CCNP ENCOR v9: Course Final Exam Answers

CCNP Enterprise: Core Networking v9 Course Final Exam Answers

1. An enterprise is planning to migrate some applications to a public cloud provider while keeping sensitive data on-premises. The network team must ensure secure, reliable connectivity between the on-premises data center and the cloud environment. Which two design considerations are essential for this hybrid cloud deployment? (Choose two.)

• Extending the on-premises Layer 2 VLANs directly into the cloud provider network
• Replacing all on-premises firewalls with cloud-native security services
• Implementing dedicated private connections such as Direct Connect for consistent performance and security
• Using the same IP addressing scheme in the cloud as on-premises to simplify routing
• Establishing redundant connectivity paths to avoid a single point of failure between on-premises and cloud

2. Which three components are part of the Cisco Catalyst SD-WAN control plane? (Choose three.)

• vBond orchestrator
• vManage
• IPsec tunnels
• WAN Edge router
• vSmart controller
• OMP protocol

3. Refer to the exhibit. An engineer is troubleshooting HSRP on two distribution switches. Based on the output, what is the current state of the HSRP configuration?

DSW1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        1    110 P Active  local           192.168.10.3    192.168.10.1

DSW2# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl10        1    100   Standby 192.168.10.2    local           192.168.10.1

• DSW2 is active because DSW1 has preempt disabled
• DSW1 is active because it has the higher priority and preempt is enabled
• Both switches are in active state causing a split-brain condition
• The configuration is invalid because the virtual IP addresses do not match

4. Which statement correctly describes a benefit of the Cisco SD-Access solution?

• It requires all network devices to be upgraded to the latest hardware
• It provides automated network segmentation based on user identity and group membership
• It eliminates the need for any underlay network infrastructure
• It replaces the need for Cisco ISE in enterprise deployments

5. Refer to the exhibit showing a QoS policy configuration. What is the effect of this policy on voice traffic?

policy-map WAN-EDGE-OUT
 class VOICE
  priority percent 10
  police cir percent 10
 class INTERACTIVE-VIDEO
  bandwidth percent 25
 class CRITICAL-DATA
  bandwidth percent 25
  random-detect dscp-based
 class class-default
  fair-queue

• Voice traffic receives best-effort treatment with 10% minimum bandwidth
• Voice traffic is guaranteed 10% bandwidth with low-latency queuing and policed to 10%
• Voice traffic is dropped if it exceeds 10% of the bandwidth
• Voice traffic is shaped to 10% of the interface bandwidth

6. Which two statements about Cisco SD-WAN vBond orchestrator are correct? (Choose two.)

• It serves as the first point of authentication for all SD-WAN components
• It stores and distributes software images to WAN edge routers
• It performs deep packet inspection for security
• It maintains the centralized routing policy database
• It must be reachable by all SD-WAN devices for initial fabric join

7. Which component of the SD-Access fabric is responsible for registering endpoint EID-to-RLOC mappings?

• Fabric edge node
• Fabric border node
• Intermediate node
• Control plane node

8. Refer to the exhibit. A network engineer is analyzing traffic patterns on a WAN link. Based on the QoS marking, which traffic class should receive priority treatment during congestion?

Traffic Analysis:
Flow 1: DSCP EF (46), 2 Mbps - VoIP
Flow 2: DSCP AF41 (34), 5 Mbps - Video Conferencing
Flow 3: DSCP AF21 (18), 10 Mbps - Business Applications
Flow 4: DSCP CS1 (8), 15 Mbps - Bulk Data
Flow 5: DSCP 0, 20 Mbps - Best Effort

• Flow 1 because DSCP EF is designated for expedited forwarding
• Flow 2 because video requires more bandwidth than voice
• Flow 4 because CS1 indicates high priority scavenger traffic
• Flow 5 because it has the highest bandwidth consumption

9. A network engineer needs to create separate routing tables for different departments while using the same physical infrastructure. Which technology should be implemented?

• VLANs
• VXLAN
• VRF (Virtual Routing and Forwarding)
• GRE tunneling

10. Refer to the exhibit. What does this VXLAN packet header indicate about the encapsulated traffic? (Choose four.)

Outer Ethernet Header:
  Dst MAC: 00:50:56:89:12:34
  Src MAC: 00:50:56:89:56:78
Outer IP Header:
  Src IP: 10.1.1.1 (VTEP1)
  Dst IP: 10.1.1.2 (VTEP2)
Outer UDP Header:
  Src Port: 49152
  Dst Port: 4789
VXLAN Header:
  VNI: 10010
Inner Ethernet Frame:
  Original L2 frame from VM

• The inner frame's original Layer 2 headers are preserved
• The outer source port 49152 indicates encrypted traffic
• The VTEPs are using IP addresses for tunnel endpoints
• UDP port 4789 is the standard VXLAN destination port
• The traffic belongs to VXLAN segment 10010

11. Which statement correctly describes the relationship between LISP and SD-Access?

• LISP replaces VXLAN as the data plane encapsulation in SD-Access
• LISP and SD-Access are competing technologies that cannot be used together
• LISP provides Layer 2 segmentation in the SD-Access fabric
• LISP provides the control plane for endpoint location tracking in SD-Access

12. An engineer is configuring IPsec tunnel mode between two sites. Which two statements about IPsec tunnel mode are correct? (Choose two.)

• Tunnel mode is typically used for site-to-site VPN connections
• Tunnel mode requires the endpoints to be the actual traffic sources
• Only the payload is encrypted while the original IP header remains visible
• The original IP header is encrypted and a new IP header is added
• Tunnel mode provides less overhead than transport mode

13. Which command would verify that VRF-Lite is properly configured and operational on a Cisco router?

• show ip vrf interfaces
• show vrf detail
• show ip route
• show ip vrf

14. Refer to the exhibit. A network engineer is troubleshooting a trunk link issue. Based on the output, what is causing the problem?

SW1# show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       auto         negotiate      not-trunking  1

SW2# show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       auto         negotiate      not-trunking  1

• Both switches are configured in passive negotiation modes
• The native VLAN mismatch between the switches
• The encapsulation is set to negotiate instead of dot1q
• DTP mode on SW2 is set to auto, which won't initiate trunk negotiation

15. A network engineer needs to configure EtherChannel between two switches. SW1 must actively negotiate the channel while SW2 should only respond to negotiation. Which configuration achieves this using LACP?

• SW1: channel-group 1 mode passive; SW2: channel-group 1 mode active
• SW1: channel-group 1 mode on; SW2: channel-group 1 mode on
• SW1: channel-group 1 mode desirable; SW2: channel-group 1 mode auto
• SW1: channel-group 1 mode active; SW2: channel-group 1 mode passive

16. Refer to the exhibit. A network administrator notices that VLAN 30 traffic is not passing through a trunk link. Based on the output, what is the cause?

SW1# show interfaces Gi0/1 trunk
Port        Mode             Encapsulation  Status        Native vlan
Gi0/1       on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-29,31-4094

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20,31,40

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20,31,40

• VLAN 30 is being pruned by VTP
• VLAN 30 is not in the spanning tree forwarding state
• VLAN 30 has been manually removed from the allowed VLAN list
• VLAN 30 does not exist in the VLAN database

17. Which two statements about RSTP port states are correct? (Choose two.)

• RSTP has five port states: disabled, blocking, listening, learning, and forwarding
• An RSTP port in learning state can forward user traffic
• RSTP backup ports provide an alternate path to the root bridge
• RSTP combines the STP disabled, blocking, and listening states into a single discarding state
• RSTP uses proposal/agreement mechanism for rapid convergence on point-to-point links

18. Refer to the exhibit. An engineer is troubleshooting OSPF neighbor adjacency issues. Based on the output, what is preventing the adjacency from forming?

R1# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Hello 10, Dead 40, Wait 40, Retransmit 5

R2# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.2/24, Area 1
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Hello 10, Dead 40, Wait 40, Retransmit 5

• The hello and dead timer mismatch
• The OSPF process ID mismatch
• The OSPF area mismatch
• Both routers are claiming DR role

19. Refer to the exhibit. A network engineer is analyzing BGP path selection. Which path will be selected as the best path to reach 10.0.0.0/8?

R1# show ip bgp 10.0.0.0/8
BGP routing table entry for 10.0.0.0/8, version 5
Paths: (3 available, best #?)
  Path 1: AS_PATH: 65001 65002, NEXT_HOP: 192.168.1.1, MED: 100, LOCAL_PREF: 200
  Path 2: AS_PATH: 65001, NEXT_HOP: 192.168.2.1, MED: 50, LOCAL_PREF: 150
  Path 3: AS_PATH: 65001 65003, NEXT_HOP: 192.168.3.1, MED: 75, LOCAL_PREF: 200

• Path 2 - shortest AS_PATH wins
• Path 1 - tie-breaker between Path 1 and Path 3 goes to lower MED
• Path 3 - highest LOCAL_PREF with better MED wins
• Path 1 - highest LOCAL_PREF wins

20. Refer to the exhibit. What does this output indicate about the router's NAT configuration?

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 203.0.113.10:512  192.168.1.10:512   8.8.8.8:512        8.8.8.8:512
icmp 203.0.113.10:513  192.168.1.11:513   8.8.8.8:513        8.8.8.8:513
icmp 203.0.113.10:514  192.168.1.12:514   8.8.8.8:514        8.8.8.8:514
tcp 203.0.113.10:1024  192.168.1.10:1024  93.184.216.34:80   93.184.216.34:80
tcp 203.0.113.10:1025  192.168.1.11:1025  93.184.216.34:443  93.184.216.34:443

• Dynamic NAT with a pool of addresses is configured
• NAT is not working because all translations use the same global address
• Static NAT is configured for three internal hosts
• PAT (NAT overload) is being used with a single public IP address

21. Which statement correctly describes EIGRP feasible successor?

• A route that always has a higher metric than the successor route
• A backup route whose reported distance is less than the feasible distance of the successor
• A route that must go through the DUAL algorithm when the successor fails
• A route with the lowest metric to the destination

22. Which IGMP version introduced support for source-specific multicast (SSM)?

• IGMPv2
• IGMPv3
• IGMPv1
• IGMPv4

23. Refer to the exhibit. A network administrator is troubleshooting HSRP. What will happen when R1 recovers from a failure?

R1# show running-config | section standby
interface GigabitEthernet0/0
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt

R2# show running-config | section standby
interface GigabitEthernet0/0
 standby 1 ip 192.168.1.1
 standby 1 priority 100

• R1 will remain in standby state until R2 fails
• R2 will remain active because it doesn't have preempt configured
• Both routers will become active causing a split-brain scenario
• R1 will become the active router

24. Which two statements about PIM Sparse Mode (PIM-SM) are correct? (Choose two.)

• PIM-SM requires a Rendezvous Point (RP) for initial tree building
• PIM-SM uses dense mode flooding for the first 3 minutes
• PIM-SM cannot switch from shared tree to source tree
• PIM-SM floods multicast traffic to all interfaces by default
• PIM-SM uses a pull model where multicast traffic is only sent where requested

25. Which command enables BPDU Guard on a specific interface?

• SW1(config-if)# spanning-tree guard bpdu
• SW1(config-if)# spanning-tree bpduguard enable
• SW1(config)# spanning-tree bpduguard enable
• SW1(config)# spanning-tree portfast bpduguard

26. A network engineer needs to filter OSPF routes being advertised to a neighbor. Which configuration method should be used?

• Apply a distribute-list with an ACL to filter specific routes
• OSPF cannot filter routes; all LSAs must be flooded
• Configure area range with the not-advertise option on an ABR
• Use route-maps to set the metric to infinity

27. Refer to the exhibit. Based on the EIGRP topology table output, which route is the feasible successor for network 10.1.1.0/24?

R1# show ip eigrp topology 10.1.1.0/24
IP-EIGRP topology table for AS(100)/ID(1.1.1.1)

IP-EIGRP topology entry for 10.1.1.0/24
  State is Passive, Query origin flag is 1, 2 Successor(s), FD is 28160
  Routing Descriptor Blocks:
  192.168.1.2 (GigabitEthernet0/0), from 192.168.1.2, Send flag is 0x0
      Composite metric is (28160/27136), Route is Internal
      Vector metric:
        Minimum bandwidth is 1000000 Kbit
        Total delay is 110 microseconds
  192.168.2.2 (GigabitEthernet0/1), from 192.168.2.2, Send flag is 0x0
      Composite metric is (30720/28672), Route is Internal
  192.168.3.2 (GigabitEthernet0/2), from 192.168.3.2, Send flag is 0x0
      Composite metric is (33280/25600), Route is Internal

• 192.168.2.2 with reported distance 28672
• 192.168.1.2 with metric 28160
• 192.168.3.2 with reported distance 25600
• There is no feasible successor; only successors exist

28. Which two commands can verify that NAT is working correctly on a Cisco router? (Choose two.)

• show ip nat translations
• debug ip nat
• show ip nat statistics
• show ip route nat
• show running-config | include nat

29. Refer to the exhibit. A network engineer is configuring NetFlow to export flow data. What is missing from this configuration?

R1(config)# flow record CUSTOM-RECORD
R1(config-flow-record)# match ipv4 source address
R1(config-flow-record)# match ipv4 destination address
R1(config-flow-record)# match transport source-port
R1(config-flow-record)# match transport destination-port
R1(config-flow-record)# collect counter bytes
R1(config-flow-record)# collect counter packets
!
R1(config)# flow exporter EXPORTER-1
R1(config-flow-exporter)# destination 10.1.1.100
R1(config-flow-exporter)# transport udp 9995
!
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip flow monitor MONITOR-1 input

• The NetFlow version is not specified in the exporter
• The flow monitor associating the record with the exporter is not configured
• The source interface for the exporter is not configured
• The interface needs both input and output flow monitoring

30. A network engineer wants to capture traffic between two hosts for analysis but the traffic doesn't pass through the engineer's workstation. Which technology should be configured?

• RSPAN with a dedicated VLAN for mirrored traffic
• Local SPAN on the switch connecting the hosts
• ERSPAN encapsulating mirrored traffic in GRE
• NetFlow export to the engineer's workstation

31. Refer to the exhibit. What does this syslog message indicate?

%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

• A notification-level message about an interface state change
• A debugging message for troubleshooting purposes
• An emergency condition requiring immediate action
• An error condition that needs investigation

32. Which SNMP version provides authentication using usernames and passwords along with encryption for data privacy?

• SNMPv3 with authNoPriv security level
• SNMPv1 with community strings
• SNMPv2c with community strings
• SNMPv3 with authPriv security level

33. Which three capabilities does Cisco Catalyst Center Assurance provide? (Choose three.)

• End-to-end path trace visualization
• Direct CLI access to all managed devices
• Automated configuration deployment to network devices
• Streaming telemetry for real-time device monitoring
• Software image distribution and upgrade
• AI/ML-driven insights for proactive issue detection

34. Refer to the exhibit. An engineer is troubleshooting SSH access issues. Based on the configuration, what is preventing SSH connections?

R1# show running-config | section line vty
line vty 0 4
 login local
 transport input ssh
 access-class 10 in
!
R1# show access-lists 10
Standard IP access list 10
    10 permit 192.168.1.0, wildcard bits 0.0.0.255 (15 matches)
    20 deny any

• Only hosts from 192.168.1.0/24 can establish SSH connections
• The VTY lines are not configured for local authentication
• The explicit deny statement is blocking all traffic
• SSH is not enabled on the router

35. Which two statements about AAA authentication are correct? (Choose two.)

• Local database authentication requires a RADIUS server
• Authentication verifies user identity before granting access
• AAA authentication must be configured before authorization
• RADIUS encrypts the entire packet payload between client and server
• TACACS+ separates authentication, authorization, and accounting functions

36. Which command sequence correctly configures a RADIUS server for AAA authentication on a Cisco IOS device?

• R1(config)# radius server RADIUS1
  R1(config-radius-server)# address ipv4 10.1.1.100 auth-port 1812 acct-port 1813
  R1(config-radius-server)# key SecretKey
• R1(config)# aaa new-model
  R1(config)# radius server 10.1.1.100 key SecretKey
• R1(config)# authentication radius-server 10.1.1.100 key SecretKey
• R1(config)# radius-server host 10.1.1.100 key SecretKey

37. Which Control Plane Policing (CoPP) action should be applied to protect against SSH brute-force attacks while still allowing legitimate SSH access?

• Permit SSH traffic without any restrictions
• Police SSH traffic to a reasonable rate limit
• Drop all SSH traffic to the control plane
• Mark SSH traffic with a higher DSCP value

38. Which two security features protect the network infrastructure from unauthorized devices connecting to switch ports? (Choose two.)

• Port security with MAC address limiting
• Storm control
• BPDU Guard
• DHCP snooping
• 802.1X port-based authentication

39. Refer to the exhibit. What type of security threat does this configuration help prevent?

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10,20,30
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# ip dhcp snooping trust
SW1(config-if)# interface range GigabitEthernet0/2-48
SW1(config-if-range)# ip dhcp snooping limit rate 15

• ARP spoofing attacks
• VLAN hopping attacks
• MAC address spoofing attacks
• Rogue DHCP server attacks

40. Which AAA accounting record type captures information about commands executed by administrators?

• Command accounting
• EXEC accounting
• Connection accounting
• Network accounting

41. Refer to the exhibit. A security engineer is reviewing the AAA configuration. What method will be used if the RADIUS server is unreachable? (Choose two.)

aaa new-model
aaa authentication login default group radius local
aaa authentication login CONSOLE local
!
radius server RADIUS1
 address ipv4 10.1.1.100 auth-port 1812
 key Cisco123
!
line console 0
 login authentication CONSOLE
line vty 0 4
 login authentication default

• VTY access will fall back to local database authentication
• Console access will use the local database
• Console access will use RADIUS for authentication
• VTY access will be denied if RADIUS is unreachable
• The 'none' keyword allows access without authentication if all methods fail

42. Which security technology would best protect against a man-in-the-middle attack on the local network segment?

• Dynamic ARP Inspection (DAI)
• Private VLANs
• Port security with sticky MAC addresses
• ACLs filtering unauthorized IP addresses

43. Which two components are part of Cisco's Zero Trust security architecture? (Choose two.)

• Trust all internal network traffic by default
• Network segmentation based on user identity and device posture
• Single perimeter-based firewall for all security
• Implicit trust for users once they pass initial authentication
• Continuous verification of user and device identity

44. Refer to the exhibit. What will be the output of this Python script?

devices = ['router1', 'switch1', 'firewall1']
for index, device in enumerate(devices):
    if 'switch' in device:
        print(f'Device {index}: {device.upper()}')
    else:
        print(f'Device {index}: {device}')

• Device 1: router1
  Device 2: SWITCH1
  Device 3: firewall1
• Device 0: router1
  Device 1: SWITCH1
  Device 2: firewall1
• Device 0: ROUTER1
  Device 1: SWITCH1
  Device 2: FIREWALL1
• Error: enumerate() does not work with lists

45. Which NETCONF operation retrieves only the configuration data from a device?

• <edit-config>
• <get>
• <copy-config>
• <get-config>

46. Refer to the exhibit. What is the purpose of this EEM applet?

event manager applet INTERFACE-DOWN
 event syslog pattern "LINEPROTO-5-UPDOWN.*GigabitEthernet0/1.*down"
 action 1.0 cli command "enable"
 action 2.0 cli command "configure terminal"
 action 3.0 cli command "interface GigabitEthernet0/2"
 action 4.0 cli command "shutdown"
 action 5.0 cli command "no shutdown"
 action 6.0 syslog msg "Bounced Gi0/2 due to Gi0/1 down event"

• To monitor interface Gi0/1 and log when it goes down
• To prevent Gi0/1 from going down by bouncing Gi0/2
• To automatically bounce Gi0/2 when Gi0/1 goes down
• To synchronize the state of Gi0/1 and Gi0/2

47. Which HTTP method is used by RESTCONF to create a new resource that does not already exist?

• GET
• PUT
• POST
• PATCH

48. Refer to the exhibit. What does this JSON response from a REST API indicate?

{
  "response": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "taskId": "task123",
    "url": "/api/v1/task/task123"
  },
  "version": "1.0"
}

• The API request was accepted and a task was created to process it
• The API returned configuration data from the device
• The API request failed with an error
• The API is returning a list of available endpoints

49. Which two tools are considered agentless for configuration management? (Choose two.)

• Puppet
• Chef
• Salt (with SSH)
• CFEngine
• Ansible

50. Which two statements correctly describe the Cisco Catalyst Center Platform APIs? (Choose two.)

• Integration APIs enable third-party applications to receive network events
• Intent APIs allow network administrators to express business intent
• All API operations are synchronous and return results immediately
• APIs use SOAP for all communication
• APIs require SNMP credentials for device access

51. What is missing or incorrect in the GRE tunnel configuration?

• The tunnel destination on R2 should be 203.0.113.2
• The tunnel mode GRE IP command is missing on both routers
• The tunnel interface IP addresses must be on the same subnet as the physical interfaces
• The tunnel destination configured on R1 does not match the tunnel source IP address of R2

52. Which two statements correctly describe Type 1 and Type 2 hypervisors? (Choose two.)

• Type 1 hypervisors run directly on hardware without a host operating system
• Type 1 hypervisors are also known as hosted hypervisors
• VMware ESXi is an example of a Type 2 hypervisor
• Type 2 hypervisors provide better performance than Type 1 for enterprise workloads
• Type 2 hypervisors run as applications on top of a host operating system

53. Refer to the exhibit. A network engineer is implementing MST (Multiple Spanning Tree). What is the result of this configuration? (Choose four.)

SW1(config)# spanning-tree mode mst
SW1(config)# spanning-tree mst configuration
SW1(config-mst)# name ENTERPRISE
SW1(config-mst)# revision 1
SW1(config-mst)# instance 1 vlan 10,20,30
SW1(config-mst)# instance 2 vlan 40,50,60

• The configuration requires matching name and revision on all MST switches
• Each VLAN will have its own independent spanning tree calculation
• VLANs 10, 20, and 30 will share a single spanning tree instance
• MST reduces CPU and memory usage compared to PVST+
• VLANs not explicitly mapped will be assigned to instance 0 (IST)

54. A network engineer is configuring eBGP between a company's edge router (AS 65001) and an ISP router (AS 65002). Which three configuration elements should the engineer verify? (Choose three.)

• The BGP router ID is configured to match the ISP router's BGP router ID
• The update-source command matches the interface used to reach the ISP peer
• The BGP timers are synchronized with the IGP protocol timers
• An ACL or firewall is not blocking TCP port 179 between the peers
• The eBGP multihop setting is configured if the peers are not directly connected
• The neighbor remote-as command specifies AS 65002 for the ISP peer

55. Which three options are valid components of a Cisco IP SLA operation? (Choose three.)

• OSPF operation to measure SPF calculation time
• BGP operation to measure route convergence
• UDP Jitter operation to measure one-way delay and jitter
• ICMP Echo operation to measure round-trip time
• HTTP operation to measure web server response time
• SNMP operation to measure MIB response time

56. A network engineer needs to create an automated response when an interface goes down. Which Cisco IOS feature should be used?

• Syslog server with alerting
• Embedded Event Manager (EEM)
• SNMP trap configuration
• IP SLA with tracking

57. Refer to the exhibit. What is the effect of this ACL when applied outbound on interface GigabitEthernet0/1?

ip access-list extended SECURITY-ACL
 10 permit tcp 192.168.10.0 0.0.0.255 any eq 443
 20 permit tcp 192.168.10.0 0.0.0.255 any eq 80
 30 permit icmp 192.168.10.0 0.0.0.255 any echo-reply
 40 deny ip any any log

• Return traffic for HTTP sessions will be permitted
• Hosts on 192.168.10.0/24 can respond to ping requests
• All denied traffic will be logged
• Hosts on 192.168.10.0/24 can access HTTPS websites
• Hosts on 192.168.10.0/24 can initiate ping requests

58. A network administrator needs to ensure that only encrypted management protocols are used to access network devices. Which two protocols should be permitted? (Choose two.)

• HTTPS on port 443
• TFTP on port 69
• Telnet on port 23
• HTTP on port 80
• SSH on port 22

59. Which statement correctly describes MACsec (Media Access Control Security)?

• MACsec provides Layer 2 hop-by-hop encryption on LAN links
• MACsec is an authentication protocol that replaces 802.1X
• MACsec provides Layer 3 encryption between sites over the WAN
• MACsec encrypts traffic between endpoints regardless of network hops

60. Which two statements about YANG data models are correct? (Choose two.)

• YANG defines the structure of configuration and operational data
• YANG uses a hierarchical tree structure to organize data
• YANG is a protocol for transporting configuration data
• YANG models are specific to Cisco devices only
• YANG directly executes configuration changes on devices

61. Which REST API response code indicates that the request was successful and a new resource was created?

• 201 Created
• 202 Accepted
• 200 OK
• 204 No Content

62. Refer to the exhibit. A network engineer is reviewing the enterprise campus design. Which three statements accurately describe this topology? (Choose three.)

                    [Core Layer]
                    /          \
        [Distribution]        [Distribution]
              /    \               /    \
        [Access]  [Access]   [Access]  [Access]
           |         |          |         |
         [PCs]     [VoIP]     [APs]    [Servers]

• The core layer should provide the highest switching speeds
• This represents a collapsed core design
• This represents a 3-tier hierarchical design model
• The distribution layer provides routing and policy enforcement
• End-user devices should connect directly to the distribution layer

63. Which two OSPF network types require manual neighbor configuration? (Choose two.)

• Point-to-point
• Point-to-multipoint
• Non-broadcast
• Point-to-multipoint non-broadcast
• Broadcast

63. Refer to the exhibit. A network engineer is configuring a GRE tunnel between two sites. Based on the configuration, what is missing or incorrect?

R1(config)# interface Tunnel0
R1(config-if)# ip address 172.16.1.1 255.255.255.252
R1(config-if)# tunnel source GigabitEthernet0/0
R1(config-if)# tunnel destination 203.0.113.2

R2(config)# interface Tunnel0
R2(config-if)# ip address 172.16.1.2 255.255.255.252
R2(config-if)# tunnel source 198.51.100.1
R2(config-if)# tunnel destination 203.0.113.1

• The tunnel mode GRE IP command is missing on both routers
• The tunnel interface IP addresses must be on the same subnet as the physical interfaces
• The tunnel destination on R2 should be 203.0.113.2
• The tunnel destination configured on R1 does not match the tunnel source IP address of R2