QUESTION 121
What is the function of Cisco DNA Center in a Cisco SD-Access deployment?

A. It is responsible for routing decisions inside the fabric.
B. It is responsible for the design, management, deployment, provisioning, and assurance of the fabric network devices.
C. It possesses information about all endpoints, nodes, and extremal networks related to the fabric.
D. It provides integration and automation for al nonfabric nodes and their fabric counterparts.

Correct Answer: B

QUESTION 122
When firewall capabilities are considered, which feature is found only in Cisco next-generation firewalls?

A. malware protection
B. stateful inspection
C. traffic filtering
D. active/standby high availability

Correct Answer: A

QUESTION 123
What does a northbound API accomplish?

A. programmatic control of abstracted network resources through a centralized controller
B. access to controlled network resources from a centralized node
C. communication between SDN controllers and physical switches
D. controlled access to switches from automated security applications

Correct Answer: A

QUESTION 124
What is one characteristic of Cisco DNA Center and vManage northbound APIs?

A. They implement the NETCONF protocol.
B. They push configuration changes down to devices.
C. They are RESTful APIs.
D. They exchange XML-formatted content.

Correct Answer: C

QUESTION 125
What is a characteristic of the overlay network in the Cisco SD-Access architecture?

A. It consists of a group of physical routers and switches that are used to maintain the network.
B. It provides multicast support to enable Layer 2 flooding capability in the underlay network.
C. It provides isolation among the virtual networks and independence from the physical network.
D. It uses a traditional routed access design to provide performance and high availability to the network.

Correct Answer: C

QUESTION 126
An engineer must implement a configuration to allow a network administrator to connect to the console port of a router and authenticate over the network. Which
command set should the engineer use?

A. aaa new-model
aaa authentication login console group radius
B. aaa new-model
aaa authentication login default enable
C. aaa new-model
aaa authentication enable default
D. aaa new-model
aaa authentication login console local

Correct Answer: A

QUESTION 127
An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied. Which
configuration should be applied?

A. aaa authorization exec default local group tacacs+
B. aaa authorization exec default group radius local none
C. aaa authorization exec default group radius local
D. aaa authorization exec default local group radius none

Correct Answer: C

QUESTION 128
A firewall address of 192.168.1.101 can be pinged from a router but, when running a traceroute to it, this output is received:
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *

What is the cause of this issue?

A. The firewall blocks ICMP traceroute traffic.
B. The firewall blocks ICMP traffic.
C. The firewall rule that allows ICMP traffic does not function correctly.
D. The firewall blocks UDP traffic.

Correct Answer: D

QUESTION 129
An engineer adds a new switch to a Cisco StackWise stack. The switch that was active before the switch was added is elected as the active switch again. Which
action does the active switch take?

A. It checks the IOS and running configuration of the new switch and updates them if necessary to match the other switches in the stack.
B. It removes any Layer 3 configuration on the new switch to maintain normal Layer 2 functionality on the stack.
C. It suspends traffic forwarding until the new switch is updated with the current running configuration of the stack.
D. It clears the MAC table of the stack and relearns the attached devices.

Correct Answer: A

QUESTION 130
Which deployment option of Cisco NGFW provides scalability?

A. Tap
B. high availability
C. clustering
D. inline tap

Correct Answer: C

QUESTION 131
Which data format can be used for an API request?

A. JSON
B. HTML
C. PERL
D. Python

Correct Answer: A

QUESTION 132
Which solution supports end-to-end line-rate encryption between two sites?

A. MACsec
B. IPsec
C. GRE
D. TrustSec

Correct Answer: B

QUESTION 133
What are two characteristics of Cisco Catalyst SD-WAN? (Choose two.)

A. unified data plane and control plane
B. distributed control plane
C. centralized reachability, security, and application policies
D. control plane operates over DTLS/TLS authenticated and secured tunnels
E. time-consuming configuration and maintenance

Correct Answer: CD

QUESTION 134
Which type of API enables Cisco Catalyst Center (formerly DNA Center) to focus on outcome instead of the individual steps that are required to achieve the
outcome?

A. northbound Intent
B. westbound Integration
C. southbound Multivendor Support
D. eastbound Events and Notifications

Correct Answer: A

QUESTION 135
Which protocol does Cisco SD-WAN use to protect control plane communication?

A. STUN
B. OMP
C. DTLS
D. IPsec

Correct Answer: C

QUESTION 136
Which characteristic applies to Cisco SD-Access?

A. It uses GRE for the policy plane.
B. It uses dynamic routing to discover and provision the border and edge switches
C. It uses VXLAN for the control plane.
D. It uses PnP to discover and provision border and access switches.

Correct Answer: D

QUESTION 137
What is the purpose of a data modeling language?

A. to describe the structure and meaning of exchanged data
B. to specify the rules for transcoding between text and binary data encodings
C. to establish a framework to process data by using an object-oriented programming approach
D. to standardize the procedures that are executed when parsing sent and received data

Correct Answer: A

QUESTION 138
What are two methods of ensuring that the multicast RPF check passes without changing the unicast routing table? (Choose two.)

A. implementing OSPF routing protocol
B. disabling the interface of the router back to the multicast source
C. implementing static mroutes
D. implementing MBGP
E. disabling BGP routing protocol

Correct Answer: CD

QUESTION 139
An engineer must configure a router to allow users to run specific configuration commands by validating the user against the router database. Which configuration
must be applied?

A. aaa authorization exec default local
B. aaa authentication exec default local
C. aaa authentication network default local
D. aaa authorization network default local

Correct Answer: A

QUESTION 140
What is the responsibility of a secondary WLC?

A. It avoids congestion on the primary controller by sharing the registration load on the LAPs.
B. It registers the LAPs if the primary controller fails.
C. It enables Layer 2 and Layer 3 roaming between itself and the primary controller.
D. It shares the traffic load of the LAPs with the primary controller.

Correct Answer: B