Question 1.
Which statement is true about RSTP topology changes?

A. Any change in the state of the port generates a TC BPDU.
B. Only nonedge ports moving to the forwarding state generate a TC BPDU.
C. If either an edge port or a nonedge port moves to a block state, then a TC BPDU is generated.
D. Only edge ports moving to the blocking state generate a TC BPDU.
E. Any loss of connectivity generates a TC BPDU.

Answer: B

Explanation:
The IEEE 802.1D Spanning Tree Protocol was designed to keep a switched or bridged network loop free, with adjustments made to the network topology dynamically. A topology change typically takes 30 seconds, where a port moves from the Blocking state to the Forwarding state after two intervals of the Forward Delay timer. As technology has improved, 30 seconds has become an unbearable length of time to wait for a production network to failover or "heal" itself during a problem.
Topology Changes and RSTP
Recall that when an 802.1D switch detects a port state change (either up or down), it signals the Root Bridge by sending topology change notification (TCN) BPDUs. The Root Bridge must then signal a topology change by sending out a TCN message that is relayed to all switches in the STP domain. RSTP detects a topology change only when a nonedge port transitions to the Forwarding state. This might seem odd because a link failure is not used as a trigger. RSTP uses all of its rapid convergence mechanisms to prevent bridging loops from forming. Therefore, topology changes are detected only so that bridging tables can be updated and corrected as hosts appear first on a failed port and then on a different functioning port. When a topology change is detected, a switch must propagate news of the change to other switches in the network so they can correct their bridging tables, too. This process is similar to the convergence and synchronization mechanism-topology change (TC) messages propagate through the network in an everexpanding wave.

Question 2.
Refer to the exhibit.

Which four statements about this GLBP topology are true? (Choose four.)

A. Router A is responsible for answering ARP requests sent to the virtual IP address.
B. If router A becomes unavailable, router B forwards packets sent to the virtual MAC address of router A.
C. If another router is added to this GLBP group, there would be two backup AVGs.
D. Router B is in GLBP listen state.
E. Router A alternately responds to ARP requests with different virtual MAC addresses.
F. Router B transitions from blocking state to forwarding state when it becomes the AVG.

Answer: A, B, D, E

Explanation:
With GLBP the following is true:
With GLB, there is 1 AVG and 1 standby VG. In this case Company1 is the AVG and Company2 is the standby. Company2 would act as a VRF and would already be forwarding and routing packets. Any additional routers would be in a listen state. As the role of the Active VG and load balancing, Company1 responds to ARP requests with different virtual MAC addresses. In this scenario, Company2 is the Standby VF for the VMAC 0008.b400.0101 and would become the Active VF if Company1 were down. As the role of the Active VG, the primary responsibility is to answer ARP requests to the virtual IP address. As an AVF router Company2 is already forwarding/routing packets

Question 3.
Refer to the exhibit.

Which VRRP statement about the roles of the master virtual router and the backup virtual router is true?

A. Router A is the master virtual router, and router B is the backup virtual router. When router A fails, router B becomes the master virtual router. When router A recovers, router B maintains the role of master virtual router.
B. Router A is the master virtual router, and router B is the backup virtual router. When router A fails, router B becomes the master virtual router. When router A recovers, it regains the master virtual router role.
C. Router B is the master virtual router, and router A is the backup virtual router. When router B fails, router A becomes the master virtual router. When router B recovers, router A maintains the role of master virtual router.
D. Router B is the master virtual router, and router A is the backup virtual router. When router B fails, router A becomes the master virtual router. When router B recovers, it regains the master virtual router role.

Answer: B

Explanation:

Question 4.
Which description correctly describes a MAC address flooding attack?

A. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the destination address found in the Layer 2 frames sent by the valid network device.
B. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the source address found in the Layer 2 frames sent by the valid network device.
C. The attacking device spoofs a destination MAC address of a valid host currently in the CAM table. The switch then forwards frames destined for the valid host to the attacking device.
D. The attacking device spoofs a source MAC address of a valid host currently in the CAM table. The switch then forwards frames destined for the valid host to the attacking device.
E. Frames with unique, invalid destination MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports.
F. Frames with unique, invalid source MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports.

Answer: F

Explanation:

Question 5.
Refer to the exhibit.
An attacker is connected to interface Fa0/11 on switch A-SW2 and attempts to establish a DHCP server for a man-in-middle attack. 

Which recommendation, if followed, would mitigate this type of attack?

A. All switch ports in the Building Access block should be configured as DHCP trusted ports.
B. All switch ports in the Building Access block should be configured as DHCP untrusted ports.
C. All switch ports connecting to hosts in the Building Access block should be configured as DHCP trusted ports.
D. All switch ports connecting to hosts in the Building Access block should be configured as DHCP untrusted ports.
E. All switch ports in the Server Farm block should be configured as DHCP untrusted ports.
F. All switch ports connecting to servers in the Server Farm block should be configured as DHCP untrusted ports.

Answer: D

Explanation:
One of the ways that an attacker can gain access to network traffic is to spoof responses that would be sent by a valid DHCP server. The DHCP spoofing device replies to client DHCP requests. The legitimate server may reply also, but if the spoofing device is on the same segment as the client, its reply to the client may arrive first. The intruder’s DHCP reply offers an IP address and supporting information that designates the intruder as the default gateway or Domain Name System (DNS) server. In the case of a gateway, the clients will then forward packets to the attacking device, which will in turn send them to the desired destination. This is referred to as a “man-in-the-middle” attack, and it may go entirely undetected as the intruder intercepts the data flow through the network. Untrusted ports are those that are not explicitly configured as trusted. A DHCP binding table is built for untrusted ports. Each entry contains the client MAC address, IP address, lease time, binding type, VLAN number, and port ID recorded as clients make DHCP requests. The table is then used to filter subsequent DHCP traffic. From a DHCP snooping perspective, untrusted access ports should not send any DHCP server responses, such as DHCPOFFER, DHCPACK, DHCPNAK.

Question 6.
Refer to the exhibit. 
The web servers WS_1 and WS_2 need to be accessed by external and internal users. For security reasons, the servers should not communicate with each other, although they are located on the same subnet. However, the servers do need to communicate with a database server located in the inside network. 

Which configuration isolates the servers from each other?

A. The switch ports 3/1 and 3/2 are defined as secondary VLAN isolated ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports.
B. The switch ports 3/1 and 3/2 are defined as secondary VLAN community ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports.
C. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls are defined as primary VLAN promiscuous ports.
D. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls are defined as primary VLAN community ports.

Answer: A

Explanation:
Service providers often have devices from multiple clients, in addition to their own servers, on a single Demilitarized Zone (DMZ) segment or VLAN. As security issues proliferate, it becomes necessary to provide traffic isolation between devices, even though they may exist on the same Layer 3 segment and VLAN. Catalyst 6500/4500 switches implement PVLANs to keep some switch ports shared and some switch ports isolated, although all ports exist on the same VLAN. The 2950 and 3550 support “protected ports,” which are functionality similar to PVLANs on a perswitch basis. 
A port in a PVLAN can be one of three types:
Isolated: An isolated port has complete Layer 2 separation from other ports within the same PVLAN, except for the promiscuous port. PVLANs block all traffic to isolated ports, except the traffic from promiscuous ports. Traffic received from an isolated port is forwarded to only promiscuous ports.
Promiscuous: A promiscuous port can communicate with all ports within the PVLAN, including the community and isolated ports. The default gateway for the segment would likely be hosted on a promiscuous port, given that all devices in the PVLAN will need to communicate with that port.
Community: Community ports communicate among themselves and with their promiscuous ports. These interfaces are isolated at Layer 2 from all other interfaces in other communities, or in isolated ports within their PVLAN.

Question 7.
What does the command udld reset accomplish?

A. allows a UDLD port to automatically reset when it has been shut down
B. resets all UDLD enabled ports that have been shut down
C. removes all UDLD configurations from interfaces that were globally enabled
D. removes all UDLD configurations from interfaces that were enabled per-port

Answer: B

Explanation:

Question 8.
Refer to the exhibit.
Dynamic ARP Inspection is enabled only on switch SW_A. Host_A and Host_B acquire their IP addresses from the DHCP server connected to switch SW_A. 

What would the outcome be if Host_B initiated an ARP spoof attack toward Host_A ?

A. The spoof packets are inspected at the ingress port of switch SW_A and are permitted.
B. The spoof packets are inspected at the ingress port of switch SW_A and are dropped.
C. The spoof packets are not inspected at the ingress port of switch SW_A and are permitted.
D. The spoof packets are not inspected at the ingress port of switch SW_A and are dropped.

Answer: C

Explanation:
When configuring DAI, follow these guidelines and restrictions:
• DAI is an ingress security feature; it does not perform any egress checking.
• DAI is not effective for hosts connected to routers that do not support DAI or that do not have this feature enabled. Because man-in-the-middle attacks are limited to a single Layer 2 broadcast domain, separate the domain with DAI checks from the one with no checking. This action secures the ARP caches of hosts in the domain enabled for DAI.
• DAI depends on the entries in the DHCP snooping binding database to verify IP-to-MAC address bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP snooping to permit ARP packets that have dynamically assigned IP addresses.
• When DHCP snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to deny packets.
• DAI is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports.
In our example, since Company2 does not have DAI enabled (bullet point 2 above) packets will not be inspected and they will be permitted.

Reference:
http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SXF/configuration/guide/dynarp.html

Question 9.
Which statement is true about Layer 2 security threats?

A. MAC spoofing, in conjunction with ARP snooping, is the most effective counter-measure against reconnaissance attacks that use Dynamic ARP Inspection to determine vulnerable attack points.
B. DHCP snooping sends unauthorized replies to DHCP queries.
C. ARP spoofing can be used to redirect traffic to counter Dynamic ARP Inspection.
D. Dynamic ARP Inspection in conjunction with ARP spoofing can be used to counter DHCP snooping attacks.
E. MAC spoofing attacks allow an attacking device to receive frames intended for a different network host.
F. Port scanners are the most effective defense against Dynamic ARP Inspection.

Answer: E

Explanation:
First of all, MAC spoofing is not an effective counter-measure against any reconnaissance attack; it IS an attack! Furthermore, reconnaissance attacks don't use dynamic ARP inspection (DAI); DAI is a switch feature used to prevent attacks.

Question 10.
What does the global configuration command ip arp inspection vlan 10-12,15 accomplish?

A. validates outgoing ARP requests for interfaces configured on VLAN 10, 11, 12, or 15
B. intercepts all ARP requests and responses on trusted ports
C. intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings
D. discards ARP packets with invalid IP-to-MAC address bindings on trusted ports

Answer: C

Explanation:
The “ip arp inspection” command enables Dynamic ARP Inspection (DAI) for the specified VLANs. DAI is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings. This capability protects the network from certain "man-in-themiddle" attacks.

Reference:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/dynarp.html

	Web www.certsbraindumps.com

Home

Search

Latest Brain Dumps

BrainDump List

Certifications Dumps

Microsoft

CompTIA

Oracle

Cisco

CIW

Novell

Linux

Sun

Certs Notes

How-Tos & Practices

Free Online Demos

Free Online Quizzes

Free Study Guides

Free Online Sims

Material Submission

Test Vouchers

Users Submissions

Site Links

Submit Site

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Braindumps for "642-785" Exam

Maintaining Cisco Service Provider Quality of Service

 Question 1.
Within a QoS policy-map configuration, one of the traffic classes is configured with the randomdetect dscp-based configuration command. What will that command accomplish?

A. provides congestion management by queueing the traffic using CBWFQ
B. provides congestion management by queueing the traffic using LLQ
C. decreases the probability of congestion by selectively dropping TCP packets before the queue is full
D. provides congestion avoidance by selectively delaying the delivery of packets with lower DSCP priority
E. decreases congestion by avoiding global UDP synchronization

Answer:  C

Explanation:

Question 2.
What are three benefits of IntServ and RSVP? (Choose three.)

A. RSVP helps network devices identify dynamic port numbers.
B. IntServ networks will reject or downgrade new RSVP sessions if all reservable bandwidth is booked somewhere in a path.
C. RSVP signaling is a scalable way to ensure all devices maintain an accurate picture of the network state.
D. They enable the network to guarantee necessary QoS to individual data flows.
E. The IntServ class-based approach is easy to design and implement.

Answer:  A, B, D

Explanation:

Question 3.
Which statement about the rates and statistics (such as match, transmit, drop, and police) shown in the show policy-map interface output is true?

A. The rates are computed as a moving average of instantaneous rates.
B. The rates are displayed in real time, which matches the actual traffic rate.
C. The matched statistics of the packet can be cleared only when the router reboots.
D. The matched statistics of the packet are displayed in real time.
E. The traffic policing statistics are displayed in real time.

Answer:  A

Explanation:

Question 4.
Which four factors can be used for packet classification in a QoS-aware network device? (Choose four.)

A. source address
B. destination address
C. DSCP
D. TTL
E. MQC
F. IP precedence

Answer:  A, B, C, F

Explanation:

Question 5.
What are the three primary types of faults associated with QoS fault management? (Choose three.)

A. classification faults
B. buffer faults
C. queue faults
D. marking faults
E. assurance faults
F. physical faults

Answer:  A, D, E

Explanation:

Question 6.
Which are the two locations where the SP network device always trusts the QoS markings from its upstream neighbor? (Choose two.)

A. at the ingress PE
B. at the egress PE
C. in the SP core
D. at the ingress CE
E. at the egress CE

Answer:  B, C 

Explanation:

Question 7.
Which of these correctly describes traffic classification using qos-group?

A. qos-group marking is automatically mapped to MPLS EXP marking.
B. qos-group is only applicable to an MPLS-enabled router.
C. qos-group marking value ranges from 0 to 7.
D. qos-group is local to the router.

Answer:  D

Explanation:

Question 8.
Which two IP SLA Probe types can be used to measure voice quality? (Choose two.)

A. HTTP
B. ICMP Path Jitter
C. UDP Echo
D. UDP Jitter
E. UDP Delay
F. UDP MOS

Answer:  B, D

Explanation:

Question 9.
Refer to the exhibit.
Traffic in CLASS-B is not getting a minimum bandwidth of 192 kb/s in this policy map. 

What can be done to correct this?

A. No changes are needed, the site is already correct.
B. The shape peak command should be used instead of the shape average command.
C. Set the shape rate to a CIR higher than 192 kb/s.
D. Decrease the maximum queue size.

Answer:  C

Explanation:

Question 10.
Which of these describes Short Pipe mode in QoS for MPLS VPN service providers?

A. Service provider can remark customer DSCP values.
B. Service provider does not remark customer DSCP values. (Service provider uses independent MPLS EXP markings.) Final PE-to-CE policies are based on service provider markings.
C. The customer and service provider share the same DiffServ domain.
D. Service provider does not remark customer DSCP values. (Service provider uses independent MPLS EXP markings.) Final PE-to-CE policies are based on customer markings.

Answer:  D

Explanation:

	Web www.certsbraindumps.com

Advertise

Submit Braindumps

Forum

Tell A Friend

Contact Us

Home

Search

Latest Brain Dumps

BrainDump List

Certifications Dumps

Microsoft

CompTIA

Oracle

Cisco

CIW

Novell

Linux

Sun

Certs Notes

How-Tos & Practices

Free Online Demos

Free Online Quizzes

Free Study Guides

Free Online Sims

Material Submission

Test Vouchers

Users Submissions

Site Links

Submit Site

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Braindumps for "642-770" Exam

Operational Foundations for Cisco Service Provider Core Networks (OFCN)

 Question 1.
Which two-stage configuration process is correct in Cisco IOS XR Software?

A. Enter configuration mode, then make configuration changes.
B. Make configuration changes, then enter "commit" to make configuration changes persist.
C. Make configuration changes, then enter "copy run start" to make configuration changes persist.
D. Enter admin mode, then make configuration changes.

Answer:  B

Explanation:

Question 2.
Which command displays the target configuration in Cisco IOS XR Software?

A. show config
B. show running-config
C. show config running
D. show config merge

Answer:  A

Explanation:

Question 3.
What will happen if a new version of Cisco IOS XR Software is installed and activated, and then the router reloads?

A. When the router comes back, the new version is loaded and the old and new versions are on disk0.
B. When the router comes back, the new version is loaded and only the new version is on disk0.
C. When the router comes back, the old version is loaded and the old and new versions are on disk0.
D. When the router comes back, the old version is loaded and only the old version is on disk0.

Answer:  C

Explanation:

Question 4.
When is it appropriate to use the commit replace command?

A. When you want to replace the existing configuration for an ipv4 address on an interface.
B. When you want to replace all configurations under router ospf.
C. When you want to replace the entire running configuration with the target configuration.
D. The commit replace command does the same as the commit command.

Answer:  C

Explanation:

Question 5.
Refer to the exhibit.
If all else are good, where could the problem be if a user in the 192.168.0.0/16 subnet reports that they are not able to connect to the router using Telnet?

A. MPP should be configured as out-of-band.
B. Interface GigabitEthernet0/2/0/1 should allow 192.168.0.0/16 address space when using Telnet.
C. Telnet traffic is going through other interfaces that are not configured in MPP.
D. Interface GigabitEthernet0/2/0/0 should allow 192.168.0.0/16 address space.
E. SNMP peer is not configured to "allow" on interface GigabitEthernet0/2/0/1 which prohibits Telnet

Answer:  C

Explanation:

Question 6.
At which SONET layer would you expect to see B3 errors?

A. physical
B. segment
C. line
D. path

Answer:  D

Explanation:

Question 7.
What is a common cause of increasing NEWPTR errors on a POS interface?

A. dirty fiber
B. incorrect timing
C. Tx and Rx swapped
D. wrong fiber type

Answer:  B

Explanation:

Question 8.
What is the range of DLCIs that are available for subscribers to configure on a Cisco IOS Frame Relay subinterface?

A. 0-1024
B. 1-2048
C. 0-991
D. 16-1007

Answer:  D

Explanation:

Question 9.
What is the acronym commonly used to identify a prearranged agreement between a service team and an external service provider?

A. SLA
B. OLA
C. UC
D. SLM
E. CICS

Answer:  C

Explanation:

Question 10.
According to the ITIL® v3 framework, a change that has an "approved" status has met which criteria?

A. The lab testing and operational assessments have been completed, and the change has been approved and committed to the change scheduler.
B. The operational testing and technical assessments have been completed, and the change has been approved and committed to the change scheduler.
C. The business and technical assessments have been completed, and the change has been approved and committed to the change scheduler.
D. The lab testing and technical assessments have been completed, and the change has been approved but is not yet committed to the change scheduler.

Answer:  C

Explanation:

	Web www.certsbraindumps.com

Privacy Policy                   Disclaimer                    Feedback                    Term & Conditions

ITCertKeys.com

Copyright © 2004 CertsBraindumps.com Inc. All rights reserved.