CCNP 2 ISCW 100% final exam

How do cable modems transfer data across local cable TV lines?
	carries analog signals end-to-end
	carries digital signals end-to-end
	toggles between radio frequency and analog data signals
	modulates digital data to an RF and transmits it at a specific frequency

Top of Form What is the maximum distance ADSL transmissions will work? 18,000 meters 5460 meters 17,068 meters 2478 meters Bottom of Form

Top of Form Which form of DSL uses the frequency band of 20khz to 1Mhz? IDSL SDSL ADSL VDSL Bottom of Form

Top of Form What is the most popular modulation technique that ADSL uses? carrierless amplitude modulation/phase modulation (CAP) frequency division multiplexing (FDM) quadrature phase shift keying (QPSK) discrete multitone modulation (DMT) consumer/Mass-Market DMT (G.lite) quadrature amplitude modulation (QAM) Bottom of Form

Refer to the exhibit. DHCP clients in the customer network do not have connectivity. What could be causing this issue?
	The subnet mask for the DHCP pool is incorrect.
	The default router that is specified in the DHCP pool is incorrect.
	The DHCP excluded addresses are incorrect.
	The command ip nat inside and ip nat outside were issued on the incorrect interfaces.
	The overload keyword should be removed.

Which statement is true about the use of dead peer detection (DPD) within an IPsec environment?
	DPD and Cisco IOS keepalives are sent together.
	DPDs are sent at regular intervals.
	DPDs are sent when no traffic is flowing.
	DPDs are sent by default only when the IKE policy is initiated.
	Cisco IOS keepalives are sent by default instead of the DPDs.

Refer to the exhibit. Which statement is true about the IPsec configuration?
	The key will not be sent encrypted to the peer.
	The default authentication has been changed.
	The local IP address is 172.16.153.2.
	Access-list 2 will be referenced to control traffic.

Refer to the exhibit. Which set of commands would correctly configure this router to display the output that is generated in the exhibit?
	crypto isakmp policy 15 hash md5 authentication rsa-sig group 2 lifetime 5000
	crypto isakmp policy 15 hash sha authentication rsa-sig group 2 lifetime 5000
	crypto isakmp policy 15 authentication pre-share lifetime 5000
	crypto isakmp policy 15 hash sha group 2 lifetime 5000
	crypto isakmp policy 15 authentication rsa-sig group 2 lifetime 5000

If SDM is being used, which statement is true when no IKE policies have been configured on a router?
	The hash algorithm used will be MD5.
	The lifetime will be unlimited.
	Pre-share authentication will be used.
	3DES encryption will be used.

Top of Form Which two modes can be selected after launching the Create a Site-to-Site VPN option using the SDM? (Choose two.) One click VPN setup Step by step wizard CLI wizard Quick setup Edit Site-to-Site VPN Bottom of Form

Refer to the exhibit. Which task would specify additional security by authenticating the user of a remote VPN device?
	Selecting the interface on which the client connections will terminate.
	Configuring IKE policies.
	Configuring an IPSec transform set.
	Configuring a group policy lookup method.
	Configuring user authentication.
	Configuring group policies on the local router.

Which two statements about the Cisco Easy VPN Client for Windows are true? (Choose two.)
	Previously installed versions of the Cisco Easy VPN Client do not have to be uninstalled before proceeding with a new installation.
	Previously installed versions of the Cisco Easy VPN Client must be uninstalled before proceeding with a new installation.
	The Cisco Easy VPN Client can be installed by using either InstallShield or the Microsoft Windows Installer (MSI).
	The Cisco Easy VPN Client can only be installed by using InstallShield.
	The Cisco Easy VPN Client can only be installed by using the Microsoft Windows Installer (MSI).
	The Cisco Easy VPN Client is only compatible with a Cisco Easy VPN server.

Top of Form What are the two components of Cisco Easy VPN? (Choose two.) Cisco Easy VPN GRE Cisco Easy VPN Router wizard Cisco Easy VPN Remote Cisco Easy VPN One-Click wizard Cisco Easy VPN Server Bottom of Form

Refer to the exhibit. A tunnel is established between routers RTA and RTB. Which two statements are true about traffic that flows from network A to network B? (Choose two.)
	Traffic cannot flow between network A and network B until NAT is activated on RTA.
	Because access-list 101 does not permit TCP or UDP, traffic will not be encrypted.
	Routers inside the Internet will see packets with the destination IP address of 128.107.155.2.
	Routers inside the Internet will see packets with the destination IP address of 192.168.0.2.
	Traffic will go through an IPsec tunnel.
	Traffic will go through a GRE tunnel.

An MPLS network consists of label switching routers (LSR) and edge LSRs. What are two functions of an edge LSR but not functions of an LSR? (Choose two.)
	adding labels
	removing labels
	forwarding of packets
	exchanging Layer 3 routing information
	exchanging labels
	populating an LFIB

Which two statements are characteristics of MPLS? (Choose two.)
	Frame Mode MPLS inserts a 32-bit label between the Layer 2 and Layer 3 headers.
	Frame Mode MPLS inserts a 53-bit label between the Layer 2 and Layer 3 headers.
	Frame Mode MPLS uses the virtual path identifier/virtual channel identifier (VPI/VCI) fields in the ATM header to label the frame.
	MPLS over ATM inserts a 32-bit label between the Layer 2 and Layer 3 headers.
	MPLS over ATM inserts a 53-bit label between the Layer 2 and Layer 3 headers.
	MPLS over ATM uses the virtual path identifier/virtual channel identifier (VPI/VCI) fields in the ATM header to label the frame.

Top of Form MPLS VPN architecture combines the best features of peer-to-peer VPN and overlay VPN models. Which three statements indicate these advantages? (Choose three.) Provider routers participate in customer routing. Provider routers maintain separate routing tables for each customer. Customers can use overlapping addresses. The customer network is isolated from the provider network. Customers are provided with a secure Layer 3 VPN. Customer traffic is automatically protected by Layer 2 encryption that is implemented on the provider routers. Bottom of Form

Which VPN implementation model provides optimum routing between customer sites without any special design or configuration effort?
	overlay VPNs
	GRE VPNs
	VPDN VPNs
	peer-to-peer VPNs
	non-service-provider MPLS VPNs

What is the benefit of implementing the peer-to-peer VPN model?
	The service provider takes care of configuration tasks when adding new VPN sites.
	A full mesh of VCs between customer sites is used to provide optimum intersite routing.
	The service provider does not participate in customer routing.
	The service provider PE routers carry all customer routes.

What is the length of a VPNv4 address that uses MPLS-VPN with route distinguishers (RD)?
	32 bits
	48 bits
	64 bits
	96 bits
	128 bits
	160 bits

Top of Form Which two MPLS configuration statements are true? (Choose two.) If no MPLS label distribution protocol is explicitly configured by the mpls label protocol command, both LDP and TDP are supported by default. If no MPLS label distribution protocol is explicitly configured by the mpls label protocol command, LDP is the default label distribution protocol. If no MPLS label distribution protocol is explicitly configured by the mpls label protocol command, TDP is the default label distribution protocol. MPLS is disabled by default. Once the ip cef command has been applied globally, the frame mode interface must be configured using the ip route-cache cef command. To disable MPLS, enter the no mpls ip interface configuration command. Bottom of Form

Which two statements are correct about applying the mpls ip command on a router interface? (Choose two.)
	Label switching is enabled on the interface.
	The command mpls ip must be run on another interface before label switching is enabled.
	Because the interface will now use labels to forward IP packets, the interface will no longer transmit or receive routing updates.
	The interface will not forward packets until it establishes an MPLS neighbor.
	A non-proprietary protocol that is used to distribute labels is activated.
	A Cisco proprietary protocol that is used to distribute labels is activated

p interface configuration command. What additonal configuration is required to prevent fragmentation across the MPLS network?
	Serial interfaces require the mpls mtu 1492 command.
	Ethernet interfaces require the mpls mtu 1492 command.
	Serial interfaces require the mpls mtu 1512 command.
	Ethernet interfaces require the mpls mtu 1512 command.
	MPLS will automatically sense the interface mtu and ensure all frames are within this MTU limit. No extra configuration is required.

Refer to the exhibit. Routers RTA, RTB, and RTC are MPLS capable Cisco routers. RTB and RTC are configured to run a Cisco proprietary protocol for distribution of MPLS tags. Routers R1 and R2 are non-Cisco MPLS capable routers. Which three command sets would correctly configure MPLS on the interfaces of router RTA? (Choose three.)
	RTA(config)# interface Serial 0 RTA(config-if)# mpls ip RTA(config-if)# mpls label protocol ldp
	RTA(config)# interface Serial 0 RTA(config-if)# mpls ip RTA(config-if)# mpls label protocol tdp
	RTA(config)# interface FastEthernet 0/0 RTA(config-if)# mpls ip RTA(config-if)# mpls label protocol ldp
	RTA(config)# interface FastEthernet 0/0 RTA(config-if)# mpls ip RTA(config-if)# mpls label protocol tdp
	RTA(config)# interface FastEthernet 0/1 RTA(config-if)# mpls ip RTA(config-if)# mpls label protocol both
	RTA(config)# interface FastEthernet 0/1 RTA(config-if)# mpls ip RTA(config-if)# mpls label protocol ldp RTA(config-if)# mpls label protocol tdp

ABC Company has configured a full mesh of GRE tunnels to link remote sites via the Internet. Which two statements correctly describe the site interconnections? (Choose two.)
	ABC Company now has a peer-to-peer Layer 3 VPN between sites.
	ABC Company now has an overlay Layer 2 VPN between sites.
	ABC Company now has an overlay Layer 3 VPN between sites.
	All ABC Company subnets will need to be advertised to the Internet to provide Layer 3 connectivity.
	This cannot be considered a virtual private network unless IPsec is enabled.
	ABC Company routers attached to the Internet can exchange routing updates directly with one another across GRE tunnels.

Refer to the exhibit. Which statement is correct about the peer-to-peer VPN model shown?
	The model outlines a network that uses tunnels to establish secure communications between Site#1 and Site#2.
	The model outlines a network that interconnects Site#1 and Site#2 via Frame Relay permanent virtual circuits.
	The model outlines a network that allows routers attached to Site#1 and Site#2 to advertise routes across the WAN without routers inside the WAN participating in the routing updates.
	The model outlines a network that provides point-to-point links between Site#1 and Site#2 unknown to devices inside the WAN.
	The model outlines a network that allows routers attached to Site#1 and Site#2 to advertise private routes across the WAN with routers inside the WAN participating in the private routing updates.

ABC Company has subscribed to a carrier-provided, full-mesh Frame Relay network. Which two statements correctly describe this network? (Choose two.)
	ABC Company now has a peer-to-peer Layer 2 VPN between sites.
	ABC Company now has an overlay Layer 2VPN between sites.
	The carrier participates in ABC Company routing updates across the Frame Relay network.
	The carrier only provides Layer 3 point-to-point links between sites and does not participate in ABC Company routing updates across the Frame Relay network.
	The Frame Relay network cannot be considered a virtual private network unless IPsec is enabled.
	ABC Company routers that are attached to the Frame Relay network can exchange routing updates directly with one another.

Top of Form For IDS and IPS systems, what are three different approaches that can be used to identify malicious traffic in a network? (Choose three.) signature-based approach honeypot approach stateful packet filtering approach malicious port-to-application mapping anomaly-based approach stateless packet filtering approach Bottom of Form

Top of Form Packet sniffers are able to capture plain text data. Which three protocols transmit traffic in plain text? (Choose three.) SNMPv3 FTP Telnet SSH SNMPv1 and 2 HTTPS Bottom of Form

Top of Form What process determines which commands and resources are made available to a user? administration authentication accounting authorization access control Bottom of Form

Top of Form The act of asking for a username and password credentials and evaluating those credentials is known as which of the following? authentication authorization administration access control accounting Bottom of Form

What is the maximum number of methods that can be specified in an AAA authentication method list?
	1
	4
	6
	unlimited

Which command is used to display TACACS+ configuration and setting information?
	show authentication
	show tacacs
	show statistics tacacs
	show tacacs settings

Which keyword is used for minimal accounting and sends a stop record accounting notice at the end of the requested user process?
	stop-only
	start-stop
	wait-stop
	end-stop

Top of Form Which statement is correct when the no service password-recovery command is used? Users will still be able to access ROMMON mode to install a new flash image. Users will still be able to access ROMMON mode to configure interface configurations to access a local TFTP server. Users will still be able to access ROMMON mode to configure Reverse Telnet features. Users are no longer able to access ROMMON mode for any reason. Bottom of Form

Which statement about the login block-for 15 attempts 3 within 5 command is true?
	The hosts that are predefined in the ACL are not subjected to the quiet time.
	After 10 login attempts, the quiet period will start.
	Connection attempts made via Telnet and SSH are not affected by the quiet period.
	Once the quiet period is activated, it will last for 15 seconds.
	This command only applies to hosts defined by ACL 15.

Which sequence of steps is recommended for worm attack mitigation?
	Step 1: Containment Step 2: Inoculation Step 3: Quarantine Step 4: Treatment
	Step 1: Containment Step 2: Quarantine Step 3: Inoculation Step 4: Treatment
	Step 1: Inoculation Step 2: Containment Step 3: Quarantine Step 4: Treatment
	Step 1: Inoculation Step 2: Quarantine Step 3: Containment Step 4: Treatment
	Step 1: Quarantine Step 2: Containment Step 3: Inoculation Step 4: Treatment
	Step 1: Quarantine Step 2: Inoculation Step 3: Containment Step 4: Treatment

Top of Form Which two statements about network attacks that use intelligence are true? (Choose two.) DoS, DDos, trust exploitation, and viruses, are examples of network attacks that are based on intelligence. DoS, DDos, viruses, Trojan horses, and worms are examples of network attacks that are based on intelligence. Human interaction is required to facilitate the spread of a virus. Human interaction is required to facilitate the spread of a worm. The anatomy of a worm consists of containment, inoculation, and quarantine. The anatomy of a worm consists of the enabling vulnerability, a propagation mechanism, and the payload. Bottom of Form

Which two statements are true about network attacks that use intelligence? (Choose two.)
	A Trojan horse can contain a worm.
	A virus can contain a Trojan horse and worms.
	A worm can contain a Trojan horse.
	A worm can contain a Trojan horse and viruses.
	A worm executes and installs copies of itself in the memory of the infected computer.

Top of Form Which two statements about console ports on Cisco routers are true? (Choose two.) It is always possible to activate ROMMON mode via the use of the hard BREAK sequence through the console port. By default, the Cisco router console port allows a hard BREAK signal within 60 seconds of a reboot to interrupt the normal boot sequence. The command no service password-recovery restricts access to ROMMON mode through the console port. By default, the Cisco router console port allows a hard BREAK signal within 90 seconds of a reboot to interrupt the normal boot sequence. The console line-level password can be used to prevent someone from issuing a hard BREAK signal if he or she gains physical access to the router. Bottom of Form

Which range of custom privilege levels can be configured on Cisco routers?
	1 through 15
	0 through 14
	1 through 16
	2 through 14
	2 through 15
	0 through 15

Refer to the exhibit. On the basis of the information that is presented, which is the likely reason that the user is unable to telnet to router RTA?
	The login authentication DEFAULT command is missing in line vty 0 4 configuration mode.
	The vty lines have not been configured, so by default telnet access is denied.
	The login command is missing in line vty 0 4 configuration mode.
	AAA has not been configured on RTB.
	Telnet has been restricted outgoing on RTB.

Refer to the exhibit. A user from router RTB attempts a Telnet session to router RTA with the username User and password cisco. A debug of aaa authentication indicates an error. On the basis of the information provided, what is the problem?
	The login authentication default command is missing in line vty 0 4 configuration mode.
	The login authentication default-list command is missing in line vty 0 4 configuration mode.
	The login command is missing in line vty 0 4 configuration mode.
	The peer relationship with the TACACS+ server is unknown.
	The TACACS+ server address and key have not been configured.
	The user entered an invalid username and password.

Which two benefits does stateful packet filtering have over packet filtering or application layer gateways? (Choose two.)
	requires less memory
	does not require CEF
	modifies the source of traffic
	has higher performance
	operates mainly at the network layer
	is application-aware

Top of Form Which two devices are fully contained inside a DMZ? (Choose two.) application layer gateway (ALG) public web servers internal mail servers external router DHCP server Bottom of Form

Which statement is true about configuring the Cisco IOS Firewall interfaces?
	Only one interface can be configured on a device, and the direction can be configured for both inbound and outbound.
	Only one interface can be configured on a device, and the direction can be configured for either inbound or outbound.
	More than one interface can be configured on a device, but rules can only be applied in a single direction.
	More than one interface can be configured on a device, and a separate rule can be configured for the inbound and outbound direction, respectively.

Which Cisco IOS Firewall feature statement is true?
	Administrators cannot define their own custom IPS signatures.
	Cisco IOS Firewall cannot filter UDP packets.
	The authentication proxy is compatible with other Cisco IOS security features, such as NAT, IPsec, and VPN client software.
	The Cisco IOS Firewall feature set can only be configured using the SDM.
	The Cisco IOS Firewall feature set is included on all IOS 12.4 images or higher.
	When a match against a signature is detected by the Cisco IOS Firewall IPS, it can be configured to reset a UDP connection.

What are the two guidelines for applying inspection rules and ACLs on the router interface where traffic initiates? (Choose two.)
	Apply a rule in the inbound direction that inspects wanted traffic.
	Apply a rule in the outbound direction that inspects wanted traffic.
	In the inbound direction apply an ACL that permits only wanted traffic.
	In the outbound direction apply an ACL that permits only wanted traffic.
	In the inbound direction apply an ACL to deny all traffic that has not been inspected by the firewall.

What is the primary use of the state information on a Cisco IOS Firewall?
	to enable logging of traffic
	to verify the content of the traffic
	to allow deeper packet inspection for stateless protocols such as UDP, as well as for more complex protocols including GRE and IPsec
	to allow a temporary opening in the ACL and permit return traffic based on permissible sessions
	to eliminate the possibility of embryonic connections

Which two statements about the use of a Cisco IOS firewall are true? (Choose two.)
	The Cisco IOS Firewall provides stateful packet filtering.
	Standard ACLs are no longer needed when the Cisco IOS Firewall is being used.
	The Cisco IOS Firewall is unable to detect fragmented packets.
	The Cisco IOS Firewall is application-aware and can inspect a session in more detail than can packet filtering.
	The Cisco IOS Firewall can handle UDP connections in the exact same manner that TCP connections are handled.

Which three statements about router services are true? (Choose three.)
	BOOTP server is disabled by default and should be enabled to support DHCP.
	Configuration auto-loading is enabled by default but should be disabled if not required.
	Finger service is enabled by default but should be disabled if not required.
	ICMP unreachable notifications are enabled by default but should be disabled on untrusted interfaces.
	Proxy ARP is disabled by default and should remain disabled if not required.
	TCP keepalives are disabled by default but should be enabled globally.

Which two statements about router services are true? (Choose two.)
	Cisco Discovery Protocol (CDP) is enabled by default but should be disabled if not required.
	The FTP server is enabled by default but should be disabled if not required.
	ICMP redirects are enabled by default and should remain enabled.
	IP source routing is enabled by default and should remain enabled.
	The Network Time Protocol (NTP) is enabled by default but should be disabled if not required.
	Simple Network Management Protocol (SNMP) is enabled by default but should be disabled if not required.

Refer to the exhibit. Based on the IOS firewall configuration, which statement is true?
	Incoming traffic that matches state table entries will be logged.
	All incoming IP traffic on the outside interface will be blocked unless the traffic matches state table entries.
	ICMP packet-too-big messages incoming on the outside interface will not match in the state table but will be permitted.
	All incoming traffic on the outside interface will be logged.

Refer to the exhibit. A configuration has been applied by one of the SDM Firewall wizards. On the basis of the information in the exhibit, which statement is true?
	Double-clicking the field name Source will sort the list alphabetically in ascending or descending order.
	Firewall features should only be applied in an outbound direction.
	Interface Fa0/0 is on the inside trusted network.
	The IOS firewall configuration is incomplete.
	The firewall will filter and deny CUSseeMe protocol traffic.

How are Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) components used conjunctively?
	The IDS blocks offending traffic and the IPS verifies that offending traffic was blocked.
	The IDS will send alert messages about "gray area" traffic while the IPS will block malicious traffic.
	The IPS will block all traffic that the IDS does not mark as legitimate.
	The IPS will send alert messages when the IDS sends traffic through that is marked as malicious.

Refer to the exhibit. The exhibit illustrates the Cisco Express Forwarding (CEF) switching architecture and the tables that it references. Each table is identified by the label on its left. Which list correctly identifies the table names?
	A = Adjacency Table B = ARP Cache C = BGP Table D = FIB Table (CEF Cache) E = IP Routing Table
	A = BGP Table B = IP Routing Table C = Adjacency Table D = FIB Table (CEF Cache) E = ARP Cache
	A = BGP Table B = IP Routing Table C = FIB Table (CEF Cache) D = Adjacency Table E = ARP Cache
	A = IP Routing Table B = BGP Table C = Adjacency Table D = ARP Cache E = FIB Table (CEF Cache)
	A = IP Routing Table B = BGP Table C = Adjacency Table D = FIB Table (CEF Cache) E = ARP Cache