1. Which Cisco feature checks the source IP address of a packet and matches it to the ingress interface on a router to prevent IP spoofing in a network?
- Loose uRPE
- Strict uRPF
- Default uRPE
- Reverse uRPE
Explanation: Topic 21.10.0
Strict Unicast Reverse Path Forwarding (uRPF) is a security feature that verifies if a packet is arriving on the interface that the router would use to reach the packet's source IP address according to the Forwarding Information Base (FIB). If the source address and ingress interface do not match, the packet is considered spoofed and is dropped.
2. Which function is not a function of CoPP?
- permit packets access to the control plane
- deny packets access to the control plane
- configured on the data plane interface
- rate limit access to the control plane
Explanation: Topic 21.9.0
This statement is not correct because Control Plane Policing (CoPP) is a policy applied directly to the control plane (using the control-plane command) rather than a physical data plane interface. While it can permit, deny, or rate-limit traffic destined for the CPU, it is logically positioned at the control plane to protect the device's management and routing functions.
3. Which statement best describes what Client onboarding timers do?
- Define how long a client has to acquire an address through DHCP before timing out.
- Monitor how long it takes for a client to boot its operating system.
- Monitor how long it takes for a wireless client to go through the Association, AAA, and DHCP process, and for a dot1x enabled wired client to go through AAA and DHCP.
- Define the maximum time allowed for a client to go through the Association, AAA, and DHCP process, and for a dot1x enabled wired client to go through AAA and DHCP.
Explanation: Topic 23.4.2
Within Cisco DNA Assurance, Client Onboarding Times specifically monitor the duration of the critical steps required for a client to gain network access. For wireless clients, this includes Association, AAA (Authentication, Authorization, and Accounting), and DHCP; for wired dot1x clients, it tracks the AAA and DHCP phases.
4. Which IPv6 First Hop Security mechanism drops NA messages that do not have a corresponding source address in the binding table?
- IPv6 Source Guard
- DHCPv6 Guard
- RA Guard
- IPv6 ND Inspection
Explanation: Topic 20.3.0
IPv6 ND Inspection is a First Hop Security tool that analyzes Neighbor Discovery (ND) messages, specifically Neighbor Solicitations (NS) and Neighbor Advertisements (NA). It drops any ND message that lacks a valid, verifiable IPv6-to-MAC mapping in the binding table, effectively preventing address spoofing at Layer 2.
5. With which DHCPv6 device role does a switch reject a DHCP Offer message?
- relay role
- server role
- client role
- relay and server role
Explanation: Topic 20.5.0
Under DHCPv6 Guard, a switch interface is assigned a specific device role. If a port is configured with the client role, the switch will reject and block DHCP server-side messages—such as Advertisements (the DHCPv6 equivalent of an Offer) or Reply messages—that originate from that port to prevent rogue DHCP servers from assigning improper information.
6. Which IPv6 First Hop Security mechanism prevents a DoS attack on a host by exhausting its ability to do Layer 2 address resolution?
- IPv6 ND Inspection
- IPv6 Source Guard
- IPv6 RA Guard
- DHCPv6 Guard
Explanation: Topic 20.6.0
IPv6 Source Guard is designed to prevent address spoofing that leads to Denial of Service (DoS) attacks on hosts. As described in the sources, without this protection, an attacker can generate packets from multiple bogus source addresses; a target server (host) will then exhaust its resources attempting Layer 2 address resolution (Neighbor Discovery) for these non-existent hosts, filling its neighbor table with incomplete entries and preventing it from processing legitimate traffic.
7. Which port does TACACS+ use by default on a Cisco router?
- UDP 149
- TCP 149
- UDP 49
- TCP 49
Explanation: Topic 22.7.0
TACACS+ is a Cisco proprietary AAA protocol that utilizes TCP port 49 for communication between the network device and the AAA server. In contrast, RADIUS uses UDP ports 1812 or 1645 for authentication.
8. Which of the following is not an available SNMPv3 mode?
- AuthNoPriv
- PRIV
- AuthPriv
- noAuthNoPriv
Explanation: Topic 22.8.2
SNMPv3 provides three specific security levels (modes): noAuthNoPriv (no authentication or encryption), AuthNoPriv (authentication but no encryption), and AuthPriv (both authentication and encryption). "PRIV" is not a standalone mode but rather a component of the AuthPriv level.
9. Which mechanism cannot be used to assign global IPv6 addresses to end devices?
- stateless DHCPv6
- stateful DHCPv6
- stateless autoconfiguration
- manual address configuration
Explanation: Topic 19.9.0
Stateless DHCPv6 (also known as DHCPv6 Lite) does not provide IPv6 address assignment. It is used strictly to provide additional configuration parameters—such as DNS server addresses, domain names, and NTP server information—to clients that have already obtained their IPv6 addresses through other means like SLAAC.
10. Which IPv6 ACL command will permit traffic from any host to an SMTP server on network 2001:DB8:10:10::/64?
- permit tcp any host 2001:DB8:10:10::100 eq 25
- permit tcp host 2001:DB8:10:10::100 any eq 25
- permit tcp any host 2001:DB8:10:10::100 eq 23
- permit tcp host 2001:DB8:10:10::100 any eq 23
Explanation: Topic 21.4.0
To permit traffic to an SMTP server, the ACL must match the destination port 25 (the standard port for SMTP). The command permit tcp any host 2001:DB8:10:10::100 eq 25 correctly identifies the source as "any" host, the destination as the specific server IP on the target network, and specifies the correct protocol (TCP) and port number (25). Port 23 is used for Telnet, not SMTP.
11. Which device can serve as a network access server?
- router
- switch
- firewall
- access point
- router, switch, firewall, and access point
Explanation: Topic 22.4.0
In a centralized AAA (Authentication, Authorization, and Accounting) architecture, any network device that provides access to the network—whether for administrative access (CLI) or remote user access (VPN/Network)—acts as a network access server (NAS). The sources specifically mention that these security features and protocols can be deployed on routers, Layer 3 switches, and firewalls. Additionally, wireless access points are frequently integrated into these AAA workflows for client onboarding.
12. A time-based ACL has been configured on a router. Using the show access-list command, you notice that the ACL entry associated to the time range is currently inactive. What could be the cause?
- The ACL is not applied to an interface.
- The time range specified is outside the router’s current internal clock time.
- The router is unable to reach the NTP server.
- The time range has not been configured.
Explanation: Topic 21.2.0
A time-based ACL entry relies on the router's system clock to determine its validity. If the show access-list command indicates that an entry is inactive, it means the current time on the router's internal clock does not fall within the specific time range defined for that ACL entry. While NTP is often used to synchronize the clock, the immediate cause of the "inactive" status is the time mismatch itself.
13. Which feature would be best suited to detect that an access point (AP) is providing a throughput level that slowly but surely degrades over time compared to other APs in the network?
- Cognitive Analytics
- Syslog
- Machine Learning
- SNMP
Explanation: Topic 23.3.0
The sources explicitly state that Machine Learning (ML) algorithms are uniquely suited to detecting "subtle changes over time" that might otherwise be missed by traditional rules-based systems. Specifically, ML is used to detect when an access point (AP) provides a throughput level that slowly degrades compared to other APs in the network, allowing administrators to take proactive corrective action.
14. Which IPv6 First Hop Security mechanism prevents an attacker from assigning a SLAAC host its default gateway?
- IPv6 ND Inspection
- IPv6 RA Guard
- DHCPv6 Guard
- IPv6 Destination Guard
Explanation: Topic 20.4.0
In a SLAAC environment, hosts use Router Advertisement (RA) messages to dynamically discover their default gateway. IPv6 RA Guard is the mechanism designed to prevent rogue or unwanted routers from sending RA messages to hosts, thereby preventing an attacker from incorrectly assigning themselves as the default gateway for SLAAC hosts.
15. Which CoPP element is configured with policing data rates and drop or transmit actions?
- ACLs
- Class maps
- Policy maps
- Service policies
Explanation: Topic 21.9.0
In the implementation of Control Plane Policing (CoPP), Policy maps are the specific elements used to define the actual traffic policy. While ACLs identify the traffic and class maps group it, the policy map is where you configure the policing data rates (e.g., bits per second) and the resulting actions (such as transmit or drop) for traffic that conforms to or exceeds those rates.
16. Place the four-way negotiation between a DHCPv6 client and a DHCPv6 server in the correct order.
Explanation: Topic 19.8.0
| first | SOLICIT |
| second | ADVERTISE |
| third | REQUEST |
| fourth | REPLY |
17. Which two AAA server types can be configured for authentication on a Cisco router? (Choose two.)
- TACACS+
- TACACS
- RADIUS
- ISE
- 802.1x
Explanation: Topic 22.4.0
Cisco routers support two primary centralized AAA protocols: TACACS+, which is a Cisco-proprietary protocol using TCP port 49, and RADIUS, an IETF standard using UDP ports 1812 and 1813. While Cisco ISE is a platform that hosts these services, TACACS+ and RADIUS are the actual server types/protocols configured on the router.
18. How many bits are added to a device’s MAC address to convert it into an EUI-64 address?
- 8 bits
- 16 bits
- 24 bits
- 32 bits
Explanation: Topic 19.6.0
To create a modified EUI-64 interface identifier from a 48-bit MAC address, the MAC address is split into two 24-bit halves, and the 16-bit hex value "FFFE" is inserted between them. This expands the 48-bit hardware address into a 64-bit identifier used for IPv6 unicast addresses.
19. How does IPv6 Snooping build its binding table?
- monitoring data packets
- inspecting ARP requests
- inspecting ARP responses
- analyzing neighbor discovery messages
Explanation: Topic 20.2.0
IPv6 Snooping builds its binding table by inspecting and "gleaning" information from control messages, specifically Neighbor Discovery Protocol (NDP) and DHCPv6 packets. It captures the binding between the MAC address, the IPv6 address, and the interface to prevent spoofing.
20. A client acquired an IPv6 address via stateless autoconfiguration. Which command can you use to view the address?
- show ipv6 dhcp interface
- show ipv6 dhcp binding
- show ipv6 interface
- show ipv6 slaac
Explanation: Topic 19.13.0
The show ipv6 interface command is used to verify the IPv6 configuration on an interface, including addresses obtained through stateless autoconfiguration (SLAAC). Commands like show ipv6 dhcp interface only provide information regarding addresses or parameters obtained specifically via DHCPv6.
21. Which two statements correctly describe IPv6 address allocation mechanisms? (Choose two.)
- DHCPv6 allows more control than stateless autoconfiguration.
- DHCPv6 can give out IPv6 and IPv4 addresses.
- DHCPv6 and stateless autoconfiguration can be used together.
- A stateless DHCPv6 server can only be implemented on Cisco routers and not Cisco Catalyst switches.
- DHCPv6 Lite is commonly referred to as SLAAC.
Explanation: Topic 19.7.0
DHCPv6 provides more control than stateless autoconfiguration (SLAAC).
It is also possible and often practical to use both methods concurrently; for example, a device might use SLAAC to generate its global address and then use Stateless DHCPv6 (DHCPv6 Lite) to obtain additional information like DNS server addresses or domain names.
DHCPv6 and DHCPv4 are separate protocols; DHCPv6 cannot assign IPv4 addresses.
22. Cisco routers process routing protocols on which functional plane?
- Data plane
- Service plane
- Management plane
- Control plane
Explanation: Topic 21.8.0
The control plane is responsible for building the routing and forwarding tables.
Dynamic routing processes (such as OSPF, EIGRP, or BGP) run at the process level on the main CPU within the control plane to exchange topology information and determine the best paths.
23. Refer to the exhibit. Which severity level is represented by the syslog message?
*Oct 17 19:52:36.231: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to down
- Informational
- Critical
- Errors
- Warnings
Explanation: Topic 22.10.1
Syslog messages follow a standard format: %FACILITY-SEVERITY-MNEMONIC. In the provided message %LINK-3-UPDOWN, the digit 3 represents the severity level. According to the standard syslog severity scale (0–7), Level 3 is categorized as Errors. The sources explicitly note that an interface failure like "changed state to down" is a severity level 3 error message.
24. Which statement correctly describes a difference between the operation of inbound and outbound ACLs?
- In contrast to outbound ALCs, inbound ACLs can be used to filter packets with multiple criteria.
- Inbound ACLs can be used in both routers and switches but outbound ACLs can be used only on routers.
- Inbound ACLs are processed before the packets are routed while outbound ACLs are processed after the routing is completed.
- On a network interface, more than one inbound ACL can be configured but only one outbound ACL can be configured.
Explanation: Topic 21.3.0
While the provided sources emphasize the importance of applying ACLs in the correct direction to achieve desired results,, they do not explicitly define the routing-to-filtering sequence.
However, in standard networking (which you may wish to verify independently), inbound ACLs filter packets immediately as they enter an interface before a routing lookup is performed. Conversely, outbound ACLs filter packets after the routing decision has determined the exit interface but before the packet is actually transmitted.
25. You want to exclude IP address 192.168.0.1/24 from the DHCP pool. Which command should you use?
- Router(config)# ip dhcp excluded-host 192.168.0.1
- Router(config-dhcp)# network 192.168.0.0 255.255.255.0
- Router(config)# ip dhcp excluded-address 192.168.0.1
- Router(config)# ip dhcp excluded-address 192.168.0.1/24
Explanation: Topic 19.2.1
To prevent the DHCP server from assigning specific IP addresses to clients, the ip dhcp excluded-address command is used in global configuration mode. To exclude a single IP address, you simply list that address. The syntax allows for a range (start and end address), but providing only one address correctly excludes just that specific host. The command ip dhcp excluded-address 192.168.0.1/24 is syntactically incorrect for Cisco IOS.
26. Refer to the exhibit. Which security mode is currently enabled for the SNMPv3 group?
Router# show snmp group groupname: nms-group security model:v3 priv readview: nms-view writeview: nms-view notifyview: *tv.00000000.00000000.10000000.0 row status: active access-list: 5
- Priv
- AuthPriv
- noAuthNoPriv
- AuthNoPriv
Explanation: Topic 22.9.0
In the output of the show snmp group command, the label "v3 priv" indicates that the group is configured for the AuthPriv security level. According to the sources, the AuthPriv mode utilizes a cryptographic hash to secure authentication credentials and also employs encryption to ensure data privacy.
27. Which command would you use to configure the DHCPv6 relay on SW1 for VLAN 22?
- SW1(config-if)# ipv6 dhcp relay destination FE80::A8BB:CCFF:FE00:A920 ethernet 1/2
- SW1(config-if)# ipv6 dhcp relay destination FE80::A8BB:CCFF:FE00:A920 ethernet 1/1
- SW1(config-if)# ipv6 dhcp relay destination FE80::A8BB:CCFF:FE00:A920 ethernet 0/0
- It is not possible if you do not have a global IPv6 address on the DHCP server.
Explanation: Topic 19.10.0
When configuring a DHCPv6 relay agent, if a link-local address (an address starting with FE80) is used as the next-hop destination, the source (exit) interface must be specified. This is required because all link-local addresses use the same prefix, and without the interface designation, the device cannot determine which link to use to reach the destination.
28. Which area would the best to give an administrator insight into every network device and has KPI details including CPU, memory, temperature, control plane and data plane statistics, monitored?
- Network Health
- Client Health
- Overall Health
- Application Health
Explanation: Topic 23.4.1
Within Cisco DNA Assurance, the Network Health score provides an administrator with detailed insights into every infrastructure device. This area monitors specific Key Performance Indicators (KPIs), including CPU, memory, temperature, and both control plane and data plane statistics.
29. Refer to the exhibit. Which statement correctly describes the Flexible Netflow implementation?
R1(config)# flow record record-1 R1(config-flow-record)# match ipv4 source address R1(config-flow-record)# match ipv4 destination address R1(config-flow-record)# match transport destination-port R1(config-flow-record)# collect interface input R1(config-flow-record)# collect counter bytes R1(config)# flow exporter exporter-1 R1(config-flow-exporter)# destination 10.1.1.1 R1(config-flow-exporter)# source Ethernet0/1 R1(config)# flow monitor monitor-1 R1(config-flow-monitor)# exporter exporter-1 R1(config-flow-monitor)# record record-1 R1(config)# interface Ethernet 1/1 R1(config-if)# ip flow monitor monitor-1 input
- It samples inbound IP traffic on Ethernet 0/1.
- It uses TCP for data export.
- It samples outbound traffic on Ethernet 1/1.
- It samples inbound traffic on Ethernet 1/1.
Explanation: Topic 22.13.1
The exhibit shows the command ip flow monitor monitor-1 input being applied under interface Ethernet 1/1. According to the configuration steps for Flexible NetFlow, applying a flow monitor to an interface in the input direction enables the device to gather information about traffic flows entering that specific interface.
30. Which model is capable of understanding or modeling the behavior of a complex system, given KPI or variable?
- Manual configuration
- Troubleshooting
- Cognitive Analytics
- Machine Learning
Explanation: Topic 23.3.0
Machine Learning (ML) is defined as the ability to train a mathematical model that is capable of understanding or modeling the behavior of a complex system when provided with specific variables or Key Performance Indicators (KPIs). These intelligent algorithms are used in platforms like Cisco AI Network Analytics to detect subtle patterns and anomalies that traditional rules-based systems cannot identify.
31. From how many source points does DNA Center collect data for assurance?
- 13
- 17
- 5
- 9
Explanation: Topic 23.2.0
Cisco DNA Assurance collects data from a total of 17 different source types. These include NetFlow, traceroute, IP SLA, syslog, RADIUS, DHCP, DNS, SNMP, and others. This multi-source approach allows for more detailed information and context when viewing network events or issues.
32. You want to gather as much detail as possible during a network audit, including data time stamping across a large number of interfaces with minimal impact on the network devices themselves. Which tool would you use to meet these requirements?
- NetFlow
- SNMPv3
- Syslog
- SPAN
- CDP
Explanation: Topic 22.12.0
NetFlow is the best tool for this requirement because it provides detailed statistics on packet flows, including time stamping (flow start and end times), while being completely transparent to the network with minimal impact on device performance. It is primarily used for network accounting and security auditing.
33. Which address enables the forwarding of DHCP messages if the DHCP client and DHCP server are not on the same subnet?
- MAC address
- IP helper address
- IPv6 address
- Broadcast address
Explanation: Topic 19.3.0
Routers do not forward UDP broadcasts by default. If a DHCP client and server are on different subnets, a DHCP relay agent must be configured. This is done using the ip helper-address command on the router interface connected to the client, which allows the router to forward the broadcast discovery message as a unicast message to the server's IP address.
34. Which two steps/benefits of DNA Center Path trace over traditional, manual service tickets? (Choose two.)
- First step: Determine which path the user attempted to take in the network.
- First step: Input the information of the application flow into the application.
- Finding the path takes 1 hour on average per ticket.
- It takes about 1 minute on average before the path is returned.
- Per 100 tickets: 100 hours are required to find the path.
Explanation: Topic 23.5.0
Traditional manual troubleshooting is time-consuming, often taking an average of 1 hour per ticket. In contrast, the DNA Center Path Trace application automates this. The user simply inputs the 5-tuple application flow information (source/destination IP, ports, and protocol). The application then calculates and returns the visualized path results within a couple of minutes.
35. Refer to the exhibit. Based on the debug ip dhcp server packet output, which statement is true?
- The client sends a DHCPDISCOVER that contains IP address 10.1.10.21 to the DHCP server.
- The client sends a DHCPREQUEST that contains IP address 10.1.10.21 to the DHCP server.
- The client sends the BOOTREPLY broadcast message to inquire for a new IP address.
- The client accepts the offer from the DHCP server for the 10.1.10.21 IP address.
Explanation: Topic 19.14.1
The provided output demonstrates the standard four-way DHCPv4 handshake, often called the "DORA" process (Discover, Offer, Request, Acknowledgment). After the server sends a DHCPOFFER to provide the client with the IP address 10.1.10.21, the server receives a DHCPREQUEST from that same client.
In the DHCP operational model, the DHCPREQUEST message is specifically used by a client to choose or accept the specific IP address and configuration parameters that were provisionally assigned in the server's offer. While the request is being broadcast to inform all potential servers of its choice, it serves as the formal acceptance of the 10.1.10.21 offer. Following this acceptance, the server finalizes the binding by sending a DHCPACK.
36. Which three statements correctly describe ACL processing of packets? (Choose three.)
- An implicit deny any rejects any packet that does not match any ACE.
- A packet can either be rejected or forwarded as directed by the ACE that is matched.
- A packet that has been denied by one ACE can be permitted by a subsequent ACE.
- A packet that does not match the conditions of any ACE will be forwarded by default.
- Each statement is checked only until a match is detected or until the end of the ACE list.
- Each packet is compared to the conditions of every ACE in the ACL before a forwarding decision is made.
Explanation: Topic 21.2.0
Access Control Lists (ACLs) follow a strict logic where entries are processed from the top to the bottom in order. When a packet matches an Access Control Entry (ACE), it is immediately executed as either a permit or a deny, and the router stops checking further statements. If a packet reaches the end of the list without matching any specific ACE, it is automatically dropped by an invisible implicit deny any statement.
37. Which two ways help Cisco DNA Assurance transform the network operation through actionable insights and simplicity? (Choose two.)
- Mostly reactive systems
- Insights for Application, Client, Networks, and Compliance
- Many clicks to isolate and resolve issues
- Root causes identified in a few clicks
- Hard to isolate issues in the network
Explanation: Topic 23.2.2
Cisco DNA Assurance transforms operations by providing comprehensive visibility and health scores across applications, clients, and network infrastructure. It uses AI and machine learning to correlate data, which allows administrators to move from reactive troubleshooting to a system-guided approach where root causes and suggested actions are identified with minimal manual effort.
38. A Cisco phone is unable to download its configuration after it has initialized. What option needs to be added to the DHCP configuration to ensure it can reach the appropriate TFTP server?
- Option 69
- Option 150
- Option 43
- Option 70
Explanation: Topic 19.5.0
DHCP options are used to provide advanced configuration parameters to clients beyond basic IP addressing. Option 150 is specifically used to provide a list of TFTP server IP addresses to Cisco IP phones, which they use to download their configuration files and firmware.
39. In applying an IPv6 ACL to a router interface, which traffic is designated as outbound?
- traffic that is coming from the source IP address into the router
- traffic that is leaving the router and going toward the destination host
- traffic that is going from the destination IP address into the router
- traffic for which the router can find no routing table entry
Explanation: Topic 21.3.0
When applying an ACL to a router interface, the direction is defined from the perspective of the router itself. Outbound (out) traffic refers to packets that have already been processed by the router and are now leaving the interface to be sent toward the destination host or the next network segment.
40. Which SNMP command sends a trap when a uRPF event is detected?
- snmp-server trap urpf
- snmp trap ip verify drop-rate
- snmp-server ip verify drop-rate
- snmp trap urpf
Explanation: Topic 21.11.1
To provide real-time auditing and alerts for Unicast Reverse Path Forwarding (uRPF) violations, administrators can configure SNMP notifications. The specific command snmp trap ip verify drop-rate is used to enable the router to send SNMP traps whenever packets are dropped due to failing a uRPF check.
41. Which line can be configured for AAA on a router?
- line con 0
- line vty 0 4
- line aux 0
- line con 0, line vty 0 4, and line aux 0
Explanation: Topic 22.5.0
AAA (Authentication, Authorization, and Accounting) can be applied to all physical and virtual access lines of a Cisco router. The sources explicitly state that a default method list is used on all lines, including VTY, CON, and AUX, unless a specifically named method list is defined for a particular line. This allows for consistent administrative access security across the console, auxiliary, and remote terminal ports.
42. Which IPv6 First Hop Security mechanism prevents an attacker from successfully conducting a DoS attack on a router?
- IPv6 Source Guard
- IPv6 RA Guard
- IPv6 ND Inspection
- IPv6 Destination Guard
Explanation: Topic 20.7.0
IPv6 Destination Guard is a mechanism specifically designed to minimize Denial-of-Service (DoS) attacks directed at a router. It prevents an attacker from exhausting a router's IPv6 neighbor cache by blocking Layer 2 address resolution for packets destined for bogus IPv6 addresses that do not exist in the binding table.
43. Before generating an RSA crypto key on a Cisco router, which two commands must first be configured? (Choose two.)
- enable secret
- username
- hostname
- aaa new-model
- ip domain-name
Explanation: Topic 22.11.0
Before generating an RSA crypto key for SSH, a Cisco router must be configured with a fully qualified domain name (FQDN). The sources confirm that a router must first have a domain name configured, and the resulting key name is a combination of the device's hostname and that domain name (e.g., BR.cisco.com).
44. Which two messages are sent out by the DHCPv6 server? (Choose two.)
- SOLICIT
- ADVERTISE
- REQUEST
- REPLY
- RENEW
Explanation: Topic 19.8.0
In the standard four-way DHCPv6 negotiation, the server is responsible for sending the ADVERTISE message (responding to a client's Solicit) and the REPLY message (finalizing the exchange after a client's Request). The SOLICIT, REQUEST, and RENEW messages are initiated and sent by the client.
45. Based on which two pieces of information can you bind an IP address to a device? (Choose two.)
- client identifier
- IP address
- serial number
- MAC address
- network identifier
Explanation: Topic 19.4.0
When configuring manual address binding to ensure a device always receives the same IP, the DHCP server uses specific identifiers to recognize the client. The sources state that a client can be identified by its client identifier (for DHCP requests) or its hardware MAC address (primarily for BOOTP requests). These values are used within a manual binding "pool" to link a specific host to a reserved IP address.
46. Where can an IPv6 Source Guard policy not be applied?
- access port
- trunk port
- VLAN
- EtherChannel port
Explanation: Topic 20.6.0
The IPv6 Source Guard feature is specifically not supported on EtherChannel ports. It is designed to be applied to other Layer 2 targets, such as access ports, trunk ports, and VLANs, provided that IPv6 Snooping is configured as a prerequisite.
47. Refer to the exhibit. A network administrator is configuring an ACL to limit the connection to R1 vty lines to only the IT group workstations in the network 192.168.22.0/28. The administrator verifies the successful Telnet connections from a workstation with IP 192.168.22.5 to R1 before the ACL is applied. However, after the ACL is applied to the interface Fa0/0, Telnet connections are denied. What is the cause of the connection failure?
R1# configure terminal
Enter configuration commands, one per line. End with CNTL/Z
R1(config)# access-list 120 deny ip 192.168.20.0 0.0.3.255 10.0.10.0 0.0.0.255
R1(config)# access-list 120 permit tcp 192.168.22.0 0.0.0.15 10.0.10.0 0.0.0.15 eq 23
R1(config)# access-list 120 permit ip any any
R1(config)# line vty 0 4
R1(config-line)# password admin-in
R1(config-line)# access-class 120 in
R1(config-line)# exit
R1(config)# interface fastEthernet 0/0
R1(config-if)# ip address 10.0.10.1 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# ip access-group 120 in
R1(config-if)# end
R1#
R1# show access-lists
Extended IP access list 120
deny ip 192.168.20.0 0.0.3.255 10.0.10.0 0.0.0.255 (16 match(es))
permit tcp 192.168.22.0 0.0.0.15 10.0.10.0 0.0.0.15 eq telnet
permit ip any any
R1#- The permit ACE specifies a wrong port number.
- The enable secret password is not configured on R1.
- The login command has not been entered for vty lines.
- The IT group network is included in the deny statement.
- The permit ACE should specify protocol ip instead of tcp.
Explanation: Topic 21.2.0
The source IP range in the deny ACE is 192.168.20.0 0.0.3.255, which covers IP addresses from 192.168.20.0 to 192.168.23.255. The IT group network 192.168.22.0/28 is included in the 192.168.20/22 network. Therefore, the connection is denied. To fix it, the order of the deny and permit ACE should be switched.
