLAN-to-instance mapping as shown on DSW2.
E. DSW1 is in VTP client mode with a lower configuration revision number, therefore, it automatically inherits MST
configuration from DW2.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 178
Which two statements about SPAN source and destination ports during an active session are true? (Choose two.)

A. The source port can be only an Ethernet physical port.

B. The source port can be monitored in multiple SPAN sessions.
C. The destination port can be destination in multiple SPAN sessions.
D. The destination port does not participate in STP.
E. You can mix individual source ports and source VLANs within a single session.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 179
In a switch stack environment, what is the total bidirectional traffic flow between two logical counter-rotating paths?

A. 16 Gbps
B. 32 Gbps
C. 64 Gbps
D. 128 Gbps

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 180
Refer to the exhibit.

Which statement about the SPAN and RSPAN configuration on SW1 is true?

A. SPAN session 2 only monitors egress traffic exiting port FastEthernet 0/14.
B. RSPAN session 1 monitors activity on VLAN 50 of a remote switch.
C. RSPAN session 1 is incompletely configured for monitoring.
D. SPAN session 2 monitors all traffic entering and exiting port FastEthernet 0/15.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 181
Which information does the subordinate switch in a switch stack keep for all the VLANs that are configured on it?

A. VLAN database
B. DHCP snooping database
C. spanning trees
D. routing information

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 182
Which option is the minimum number of bindings that the DHCP snooping database can store?

A. 1000 bindings
B. 2000 bindings
C. 5000 bindings
D. 8000 bindings

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 183
On which layer does IP source guard provide filtering to prevent a malicious host from impersonating the IP address of a
legitimate host?

A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 7

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 184
By default, what is the state of port security on a switch?

A. disabled
B. on
C. off
D. learning

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 185
Which two statements about HSRP, GLBP, and VRRP are true? (Choose two.)

A. HSRP is the preferred protocol to be used on multivendor environments.

B. VRRP has one master router, one standby router, and many listening routers.
C. GLBP allows for a maximum of four MAC addresses per group.
D. HSRP supports up to 255 groups on the same switch or router.
E. VRRP is a Cisco proprietary protocol.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 186
Refer to the exhibit.

Which option is the most likely explanation of the duplicate address message logged?

A. spanning-tree loop
B. HSRP misconfiguration
C. a PC with IP of 10.10.1.1
D. a hardware problem

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 187
DRAG DROP
Drag and drop the characteristic from the left to the matching Layer 2 protocol on the right.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 188
Refer to the exhibit.
A network engineer changes the default native VLAN to VLAN 999. After applying the settings on the uplinks to the core
switches, the switch control traffic, such as CDP and VTP, is no longer working. The standard configuration is used for
each uplink. What is wrong with the configuration?

A. The interface is administratively down.

B. The encapsulation type is incorrect.
C. The switchport mode trunk command should be first in the output.
D. The native VLAN is not present on the trunk.
E. The control traffic must be manually enabled on the new native VLAN.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 189
Which two options are two results of using the command spanning-tree vlan 50 root primary within a spanning-tree network
under global configuration? (Choose two.)

A. Spanning tree determines the priority of the current root for VLAN 50 and reduces the priority of the local switch to a
lower value.
B. The priority value for VLAN 50 is set to 4094 on the root while the local switch priority is set to 32768.
C. The spanning-tree timers are reduced to improve the convergence time for VLAN 50.
D. All ports that are configured on the current switch with VLAN 50 transition to designated ports.
E. The switchport that is configured for VLAN 50 is the primary connection to the spanning-tree root switch.

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 190
An access switch at a remote location is connected to the spanning-tree root with redundant uplinks. A network engineer
notices that there are issues with the physical cabling of the current root port. The engineer decides to force the secondary
link to be the desired forwarding root port.

Which action accomplishes this task?

A. Change the link-type to point-to-point.

B. Enable Rapid Spanning Tree to converge using the secondary link.
C. Adjust the secondary link to have a lower priority than the primary link.
D. Apply a BPDU filter on the primary interface of the remote switches.
Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 191
A network engineer wants to make sure that an access switch will never become a Spanning Tree root for VLAN 5. What
action will accomplish this task?

A. adjust STP priority to the maximum value

B. disable STP globally
C. apply root guard to all outgoing neighbor interfaces
D. enable MSTP and use a different revision number than all other switches

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 192
Instructions
To configure a switch click on the console host icon in the topology.
You can click on the buttons to view the different windows.
Each of the windows can be minimized by clicking on the [-]. You can also reposition a window by dragging it by the title
bar.

Most commands that use the “Control” or “Escape” keys are not supported and are not necessary to complete this
simulation. The help command does not display all commands of the help system.

Scenario
You work for SWITCH.com. They have just added a new switch (SwitchB) to the existing network as shown in the topology
diagram.
RouterA is currently configured correctly and is providing the routing function for devices on SwitchA and SwitchB. SwitchA
is currently configured correctly, but will need to be modified to support the addition of SwitchB. SwitchB has a minimal
configuration. You have been tasked with competing the needed configuring of SwitchA and SwitchB. SwitchA and SwitchB
use cisco as the enable password.
All commands must be entered at the physical interface level.
Configuration Requirement for SwitchA:
The VTP and STP configuration modes on SwitchA should not be modified.
SwitchA needs to be the root switch for vlans 11, 12, 13, 21, 22, and 23. All other vlans should be left are their default
values.
Configuration Requirement for SwitchB:
Vlan 21
- Name: Marketing
- will support wo servers attached to fa0/9 and fa0/10
Vlan 22
- Name: Sales
- will support two servers attached to fa0/13 and fa0/14
Vlan 23
- Name: Engineering
- will support two servers attached to fa0/15 and fa0/16
Access ports that connect to server should transition immediately to forwarding state upon detecting the connection of a
device.
SwitchB VTP mode needs to be the same as SwitchA.
SwitchB must operate in the same spanning tree mode as SwitchA.
No routing is to be configured on SwitchB
Only the SVl Vlan 1 is to be configured and it is to use address 192.168.1.11/24
Inter-switch Connectivity Configuration Requirements
For operational and security reasons trunking should be unconditional and Vlans 1, 21, 22, and 23 should tagged when
 traversing the trunk link.
The two trunks between SwitchA and SwitchB need to be configured in a mode that allows for the maximum use of their
bandwidth for all vlans. This mode should be done with a non-proprietary protocol, with SwitchA controlling activation.
Propagation of unnecessary broadcasts should be limited using manual pruning on this trunk link.

Topology

Refer to the exhibit.

Which configuration ensures that the Cisco Discovery Protocol packet update frequency sent from DSW1 to ALS1 is half of
the default value?

A. DSW1(config)#cdp timer 90
B. DSW1(config-if)#cdp holdtime 60
C. DSW1(config)#cdp timer 30
D. DSW1(config)#cdp holdtime 90
E. DSW1(config-if)#cdp holdtime 30
F. DSW1(config-if)#cdp timer 60

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 193
Instructions
To configure the switch click on the console host icon.
You can click on the buttons below to view the different windows.
Each of the windows can be minimized by clicking on the [-]. You can also reposition a window by dragging it by the title
bar.

Most commands that use the “Control” or “Escape” keys are not supported and are not necessary to complete this
simulation. The help command does not display all commands of the help system.

Scenario
ABC.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches; DSW1 and
ASW1. The topology diagram indicates their layer 2 mapping. Vlan 20 is a new VLAN that will be used to provide the
shipping personnel access to the server. Corporate polices do not allow layer 3 functionality to be enabled on the switches.
For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:
 Users connecting to VLAN 20 via port f0/1 on ASW1 must be authenticated before they are given access to the network.
Authentication is to be done via a Radius server:
- Radius server host 172.120.40.46
- Radius key: rad123
- Authentication should be implemented as close to the host as possible.
Devices on VLAN 20 are restricted to the subnet of 172.120.40.0/24.
- Packets from devices in the subnet of 172.120.40.0/24 should be allowed on VLAN 20.
- Packets from devices in any other address range should be dropped on VLAN20.
- Filtering should be implemented as close to the server farm as possible,

The Radius server and application servers will be installed at a future date. You have been tasked with implementing the
above access control as a pre-condition to-installing the servers. You must use the available IOS switch features.

Note: Named access list is not supported.

Interfaces are assigned to a VLAN, and then the VLAN is deleted. Which state are these interfaces in after the VLAN is
deleted?

A. They remain up, but they are reassigned to the default VLAN.
B. They go down until they are reassigned to a VLAN.
C. They go down, but they are reassigned to the default VLAN.
D. They remain up, but they are reassigned to the native VLAN.

Correct Answer: B
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 194
Refer to the exhibit. Which two statements about the network environment are true? (Choose two.)

A. The two aaaa.aaaa.aaaa MAC address entries must be from the same VLAN
B. Interfaces Fa0/1 and Fa0/3 cannot communicate via Layer 2 switching
C. Interfaces Fa0/1 and Fa0/2 cannot communicate via Layer 2 switching
D. The two aaaa.aaaa.aaaa MAC address entries must be from different VLANs
E. Interfaces Fa0/2 and Fa0/3 can communicate via Layer 2 switching

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 195
When port security is configured on a switch, which violation mode is the default?

A. no change
B. error disable
C. logging
D. shutdown

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 196
Which command configures VLAN 99 as an untagged VLAN on a trunk?

A. switchport trunk allowed vlan 99

B. switchport trunk pruning vlan except 99
C. switchport trunk native vlan 99
D. switchport access vlan 99

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 197
Which two DTP negotiated interface mode combinations negotiate to form an access port? (Choose two.)

A. dynamic auto and dynamic auto

B. nonegotiate and trunk
C. dynamic auto and trunk
D. dynamic desirable and access
E. dynamic desirable and dynamic auto

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 198
A network engineer is trying to prevent users from connecting unauthorized equipment to a production network. Which
option can be implemented campus-wide to satisfy this requirement?

A. UplinkFast
B. BPDU Guard
C. private VLANs
D. switchport block
E. IP Source Guard

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 199
Refer to the exhibit. Which statement about the interface is true?
A. The interface needs to shutdown configured
B. The other side of the interface is set as access
C. The interface is down
D. The switchport command is missing from the configuration

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 200
Refer to the exhibit. An engineer has run the show EtherChannel summary command and the output is displayed. Which
statement about the status of the EtherChannel is true?

A. The EtherChannel is down because of a mismatched EtherChannel protocol

B. The EtherChannel is operational and is using no EtherChannel protocol
C. The EtherChannel is down and configured for LACP
D. The EtherChannel is operational and configured for PAgP
E. IP Source Guard
Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 201
Which two statements about HSRP timers are true? (Choose two.)

A. The default Hold timer is 30 seconds

B. The default Hold timer is 10 seconds
C. The default Hello timer is 3 seconds
D. The default Hold timer is 15 seconds
E. The default Hello timer is 30 seconds
F. The default Hello timer is 5 seconds

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 202
After you connect a host to switch port G0/1, the port error disabled. Which command can you enter to determine the
reason?

A. show log
B. show run interface g0/1
C. show interfaces g0/1 status
D. show ip interface brief

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 203
A switch has been configured with the vlan dot1q tag native command. Which statement describes what the switch does
with untagged frames that it receives on a trunked interface?

A. Untagged frames are forwarded via the default VLAN

B. The trunked port is put in err-disable state
C. It drops the untagged frames
D. Untagged frames are forwarded via the native VLAN

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
Reference:
http://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/nxos/commands/l2/vlan-dot1q-tag-native.html

QUESTION 204
Refer to the exhibit. Which two commands ensure that DSW1 becomes root bridge for VLAN 10 and 20? (Choose two.)
A. spanning-tree mst 1 root primary
B. spanning-tree mstp vlan 10, 20 root primary
C. spanning-tree mst 1 priority 4096
D. spanning-tree mst vlan 10, 20 priority root
E. spanning-tree mst 1 priority 1

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 205
Refer to the exhibit. Currently, R1 is the VRRP master virtual router. Which statement about the VRRP configuration on R1
and R2 is true?
A. R2 does not have a route to 10.10.1.1/32 in its routing table
B. R2 becomes master if R1 reboots or track in R1 does not fail
C. Communication between VRRP members is encrypted using md5
D. R1 has a route to 10.10.1/32 in its routing table

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 206
Which two options are advantages of deploying VTPv3? (Choose two.)

A. It supports the use of AES to encrypt VTP messaging

B. It stores the VTP domain password securely as a SHA-1 hash
C. It adds an FCS field at the end of each VTP frame for consistency checking
D. It supports the propagation of private VLANs
E. It can be configured to allow only one VTP server to make changes to the VTP domain

Correct Answer: DE
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 207
Which two statements about StackWise are true? (Choose two.)

A. It groups multiple switch ports as a single EtherChannel

B. It uses a single IP address to communicate with the network
C. It monitors multiple switches from a central console
D. It enables multiple switch ports to share a single master configuration
E. It allows multiple switches to operate as a single switch

Correct Answer: DE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 208
A physical switch port is part of an EtherChannel group. What happens while the same port is configured as a SPAN
destination?

A. The port forwards traffic in the EtherChannel group and acts as a SPAN source simultaneously
B. The port is removed from the EtherChannel group
C. The port is put in the errdisabled state and can only be reenabled manually
D. The operation is not allowed as an EtherChannel member cannot be a SPAN source port

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 209
Which two conditions must be met to establish a Layer 2 EtherChannel? (Choose two.)

A. The trunking protocol must be the same for all links in the EtherChannel
B. SPAN must be disabled on the ports
C. All ports in the EtherChannel must operate in half-duplex
D. LAN ports in the EtherChannel must be contiguous
E. All ports in the EtherChannel must be on the same module

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 210
Which two authentication types does VRRP support? (Choose two.)

A. CHAP
B. plain-text
C. PAP
D. MD5
E. 802.1x
Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 211
When using EtherChannel misconfiguration guard, which technology is used to prevent this type of misconfiguration from
affecting the network?

A. LACP
B. STP
C. PAgP
D. port security

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 212
Which two new features are included in VTPv3? (Choose two.)

A. VTP now supports MD5 passwords

B. VLANs in the extended range are now eligible to participate in VTP
C. VTPs can now be configured in off mode
D. It can be configured to prevent the override of the VLAN database
E. VLANs configured for token ring are now eligible to participate in VTP

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 213
Which switch is chosen as the stack master during a stack master election or re-election?

A. the switch with the highest stack member ID

B. the switch with the lowest stack member ID
C. the switch with the lowest stack member priority value
D. the switch with the highest stack member priority value

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 214
Which feature actively validates DHCP messages and drops invalid messages?

A. DHCP host tracking

B. CGMP binding
C. Dynamic ARP Inspection
D. DHCP inspection
E. DHCP snooping
F. IGMP snooping

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 215
Which two limitations of local SPAN are true? (Choose two.)

A. Each SPAN session supports only one source VLAN or interface

B. A switch can support only one local SPAN session at a time
C. It can monitor only traffic that ingresses or egresses on the source interface or VLAN
D. A SPAN session can support multiple destination ports only if they are on the same VLAN
E. The source and destination ports must reside in the same switch or switch stack

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 216
Which command enables root guard on a Cisco switch at location id: 28468780

A. Switch(config)#spanning-tree guard root

B. Switch(config-if)#spanning-tree root guard
C. Switch(config)#spanning-tree root guard
D. Switch(config-if)#spanning-tree guard root

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 217
When EtherChannel guard is enabled and a misconfiguration is detected on a port, how does the port respond?

A. It enters the shutdown state

B. It enters the channel-error state
C. The port remains up, but it is unable to pass traffic
D. The port state remains unchanged, but the EtherChannel stays down
E. It enters the errdisable state

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 218
DRAG DROP

Drag and drop the characteristics from the left to the matching STP category on the right:

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:
QUESTION 219
Refer to the exhibit. You have configured routers R1 and R2 with VRRP for load sharing as shown. Which two effects of
this configuration are true? (Choose two.)

A. Router R1 is the primary gateway for 10.1.0.1 and router R2 is the primary gateway for 10.1.0.10
B. The four PCs send all requests to router R1, which forward traffic to router R2 as necessary
C. Router R2 is the primary gateway for 10.1.0.1 and router R1 is the primary gateway for 10.1.0.10
D. The four PCs send packets round-robin between routers R1 and R2
E. PC2 and PC4 use router R1 as the primary gateway
F. PC1 and PC3 use router R1 as the primary gateway

Correct Answer: AF
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 220
Which two prerequisites for HSRP to become active on an interface are true? (Choose two.)

A. A virtual MAC address must be configured on the interface

B. Cisco Express Forwarding must be disabled globally
C. PIM routing must be disabled on the interface
D. An IP address must be configured on the interface
E. The VIP must be in the same subnet as the primary IP address

Correct Answer: DE
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 221
Refer to the exhibit. Which two statements about the network environment of the device that generated this output are true?
(Choose two.)

A. The virtual IP address of the HSRP group is 10.1.1.1

B. If a router with a higher IP address and same HSRP priority as the active router becomes available, that router becomes
the new active router 5 seconds later
C. The local device has a higher priority setting than the active router
D. The hello and hold timers are set to custom values
E. If the local device fails to receive a hello from the active router for more than 5 seconds, it can become the active router

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 222
If StormControl is enabled on a port and the traffic reaches the configured level, which two actions can be configured to
occur? (Choose two.)

A. trap
B. log
C. notify admin
D. redirect traffic
E. shut down

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 223
In which two ways can a port respond to a port-security violation? (Choose two.)
A. The port enters the err-disabled state
B. The port enters the shutdown state
C. The port triggers an EEM script to notify support staff and continues to forward traffic normally
D. The SecurityViolation counter is incremented and the port sends an SNMP trap
E. The SecurityViolation counter is incremented and the port sends a critical syslog message to the console
F. The port immediately begins to drop all traffic

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
protect - The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC
addresses to drop below the maximum value.
restrict - The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC
addresses to drop below the maximum value and causes the security violation counter to increment.
shutdown - Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.
Restrict increments the counter and sends an SNMP trap. And shutdown puts the interface in err-disabled state.

QUESTION 224
Which two statements about Cisco Discovery Protocol are true? (Choose two.)

A. It is not supported with SNMP

B. It runs on OSI Layer 2
C. It is supported on Frame Relay subinterfaces
D. It uses a TLV to advertise the native VLAN
E. It runs on OSI Layer 1

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 225
DRAG DROP

Drag and drop the characteristic from the left to the matching STP feature on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 226
Which two statements about GLBP are true? (Choose two.)

A. The AVF assigns virtual MAC addresses to GLBP group members

B. The AVG assigns virtual MAC addresses to GLBP group members
C. The AVF responds to ARP requests for the virtual IP address
D. The AVG responds to ARP requests for the virtual IP address
E. LAN client traffic is handled by the active AVF only

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 227
Refer to the exhibit, which statement abort the current configuration on port GigabitEthernet2/0/1 is true?
A. It is an access port configured for a phone and a PC
B. It is a trunk port and the native VLAN is VLAN1
C. It is a trunk port and the native VLAN m VLAN 700
D. It is an access port in VLAN 700

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 228
When a Cisco Catalyst switch that is configured in VTP server mode is first booted, which two VLAN ranges are loaded on
the switch?

A. all VLAN are in the VLAN database.

B. VLANs greater than 1005 in the startup-config file
C. the first 1005 VLANs in the VLAN database file
D. the first 1005 VLANs in the startup-config file
E. VLANs greater than 1005 in the VLAN database file

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:

If the startup VTP mode is server mode, or the startup VTP mode or domain names do not match the VLAN database, VTP
mode and VLAN configuration for the first 1005 VLANs are selected by VLAN database information, such as the vlan.dat
file. VLANs greater than 1005 are configured from the switch configuration file.

QUESTION 229
An enterprise network has port security sticky enabled on all access ports.
A network administrator moves a PC from one office desk to another.
After the PC is moved, the network administrator clears the port security on the new network switch port connecting to the
PC, but the port keeps going back into err-disabled mode. Which two factors are possible causes of this issue? (Choose
two)

A. Port security sticky exists on the new network switch port.

B. Port security sticky is disabled on the new network switch port.
C. Port security must be disabled on all access ports.
D. Port security is still enabled on the older network switch port.
E. Port security sticky is still enabled on the older network switch port.
Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 230
SIMULATION

Lab Simulation - AAA dot1x

ABC.com is an IT company that has an existing enterprise network comprised of two layer 2 only switches; DSW1 and
ASW1. The topology diagram indicates their layer 2 mapping. VLAN 20 is a new VLAN that will be used to provide the
shipping personnel access to the server. Corporate polices do not allow layer 3 functionality to be enabled on the switches.
For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:

Users connecting to VLAN 20 via portfO/1 on ASW1 must be authenticated before they are given access to the network.
Authentication is to be done via a Radius server:

Radius server host: 172.120.40.46

Radius key: rad123
Authentication should be implemented as close to the host as possible.
Devices on VLAN 20 are restricted to the subnet of 172.120.40.0/24.
Packets from devices in the subnet of 172.120.40.0/24 should be allowed on VLAN 20.

Packets from devices in any other address range should be dropped on VLAN 20.
Filtering should be implemented as close to the serverfarm as possible.

The Radius server and application servers will be installed at a future date. You have been tasked with implementing the
above access control as a pre-condition to installing the servers. You must use the available IOS switch features.
Correct Answer: See the explanation
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
1. Verification of Pre-configuration:
a. Check that the denoted vlan [vlan20] is created in both switches and ports [fa0/1 of ASW1] are assigned.
b. Take down the radius-server ip [172.120.39.46] and the key [rad123].
c. Take down the IP range [172.120.40.0/24] to be allowed the given vlan [vlan20]

Configure the Port based authentication on ASW1: Enable AAA on the switch:

ASW1> enable
ASW1# conf t
ASW1(config)# aaa new-model

The new-model keyword refers to the use of method lists, by which authentication methods and sources can be grouped or
organized. Define the server along with its secret shared password:

ASW1(config)# aaa authentication dot1x default group radius ASW1(config)# radius-server host 172.120.39.46 key rad123

This command causes the RADIUS server defined on the switch to be used for 802.1x authentication.
Enable 802.1x on the switch:

ASW1(config)# dot1x system-auth-control

Configure Fa0/1 to use 802.1x:

ASW1(config)# interface fastEthernet 0/1

ASW1(config-if)# switchport mode access
ASW1(config-if)# dot1x port-control auto

Notice that the word “auto” will force connected PC to authenticate through the 802.1x exchange.

ASW1(config-if)# exit
ASW1# copy running-config startup-config

Filter the traffic and create vlan access-map to restrict the traffic only for a range on DSW1 Define an access-list:

DSW1> enable
DSW1# conf t
DSW1(config)# ip access-list standard 10 (syntax: ip access-list {standard | extended} acl-name)

DSW1(config-ext-nacl)# permit 172.120.40.0 0.0.0.255 DSW1(config-ext-nacl)# exit

Define an access-map which uses the access-list above:

DSW1(config)# vlan access-map MYACCMAP 10 (syntax: vlan access-map map_name [0-65535]

)

DSW1(config-access-map)# match ip address 10 (syntax: match ip address {acl_number | acl_name})

DSW1(config-access-map)# action forward
DSW1(config-access-map)# exit
DSW1(config)# vlan access-map MYACCMAP 20
DSW1(config-access-map)# action drop (drop other networks)
DSW1(config-access-map)# exit

Apply a vlan-map into a vlan:

DSW1(config)# vlan filter MYACCMAP vlan-list 20 (syntax: vlan filter mapname vlan-list list)
DSW1# copy running-config startup-config
4. Note:

It is not possible to verify the configuration in this lab. All we have do the correct configurations. Most of the exam takers
report that “copy running-config startup-config” is not working. It does not a matter. Do not try unwanted/wrong commands
in the consoles. They are not real switches.

QUESTION 231
Based on the show spanning-tree vlan 200 output shown in the exhibit, which two statements about the STP process for
VLAN 200 are true? (Choose two.)

A. BPDUs will be sent out every two seconds.

B. The time spent in the listening state will be 30 seconds.
C. The time spent in the learning state will be 15 seconds.
D. The maximum length of time that the BPDU information will be saved is 30 seconds
E. This switch is the root bridge for VLAN 200.
F. BPDUs will be sent out every 10 seconds.

Correct Answer: BF
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 232
Which three statements are correct with regard to the IEEE 802.1Q standard? (Choose three.)

A. The IEEE 802.1Q frame format adds a 4 byte field to a Ethernet frame
B. The packet is encapsulated with a 26 byte header and a 4 byte FCS
C. The protocol uses point-to-multipoint connectivity
D. The protocol uses point-to-point connectivity
E. The IEEE 802.1Q frame uses multicast destination of 0x01-00-0c-00-00
F. The IEEE 802.1Q frame retains the original MAC destination address

Correct Answer: ADF

Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 233
Refer to the exhibit. Based upon the output of show vlan on switch CAT2, what can we conclude about interfaces Fa0/13
and Fa0/14?

A. That interfaces Fa0/13 and Fa0/14 are in VLAN 1

B. That interfaces Fa0/13 and Fa0/14 are down
C. That interfaces Fa0/13 and Fa0/14 are trunk interfaces
D. That interfaces Fa0/13 and Fa0/14 have a domain mismatch with another switch
E. That interfaces Fa0/13 and Fa0/14 have a duplex mismatch with another switch

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 234
VLAN maps have been configured on switch R1. Which of the following actions are taken in a VLAN map that does not
contain a match clause?

A. Implicit deny feature at end of list.

B. Implicit deny feature at start of list.
C. Implicit forward feature at end of list
D. Implicit forward feature at start of list.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 235
Given the configuration on a switch interface, what happens when a host with the MAC address of 0003.0003.0003 is
directly connected to the switch port?

switchport mode access

switchport port-security
switchport port-security maximum 2
switchport port-security mac-address 0002.0002.0002 switchport port-security violation shutdown

A. The host will be allowed to connect.

B. The port will shut down.
C. The host can only connect through a hub/switch where 0002.0002.0002 is already connected.
D. The host will be refused access.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 236
Refer to the exhibit. Switch 15 is configured as the root switch for VLAN 10 but not for VLAN 20. If the STP configuration is
correct, what will be true about Switch 15?

A. All ports will be in forwarding mode.

B. All ports in VLAN 10 will be in forwarding mode.
C. All ports in VLAN 10 will be in forwarding mode and all ports in VLAN 20 will be in blocking mode.
D. All ports in VLAN 10 will be in forwarding mode and all ports in VLAN 20 will be in standby mode.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 237
Which of the following HSRP router states does an active router enter when it is preempted by a higher priority router?
A. active
B. speak
C. learn
D. listen
E. init
F. standby

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 238
Refer to the exhibit. On the basis of the output of the show spanning- tree inconsistentports command, which statement
about interfaces FastEthernet 0/1 and FastEthernet 0/2 is true?

A. They have been configured with the spanning-tree bpdufilter disable command.
B. They have been configured with the spanning-tree bpdufilter enable command.
C. They have been configured with the spanning-tree bpduguard disable command.
D. They have been configured with the spanning-tree bpduguard enable command.
E. They have been configured with the spanning-tree guard loop command.
F. They have been configured with the spanning-tree guard root command.

Correct Answer: F
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 239
You want to configure a switched internetwork with multiple VLANs as shown above. Which of the following commands
should you issue on SwitchA for the port connected to SwitchB?
A. switchport mode trunk
B. switchport access vlan 5
C. switchport mode access vlan 5
D. switchport trunk native vlan 5

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 240
You administer a network that uses two routers, R1 and R2, configured as an HSRP group to provide redundancy for the
gateway. Router R1 is the active router and has been configured as follows:

R1#configure terminal
R1(config)#interface fa0/0
R1(config-if)#ip address 10.10.0.5 255.255.255.0
R1(config-if)#standby 1 priority 150
R1(config-if)#standby preempt delay minimum 50
R1(config-if)#standby 1 track interface fa0/2 15
R1(config-if)#standby 1 ip 10.10.0.20

Which of the following describes the effect the "standby preempt delay minimum 50" command will have on router R1?

A. The HSRP priority for router R1 will increase to 200.

B. Router R1 will become the standby router if the priority drops below 50.
C. The HSRP priority for router R1 will decrease to 50 points when Fa0/2 goes down.
D. Router R1 will wait 50 seconds before attempting to preempt the active router.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 241
Which statement is correct about 802.1Q trunking?

A. Both switches must be in the same VTP domain.

B. The encapsulation type of both ends of the trunk does not have to match.
C. The native VLAN on both ends of the trunk must be VLAN 1.
D. 802.1Q trunking can only be configured on a Layer 2 port.
E. In 802.1Q trunking, all VLAN packets are tagged on the trunk link, except the native VLAN.

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 242
Which of the following commands can be issued without interfering with the operation of loop guard?

A. Switch(config-if)#spanning-tree guard root

B. Switch(config-if)#spanning-tree portfast
C. Switch(config-if)#switchport mode trunk
D. Switch(config-if)#switchport mode access

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 243
The following command was issued on a router that is being configured as the active HSRP router.
standby ip 10.2.1.1
Which statement is true about this command?

A. This command will not work because the HSRP group information is missing
B. The HSRP MAC address will be 0000 0c07 ac00
C. The HSRP MAC address will be 0000 0c07 ac01.
D. The HSRP MAC address will be 0000.070c ad01.
E. This command will not work because the active parameter is missing

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 244
Routers R1 and R2 are configured for HSRP as shown below:

Router R1:
interface ethernet 0
ip address 20.6.2.1 255.255.255.0
standby 35 ip 20.6.2.21
standby 35 priority 100
interface ethernet 1
ip address 20.6.1.1.2 255.255.255.0
standby 34 ip 20.6.1.21

Router R2:
interface ethernet 0
ip address 20.6.2.2 255.255.255.0
standby 35 ip 20.6.2.21
interface ethernet 1
ip address 20.6.1.1.1 255.255.255.0
standby 34 ip 20.6.1.21
standby 34 priority 100

You have configured the routers R1 & R2 with HSRP. While debugging router R2 you notice very frequent HSRP group
state transitions. What is the most likely cause of this?

A. physical layer issues

B. no spanning tree loops
C. use of non-default HSRP timers
D. failure to set the command standby 35 preempt

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 245
Which two statements about the HSRP priority are true? (Choose two.)

A. To assign the HSRP router priority in a standby group, the standby group-number priority priority-value global
configuration command must be used.
B. The default priority of a router is zero (0).
C. The no standby priority command assigns a priority of 100 to the router.
D. Assuming that preempting has also been configured, the router with the lowest priority in an HSRP group would
become the active router.
E. When two routers in an HSRP standby group are configured with identical priorities, the router with the highest
configured IP address will become the active router.

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 246
Which three statements are true of a default HSRP configuration? (Choose three.)

A. The Standby hello time is 2 seconds.

B. Two HSRP groups are configured.
C. The Standby track interface priority decrement is 10.
D. The Standby hold time is 10 seconds
E. The Standby priority is 100.
F. The Standby delay is 3 seconds.

Correct Answer: CDE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 247
Refer to the exhibit. What is the result of setting GLBP weighting at 105 with lower threshold 90 and upper threshold 100 on
this router?
A. Only if both tracked objects are up will this router will be available as an AVF for group 1.
B. Only if the state of both tracked objects goes down will this router release its status as an AVF for group 1.
C. If both tracked objects go down and then one comes up, but the other remains down, this router will be available as an
AVF for group 1.
D. This configuration is incorrect and will not have any effect on GLBP operation.
E. If the state of one tracked object goes down, then this router will release its status as an AVF for group 1.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 248
Which describes the default load balancing scheme used by the Gateway Load Balancing Protocol (GLBP)?

A. Per host using a strict priority scheme

B. Per session using a round-robin scheme
C. Per session using a strict priority scheme
D. Per GLBP group using a strict priority scheme
E. Per host basis using a round robin-scheme
F. Per GLBP group using a round-robin scheme

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 249
DRAG DROP

Select and Place:

Syslog information can generate messages up to and including the configured severity level. Organize the levels by
dragging each the highest level all the top and the lowest level at the bottom.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation
Explanation/Reference:

QUESTION 250
DRAG DROP

Select and Place:

Drag the choices on the left to the boxes on the right that should be included when creating an implementation plan. Not all
choices will be used.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 251
DRAG DROP

Select and Place:

You have been tasked with planning a VLAN solution that will connect a server in one building to several hosts in another
building of the local VLAN model and Layer 3 switching at the distribution layer. Drag the questions that you would ask the
network administrator from the left to the right. Not all questions will be used.
Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:
QUESTION 252
DRAG DROP

Select and Place:

Drag the attributes on the left to the types of VLAN designs that they describe on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 253
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation
Explanation/Reference:

QUESTION 254
DRAG DROP

Select and Place:

Drag the port states to their correct description

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:
QUESTION 255
DRAG DROP

Select and Place:

Capabilities of SNMP are dependent on the version implemented. Drag the feature descriptions on the left to the respective
SNMP.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 256
DRAG DROP

Select and Place:

You have a VLAN implementation that requires inter-VLAN routing using Layer 3 switches. Drag the steps from the left to
the right. Not all choices will be used.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 257
DRAG DROP

Select and Place:

Prioritize the traffic types by dragging them from the left to the appropriate Cisco priority level on the right. Put the highest
priority at the bottom.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 258
DRAG DROP

Match the HSRP states on the left with the correct definition on the right.
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 259
DRAG DROP

Select and Place:

Categorize the high availability network resources or feature items on the left by dragging them to the appropriate resiliency
or management level on the right.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation
Explanation/Reference:

QUESTION 260
Which two statements about default FHRP behavior are true? (Choose two.)

A. A backup GLBP active virtual gateway can become active only if the current active virtual gateway fails.
B. Preemption is enabled by default.
C. Unless specifically Configured, the priority of an HSRP router is 200.
D. A standby HSRP router becomes active if it has a higher priority than the priority of the current active router.
E. A VRRP backup virtual router becomes the master router if its priority is higher than the priority of the current master
router.

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 261
To provide security, a service provider configures various private VLANs in its backbone network infrastructure to prevent
certain VLAN communication to each other. Which version of VTP supports the use of private VLANs?

A. Version 1
B. Version 3
C. VTP does not support private VLANs
D. Version 2

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 262
Which statement about HSRP, GLBP, and VRRP is true?

A. VRRP group members communicate using multicast address 224.0.0.102.

B. MAC address 0000.0c07.acOc indicates that default gateway redundancy is provided through GLBP.
C. HSRP group members communicate using multicast address 224.0.0.18.
D. GLBP uses UDP port 3222 (source and destination) for hello messages.
E. MAC address 0c07.A698.8904 indicates that default gateway redundancy is provided through HSRP.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 263
What action should a network administrator take to enable VTP pruning on an entire management domain?

A. Enable VTP pruning on any client switch in the domain.

B. Enable VTP pruning on every switch in the domain.
C. Enable VTP pruning on any switch in the management domain.
D. Enable VTP pruning on a VTP server in the management domain.
Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 264
Refer to the exhibit. BPDUGuard is enabled on both ports of SwitchA. Initially, LinkA is connected and forwarding traffic. A
new LinkB is then attached between SwitchA and HubA. Which two statements about the possible result of attaching the
second link are true? (Choose two.)

A. The switch port attached to LinkB does not transition to up.

B. One or both of the two switch ports attached to the hub goes into the err-disabled state when a BPDU is received.
C. Both switch ports attached to the hub transitions to the blocking state.
D. A heavy traffic load could cause BPDU transmissions to be blocked and leave a switching loop.
E. The switch port attached to LinkA immediately transitions to the blocking state.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 265
What is the effect of configuring the following command on a switch?

Switch(config) # spanning-tree portfast bpdufilter default

A. If BPDUs are received by a port configured for PortFast, then PortFast is disabled and the BPDUs are processed
normally.
B. If BPDUs are received by a port configured for PortFast, they are ignored and none are sent.
C. If BPDUs are received by a port configured for PortFast, the port transitions to the forwarding state.
D. The command enables BPDU filtering on all ports regardless of whether they are configured for BPDU filtering at the
interface level.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 266
Which protocol will enable a group of routers to form a single virtual router and will use the real IP address of a router as
the gateway address?

A. Proxy ARP
B. HSRP
C. IRDP
D. VRRP
E. GLBP

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 267
Which two statements are true about recommended practices that are to be used in a local VLAN solution design where
layer 2 traffic is to be kept to a minimum? (Choose two.)

A. Routing should occur at the access layer if voice VLANs are utilized. Otherwise, routing should occur at the distribution
layer.
B. Routing may be performed at all layers but is most commonly done at the core and distribution layers.
C. Routing should not be performed between VLANs located on separate switches.
D. VLANs should be local to a switch.
E. VLANs should be localized to a single switch unless voice VLANs are being utilized.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 268
What two things occur when an RSTP edge port receives a BPDU? (Choose two.)

A. The port immediately transitions to the forwarding state.

B. The switch generates a Topology Change Notification BPDU.
C. The port immediately transitions to the err-disable state.
D. The port becomes a normal STP switch port.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 269
How does VTP pruning enhance network bandwidth?

A. by restricting unicast traffic across VTP domains

B. by reducing unnecessary flooding of traffic to inactive VLANs
C. by limiting the spreading of VLAN information
D. by disabling periodic VTP updates

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 270
In the hardware address 0000.0c07.ac0a, what does 07.ac represent?

A. vendor code
B. HSRP group number
C. HSRP router number
D. HSRP well-known physical MAC address
E. HSRP well-known virtual MAC address

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 271
Which statement is true about RSTP topology changes?

A. Any change in the state of the port generates a TC BPDU.

B. Only nonedge ports moving to the forwarding state generate a TC BPDU.
C. If either an edge port or a nonedge port moves to a block state, then a TC BPDU is generated.
D. Only edge ports moving to the blocking state generate a TC BPDU.
E. Any loss of connectivity generates a TC BPDU.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 272
Refer to the exhibit. Based on the debug output, which three statements about HSRP are true? (Choose three.)
A. The final active router is the router with IP address 172.16.11.111.
B. The router with IP address 172.16.11.111 has preempt configured.
C. The priority of the router with IP address 172.16.11.112 is preferred over the router with IP address 172.16.11.111.
D. The IP address 172.16.11.115 is the virtual HSRP IP address.
E. The router with IP address 172.16.11.112 has nonpreempt configured.
F. The router with IP address 172.16.11.112 is using default HSRP priority.

Correct Answer: ABD

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 273
When a Layer 2 trunking EtherChannel is configured, which two attributes must match across the member ports? (Choose
two.)

A. spanning-tree cost
B. spanning-tree priority
C. allowed VLANs on the trunk
D. trunking mode
E. interface description

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 274
In a switch stack where is the SDM template stored?
A. All switches in stack
B. Master switch
C. Flash memory

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 275
Refer to exhibit, which two statements correctly indicate when an SNMP trap is set to the switch? (Choose two.)

A. When a new workstation connects to port Fa0/1

B. When 61 MAC address are in the switch table
C. When 61 percent of the MAC address table capacity is used
D. When the switch loses power and reboots
E. When the phone previously on Fa0/2 is now connect to Fa0/5

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 276
What is the default port security violation?

A. log
B. shutdown
C. no change
D. error-disable

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 277
What is the command for configuring root guard?

A. (config)#spanning-tree guard root

B. (config-if)#spanning-tree guard root
C. (config-if)#spanning-tree root guard
D. (config-if)#spanning tree guard root
E. (config)#spanning-tree root guard
Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 278
Network engineer wants to use UDLD, what he need to consider?

A. udld is a non-propriety
B. udld is working with non cisco devices
C. udld is layer 1
D. udld can aggressively disabled the port after eight failed retries

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 279
What is cisco recommendation for RSPAN best practice?

A. you should configure remote vlan first

B. use different vlan for multiple/different switches
C. use different portchannel

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 280
What is needed for Virtual Switching System "VSS"?

A. portchannel
B. trunk
C. Virtual Switching Link "or VSL"

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 281
Which will identify the master switch in stack wise?

A. lower priority
B. higher priority
C. lower id
D. higher id

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 282
What happens if you apply this command "vlan dot1q tag native"?

A. packet will be dropped

B. packet go to default vlan
C. packet go to native vlan

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 283
An engineer is configuring an EtherChannel between two switches using PAgP If the EtherChannel mode on switch 1 is
configured to auto, which modes on switch 2 establish an operational EtherChannel?

A. active
B. auto
C. desirable
D. on
E. passive

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 284
Refer to the exhibit. Which two statements can be derived from the output of the show standby command? (Choose two.)

switch#show standby
FastEthernet0/0 - Group 40
State is Standby
2 state changes,last state change 00:20:53
Virtual IP address is 192.168.1.1
Active virtual MAC address is 0000.0c07.ac28
local virtual MAC address is 0000.0c07.ac28 (v1 default)
Hello time 3 sec, hold time 10 sec
Preemption disabled
Active router is 192.168.1.3 priority 85
Standby router is local
Priority 90 (configured 90)
Track interface Fa0/0 state decrement 10

A. The active router will change as soon as the fa0/0 link is restored
B. 192.168.1.3 is active because it has higher IP address
C. when Fa0/0 is down priority will be 80
D. it is using default hello and hold values

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 285
What happens spoofed packet or something like untrusted packet is detected? (Choose three)

A. log
B. deletes
C. intercepts
D. accepts
E. discad

Correct Answer: ACE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 286
Refer to the exhibit. An engineer is configuring an etherchannel between two switches, he notices the error message on
Switch 2 (error message channel-misconfiguring error), based on the output what is the problem?

A. the etherchannel on the switch 1 using incorrect member port

B. the etherchannel interface of switch 1 is not configured
C. the etherchannel protocol on switch 1 is not correct
D. the etherchannel interface of switch 2 is not configured

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 287
What is the Ethernet frame size for 802.1Q?

A. 64
B. 128
C. 1518
D. 1522

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 288
Which two statements are true about StackWise? (Choose two.)

A. It looks like one device.

B. It can use one IP address.
C. It can use multiple IP address.
D. It looks like a multiple device.
E. StackWise manages like a hybrid device.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 289
If HSRP group number is 45 what would be the MAC address?
(Basically conversion of digit to hexadecimal with group of 16.)

A. 00-00-0c-07-ac-2D
B. 00-00-0c-07-ac-2E
C. 00-00-0c-07-ac-25
D. 00-00-0c-07-ac-45

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
00-00-0c- 07-ac-2D
CISCO_ID:HSRP_ID:GROUP_ID
2d=45

QUESTION 290
Select a valid VRRP configuration from a list of possible configurations.

A. vrrp [group-number] ip [ip-address]

B. vrrp [group-number] priority [priority]
C. vrrp [group-number] preempt

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
You can eliminate configurations with the word `standby', as that would be HSRP, not VRRP. Also, I think the options that
put things like vrrp group 1 ip x.x.x.x are wrong.
You don't need the word `group' in the configuration line. The number 1 is the group number. Anyway, just take a good look
a t a few valid VRRP configuration examples so that you will be able to recognize invalid ones.

QUESTION 291
Which two secondary VLAN types of Private VLANs (PVLANs)? (Choose two)

A. community
B. isolated
C. promiscuous
D. host

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Secondary VLANs provide Layer 2 isolation between ports within the same private VLAN domain.
There are two types of secondary VLANs:

Isolated VLANs - Ports within an isolated VLAN cannot communicate with each other at the Layer 2 level.
Community VLANs - Ports within a community VLAN can communicate with each other but cannot communicate with
ports in other communities at the Layer 2 level

QUESTION 292
What types of SDM templates you can use in switch? (Choose all that apply.)

A. Access
B. Default
C. Routing
D. VLANs

Correct Answer: ABCD

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Access - The access template maximizes system resources for access control lists (ACLs) to accommodate a large
number of ACLs.
Default - The default template gives balance to all functions.
Routing - The routing template maximizes system resources for IPv4 unicast routing, typically required for a router or
aggregator in the center of a network.
VLANs - The VLAN template disables routing and supports the maximum number of unicast MAC addresses. It would
typically be selected for a Layer 2 switch.

QUESTION 293
What is the process to configure EtherChannel?

A. shutdown both interface ports

B. shutdown the interface on one side only

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 294
What is the default spanning tree port priority?

A. 128
B. 129
C. 1
D. 64

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 295
How do you configure Spanning-tree EtherChannel guard?

A. (config)#spanning-tree etherchannel guard misconfig

B. (config-if)#spanning-tree etherchannel guard misconfig
C. (config)#spanning-tree etherchannel misconfig guard
D. (config-if)#spanning-tree etherchannel misconfig guard

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 296
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 297
If EtherChannel guard is configured, how the interface status is (or looks like) if misconfigured?

A. errdisabled
B. shutdown

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 298
Which option is the TPI 802.1Q tag?

A. 0x0806
B. 0x888E
C. 0x0800
D. 0x8100
Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
16-bit field set to 0x8100 in order to identify the frame as 802.1q tagged frame.

QUESTION 299
DRAG DROP
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 300
How do you configure loop guard?

A. (config)#spanning-tree loop guard default

B. (config-if)#spanning-tree loop
C. (config)#spanning-tree loop-guard default
D. (config-if)#spanning-tree guard loop

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 301
A dynamic access port is member of which VLAN by default?

A. VLAN 1 is the default VLAN

B. Same as the native VLAN
C. none until the port VLAN is determined
D. VLAN 4096

Correct Answer: A
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 302
What will be behavior of an access port when a tagged packet is received with a VLAN ID of an access port?

A. Not Available
B. tag is removed and packet is forwarded to the VLAN mentioned in the tag
C. packet is dropped
D. tag is removed and packet is forwarded on the VLAN of the access port

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 303
What is an extension of HSRP that allows load sharing between two or more HSRP groups?

A. MHSRP
B. GLBP
C. GHSRP
D. Not Available

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 304
Which of the following will cause a switch port to go into the errdisable state?

A. configuration ports into EtherChannel

B. storm control
C. security violation
D. Dynamic ARP inspection
E. IGMP Snooping
F. BPDUguard

Correct Answer: BCF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 305
Which switchport feature will block the packet with unknown MAC address from sending it via port?

A. Switchport block unicast

B. Packet with unknown MAC will be dropped
C. Switchport portfast
D. Switchport protect

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 306
What happens if a switch with dhcp snooping and ip source guard enabled globally, what does the switch do when it
receives a packet with option 82?

A. Drop
B. Remove 82 and forward
C. Proxy
D. NA

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 307
Which type of packet does DHCP snooping continuously check in a production network?

A. DHCP Snooping
B. DHCP Relay
C. DHCP Request
D. DHCP Acknowledge
E. DHCP Reply
F. DHCP Allow

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 308
Which three functions does Dynamic ARP Inspection perform with invalid IP-to MAC address bindings? (Choose three.)

A. deletes
B. logs
C. accepts
D. intercepts
E. discards
F. bypasses

Correct Answer: BDE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 309
Which three features can be optimized by using SDM templates? (Choose three.)
A. port security
B. trunk
C. VLAN
D. access
E. DHCP snooping
F. routing

Correct Answer: CDF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 310
If all devices on an EtherChannel are sending traffic to a single MAC address, which two methods of load balancing on the
EtherChannel are preferred? (Choose two.)

A. destination-MAC
B. src-dst-MAC
C. destination-IP
D. source-MAC
E. source-IP

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 311
Which command is used to verify trunk native VLANs?

A. show access ports

B. show interfaces trunk
C. show trunk
D. show vlan native trunk

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 312
Which information does CDP supply from connected devices? (Choose three.)

A. Hardware Platform
B. Interface ID
C. Hostname
D. Config Register

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 313
How to configure dynamic ARP inspection on a VLAN?

A. (config)# ip arp inspection vlan

B. (config-if)# ip arp inspection vlan
C. (config)# arp inspection default
D. (config-if)# inspection arp vlan

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 314
What keyword in macro command is used to configure a root bridge and automatically adjust STP timers?

A. root primary
B. diameter
C. reflector
D. STP bridge root

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 315
Your manager asked you to make every port on your switch bypass the normal spanning-tree timers which includes your
uplink to other switches.
What two commands can you apply on the interfaces? (Choose two.)

A. spanning-tree portfast
B. spanning-tree portfast default
C. spanning-tree portfast access
D. spanning-tree portfast trunk

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 316
Which IOS configuration command is required to configure a VLAN as a private VLAN?

A. switch(config-vlan)# private-vlan common

B. switch(config-vlan)# private-vlan private
C. switch(config-vlan)# private-vlan primary
D. switch(config-vlan)# private-vlan transparent

Correct Answer: C
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 317
Regarding high availability, with the MAC address 0000.0c07.ac03, what does the "03" represent?

A. The GLBP group number

B. The type of encapsulation
C. The HSRP router number
D. The VRRP group number
E. The HSRP group number
F. The active router number

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 318
HSRP has been configured between two Company devices. Which of the following describe reasons for deploying HSRP?
(Choose three)

A. HSRP provides redundancy and fault tolerance

B. HSRP allows one router to automatically assume the function of the second router if the second router fails
C. HSRP allows one router to automatically assume the function of the second router if the second router starts
D. HSRP provides redundancy and load balancing

Correct Answer: ABD

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 319
Refer to the exhibit. Which configuration on the HSRP neighboring device ensures that it becomes the active HSRP device
in the event that port fa1/1 on Switch_A goes down?

A.

B.

C.
D.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 320
What are three possible router states of HSRP routers on a LAN? (Choose three)

A. Standby
B. Established
C. Active
D. Idle
E. Backup
F. Init

Correct Answer: ACF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 321
HSRP was implemented and configured on two switches while scheduled network maintenance was performed.

After the two switches have finished rebooting, you notice via show commands that Switch2 is the HSRP active router.
Which two items are most likely the cause of Switch1 not becoming the active router? (Choose two)

A. booting delays
B. standby group number does not match VLAN number
C. IP addressing is incorrect
D. preemption is disabled
E. incorrect standby timers
F. IP redirect is disabled

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 322
Which protocol specified by RFC 2281 provides network redundancy for IP networks, ensuring that user traffic immediately
and transparently recovers from first-hop failures in network edge devices or access circuits?

A. ICMP
B. IRDP
C. HSRP
D. STP
Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 323
What statement about MAC address table is true?

A. Every entry in MAC address table has VLAN assigned

B. Extended VLANs doesn't have VLAN assigned in MAC address table.
C. Private VLANs doesn't have to be assigned in MAC address table.
D. Static bindings can't be removed from MAC address table.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 324
What is the default mode for LACP EtherChannel when configured?

A. On
B. Active
C. Passive
D. Desirable
E. Off

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 325
Which layer private VLAN partition the broadcast domain?

A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 4

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 326
What statements about STP path cost are true? (Choose two.)

A. Long path cost is 64 bits

B. Short path cost is 32 bits
C. MST uses long path cost
D. Default path cost is short
E. They have equal path cost by default

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 327
In a Virtual Switching System, DSW1 and DSW2 need to communicate with each other to determine the role. Which
technology is it using?

A. STP
B. NA
C. VSL Protocol (Virtual Switch Link)
D. LACP

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 328
Which two statements about frame LLDP is true?

A. Frame has destination multicast address

B. NA
C. Frame has CRC

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 329
Which statement about frame SPAN is true?

A. Destination and source port SPAN works on L2 (Layer 2).

B. Source ports SPAN work on L2 (Layer 2).
C. Destination ports SPAN work on L2 (Layer 2).
D. Destination and source port SPAN don't work on L2.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 330
Which two commands is used to remove VLAN 55 from the trunk port? (Choose two.)

A. switchport trunk allowed vlan add 3, remove 55

B. switchport trunk allowed vlan remove 55
C. switchport trunk allowed vlan except 55

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 331
Which two operational attributes can be checked for EtherChannel ports that are in err-disabled state? (Choose two.)

A. Port mode
B. Port cost
C. Duplex
D. DTP
E. VLAN

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
See “compatibility requirements”
Reference http://www.cisco.com/c/en/us/td/docs/switches/datacenter/

QUESTION 332
What statement is true about PVST?

A. PVST+ is the default STP mode on Cisco switches

B. Rapid PVST+ is the default STP mode on Cisco switches
C. Is the default mode on Cisco switches
D. STP is the default mode on Cisco switches

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 333
What is the value of the TPID/tag protocol identifier in dot1q?

A. 0x8100
B. 0x8a88
C. 0x8b45
D. 0x8200

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 334
What is the value of the TPID/tag protocol identifier of QinQ?
A. 0x8a88
B. 0x8100
C. 0x8b45
D. 0x8200

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 335
Which two configurations cause the frames to be tagged? (Choose two.)

A. interface gi 0/1.116 encapsulation dot1q

B. trunk allowed vlan 116
C. interface with access and voice VLAN configured to 116
D. interface encapsulation native vlan
E. switchport mode on

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 336
What VSS technology allows you to share downstream resources?

A. LACP
B. PAgP
C. MEC
D. EOA

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 337
SERVER SERVER
| |
SWITCH
|||||||||||
SWITCH
|
HOST

Which EtherChannel load balancing algorithm should be used to optimize the EtherChannel links between switches?

A. Source MAC
B. Source-dest MAC
C. Destination IP
D. Destination MAC
Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 338
Where should the Root Guard be implemented in the network topology that Cisco recommends? (Choose two.)

A. All non-root ports of the Access Switches.

B. Downstream links from Distribution to Access Switches
C. Access Switches to uplink ports to Distribution Switches
D. On Layer 3 Switches.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 339
A Cisco switch was configured using the “switchport trunk allowed vlan 1,80,99-250” command.

Which two commands will remove VLAN 100 from the allowed VLAN list? (Choose two.)

A. switchport trunk allowed vlan remove vlan 100

B. switchport trunk allowed vlan 1-80,99,101-250
C. switchport trunk allowed vlan except vlan 100

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
A & B are right
1- after applying the question command:switchport trunk allowed vlan 1,80,99-250
Switch(config)#do show int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1,80,99-250
Port Vlans allowed and active in management domain Fa0/1 1
Port Vlans in spanning tree forwarding state and not pruned Fa0/1 1
now after applying “except 100”: Switch(config-if)#switchport trunk allowed vlan except 100 Switch(config-if)#do show int
trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-99,101-1005
Port Vlans allowed and active in management domain Fa0/1 1
Port Vlans in spanning tree forwarding state and not pruned Fa0/1 none
You can see that except 100, allowed all vlans except 100, which is against what is required in the question.

QUESTION 340
What is the benefit of UDLD?

A. provides backup for fiber

B. help in preventing loops
C. removes loops
D. determines switch path

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 341
Behavior of an access port when a tagged packet is received other than the access VLAN value.

A. Tag is removed and packet is forwarded of the VLAN mentioned in the tag.
B. tag is removed and packet is forwarded on the VLAN of the access port
C. Not Available
D. packet is dropped

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 342
Which option is the maximum frame size for an 802.1Q frame?

A. 64 bytes
B. 68 bytes
C. 1518 bytes
D. 1522 bytes

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 343
Which option is the minimum frame size for an 802.1Q frame?

A. 64 bytes
B. 68 bytes
C. 1518 bytes
D. 1522 bytes

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 344
What SPAN configuration is required to enable on a switch?

A. A monitor VLAN is created for the SPAN traffic.

B. Configure a source and destination port
C. Disable VTP pruning on trunk links
D. LLDP must be enabled in an interface.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 345
Which two actions can be configured for storm control violation?

A. Shutdown
B. Trap
C. Notify admin
D. Discard Port

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 346
Which statements about RSPAN are true? (Choose two.)

A. It supports MAC address learning.

B. RSPAN VLANS can carry RSPAN traffic only.
C. only one RSPAN VLAN can be configured per device.
D. RSPAN VLANs are exempt from VTP pruning.
E. MAC address learning is not supported
F. RSPAN uses are GRE tunnel to transmit captured traffic.

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special
characteristics:
All traffic in the RSPAN VLAN is always flooded.
No MAC address learning occurs on the RSPAN VLAN.
RSPAN VLAN traffic only flows on trunk ports.
RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode
command.
STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP), the VLAN ID and its associated RSPAN
characteristic are propagated by VTP. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094), you
must manually configure all intermediate switches.
It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide
RSPAN session. That is, multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN
session. It is also possible to have multiple RSPAN destination sessions throughout the network, monitoring the same
RSPAN VLAN and presenting traffic to the user. The RSPAN VLAN ID separates the sessions.
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/
swspan.pdf
QUESTION 347
When a private VLAN is configured, which mode must be configured as a router facing port?

A. isolated
B. promiscuous
C. community
D. host

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 348
When a switch is added to a stack, which switch automatically configures the new switch with the correct IOS?

A. master
B. peer
C. adjacent
D. slave

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 349
Which HSRP extension allows groups to share traffic loads?

A. GLBP
B. CHSRP
C. MHSRP
D. CGMP
E. FHRP

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 350
A network engineer is considering implementing UDLD throughout the network. Which option must the network engineer
consider?

A. UDLD aggressively disables the port after eight failed retries to connect to neighbor.
B. UDLD works at layer 1 of the OSI model.
C. UDLD is an IEEE standard that can be configured on non-cisco devices.
D. UDLD is already enabled by default on all ports on cisco switches.

Correct Answer: A
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 351
Which mechanism is specific for RSPAN and not for SPAN?

A. source port
B. monitor port
C. reflector port
D. redundant port
E. destination port

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 352
Which three pieces of information about the remote device are reported by Cisco Discovery Protocol? (Choose three.)

A. the routing protocols in use on the device

B. its spanning-tree state
C. its hostname
D. its port number
E. its configuration register value
F. its hardware platform

Correct Answer: CDF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 353
Where can netflow export data for long term storage and analysis?

A. another network device

B. flat file
C. syslog
D. collector

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 354
Which two types of threshold can you configure for tracking objects? (Choose two.)

A. weight
B. bandwidth
C. MTU
D. percentage
E. administrative distance15
F. delay

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 355
What do subordinate switches in a switch stack keep?

A. Subordinate switches keep their own spanning trees for each VLAN that they support.
B. Subordinate switches keep entire VLAN database
C. Store running config all the switches
D. Subordinate switches does not keep their own spanning trees

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 356
802.1Q trunking, what does it do? (Choose two.)

A. Encapsulate frame with VLAN tag

B. Makes the frame size 1596
C. Adds 32-bit header
D. Allows 8-bits in VLAN tag header

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 357
What are the possible results of port-security?

A. error disable (shut down)

B. send a trap
C. port disabled
D. loop inconsistent

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 358
Which two statements about SDM templates are true?

A. They are used to allocate system resources

B. Changing the SDM template will not disturb switch operation.
C. You can verify the SDM template that is in use with the show sdm prefer command
D. SDM templates are defined by the switch model and can't be changed
E. SDM templates changes don't require switch to be rebooted

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 359
Which two statements apply to LLDP? (Choose two.)

A. It runs on the data link layer

B. It runs on the network layer
C. It is not enabled by default on Cisco devices
D. Enabled on Cisco devices by default
E. Hold-time is 100 seconds on Cisco devices

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 360
Which two statements apply to topology-based switching? (Choose two.)

A. It is functionally equivalent to Cisco Express Forwarding

B. It is the preferred switching mode in Cisco multilayer switches
C. It uses Loop free protocol for switching
D. disabled by default
E. Multi-vendor Protocol

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 361
In which two ways are IEEE STP BPDUs forwarded if VLAN 99 is configured as native? (Choose two)

A. VLAN 1 STP BPDUs are sent tagged on VLAN 1

B. VLAN 1 STP BPDUs are sent tagged on VLAN 99
C. VLAN 1 and VLAN 99 BPDUs are sent tagged on VLAN 1
D. VLAN 1 STP BPDUs are sent untagged on VLAN 1
E. VLAN 1 STP BPDUs are sent untagged on VLAN 99

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 362
A workstation technician moves a PC from one office desk to another. Before the move the PC has network connectivity
After the move as the PC plugged into the now network port, it loses network connectivity and the network switch port
becomes err disabled. Which option can cause the issue?

A. wrong VLAN
B. wrong switch port mode
C. port security
D. speed issue

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 363
Which feature do you implement so that an interface enters the root inconsistent state if it receives a superior BPDU?

A. DPDU filter
B. root guard
C. BPDU guard
D. loop guard

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 364
Which two statements about 802.1q are true? (Choose two)

A. It encapsulates the original Ethernet frame and adds a VLAN identifier.

B. It increases the maximum size an Ethernet frame to 1594 bytes.
C. It is a Cisco proprietary protocol.
D. When It is enabled, it forces a recalculation of the frame check sequence field.
E. It supports 8-byte VLAN identifiers.
F. It adds a 32-bit field to the Ethernet frame between the source MAC address and length fields.

Correct Answer: DF
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
D: https://en.wikipedia.org/wiki/IEEE_802.1Q
A is not ok, since it does not encapsulate the original frame.

QUESTION 365
Which two statements about CDP are true? (Choose two.)

A. CDP uses a TLV to advertise the native VLAN

B. CDP is not supported with SNMP
C. CDP is supported on Frame Relay sub interfaces.
D. CDP runs on OSI layer 2
E. CDP runs on OSI layer 1
Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 366
Which two combinations of Ether Channel modes support the formation of an EtherChannel? (Choose two.)

A. desirable, passive
B. desirable, desirable
C. active, passive
D. passive, passive
E. active, desirable

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 367
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 368
DRAG DROP
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 369
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 370
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 371
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 372
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 373
Which two commands sequences must you enter on a pair switches so that they negotiate? (Choose two.)

A. channel-protocol lacp
channel-group 1 mode auto
B. channel-protocol lacp
channel-group 1 mode passive
C. channel-protocol pagp channel-group 1 mode on
D. channel-protocol pagp
channel-group 1 mode auto
E. channel-protocol lacp
channel-group 1 mode active

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 374
Which Statement about the default SWITCH Database Management Template is true?
A. Template disables routing and supports the maximum number of unicast MAC addresses
B. Template maximizes system resources for access control lists.
C. Template maximizes system resources for unicast routing.
D. Template gives balance to all functions

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 375
Which results happens when a non-trunking port that is configured with BPDU guard is connected to a device that is
transmitting?

A. The port is moved into the spanning-tree blocking state.

B. The port is error-disabled.
C. A routing loop can occur on the network.
D. The port transitions to the connected state.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 376
Refer to the exhibit. Which two statements can be derived from the output of the show standby command? (Choose two.)

A. R2 Fa1/0 regains mastership when the link comes back up

B. Router with IP 10.10.1.3 is active because it has a higher IP address
C. If Fa0/0 is shut down, the HSRP priority on R2 becomes 80
D. R2 is using the default HSRP hello and hold timers
E. R2 becomes the active router after the hold time expires

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 377
Which two settings are the parts of a Default LLDP configuration? (Choose two.)

A. The LLDP hold time is 60 seconds.

B. The LLDP global state is Disabled.
C. The LLDP reinitialization delay is 5 seconds.
D. The LLDP interface state is Enabled.
E. The LLDP timer is 60 seconds.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 378
Refer to the exhibit. If switch SW6 is operating VTP Server and the other devices have the same configuration as SW4,
which statement about the VLANs network is true?

SW4# show run | include vtp

vtp mode client
vtp domain cisco
vtp domain ciscotest
vtp pruning
vtp version 3

A. Traffic on VLANs 1 through 9 is flooded to all switches in the network.

B. VLANs 1 through 101 are operational on all switch trunks.
C. VLANs 1 through 9 are pruned on the link between SW1 and SW4.
D. VLANs 1 through 101 are pruned on the link between SW1 and SW2.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 379
Which option is a CISCO recommended RSPAN configuration practice?

A. Define RSPAN VLAN before configuring an RSPAN source and destination session.
B. Assign access ports to an RSPAN VLAN like any other campus VLAN.
C. Use a different RSPAN VLAN for each session if configuring RSPAN on multiple switches.
D. Use only one destination port for EACH RSPAN Session.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/
prod_white_paper0900aecd805457cc.html

QUESTION 380
Which two pieces of information are carried in a Cisco Discovery Protocol advertisement? (Choose two.)

A. Processor Type
B. VTP domain name
C. Routing protocol
D. Memory usage
E. Spanning-Tree mode
F. Native VLAN-ID

Correct Answer: BF
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 381
Refer to the Exhibit. Which Two statements about the network environment of the device that generated this output are
true? (Choose two.)

A. The exhibit hello and hold timer values are in use.

B. The standby router can take the active HSRP if it fails to receive a hello packet from the active router within 1.616
seconds.
C. The priority value of the HSRP group is 1.
D. HSRP version 2 is in use.
E. The standby router can take the active HSRP role if it fails to receive a hello packet from the active router within 10
seconds.

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 382
Which statement about the VTP v2 is true?

A. IT supports the use of multiple instances.

B. IT propagates VLANs 1 - 1005 only.
C. IT can be enabled on a per-port basis.
D. IT performs consistency checks only when a new VLAN is added
E. IT can be enabled on a per-interface basis

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 383
What carries voice VLAN to a Cisco phone?

A. SIP
B. LLDP
C. CDP
D. SKINNY

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 384
Which options of VLANs IDs are in extended range? (Choose three.)

A. 1006
B. 1001
C. 999
D. 4021
E. 3003
F. 99

Correct Answer: ADE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 385
Refer to the exhibit. Which three statements about the network environment of the interface that generated? (Choose
three.)
A. The configured VRRP priority of the interface is 120
B. The device on which the interface resides is acting as a standby router
C. The Skew time .531 seconds
D. The Configured VRRP Priority of the interface is 105
E. If the priority of another router is higher than the priority of the master router, it becomes the master router

Correct Answer: ACE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 386
What are possible Etherchannel load balancing mechanism based on layer 3? (Choose two.)

A. Mac source
B. Mac source-destination
C. IP Source
D. IP Source-destination
E. Mac destination

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 387
Which of the following are true regarding TACACS+ ? (Choose three.)

A. Supports backwards compatible with TACACS

B. Encrypts the header
C. Encrypts the whole payload
D. Utilizes TCP port 49
E. Utilizes UDP port 49
F. Separates Authentication & Authorization

Correct Answer: CDF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 388
Which two statements about MST are true? (Choose two.)

A. it can operate without a root bridge

B. it supports one STP instance per VLAN
C. it is vendor neutral
D. all vlans must reside in a single MST region
E. it can map multiple vlans to a single STP instance

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 389
Which two statements about HSRP are true? (Choose two.)

A. You must manually configure ICMP redirect messages on HSRP interfaces

B. It is supported on switch virtual interfaces and routed ports
C. Primary and secondary HSRP switches forward traffic in a round-robin style
D. The interfaces in a HSRP group share a virtual MAC address
E. An HSRP group can support a maximum of eight switches.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 390
Which vtp2 mode does the switch operate without participating in vtp?

A. Client
B. Server
C. Transparent
D. Off

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 391
Which two features can you configure on an access port? (Choose two)

A. QinQ
B. portfast
C. voice VLAN
D. STP mode
E. 802.1q

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 392
What is true about CDP? (Choose two.)

A. disabled when native vlan mismatched

B. can be disable on interface only
C. send periodic broadcast
D. send periodic multicast

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 393
DRAG DROP

Match the steps needed to configure RSPAN in the proper order.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 394
DRAG DROP

Match the features on the left to the correct VRRP version on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 395
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 396
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 397
Which of these options supports to maintain the network architecture and stability of the root bridge in a spanning-tree
service?

A. BPDU Filter
B. BPDU Guard
C. Root Guard
D. Loop Guard

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
BPDU Guard puts a portfast port in err-disabled in case of receiving a BPDU. But root guard is a feature specially designed
in order to enforce the root bridge placement in the network forcing an interface to become a designated port to prevent
surrounding switches from becoming a root switch.

QUESTION 398
Which STP feature used to monitor BPDU traffic and enable STP to transition between states?

A. Root Guard
B. Loop Guard
C. BPDU Filter
D. BPDU Guard

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 399
Which of the following are valid methods of VRRP authentication? (Choose three.)

A. SHA-124
B. SHA-254
C. No authentication
D. WAP
E. Plain text authentication
F. MD5

Correct Answer: CEF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 400
Storm control options apart from the default one. (Choose two.)

A. log
B. shutdown
C. trap
D. err-disable
E. let admin know

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 401
Which two statements about GLBP is true? (Choose two.)

A. Can have 128 AVFs on an interface

B. Maximum 4 AVFs allowed in a group
C. Can work with dual active AVGs
D. Can have 6 AVFs in a group
E. GLBP supports up to 1024 virtual routers per group.

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 402
Which of these two options are true about RADIUS? (Choose two.)

A. Uses TCP port 49

B. Uses client server model
C. Uses UDP to exchange traffic
D. Support for multiple protocols
E. Is compatible with TACACS+

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 403
Which of the following are true regarding TACACS+. ? (Choose two.)

A. Backward compatible with TACACS.

B. More secure then RADIUS as it uses UDP.
C. Has support for multiple protocols other than IP.
D. Separates authentication and authorization.
E. Encrypts just the header.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 404
Refer to the exhibit. You can change the SDM template to maximize the number of supported MAC addresses. You noticed
that the switch routing performance has been significantly degraded. Which action do you take to correct the problem?

A. Configure sdm prefer vlan

B. Configure sdm prefer routing
C. Execute clear ip route command to reset the routing table.
D. Configure sdm prefer default

Correct Answer: D
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 405
Which three characteristics of AAA with RADIUS are true? (Choose three.)

A. It uses a client-server architecture.

B. It uses standards-based implemented.
C. It runs on UDP port 1812.
D. It is a Cisco proprietary implementation.
E. It runs on TCP port 49.
F. It uses a client-private cloud architecture.

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 406
Which two statements about an access port with voice VLAN are true? (Choose two.)

A. They support a single VLAN for data traffic.

B. They require VTP.
C. Frame on the voice VLAN are tagged with a Layer 2 CoS value.
D. They can be configured on VLANs 1 through 1001.
E. They can be configured on trunk ports and access ports.

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 407
Why the network administration can want to disable MAC address learning on the router?

A. To free up space in MAC address table.

B. To use space in MAC address table
C. To wipe space in MAC address table.
D. There was a security violation.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 408
Where can you disable MAC address learning on the switch?

A. On the VLAN or interface.

B. Per switch port.
C. A VLAN filter template is necessary.
D. With the global command mac-address disable
Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 409
Which three advantages of TACACS+ are true? (Choose three.)

A. It integrates authentication and authorization

B. It controls access to network devices
C. It controls access to endpoint devices
D. It encrypted the passwords
E. It encrypted the whole transition
F. It separates authentication and authorization

Correct Answer: BEF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 410
Which two restrictions of the port security feature are true? (Choose two.)

A. trunk ports
B. SPAN ports
C. tunnel ports
D. EtherChannel
E. private VLANs

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 411
Which of the following commands are valid to configure DHCP snooping with Dynamic ARP Inspection for a VLAN?
(Choose four.)

A. (config)# ip dhcp snooping vlan arp trust

B. (config)# ip dhcp snooping
C. (config)# ip dhcp snooping vlan 10
D. (config)# ip arp inspection vlan 10
E.

F.

Correct Answer: BCDE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 412
Which two statements about extended-range VLANs are true? (Choose two.)

A. Created in VTP server mode in VTP version 3.

B. Created when switch is in VTP server mode.
C. They support pruning.
D. VTP version 3 stores extended-range VLAN in VLAN database.
E. VTP version 1 and 2 stores extended-range VLAN in VLAN database.

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 413
How many VLANs can be assigned to a user access port configured for VoIP?

A. 1
B. 2
C. 3
D. unlimited

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 414
Which three authentication methods does VRRP use? (Choose three.)

A. 802.1x authentication
B. Cipher authentication
C. SHA-256 authentication
D. No authentication
E. Plain text authentication
F. MD5 authentication

Correct Answer: DEF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 415
Which three authentication methods does GLBP use? (Choose three.)

A. Single Sign On authentication

B. MD5 authentication
C. No authentication
D. Plain text authentication
E. DCSP authentication
F. 6-to-4 authentication

Correct Answer: BCD

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 416
Which two authentication methods does HSRP use? (Choose two.)

A. WPA2 authentication
B. SHA-128 authentication
C. MD5 authentication
D. Plain text authentication
E. Teredo
F. No authentication methods do exist

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 417
Which three HSRP exchange states are used in multicast messages? (Choose three.)

A. err-disabled
B. coup
C. inherit
D. hold
E. hello
F. resign

Correct Answer: BEF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 418
Which two tasks can be accomplished to configure multiple HSRP client groups? (Choose two.)

A. Use the standby priority command to configure an HSRP group to become a backup of another HSRP group.
B. Use the standby follow command to configure an HSRP group to become a slave of another HSRP group.
C. Use the standby track command to configure an HSRP group to become a primary HSRP group.
D. Use the standby mac-refresh <seconds> command to change the refresh interval of the HSRP client group.
E. Use the standby mac-resurrect <seconds> command to change the refresh interval of the HSRP client group.

Correct Answer: BD
Section: Mix Questions
Explanation
Explanation/Reference:
Explanation:
Perform this task to configure multiple HSRP client groups.
The standby follow command configures an HSRP group to become a slave of another HSRP group.
HSRP client groups follow the master HSRP with a slight, random delay so that all client groups do not change at the same
time.
Use the standby mac-refresh seconds command to directly change the HSRP client group refresh interval. The default
interval is 10 seconds and can be
configured to as much as 255 seconds.

Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-12-4-book/fhp-
hsrp.html#GUID-EBDA2930-B8E5-4E54-9ECC-F9F232EC2955

QUESTION 419
Which three statements about RSPAN VLAN are true? (Choose three.)

A. RSPAN VLAN traffic only flows on trunk ports.

B. RSPAN VLAN prevents from carrying traffic
C. RSPAN VLAN cannot be a private primary VLAN or secondary VLAN.
D. All RSPAN VLAN traffic is flooded.
E. RSPAN VLAN traffic only flows on access ports.
F. RSPAN VLAN does not support Spanning-Tree Protocol.

Correct Answer: ACD

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 420
Which two statements about RSPAN VLAN are true? (Choose two.)

A. RSPAN VLAN must be configured in VLAN configuration mode using the remote-span command.
B. RSPAN VLAN trunks can handle Spanning-Tree protocol, except for SPAN destination ports.
C. RSPAN VLAN access ports can handle Spanning-Tree protocol in conjunction with SPAN destination ports.
D. RSPAN VLAN does not support any protocols
E. RSPAN VLAN traffic does not get flooded.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 421
Which two restrictions of the port security feature are true? (Choose two.)

A. Static port MAC address assignments are not supported.

B. It is not supported on PVLAN ports.
C. It is not supported on EtherChannel port-channel interfaces.
D. A single device can learn a maximum of three sticky MAC addresses.
E. It is supported on destination SPAN ports.

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 422
Which configuration do you apply to an interface so that it uses port security to learn and commit the first MAC address?

A. Configure the switchport switch-port security violation restrict 1 command.

B. Enable the sticky MAC addresses feature.
C. Enable the static secure MAC addresses feature.
D. Configure the switch for port-security aging type inactivity command.
E. Configure the switchport port-security maximum 1 command.
F. Disable the sticky MAC addresses feature.

Correct Answer: E
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Here is a concept example on how to learn and commit MAC addresses.
This example shows how to configure a maximum of 64 secure MAC addresses on the Fast Ethernet port 5/12:

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
port_sec.pdf (see page 62-9)

QUESTION 423
Which two commands can you enter to configure load-balancing at Layer 2? (Choose two.)
A. port-channel load-balance dst-ip
B. port-channel load-balance src-dst-ip
C. port-channel load-balance src-mac
D. port-channel load-balance src-dest-mac
E. port-channel load-balance src-ip

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 424
Which two statements about CDP are true? (Choose two.)

A. It can be disabled only at the interface level.

B. Devices with Cisco Discovery Protocol configured send advertisement messages to a multicast address on a periodic
basis
C. It is disabled when switches have mismatched native VLANs
D. Devices with Cisco Discovery Protocol configured send advertisement messages to a broadcast address on a periodic
basis.
E. VTP relies on Cisco Discovery Protocol to carry VTP domain information

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 425
Which two command sequences must you enter on a pair of switches so that they negotiate an EtherChannel using the
Cisco proprietary port-aggregation protocol? (Choose two.)

A.

B.

C.

D.

E.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 426
Which two ways can you use to disable Cisco Discovery Protocol? (Choose two.)

A. Enter the no cdp enable command to disable it on a device.

B. Enter the no cdp run command to disable it in the global configuration
C. Enter the no cdp run command to disable it on an individual interface.
D. Enter the cdp disable command to disable it on an individual interface
E. Enter the no cdp enable command to disable it on an individual interface.

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 427
Which two statements about errdisable recovery are true? (Choose two.)

A. You can use the show errdisable recovery command to view the reason a port was error-disabled.
B. Errdisable detection is enabled by default on ports with port security enabled
C. You can use the show errdisable detect command to view the reason a port was error-disabled.
D. Errdisabled autorecovery is enabled by default.
E. Errdisabled detection is disabled by default on ports with port security enabled

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 428
What are the prerequisite for HSRP interface to come up? (Choose two.)

A. VIP on same subnet.

B. Physical IP address must be set.
C. Virtual MAC address need to be configured.
D. VIP on a separate subnet.
E. There are no prerequisites required to configure HSRP.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 429
Which two prerequisites are required for an HSRP interface to come up? (Choose two.)

A. The virtual IP address must be in the same subnet as the interface IP address.
B. Configure a physical IP address for the interface and enable that interface before HSRP becomes active
C. It requires to configure more than one first-hop redundancy protocol on the same interface.
D. Configure HSRP version 2 to interoperate with HSRP version 1.
E. The virtual IP address is prohibited to be in the same subnet as the interface IP address under IPv4.
Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 430
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 431
DRAG DROP

Drag and drop the statements about SPAN source and destination ports from the left onto the correct port types on the
right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 432
DRAG DROP

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 433
Which two statements about VRRP are true? (Choose two.)

A. It requires each device in the group to participate in the same dynamic routing protocol.
B. Preemption is not supported.
C. It can use a single virtual address to provide default gateway redundancy.
D. It uses a shared VIP to support default gateway redundancy.
E. It support clear-text authentication only.

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 434
Which two device types does DHCP snooping treat as untrusted in an ISP environment? (Choose two.)

A. provider devices
B. customer edge devices
C. user-facing provider edge devices
D. end host devices
E. provider edge devices

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 435
Which feature can prevent ARP poisoning attacks on a device?

A. Dynamic MAC Inspection

B. CGMP snooping
C. Dynamic ARP Inspection
D. MAC snooping
E. DHCP snooping
F. Static ARP Inspection

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 436
Which two statements about LLDP frames are true? (Choose two.)

A. They contain a CRC for error checking.

B. The destination MAC address in a LLDP frame is a multicast address.
C. Each LLDP frame contains a sequence of TLVs.
D. Each LLDP frame includes a field containing the CoS value.
E. They have an EtherType of 0x8080.
F. All switches forward the destination MAC address in a LLDP frame.

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 437
Which virtual MAC address does HSRP group 37 use with default configuration?

A. 00:00:0c:07:ac:25
B. C0:00:00:25:00:00
C. 00:00:0c:07:ac:37
D. C0:00:00:37:00:00

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 438
Which two commands or command sequences configure a switch so that it tags native VLAN 3939? (Choose two.)

A.

B.

C.

D.

E.

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 439
Which two tasks must you perform to enable DHCP option 82 on an untrusted port? (Choose two.)

A. Enter the ip dhcp snooping trust command to enable data insertion for DHCP option 82.
B. Enter the ip dhcp snooping information option command to enable option 82.
C. Enter the ip dhcp snooping trust command to enable DHCP option 82.
D. Enter the ip dhcp snooping information option allow-untrusted command to enable the untrusted port.
E. Enter the ip dhcp snooping information option replace command to enable DHCP option 82.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 440
Refer the exhibit. Which two statements about the spanning-tree operation of this switch are true? (Choose two.)

A. The spanning-tree mode stp ieee command was entered on this switch
B. The spanning-tree operation mode for this switch is PVST.
C. The switch is operating in the default cisco spanning-tree mode.
D. The spanning-tree operation mode for this switch is IEEE/
E. the spanning-tree operation mode for this switch is PVST+.

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 441
Which feature prevents a newly-added switch from being the primary?

A. root guard
B. BPDU guard
C. BPDU filtering
D. loop guard

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 442
DRAG DROP

Drag and drop the correct statements about HSRP from the left onto the True column on the right. Not all options are used.
Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 443

Refer to the exhibit. Which two statements about the network environment of the device that generated this output are true?
(Choose two.)

A. The default hello and hold timer values are in use

B. HSRP version 2 is in use.
C. The standby router can take the active HSRP role if it fails to receive a hello packet from the active within 10 seconds.
D. The standby router can take the active HSRP role if it fails to receive a hello packet from the active within 1.616
seconds.
E. The priority value of the HSRP group is 1.

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 444
DRAG DROP

Drag and drop the description of VRRP from the left onto the correct versions of VRRP on the right.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 445
DRAG DROP

Drag and drop the characteristic from the left to the matching STP timer variables on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 446
Which two statements about GLBP is true? (Choose two.)

A. Member devices can elect one or more AVGs.

B. Member devices send hello messages to multicast address 224.0.0.39.
C. It supports up to 32 groups on a single interface.
D. Member devices must elect exactly one AVG.
E. The AVG assigns virtual MAC addresses to all group members.

Correct Answer: DE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 447
DRAG DROP
Drag and drop the descriptions of switching technologies from the left onto the correct technologies on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 448

Refer to the exhibit. Which two statements about SW1 are true? (Choose two.)

A. Interface Gi6/2 is the root for VLAN 36.

B. Interface Gi5/1 is using an industry-standard trunking protocol.
C. Interface Gi5/1 is using a Cisco proprietary trunking protocol.
D. On interface Gi6/2, all untagged traffic is tagged with VLAN 600.
E. On interface Gi6/1, all untagged traffic is tagged with VLAN 113.
F. The device is configured with the default MST region.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 449
Which two statements about the LACP port priority of a device are true? (Choose two.)

A. To manually configure a link within an EtherChannel to come up first, set its lacp port-priority value lower than the
default.
B. To manually configure a link within an EtherChannel to come up first, set its lacp port-priority value higher than the
default.
C. The system uses the port priority of the local and remote devices to determine which links in an EtherChannel group are
active.
D. The system uses the port priority of the local and remote devices to determine which links in an EtherChannel group are
hot-standby.
E. It determines which links in an EtherChannel group are active.
F. LACP port-priority is used in the hashing algorithm to load-balance links within an EtherChannel.

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 450
In which two circumstances does a port security violation occur? (Choose two.)

A. when sticky MAC address learning is enabled and the port has a link-down condition
B. when a port with a secure MAC address attempts to use a different port in the same VLAN
C. when the same MAC addresses enters a port more than once
D. when the CAM table overflows with dynamically learned MAC addresses
E. when the port has received more MAC addresses than allowed

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
port_sec.pdf

QUESTION 451
Which three VLANs are part of the extended range of available VLANs? (Choose three.)

A. 1006
B. 4095
C. 4195
D. 3000
E. 4094
F. 1001

Correct Answer: ADE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 452
Which three options are reasons for an interface to go into err-disable state? (Choose three.)

A. security violation
B. BPDU guard violation
C. hard-coded speed duplex match on both sides
D. ARP inspection
E. storm-control broadcast
F. grouping ports into a port channel

Correct Answer: ABD

Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-
recovery.html

QUESTION 453
In a switch stack is configured to use SDM template, where are the templates stored?

A. all stack members

B. stack master
C. flash memory
D. TFTP server

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/
configuration/guide/3750xscg/swsdm.html

QUESTION 454
Network engineer want to use UDLD, what he need to consider?

A. udld is a non-propriety
B. udld is working with non cisco devices
C. udld is layer 1
D. udld can aggressively disabled the port after eight failed retries

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 455
Which command enables root guard on a cisco switch?

A. switch(config-if)# spanning-tree guard root

B. switch(config)# spanning-tree guard root
C. switch(config-if)# spanning-tree guard-root
D. switch(config)# spanning-tree root guard
E. switch(config-if)# spanning-tree root guard

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10588-74.html

QUESTION 456
Refer to the exhibit. Which statement describes the result if a switch that is running PVST+ is added to this network?

A. Spanning tree is disabled automatically on the network

B. Spanning tree continues to operate in Rapid PVST+ on DSW2 and the new switch operates in PVST+
C. Both switches operate in the PVST+ mode
D. Both switches operate in the Rapid PVST+ mode

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 457
A network engineer deployed an older switch with the same spanning-tree priority as the existing root, which caused a
network outage. In which two locations should the Spanning Tree protocol root guard feature be implemented? (Choose
two.)

A. On the designated root switch downlinks to the access layer.

B. On all of non-root switch facing ports of the access layer
C. On the access layers root facing ports
D. On Layer 3 boundaries in the distribution layer
E. Globally on all network switches.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 458
How will a switch become a stack master during election?

A. highest member ID value

B. highest member priority value

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 459
Technician moves PC from one switch port to another switch port. After the move, the new switch port goes errdisabled.
Why?

A. Security violation
B. Duplex mismatch
C. different vlan

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 460
What happens when a port configured with root-inconsistent receives a superior BPDU?

A. Loop Guard
B. Root Guard
C. BPDU Guard
D. BPDU Filter

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 461
Which configuration do you apply to an interface so that it uses port security to learn and commit the first MAC address?

A. Sticky
B. Restrict
C. Shutdown
D. Protect

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 462
– DSW1 (Distribution Switch 1) is the primary device for VLAN 101, 102, 105
– DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104
– A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device, unless
GigabitEthernet 1/0/1 on backup device has also failed.

During routine maintenance, G1/0/1 on DSW1 was shutdown. All other interfaces were up. DSW2 became the active HSRP
device for Vlan101 as desired. However, after G1/0/1 on DSW1 was reactivated. DSW1 did not become the active HSRP
device as desired.
What need to be done to make the group for Vlan101 function properly?

A. Enable preempt in the VLAN 101 HSRP group on DSW1.

B. Disable preempt in the VLAN 101 HSRP group on DSW2's.
C. In the VLAN 101 HSRP group on DSW1, decrease the priority value to value that is less ' than the priority value
configured in the VLAN 101 HSRP group on DSW2.
D. Decrease the decrement value in the track command for the VLAN 101 HSRP group on U DSWTs to a values less than
the value in the track command for the VLAN 101 HSRP group on DSW2.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Continue to check VLAN 101 on both switches
We learned that DSW1 doesn’t have the “standby 1 preempt” command so it can’t take over the active role again even if its
priority is the highest. So we need to enable this command on VLAN 101 of DSW1.

QUESTION 463
If G1/0/1 on DSW1 is shutdown, what will be the current priority value of the Vlan105′s group on DSW1?

A. 95
B. 100
C. 150
D. 200

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Below is the output of VLAN 105:
Priority is configured 150, Track is 55. So, if shutdown interface G1/0/1 it would be 150-55 = 95.

QUESTION 464
Which statement about the current configuration on port GigabitEthernet 2/0/1 is true?

A. It is an access port configured for a phone and PC

B. It is a trunk port and native VLAN is VLAN 1
C. It is a trunk port and native VLAN id VLAN 700
D. It is an access port in VLAN 700

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 465
Refer to the exhibit. Three switches are configured for HSRP. Switch1 remains in the HSRP listen state. What is the most
likely cause of this status?
A. this is normal operation
B. standby group number does not match VLAN number
C. IP addressing is incorrect
D. incorrect priority commands
E. incorrect standby timers

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 466
An engineer is configuring EtherChannel between two switches using PAgP. If the EtherChannel mode on switch 1 is
configured using auto, which mode on switch 2 establishes an operational EtherChannel?

A. desirable
B. passive
C. active
D. auto

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 467
When using EtherChannel misconfiguration guard which technology is used to prevent this type of misconfiguration from
affecting the network?

A. PAgP
B. STP
C. LACP
D. port security

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 468
In regards to Cisco Virtual Switching System which technology is needed between two switches for them to act as one
network element and share control information and data traffic?

A. trunk
B. virtual port channel
C. EtherChannel
D. virtual switch link

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 469
Refer to the exhibit. What is the effect of the given configuration?

A. In enables the switch to become the spanning-tree root bridge.

B. It enables the reduced MAC address feature.
C. It enables spanning-tree to create dynamic system IDs.
D. It enables extended VLANs.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 470
Which command do you enter so that the default authentication group on a device falls back to the case-sensitive local user
database when the initial authentication fails?

A. aaa authentication login default group tacacs+ radius local

B. aaa authentication exec default group tacacs+ local if-authenticated
C. aaa authentication login default group tacacs+ local-case if-authenticated
D. aaa authentication exec default group tacacs+ if-authenticated local

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 471
Which two statements about VRRP are true? (Choose three.)

A. Authentication commands must be entered under the interface.

B. It sends advertisements to multicast address 224.0.0.9.
C. It supports MD5 and IP sec authentication.
D. It can use an interface IP address as the virtual IP address.
E. It sends advertisements to multicast address 224.0.0.18.
F. It is a Cisco proprietary protocol.

Correct Answer: ADE

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 472
Which statement about Layer 2 protocol participation of ports involved in a SPAN session is true?

A. Neither a SPAN source nor SPAN destination participates in any Layer 2 protocols.
B. A SPAN source does not participate in any Layer 2 protocols.
C. A SPAN destination does not participate in any Layer 2 protocols.
D. Both SPAN source and SPAN destination participate in any Layer 2 protocols.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/configuration/
guide/2960scg/swspan.pdf

QUESTION 473
Refer to the exhibit. Which description of the effect of entering the switch port trunk allowed vlan 2,3,4 command on
FastEthernet0/2 is true?
A. The two workstations continue to communicate without a default gateway configured.
B. The command is unsupported on a trunk where VLANs have already been pruned manually.
C. The running configuration displays switch port trunk allowed vlan 1-5 for Fa0/2.
D. The two workstations stop communicating because they are on VLAN 5, which is not allowed on the trunk.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 474
Which three responses from a RADIUS server are valid? (Choose three.)

A. REJECT
B. CHALLENGE
C. ACCEPT
D. UPDATE PASSWORD
E. CONFIRM

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 475
Which two configurations can you apply to a port so that it tags traffic with VLAN 915? (Choose two.)

A.

B.

C.

D.

E.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 476
During the implementation of a voice solution, which two required items are configured at an access layer switch that will be
connected to an IP phone to provide VoIP communication? (Choose two.)

A. allowed codecs
B. untagged VLAN
C. auxiliary VLAN
D. Cisco Unified Communications Manager IP address
E. RSTP

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 477
– DSW1 (Distribution Switch 1) is the primary device for VLAN 101, 102, 105.
– DSW2 (Distribution Switch 2) is the primary device for VLAN 103 and 104.
– A failure on gig1/0/1 on primary device should cause the primary device to release its status as the primary device, unless
GigabitEthernet 1/0/1 on backup
device has also failed.

During routine maintenance, it became necessary to shutdown G1/0/1 on DSW1. All other interfaces were up. During this
time, DSW1 remained the active device for VLAN 102’s HSRP group. You have determined that there is an issue with the
decrement value in the track command in VLAN 102’s
HSRP group. What need to be done to make the group function properly?

A. The DSW1’s decrement value should be configured with a value from 5 to 15.
B. The DSW1’s decrement value should be configured with a value from 9 to 15.
C. The DSW1’s decrement value should be configured with a value from 11 to 18.
D. The DSW1’s decrement value should be configured with a value from 195 to less than 205.
E. The DSW1’s decrement value should be configured with a value from 200 to less than 205.
F. The DSW1’s decrement value should be greater than 190 and less 200.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Use the “show run” command to show. The left Vlan102 is console1 of DS1. Priority value is 200, we should decrement
value in the track command from 11 to 18. Because 200 – 11 = 189 < 190 (priority of Vlan102 on DS2)

QUESTION 478
SIMULATION

The headquarter office for a cement manufacturer is installing a temporary Catalyst 3550 in an IDF to connect 24 additional
users. To prevent network corruption, it is important to have the correct configuration prior to connecting to the production
network.
It will be necessary to ensure that the switch does not participate in VTP but forwards VTP advertisements that are received
on trunk ports. Because of errors that have been experienced on office computers, all non-trunking interfaces should
transition immediately to the forwarding state of Spanning tree. Also configure the user ports (all FastEthernet ports) so that
the ports are permanently non-trunking.

Requirements:
You will configure FastEthernet ports 0/12 through 0/24 for users who belong to VLAN 20. Also all VLAN and VTP
configurations are to be completed in global configuration mode as VLAN database mode is being deprecated by Cisco.
You are required to accomplish the following tasks:
1. Ensure the switch does not participate in VTP but forwards VTP advertisements received on trunk ports.
2. Ensure all non-trunking interfaces (Fa0/1 to Fa0/24) transition immediately to the forwarding state of Spanning-Tree.
3. Ensure all FastEthernet interfaces are in a permanent non-trunking mode.
4. Place FastEthernet interfaces 0/12 through 0/24 in VLAN 20.

Correct Answer: See Explanation below.

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:

switch#conf t
switch(config)#vtp mode transparent
switch(config)#interface range fa0/12 – 24
switch(config-if-range)#switchport mode access
switch(config-if-range)#spanning-tree portfast
switch(config)#interface range fa0/12 – 24
switch(config-if-range)#switchport access vlan 20
switch(config-if-range)#end
switch# copy run start

QUESTION 479
SIMULATION

The headquarter offices for a book retailer are enhancing their wiring closets with Layer3 switches. The new distribution-
layer switch has been installed and a new access-layer switch cabled to it. Your task is to configure VTP to share VLAN
information from the distribution-layer switch to the access-layer devices.
Then, it is necessary to configure interVLAN routing on the distribution layer switch to route traffic between the different
VLANs that are configured on the access-layer switches; however, it is not necessary for you to make the specific VLAN
port assignments on the access-layer switches. Also, because VLAN database mode is being deprecated by Cisco, all
VLAN and VTP configurations are to be completed in the global configuration mode.
Please reference the following table for the VTP and VLAN information to be configured:

These are your specific tasks:

1. Configure the VTP information with the distribution layer switch as the VTP server.
2. Configure the VTP information with the access layer switch as a VTP client.
3. Configure VLANs on the distribution layer switch.
4. Configure inter-VLAN routing on the distribution layer switch.
5. Specific VLAN port assignments will be made as users are added to the access layer switches in the future.
6. All VLANs and VTP configurations are to completed in the global configuration. To configure the switch, click on the host
icon that is connected to the switch be way of a serial console cable.

Correct Answer: See Explanation below.

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:

1) Configure the VTP information with the distribution layer switch as the VTP server:

DLSwitch#configure terminal
DLSwitch(config)#vtp mode server
DLSwitch(config)#vtp domain cisco (use cisco, not CISCO because it is case sensitive)
2) Configure the VTP information with the access layer switch as a VTP client
ALSwitch#configure terminal
ALSwitch(config)#vtp mode client
ALSwitch(config)#vtp domain cisco
ALSwitch(config)#exit

3) Configure VLANs on the distribution layer switch

To create VLANs on a switch, use the vlan vlanID# command:
DLSwitch(config)#vlan 20
DLSwitch(config)#vlan 21
Configure Ip addresses for Vlans:
DLSwitch(config)#interface vlan 20
DLSwitch(if-config)#ip address 172.16.71.1 255.255.255.0
DLSwitch(if-config)#no shutdown
DLSwitch(if-config)#interface vlan 21
DLSwitch(if-config)#ip address 172.16.132.1 255.255.255.0
DLSwitch(if-config)#no shutdown
DLSwitch(if-config)#exit

4) Configure inter-VLAN routing on the distribution layer switch

DLSwitch(config)#ip routing
DLSwitch(config)#exit
DLSwitch#copy running-config startup-config

ALSwitch#copy running-config startup-config

QUESTION 480
SIMULATION

Acme is a small export company that has an existing enterprise network comprised of 5 switches;
- CORE, DSW1, DSW2, ASW1 and ASW2.
The topology diagram indicates their desired pre-VLAN spanning tree mapping.
Previous configuration attempts have resulted in the following issues:
– CORE should be the root bridge for VLAN 20; however, DSW1 is currently the root bridge for VLAN 20.
– Traffic for VLAN 30 should be forwarding over the gig 1/0/6 trunk port between DSW1 and DSW2. However, VLAN 30 is
currently using gig 1/0/5.
– Traffic for VLAN 40 should be forwarding over the gig 1/0/5 trunk port between DSW1 and DSW2. However, VLAN 40 is
currently using gig 1/0/6.
You have been tasked with isolating the cause of these issuer and implementing the appropriate solutions.
You task is complicated by the fact that you only have full access to DSW1, with isolating the cause of these issues and
implementing the appropriate solutions. Your task is complicated by the fact that you only have full access to DSW1, with
the enable secret password cisco. Only limited show command access is provided on CORE, and DSW2 using the enable
2 level with a password of acme.
No configuration changes will be possible on these routers.
No access is provided to ASW1 or ASW2.
Correct Answer: See Explanation below.
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:

DSW1#conf t
DSW1(config)#spanning-tree vlan 20 priority 61440
DSW1(config)#int g1/0/5
DSW1(config-if)#spanning-tree vlan 40 cost 1
DSW1(config-if)#no shut
DSW1(config-if)#exit
DSW1(config)#int g1/0/6
DSW1(config-if)#spanning-tree vlan 30 port-priority 64
DSW1(config-if)#no shut DSW1(config-if)#end
DSW1#copy run start
Verification:
DSW1# show spanning-tree vlan 20
DSW1# show spanning-tree vlan 40
DSW2# show spanning-tree vlan 30

QUESTION 481
DRAG DROP

Drag and drop the characteristic from the left to the matching STP mode on the right.
Select and Place.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 482
DRAG DROP

Drop the STP components from the left onto the correct descriptions on the right.
Select and Place.

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation
Explanation/Reference:

QUESTION 483
DRAG DROP

Drag and drop the LLDP-MED TLVs from the left onto the correct statements on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 484
DRAG DROP

Drag and drop the characteristic from the left to the matching STP category on the right.
Select and place.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 485
DRAG DROP

LACP vs PAGP
Select and Place:

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation

Explanation/Reference:

QUESTION 486
DRAG DROP
Drag and Drop - RSPAN True and False
Select and Place:

Select and Place:

Correct Answer:

Section: Mix Questions

Explanation
Explanation/Reference:

QUESTION 487
DRAG DROP

Drag and Drop - VRRPv2 & VRRPv3 vs VRRPv3 Comparison

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 488
DRAG DROP

Drag and Drop - LLDP-TLV (Concepts Only)

LLDP-MED Capabilities TLV
Network Policy TLV
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 489
DRAG DROP

Drag and Drop - LLDP-TLV (Concepts Only)

Power Management TLV
Inventory Management TLV
Location TLV
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 490
DRAG DROP

Drag and Drop - STP Timer Delay (Concepts Only)

Diameter of the STP Domain (dia)
Bridge Transit Delay (transit delay)
BPDU Transmission Delay (bpdu_delay)
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/19120-122.html

QUESTION 491
DRAG DROP

Drag and Drop - STP Timer Delay (Concepts Only)

Message Age Increment Overestimate (msg_overestimate)
Lost Message (lost_msg)
Transmit Halt Delay (Tx_halt_delay)
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 492
DRAG DROP

Drag and Drop - STP Timer Delay (Concepts Only)

Medium Access Delay (med_access_delay)
End-to-end BPDU Propagation Delay
Maximum Transmission Halt Delay
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 493
DRAG DROP

Drag and Drop - RSPAN Steps (Concept 1) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 494
DRAG DROP

Drag and Drop - RSPAN Steps (Concept 2) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 495
DRAG DROP

Drag and Drop - VRRPv2 vs VRRPv3 (Concept 1) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 496
DRAG DROP

Drag and Drop - HSRPv1 vs HSRPv2 (Concept 1) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/15-mt/fhp-15-mt-book/fhp-hsrp-
v2.pdf

QUESTION 497
DRAG DROP

Drag and Drop - Stack Master Election Process (CONCEPT ONLY)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-
switch-stks.html

QUESTION 498
DRAG DROP

Drag and Drop - DHCP Snooping Process (Concept 1) - CONCEPT ONLY (UNOFFICIAL)
Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 499
DRAG DROP

Drag and Drop - RADIUS vs TACACS+ (Concept 1) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-
10.html#comp_multi_prot

QUESTION 500
DRAG DROP

Drag and Drop -RADIUS vs TACACS+ (Concept 2) - CONCEPT ONLY (UNOFFICIAL)

Select and Place:

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-
10.html#comp_multi_prot

QUESTION 501
What happens if an interface within channel group is configured as SPAN destination?

A. Portchannel will forward traffic to source span

B. will not be operational
C. the link will be in error-disable
D. The interface will be removed from the channel group

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 502
EtherChannel guard misconfig is configured on a switch, which technology supports that?

A. LACP
B. PagP
C. STP
D. Port Security

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 503
Which will identify the master switch in stackwise?

A. The switch that is currently the stack master

B. The switch with the highest stack member priority value
C. The switch that uses the non-default interface-level configuration
D. The switch with the lower priority stack member priority value

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-
switch-stks.html

QUESTION 504
How will the traffic reach the core switch from AS switch to DS core switch?
(Based on a topology shown with one core, two distribution and two access switches on each distribution switch, with
redundant links and bandwidth mentioned.)

A. ASW1 to DWS1 to core

B. ASW1 to DWS2 to core
C. ASW1 to DSW1 to DSW2 to core
D. ASW1 to DSW2 to DSW1 to core

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 505
If HSRP group number is 37, what would be the vMAC (virtual MAC) address?

A. 00-00-0C07-AC25
B. 0000-0C07-AC37
C. 0000-C007-AC25
D. 0000-C007-AC37

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 506
What is the default value for spanning-tree port-priority?

A. 128
B. 64
C. 32
D. 1024

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/n5k/commands/spanning-tree-port-priority.html

QUESTION 507
What statement is true if a new switch with a lower bridge ID is introduced in a network with root guard enhancement?

A. Prevent unknown switch be a root port

B. Root Guard puts the port into root-inconsistent
C. Allow two root bridges in a network
D. All ports of the new switch are changed to listening state

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10588-74.html

QUESTION 508
How to configure loop guard in a Cisco switch IOS?

A. (config)#spanning-tree loop guard default

B. (config-if)#spanning-tree loop
C. (config)#spanning-tree loop-guard default
D. (config-if)#spanning-tree guard loop
E. (config-if)#spanning-tree guard

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10596-84.html#loop_guard

QUESTION 509
Which statement is true about dynamic access port?

A. VLAN 1 is the default VLAN.

B. None until the port VLAN is determined.
C. All VLANs are permitted in a dynamic access port link.
D. By default the port has to participate in a VLAN election to determine which VLAN a port is assigned.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 510
What can happen after a RSPAN configuration in a Cisco switch?
A. Destination port is unusable for normal use
B. Traffic in network is doubled
C. CDP or LLDP must be enable on switch
D. The traffic is cached in NVRAM

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 511
Which two statements are true about Option 82? (Choose two.)

A. Layer 2 ingress
B. Layer 3 egress
C. Layer 3 ingress
D. Layer 2 egress
E. Layer 4 egress
F. Layer 4 ingress

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 512
Where is SDM template stored in a Stackwise configuration?

A. master
B. slave
C. NVRAM
D. flash

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/
configuration/guide/3750xscg/swsdm.html

QUESTION 513
Which information is true about RSPAN?

A. RSPAN VLAN carries only RSPAN traffic

B. On a switch there can be only one RSPAN VLAN
C. RSPAN VLAN carries RSPAN traffic along multiple switches
D. RSPAN can be enable only in a Layer 3 switch

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 514
What is the link called between a VSS?

A. VSL (Virtual Switch Link)

B. SVI
C. DCSP
D. VLAN

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 515
Which statement is true about GLBP?

A. GLBP uses multicast address 224.0.0.102 with UDP port 3222.

B. GLBP uses multicast address 224.0.0.2 with TCP port 3222.
C. GLBP uses multicast address 224.0.0.102 with TCP port 3222.
D. GLBP uses multicast address 224.0.0.18 with UDP port 3222

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 516
How many Active Virtual Gateways (AVG) can be used in a GLBP protocol?

A. Only one AVG can be elected on a switch

B. Two AVG could be elected on a switch
C. Two AVG just could be elected in GLBP v2
D. GLBP supports 8 AVGs per group

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 517
Which statement is true about VRRP?

A. VRRP uses multicast address 224.0.0.18 and uses IP Protocol 112

B. VRRP uses multicast address 224.0.0.28 and uses UDP port 112
C. VRRP uses multicast address 224.0.0.2 and uses IP Protocol port 3222
D. VRRP uses multicast address 224.0.0.18 and uses TCP port 112
E. VRRP uses multicast address 224.0.0.9 and uses UCP port 112

Correct Answer: A
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 518
Which statement is true about HSRP?

A. HSRP uses multicast address 224.0.0.2 and uses UDP port 1985.
B. HSRP uses multicast address 224.0.0.22 with TCP port 1122
C. HSRP uses broadcast address 224.0.0.2 with UDP port 1985
D. HSRP uses broadcast address 224.0.0.22 with UDP port 32229

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 519
What is the multicast address for HSRPv2?

A. 224.0.0.102
B. 127.0.0.1
C. 224.1.1.2
D. 224.1.1.102

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 520
What will be the behavior of an access port when a tagged packet is received, with a VLAN ID of an access port?

A. The tag is removed and packet is forwarded to a VLAN of access port.

B. The tag is removed and packet is forwarded of the VLAN mentioned in the tag.
C. The tag is not removed and packet is forwarded of the VLAN mentioned in the tag.
D. Packet is dropped.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 521
An engineer needs to add a customer private VLAN to the network. What configuration is required to isolate the customer's
traffic on the network?

A. Configure transparent mode

B. Enable VTP v3
C. Configure VTP in server mode
D. Disable VTP and manually configure the customer VLAN

Correct Answer: A
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 522
What is the behavior of an access port when a tagged packet is received other than the access VLAN value?

A. Tag is removed and packet is forwarded of the VLAN mentioned in the tag.
B. Tag is removed and packet is forwarded on the VLAN of the access port.
C. Not available
D. Packet is dropped

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 523
If you have a new switch (that runs spanning-tree mode pvst+) connect to the exist switch, which statement is true?

A. It will not work between two switches.

B. It will work, the new switch will communicate to the existing switch with PVST+
C. It will work, the new switch will communicate to the existing switch with Rapid-PVST
D. It will work, the new switch will communicate to the existing switch with MSTP

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 524
What is the default violation status of port security?

A. none
B. shutdown
C. trap
D. enabled

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 525
What is the storm control violation defined by default on a Cisco switch?

A. Disabled
B. Enabled
C. Enabled by broadcast only
D. Enabled by multicast only

Correct Answer: A
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 526
What happens when a destination SPAN port that is configured as EtherChannel receives traffic?

A. Shutdown
B. Err-disable
C. Nothing
D. Broadcast threshold is doubled in an interface

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 527
Refer to the exhibit. Which two statements about the network environment of the interface that generated this output are
true? (Choose two.)

A. The configured VRRP priority of the interface is 120.

B. The device on which the interface resides is acting as a standby router.
C. The Skew time is .531 seconds.
D. The configured VRRP priority of the interface is 105.
E. If the priority of another router is higher than the priority of the master router, it becomes the master router after 3.351
seconds.

Correct Answer: CE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 528
Which statement about the VTPv2 is true?
A. It supports the use of multiple instances.
B. It propagates VLANs 1 – 1005 only.
C. It can be enabled on a per-port basis.
D. It performs consistency checks only when a new VLAN is manually added.
E. It can be enabled on a per-interface basis.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 529
Which two possible EtherChannel load balancing mechanisms are based on Layer 3? (Choose two.)

A. MAC Source
B. MAC Source-destination
C. IP Source
D. IP Source-destination
E. MAC Destination

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 530
Which VTPv2 mode does the switch operate without participating in VTP?

A. client
B. server
C. transparent
D. off

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 531
How to disable CDP? (Choose two.)

A. no cdp run on interface

B. no cdp run in global configuration
C. cdp disable on interface
D. no cdp enable on interface
E. no cdp enable in global configuration

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 532
What happens if we add "line" on AAA command?

A. Disable TACACS+ authentication

B. Disable RADIUS authentication
C. It's a last resource (or resort) login
D. Is the prefer logging method in Cisco switches

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 533
Which one is related to Stackwise technology?

A. Switches can be stack with port-channel.

B. Multiple switches can be stacked.
C. Master switch and backup switch is listed in line.
D. ProStack with mix switch.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 534
A switch which was connected with 2 fiber cables attached to another switch. After initial boot (I think another switch), one
of the link get error-disable or shutdown. What was the reason for that?

A. Due to STP.
B. Due to UDLD aggressive mode, the other switch didn't get the BPDU message.
C. Due to UDLD normal mode, the other switch didn't get the BPDU message.
D. Due to port security configuration.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 535
Which technique will control broadcast, multicast and unicast problems?

A. port security
B. STP
C. storm control
D. SPAN

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 536
How to recover err-disable after an UDLD failure?

A. UDLD reset
B. Err-disable auto recovery
C. Shut and no shutdown (restart)
D. Reboot the switch
E. UDLD recovery

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 537
How to configure DHCP snooping and DAI (Dynamic ARP Inspection) in VLAN? (Choose all that apply.)

A. Define and configure a DHCP server

B. Enable DHCP snooping on at least one VLAN
C. Ensure that DHCP server is connected in a trusted interface
D. Configure DHCP snooping DB agent
E. Enable DHCP snooping globally
F. Redirect DHCP snooping locally
G. Disable DHCP snooping on at least one VLAN
H. Prevent DHCP server from connecting to a trusted interface

Correct Answer: BCF

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 538
Which three feature sets are used in Stackwise technology? (Choose three.)

A. LAN Base
B. IP Base
C. WAN Services
D. IP Services
E. ARP Base
F. LAN Agent

Correct Answer: ABD

Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 539
Which statement is true about Stackwise?

A. When building a switch stack, you cannot mix software feature sets.
B. When building a switch stack, you can mix software feature sets.
C. When building a Switch stack, a broadcast storm would occur.
D. When building a Switch stack, performance will be degraded.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 540
Which three statements about SPAN and RSPAN are true? (Choose three.)

A. The switch port monitor provides data on network switches by port in use, CPU load and memory used.
B. It provides specific port data to obtain active and historical port utilization information.
C. Accurate information on unused switch ports helps the administrator keep these ports closed for security risk best
practices.
D. Does not provide specific port data to obtain active and historical port utilization information.
E. Accurate information on unused switch ports is not necessary.

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.solarwinds.com/topics/switch-port-monitor

QUESTION 541
Refer to the exhibit. Which two statements about the flag of the EtherChannel is true? (Choose two.)

A. Flag S indicates Layer 2 is operational.

B. Flag U indicates EtherChannel is operational.
C. Flag R indicates Layer 2 is operational.
D. Flag U indicates Layer 2 is operational.
E. Flag H indicates EtherChannel is operational.
Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 542
Refer to exhibit: How to make DSW1 the primary root for VLAN 10. (Choose two.)

A. Change DSW2 bridge priority to VLAN 20 to 61440

B. Change DSW1 bridge priority to VLAN 10 to 4096
C. Change DSW1 bridge priority to VLAN 20 for 4096
D. Change DSW1 bridge priority to VLAN 10 for 1
E. Change DSW1 bridge priority to VLAN 10 with the command priority root

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 543
Which information does the subordinate switch in a switch stack keep for all the VLANs that are configured on it?

A. VLAN database
B. DHCP snooping database
C. Spanning trees information
D. Routing information

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 544
Which two TLVs are included in Cisco Discovery Protocol advertisements? (Choose two.)

A. Network Policy TLV

B. VTP Management Domain TLV
C. System Name TLV
D. Inventory Management TLV
E. Native VLAN TLV

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cdp/configuration/15-mt/cdp-15-mt-book/nm-cdp-
discover.html

QUESTION 545
Which fallback method can you configure to allow all AAA authorization requests to be granted if the other methods do not
respond or return an error?

A. enable
B. RADIUS
C. none
D. TACACS+

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 546
Which two statements about VRRP advertisements are true? (Choose two.)

A. They are sent from the master router and standby routers.
B. They include VRRP timer information.
C. They are sent only from the master router.
D. They include priority information.
E. They are sent every three seconds by default.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_2/nx-os/unicast/configuration/guide/
l3_cli_nxos/l3_vrrp.pdf

QUESTION 547
Which two StackWise configuration setting types are applied at the system level? (Choose two.)

A. 802.1x settings
B. speed/duplex settings
C. port-security settings
D. VLAN settings
E. SNMP settings

Correct Answer: DE
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swstack.pdf

QUESTION 548
Which three values can Cisco IOS device use as the basis for EtherChannel load-balancing? (Choose three.)

A. MAC address
B. port number
C. IP address
D. VLAN ID
E. IP precedence
F. DSCP

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html

QUESTION 549
Which command can you enter to set the time between BPDUs in an MST environment by route bridge?

A. spanning-tree mst 1 cost 5

B. spanning-tree mst mst forward-time 5
C. spanning-tree mst hello-time 2
D. spanning-tree mst max-age 20

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 550
Which two tasks must you perform on a device to ensure that an Etherchannel operate at Layer 3? (Choose two.)

A. configure no switchport on physical interface

B. configure EtherChannel directly on the interface
C. switchport mode trunk
D. configure switchport on
E. configure switchport mode access

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 551
Which two configuration requirements for port security are true? (Choose two.)

A. Port must be in access mode

B. Port security must be enabled on the port level
C. Port must be in interface VLAN mode
D. Port security must be disabled on the port level
E. Port must be in encapsulation mode

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 552
Which two ISP devices should have trust Port-Statement with DHCP Snooping feature? (Choose two.)

A. User responsible to control ISP edge devices

B. Only ISP edge devices
C. Edge devices
D. Network devices
E. Local only devices
F. Nobody is responsible to control ISP edge devices

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 553
Which two requirements are required to form a Layer 2 EtherChannel? (Choose two.)

A. Ports should be contiguous.

B. Ports should be in same module of switch stack.
C. Same trunking protocol should be used on all ports.
D. No port should be a part of SPAN destination session.
E. All ports should be a part of SPAN source and destination session.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 554
Which two port err-disabled recovery options are used to detect the reason? (Choose two.)

A. show errdisable detect

B. show errdisable recovery
C. error-disable notifications/traps are active by default.
D. error-disable notifications/traps are disabled by default.
E. error-disable notifications/traps is never possible.
Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-
recovery.html

QUESTION 555
Which two functions of DHCP snooping are true? (Choose two.)

A. It rate-limits DHCP traffic from trusted and untrusted sources.

B. It listens to multicast messages between senders and receiver.
C. It helps build the route table.
D. It filters invalid messages from untrusted sources.
E. It correlates IP address to hostnames.

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
snoodhcp.html

QUESTION 556
Refer to the exhibit. Which two statements about the network environment are true? (Choose two.)

A. Interface fa0/1 and fa0/2 cannot communicate via Layer 2 switching.

B. Interface fa0/1 and fa0/3 cannot communicate via Layer 2 switching.
C. Interface fa0/2 and fa0/3 can communicate via Layer 2 switching.
D. The two aaaa.aaaa.aaaa MAC address entries must be from the same VLANs.
E. The two aaaa.aaaa.aaaa MAC address entries must be from different VLANs.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 557
If VLAN 99 is set to trunk, how can you set it to untagged from trunk VLAN 99?

A. switchport access vlan 99

B. switchport vlan 99 access
C. switchport vlan 99 allow access
D. switchport allow access vlan 99

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 558
Which feature rate-limits DHCP traffic?

A. DHCP Snooping
B. DHCP Acknowledge
C. DHCP Request
D. DHCP Spoofing

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 559
Which two statements are true about StackWise? (Choose two.)

A. It groups multiple switch ports as a single EtherChannel.

B. It can use one IP address to communicate with n/w (network).
C. It monitors multiple switches from a central console.
D. It enables multiple switch ports to share a single master configuration.
E. It allows multiple switches to operate as a single switch.

Correct Answer: BE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 560
Which statement about GLBP is true?

A. Unused bandwidth is never utilized.

B. They communicate under TCP port 3222 for both source and destination.
C. They become active if any of the existing forwarding switches fail.
D. They become restricted if any of the existing forwarding switches fail.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 561
With GLBP, in which state is the standby virtual gateway in?

A. learn
B. listen
C. init
D. reply
Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 562
Which statement is true when one of its virtual gateway redundancy with an AVF has failed?

A. If an AVF has failed, one of the primary virtual forwarders in the listen state assumes responsibility for the virtual MAC
address.
B. If an AVF has failed, one of the secondary virtual forwarders in the listen state assumes responsibility for the virtual
MAC address.
C. If an AVF has failed, one of the secondary virtual forwarders in the listen state will also fail.
D. If an AVF has failed, one of the primary virtual forwarders in the listen state will also fail.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 563
Which three design types of capable Ethernet LANs does HSRP support? (Choose three.)

A. Multicaccess
B. Multicast
C. Broadcast
D. Unicast
E. Token Ring
F. FDDI

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
HSRP is designed for use over multiaccess, multicast, or broadcast capable Ethernet LANs. HSRP is not intended as a
replacement for existing dynamic protocols.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-2sr/fhp-12-2sr-book/fhp-hsrp.pdf

QUESTION 564
Which hot standby groups numbers are used in a HSRP token ring?

A. 0, 1 and 2
B. 3, 5, and 7
C. 0 and 1
D. 2 and 4

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/12-2sx/fhp-12-2sx-book/fhp-hsrp.pdf
QUESTION 565
Which component does the GLBP client cache stores for each host of a particular GLBP group?

A. IP address
B. MAC address
C. VLAN
D. Token ring
E. DCSP

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 566
What will extend a trust boundary (There is a switch interface configuration with separate voice VLAN and data VLAN to,
also showing endpoint (host), IPPhone, Access Switch, Distribution Switch, Core Switch and Data Centre Aggregation
switch)?

A. Multiple Layers PC
B. IP Phone
C. Access Switch
D. Distribution Switch
E. Core Switch

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 567
Which of the following LLDP mandatory TLVs are valid for basic management? (Choose five.)

A. Port description TLV

B. System name TLV
C. System description
D. System capabilities TLV
E. Management address TLV
F. Isolated address TLV
G. Source and destination capabilities TLV

Correct Answer: ABCDE

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
LLDP supports a set of attributes that it uses to discover neighbor devices. These attributes contain type, length, and value
descriptions and are referred to as TLVs. LLDP supported devices can use TLVs to receive and send information to their
neighbors. This protocol can advertise details such as configuration information, device capabilities, and device identity.
The switch supports these basic management TLVs. These are mandatory LLDP TLVs.
+ Port description TLV
+ System name TLV
+ System description TLV
+ System capabilities TLV
+ Management address TLV
These organizationally specific LLDP TLVs are also advertised to support LLDP-MED.
+ Port VLAN ID TLV ((IEEE 802.1 organizationally specific TLVs)
+ MAC/PHY configuration/status TLV(IEEE 802.3 organizationally specific TLVs)

QUESTION 568
Which two of the following organizationally specific LLDP TLVs are also advertised to support LLDP-MED? (Choose two.)

A. Port VLAN ID TLV (IEEE 802.1 organizationally specific TLVs)

B. MAC/PHY configuration/status TLV (IEEE 802.3 organizationally specific TLVs)
C. IP Address TLV (IEEE 802.9 organizationally specific TLVs)
D. DSCP TLV (IEEE 802.3 organizationally specific TLVs)
E. Descriptive TLV (IEEE 802.5 organizationally specific TLVs)

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 569
Which two mandatory TLV types does LLDP advertise? (Choose two.)

A. Native VLAN TLV

B. Platform TLV
C. Network TLV
D. Hostname TLV
E. Port ID TLV
F. Chassis ID TLV

Correct Answer: EF
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://learningnetwork.cisco.com/docs/DOC-26851

QUESTION 570
Which four mandatory TLVs are valid in CDP? (Choose four.)

A. End of LLDPDU
B. Chassis ID
C. Port ID
D. Time To Live
E. VLAN ID
F. System name ID
G. Description ID

Correct Answer: ABCD

Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://learningnetwork.cisco.com/docs/DOC-26851

QUESTION 571
Which six optional TLVs are valid? (Choose six.)
A. Port description TLV
B. System name TLV
C. System description TLV
D. System capabilities TLV
E. Management address TLV
F. Specific TLVs
G. Source ID TLV
H. Native hostname TLV

Correct Answer: ABCDEF

Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://learningnetwork.cisco.com/docs/DOC-26851

QUESTION 572
When you enable MST on the switch, what happens?

A. Enables RSTP and use BPDU type 2, maximum 16 instances to be used.

B. Enables RSTP and use BPDU type 4, maximum 16 instances to be used.
C. Disables RSTP and use BPDU type 2, maximum 16 instances to be used.
D. Disables RSTP and use BPDU type 4, maximum 16 instances to be used.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 573
Which two methods are used to configure a trusted option 82? (Choose two.)

A.

B.

C.

D.

E.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 574
Which of the following commands to configure a DHCP trust is valid?
A.

B.

C.

D.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 575
If switch SW1 is connected in a mesh with four other switches and all switches retain the default configuration, which
command do you enter on SW1 interface to make it the root bridge for all VLANs?

A. SW1(config)#spanning-tree port-priority 129

B. SW1(config)#spanning-tree port-priority 127
C. SW1(config-if)#spanning-tree port-priority 129
D. SW1(config-if)#spanning-tree port-priority 127

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 576
Which two attributes must match across the member ports, when a Layer 2 EtherChannel is configured? (Choose two.)

A. switchport mode
B. spanning-tree cost
C. spanning-tree priority
D. VLAN membership

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 577
Which tool can error-disable an interface if the storm control threshold is exceeded?

A. storm control action shutdown

B. storm control action default
C. storm control enable
D. storm control action trap
Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/
storm.html

QUESTION 578
A switch has a pair of fiber and it has been damaged. Which two statements is true about the configuration below? (Choose
two.)

A. It would prevent loops.

B. It would be in shutdown mode until fiber is replaced.
C. It would be up for 15 minutes after fiber is fixed.
D. The port would try to activate the repaired damaged fiber after 15 seconds.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 579
Which two statements about PortFast is true? (Choose two.)

A. It will skip all spanning-tree states.

B. Only when the port is active when it moves to the forwarding state.
C. It is mostly used when connecting to workstations and servers.
D. It skips the learning state.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10553-12.html

QUESTION 580
Which two statements about HSRP is true? (Choose two.)

A. It required all the groups to have the same routing protocols.

B. It must have an IP address that is active.
C. It must have the same virtual MAC address for all groups.
D. It must have the same VIP address in all groups.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 581
Which two statements about VLAN database is true? (Choose two.)

A. It supports VLANs 1-1001.

B. It supports extended VLAN.
C. Information about VLANs are stored in the configuration.
D. It can have different VLANs with the same VLAN ID, but must have the same name.
E. It can be configured in VTP transparent, but must be in the VLAN database mode.

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 582
Which command is used to configure DHCP snooping for Option 82?

A. dhcp snooping trust

B. dhcp snooping information option untrust
C. ip dhcp snooping option replace
D. ip dhcp snooping information option allow-untrusted

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 583
Which three commands are valid to configure DHCP snooping for Option 82? (Choose two.)

A.

B.

C.

D.

E.

F.
Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 584
Which two advantages of LLDP are used over CDP? (Choose two.)

A. It supports topology change notification.

B. It supports ATM.
C. It supports checksum.
D. It supports vendor-agnostic.
E. It supports FrameRelay

Correct Answer: AD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 585
Which statement about RSPAN session is true?

A. Only the source switch in a session must support RSPAN.

B. The same RSPAN VLAN is used for a RSPAN session on all switches.
C. At least one access port must be configured in the RSPAN VLAN.
D. RSPAN support by default monitors at Layer 2.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
You can configure any VLAN as an RSPAN VLAN as long as these conditions are met:
– The same RSPAN VLAN is used for an RSPAN session in all the switches.
– All participating switches support RSPAN.
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/
guide/scg/swspan.pdf

QUESTION 586
Which two VLAN ranges can you add, modify or delete on a switch? (Choose two.)

A. VLANs 1-1001
B. VLANs 1005-4094
C. VLANs 1006-4094
D. VLANs 2-1001
E. VLANs 2-4094

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/3se/vlan/configuration_guide/
b_vlan_3se_3650_cg/b_vlan_3se_3650_cg_chapter_011.html
QUESTION 587
Where does the VLAN information get saved to?

A. The information is saved to the vlan.dat file.

B. The information is saved to the running configuration file.
C. The information is saved to the vlan.txt file.
D. The information is saved to the vlan.conf file.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 588
Which two statements are true in regards to normal and extended range VLANs? (Choose two)

A. Normal range VLANs from 1-1005 are stored in vlan.dat.

B. Extended range VLANs from 1006-4096 are stored in the startup configuration.
C. Normal range VLANs from 1-1005 are stored in the startup configuration.
D. Extended range VLANs from 1006-4096 are stored in vlan.dat.
E. Both normal and extended VLANs are stored in vlan.dat file.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 589
Which normal VLAN range are valid and is stored in the vlan.dat configuration file?

A. VLANs 1-1005
B. VLANs 1005-2030
C. VLANs 2094-4094
D. VLANs 4094-8030

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 590
Which extended VLAN range are valid and is stored in the startup configuration?

A. VLANs 1006-4096
B. VLANs 2006-6096
C. VLANs 1-1005
D. VLANs 1005-2060

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 591
Which type of MAC address can be dropped by a switch that is configured for MAC address filtering?

A. unicast
B. router
C. multicast
D. CPU-destined

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://supportforums.cisco.com/t5/lan-switching-and-routing/mac-address-based-traffic-blocking/td-p/2688819

QUESTION 592
Which feature prevents from sending BPDUs on a portfast enabled port?

A. BPDU guard
B. PortFast
C. root guard
D. BPDU filtering

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 593
Which feature do you implement so that a physical port will enter the loop-inconsistent state if it fails to receive BPDUs?

A. loop guard
B. loop disable
C. root guard
D. flex links
E. BPDU ignore
F. loop block

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/stp_enha.html

QUESTION 594
Which feature places a port in an err-disabled state when it receives an unanticipated BPDU?

A. loop guard
B. root guard
C. BPDU guard
D. BPDU filtering

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 595
On which PVLAN type can host ports communicate with promiscuous ports?

A. primary
B. community
C. promiscuous
D. isolated

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 596
Which statement about the configuration of a trunk port as the source of a SPAN session is true?

A. Only VLANs that are configured individually as SPAN sources are monitored.
B. All VLANs in the trunk are monitored.
C. The trunk is errdisabled automatically.
D. All VLANs in the trunk are monitored, provided the SPAN destination port is a trunk.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 597
Which configuration do you apply to a device to place interface GigabitEthernet0/0 info VRRP group 10?

A.

B.

C.

D.
E.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 598
Which two statements about the monitored traffic in a SPAN session are true? (Choose two.)

A. You cannot configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN
source ports and VLANs
B. By default, all monitored packets are captured without the IEEE 802.1Q tag
C. Egress SPAN monitors packets sent by the source interface before any QoS modifications
D. Sources can be ports or VLANs or any combination in the same session
E. By default, all monitored packets include the IEEE 802.1Q tag that they had on the source port
F. Ingress SPAN monitors packets received by the source interface before any QoS modifications

Correct Answer: EF
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 599
Which statement about the default behavior of a Cisco switch MAC address table is true?

A. MAC addresses are not learned on extended VLANs.

B. MAC addresses are aged out of the MAC table after 600 seconds.
C. MAC addresses are associated with a VLAN.
D. MAC address filtering is enabled on trunk ports.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 600
When a Layer 2 EtherChannel is configured, which statement about interaction with the Spanning Tree Protocol is true?

A. Spanning Tree uses only the member ports for forwarding.

B. Spanning Tree uses the port channel for forwarding.
C. Spanning Tree uses the port channel and member ports for forwarding.
D. Spanning Tree does not use port channels in loop prevention.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 601
Which command can be used to block a frame with an unknown destination MAC address from being forwarded out of an
interface?

A. switchport protected
B. It is not forwarded if the destination MAC address is unknown.
C. switchport port-fast
D. switchport block unicast

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 602
For which reason does an administrator disable MAC address learning within a VLAN?

A. to configure a VLAN as an SVI

B. to free up space in the MAC address table
C. to implement port security
D. to reduce flooding in the network

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/wireless/mwr_2941_dc/software_config/
guide/3_3/2941_33_Config_Guide/mac_lrn.pdf

QUESTION 603
Which two statements about manually-configured LACP EtherChannels are true? (Choose two.)

A. LACP negotiation must be disabled on both devices in the EtherChannel.

B. They require Cisco Discovery Protocol.
C. Each physical port in the EtherChannel must have the same speed and duplex settings.
D. LACP negotiation must be disabled on one device in the EtherChannel.
E. They use an MD5 hash for equal load balancing.
F. If the physical port configurations on the two devices are different, the ports are placed into the errdisabled state.

Correct Answer: AC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 604
Which two statements correctly describe the benefits of GLBP? (Choose two.)

A. It can load-share LAN traffic across up to four AVFs in a GLBP group.

B. It uses dual active AVGs for redundancy.
C. LAN traffic can be distributed to up to six routers in a GLBP group.
D. It supports up to 128 virtual routers per physical interface.
E. It can automatically adjust group weighting when an interface goes down.

Correct Answer: AE
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html

QUESTION 605
Which two statements about native VLANs are true? (Choose two.)

A. VLAN 1 and VLAN 1001 are native VLANs by default.

B. The native VLAN is untagged over trunks.
C. The native VLAN can be changed on a per port basis.
D. Only one VLAN can be the native VLAN on a device.
E. Cisco Discovery Protocol versions 1 and 2 can carry native VLAN information.

Correct Answer: BC
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 606
Refer to the exhibit.

Which effect of this configuration is true?

A. The switch port continues to negotiate an EtherChannel even when there are configuration discrepancies between the
two ports.
B. Spanning tree blocks EtherChannel formation on the device.
C. The switch port error disables when a port attempts to form an EtherChannel with a port that has a different
configuration.
D. Spanning tree is disabled if the switch port establishes an EtherChannel.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swstpopt.html

QUESTION 607
Which keyword can be applied to the spanning-tree priority command that allows the IT department to adjust the timers
based on the number of switches between any two end stations?

A. root primary
B. priority
C. cost
D. diameter
E. hello-time

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/
guide/3560scg/swstp.html

QUESTION 608
Which command do you enter to enable Dynamic ARP Inspection for VLAN 15?

A. SW1(config-vlan)# ip arp inspection vlan 15

B. SW1(config-vlan)# ip arp inspection trust
C. SW1(config-if)# ip arp-inspection trust
D. SW1(config)# ip arp inspection vlan 15

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 609
Which three restrictions of port security features are true? (Choose three.)

A. It is not supported on EtherChannel port-channel interfaces.

B. Static MAC address assignments are not supported.
C. It is not supported on destination SPAN ports.
D. It is not supported on PVLAN ports.
E. A single device supports up to two sticky MAC addresses.

Correct Answer: ABC

Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Follow these guidelines when configuring port security:
• A secure port cannot be a trunk port.
• A secure port cannot be a destination port for Switch Port Analyzer (SPAN).
• A secure port cannot belong to an EtherChannel port-channel interface.
• A secure port and static MAC address configuration are mutually exclusive
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/
port_sec.pdf

QUESTION 610
For which reason would you configure RSPAN instead of SPAN on your network?

A. RSPAN provides more complete monitoring of the traffic on a single switch.

B. Only RSPAN devices can monitor traffic on other device.
C. Only RSPAN can log traffic on a VLAN that spans multiple switches.
D. Only RSPAN supports STP on multiple switches across a campus.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 611
Which benefit of Stackwise is true?

A. It allows multiple switches to operate independently while sharing a single management address.
B. It enables a Layer 2 switch to be converted to a Layer 3 switch when additional switches are added to the stack.
C. It allows multiple switches to be managed by a single management address.
D. It supports single-chassis EtherChannel mode option.

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 612
Refer to the exhibit.

One pair of fibre that is connected to Gi0/1 has been damaged. What is likely to happen?

A. The interface is shut down until the fiber pair is replaced.

B. The interface is prevented from causing spanning-tree loops.
C. After the fiber pair is replaced, the interface recovers within 15 minutes.
D. The interfaces actively tries to fix the damaged fiber link.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 613
Which two statements about error-disabled ports are true? (Choose two.)

A. When a port is error-disabled, it may continue to pass management traffic.

B. When a port is error-disabled, all traffic on the port stops.
C. By default, error-disabled ports automatically recover once the issue is resolved.
D. When a port is error-disabled, the port LED changes to solid orange.
E. They can be recovered only by resetting the interface.

Correct Answer: BD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 614
Which statement describes the result of configuring SPAN on a Cisco device?

A. SPAN doubles traffic internally.

B. SPAN halves the capacity of the source port.
C. SPAN blocks for normal use on one additional port for each configured source port.
D. If not carefully planned, SPAN can lead to loops between source and destination ports.

Correct Answer: D
Section: Mix Questions
Explanation
Explanation/Reference:

QUESTION 615
Which two statements about PortFast are true? (Choose two.)

A. It forces the port to skip all spanning-tree states.

B. The port is error-disabled if it attempts to move into the listening or learning states.
C. It allows the port to skip the learning state only.
D. The port moves immediately to the forwarding state when a device is connected.
E. It is most appropriate for ports that provide connectivity to individual workstations or servers.

Correct Answer: DE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 616
Which configuration do you apply to an interface so that a host can be placed into VLAN 593?

A.

B.

C.

D.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 617
Which security feature inspects ARP packets based on valid IP –to-MAC address bindings?

A. IP Source Guard
B. BPDU guard
C. DAI
D. port security

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:
QUESTION 618

Refer to the exhibit. Which two statements about the network environment are true? (Choose two.)

A. UDLD aggressive mode put the interface into an error-disabled state.

B. After the error is corrected, the udld reset command recovers the disabled ports.
C. The UDLD mode changed from normal to aggressive when the error was detected.
D. The interface was error-disabled as the result of STP.
E. UDLD negotiation failed when the neighbor switch went offline.

Correct Answer: AB
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: http://packetlife.net/blog/2011/mar/7/udld/

QUESTION 619
Which two options are benefits of using VSS for chassis virtualization? (Choose two.)

A. It supports GLBP to balance VSS traffic.

B. It provides multiple points of management for redundancy and improved support.
C. It uses a single database to manage configuration for multiple switches.
D. It provides a single point of management for improved efficiency.
E. It requires only one gateway per VLAN.

Correct Answer: DE
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 620
If EtherChannel guard is configured on a device, which result happens when the device detects a misconfiguration on a
connected device?

A. Spanning tree is disabled for the VLANs associated with the EtherChannel.
B. The port generates a syslog message.
C. The EhterChannel configuration is removed from the running configuration of the device.
D. The port is error disabled.

Correct Answer: D
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Understanding EtherChannel Guard
You can use EtherChannel guard to detect an EtherChannel misconfiguration between the switch and a connected device.
A misconfiguration can occur if the switch interfaces are configured in an EtherChannel, but the interfaces on the other
device are not. A misconfiguration can also occur if the channel parameters are not the same at both ends of the
EtherChannel. For EtherChannel configuration guidelines, see the “EtherChannel Configuration Guidelines” section.
If the switch detects a misconfiguration on the other device, EtherChannel guard places the switch interfaces in the error-
disabled state, and displays an error message.
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swstpopt.html

QUESTION 621
How does the Spanning Tree Protocol determine path cost?

A. interface hop count

B. interface reliability
C. interface bandwidth
D. interface load
E. interface delay

Correct Answer: C
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 622
Which feature can protect a Layer 2 port from spoofed IP addresses?

A. port security
B. IP source guard
C. uRPF
D. DHCP snooping

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-
catl3fixed.html

QUESTION 623
You have recently deployed an access switch with two fiber cables that connect it to a distribution switch in EtherChannel
mode. Soon after it booted up, one of the uplink ports to the distribution switch was error-disabled. Which option is the most
likely reason for the problem?
A. The switch is operating in UDLD aggressive mode and it failed to receive a UDLD message from the peer.
B. The port-channel detected an inconsistent configuration.
C. The switch is operating in UDLD normal mode and it failed to receive a UDLD message from the peer.
D. Spanning tree is detected a loop.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 624
Which statement about SPAN functionality for an EtherChannel group is true?

A. It can be configured as a SPAN source or a SPAN destination port.

B. It can be configured as a SPAN source but not as a SPAN destination port.
C. It can be configured as a SPAN destination but not as a SPAN source port.
D. It cannot be configured as a SPAN source or a SPAN destination port.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Explanation:
Can You Configure SPAN on an EtherChannel Port?
An EtherChannel does not form if one of the ports in the bundle is a SPAN destination port. If you try to configure SPAN in
this situation, the switch tells you:
Channel port cannot be a Monitor Destination Port
Failed to configure span feature
You can use a port in an EtherChannel bundle as a SPAN source port.
Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc63

QUESTION 625
Which two statements about configuring a voice VLAN on a switch port are true? (Choose two.)

A. The port must be operating in untrusted mode.

B. Tagged traffic is not supported.
C. It must be configured separately from the VLAN that carries data traffic.
D. If the port is trusted, data traffic that passes through the Cisco IP Phone maintains its QoS values.
E. The port must be operating in trusted mode.
F. Cisco Discovery Protocol must be disabled on the switch port.

Correct Answer: CD
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 626
Which statement about the connection of two switches with several links using LACP link aggregation on IOS is true?

A. By default, when an LACP channel is configured, the LACP channel mode is off.
B. By default, when an LACP channel is configured, the LACP channel mode is on.
C. By default, when an LACP channel is configured, the LACP channel mode is active.
D. By default, when an LACP channel is configured, the LACP channel mode is passive.
Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/interfaces/configuration/guide/
b_Cisco_Nexus_9000_Series_NX-OS_Interfaces_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-
OS_Interfaces_Configuration_Guide_chapter_0110.html#concept_98946DAEC5AA41B085E5D04709CDCB4B

QUESTION 627
Refer to the output below. Which effect of this configuration is true?

A. It enables tagging support for 1000 VLANs, including the native VLAN.
B. It enables tagging for up to 4096 VLANs, but tagging on the native VLAN is not supported.
C. It prevents the port from operating with VTP.
D. It enables a Cisco-proprietary trunking protocol.

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 628
Which command do you enter to troubleshoot a misconfigured EtherChannel?

A. CORE-SW (config-if)#spanning-tree etherchannel guard misconfig

B. CORE-SW (config)#spanning-tree etherchannel guard misconfig
C. CORE-SW (config-if)#spanning-tree loopguard default
D. CORE-SW (config-if)#spanning-tree guard root

Correct Answer: B
Section: Mix Questions
Explanation

Explanation/Reference:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/
configuration/guide/3750xscg/swstpopt.html

QUESTION 629
Which two TLVs are mandatory in LLDP advertisements? (Choose two.)

A. Platform TLV
B. System Capability TLV
C. Network Policy TLV
D. System Name TLV
E. Native VLAN TLV

Correct Answer: BD
Section: Mix Questions
Explanation
Explanation/Reference:
Explanation:
Following are the LLDP TLV’s. Only System Capability TLV and System Name TLV are valid LLDP TLV’s but they are
optional, not mandatory. These are the two best answer choices based on the alternatives, perhaps the question was
meant to read “Which two TLVs are optional in LLDP advertisements”

QUESTION 630
Refer to the exhibit. An engineer entered the no spanning-tree bpduguard enable on interface Fa1/0/7 command. Which
statement describes the effect of this command?

A. Interface Fa1/0/7 remains in err-disabled state until the shutdown/no shutdown command is entered in the interface
configuration mode.
B. Interface Fa1/0/7 returns to an up and operational state.
C. Interface Fa1/0/7 remains in err-disabled state until the spanning-tree portfast bpuguard disable command is
entered in the interface configuration mode.
D. Interface Fa1/0/7 remains in err-disabled state until the errdisable recovery bpduguard command is entered in the
interface configuration mode.
E. Interface Fa1/0/7 remains in err-disabled state until the errdisable recovery cause bpduguard command is entered in
the interface configuration mode.

Correct Answer: A
Section: Mix Questions
Explanation

Explanation/Reference:

QUESTION 631
DRAG DROP

Drag and drop the statements about RSPAN VLANs from the left onto the correct section on the right.

Select and Place:

Correct Answer:
Section: Mix Questions
Explanation

Explanation/Reference: