Guaranteed of passleader 400 101 dumps materials and prep for Cisco certification for client, Real Success Guaranteed with Updated ccie 400 101 pdf dumps vce Materials. 100% PASS CCIE Routing and Switching (v5.0) exam Today!


♥♥ 2021 NEW RECOMMEND ♥♥

Free VCE & PDF File for Cisco 400-101 Real Exam (Full Version!)

★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW 400-101 Exam Dumps (PDF & VCE):
Available on: http://www.surepassexam.com/400-101-exam-dumps.html

Q431. Which two statements about port ACLs are true? (Choose two.) 

A. Port ACLs are supported on physical interfaces and are configured on a Layer 2 interface on a switch. 

B. Port ACLs support both outbound and inbound traffic filtering. 

C. When it is applied to trunk ports, the port ACL filters only native VLAN traffic. 

D. When it is applied to a port with voice VLAN, the port ACL filters both voice and data VLAN traffic. 

Answer: A,D 

Explanation: 

PACLs filter incoming traffic on Layer 2 interfaces, using Layer 3 information, Layer 4 header information, or non-IP Layer 2 information The port ACL (PACL) feature provides the ability to perform access control on specific Layer 2 ports. A Layer 2 port is a physical LAN or trunk port that belongs to a VLAN. Port ACLs perform access control on all traffic entering the specified Layer 2 port, including voice and data VLANs that may be configured on the port. Port ACLs are applied only on the ingress traffic. 

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/port_acls.html 


Q432. Which two protocols are used to establish IPv6 connectivity over an MPLS network? (Choose two.) 

A. 6PE 

B. 6VPE 

C. RSVP 

D. ISATAP 

E. LDP 

F. IPv6IP 

Answer: A,B 


Q433. Which three protocols support SSM? (Choose three.) 

A. IGMPv2 

B. IGMPv3 

C. IGMP v3lite 

D. URD 

E. CGMP 

F. IGMPv1 

Answer: B,C,D 


Q434. Refer to the exhibit. 

Which two statements about the output are true? (Choose two.) 

A. 802.1D spanning tree is being used. 

B. Setting the priority of this switch to 0 for VLAN 1 would cause it to become the new root. 

C. The hello, max-age, and forward delay timers are not set to their default values. 

D. Spanning-tree PortFast is enabled on GigabitEthernet1/1. 

Answer: A,B 

Explanation: 

802.1D is the standard for Spanning tree, which is being used here. For priority, The priority order starts from 0 (yes, 0 is valid) and then increases in 4096. 0, 4096, 8192, 12288, …. Etc. 

The lower the number is, the higher is the priority. Here we see that the current root has a priority of 8192, so configuring this with a priority of 0 will make it the new root. 


Q435. DRAG DROP 

Drag and drop each PHB on the left to the functionality it performs on the right. 

Answer: 


Q436. Refer to the exhibit. 

Which action will solve the error state of this interface when connecting a host behind a Cisco IP phone? 

A. Configure dot1x-port control auto on this interface 

B. Enable errdisable recovery for security violation errors 

C. Enable port security on this interface 

D. Configure multidomain authentication on this interface 

Answer: D 

Explanation: 

In single-host mode, a security violation is triggered when more than one device are detected on the data vlan. In multidomain authentication mode, a security violation is triggered when more than one device are detected on the data or voice VLAN. Here we see that single host mode is being used, not multidomain mode. 

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/50sg/configuration/guide/Wrapper-46SG/dot1x.html#wp1309041 


Q437. Which three options are characteristics of a Type 10 LSA? (Choose three.) 

A. It is an area-local, opaque LSA. 

B. Data is flooded to all routers in the LSA scope. 

C. It is used for traffic-engineering extensions to OSPF. 

D. It is a link-local, opaque LSA. 

E. Data is flooded only to the routers in the LSA scope that understand the data. 

F. It is used for traffic-engineering extensions to LDP. 

Answer: A,B,C 


Q438. Refer to the exhibit. 

The device with this configuration is unable to reach network 172.31.31.0/24. The next hop router has been verified to have full connectivity to the network. Which two actions can you take to establish connectivity to the network? (Choose two.) 

A. Create a static route to 172.16.199.0 using the address of the next hop router. 

B. Create a default route to the link address of the next hop router. 

C. Create a static route to the loopback address of the next hop router. 

D. Create a default route to 172.16.199.9. 

E. Modify the existing static route so that the next hop is 0.0.0.0. 

F. Replace the ip default-network command with the ip default-gateway command. 

Answer: A,B 

Explanation: 

Unlike the ip default-gateway command, you can use ip default-network when ip routing is enabled on the Cisco router. When you configure ip default-network the router considers routes to that network for installation as the gateway of last resort on the router. 

For every network configured with ip default-network, if a router has a route to that network, that route is flagged as a candidate default route. However, in this case if the router does not a route to the drfault network of 172.16.199.9, then you would need to ensure that this route exisits by creating a static route to 172.16.199.0 using the address of the next hop router, or simply create a default route using the address of the next hop router. 


Q439. Which three condition types can be monitored by crypto conditional debug? (Choose three.) 

A. Peer hostname 

B. SSL 

C. ISAKMP 

D. Flow ID 

E. IPsec 

F. Connection ID 

Answer: A,D,F 

Explanation: 

Supported Condition Types 

The new crypto conditional debug CLIs--debug crypto condition, debug crypto condition unmatched, and show crypto debug-condition--allow you to specify conditions (filter values) in which to generate and display debug messages related only to the specified conditions. The table below lists the supported condition types. 

Table 1 Supported Condition Types for Crypto Debug CLI 

Condition Type (Keyword) 

Description 

connid 1 

An integer between 1-32766. Relevant debug messages will be shown if the current IPSec operation uses this value as the connection ID to interface with the crypto engine. 

flowid 1 

An integer between 1-32766. Relevant debug messages will be shown if the current IPSec operation uses this value as the flow-ID to interface with the crypto engine. 

FVRF 

The name string of a virtual private network (VPN) routing and forwarding (VRF) instance. Relevant debug messages will be shown if the current IPSec operation uses this VRF instance as its front-door VRF (FVRF). 

IVRF 

The name string of a VRF instance. Relevant debug messages will be shown if the current IPSec operation uses this VRF instance as its inside VRF (IVRF). 

peer group 

A Unity group-name string. Relevant debug messages will be shown if the peer is using this group name as its identity. 

peer hostname 

A fully qualified domain name (FQDN) string. Relevant debug messages will be shown if the peer is using this string as its identity; for example, if the peer is enabling IKE Xauth with this FQDN string. 

peeripaddress 

A single IP address. Relevant debug messages will be shown if the current IPSec operation is related to the IP address of this peer. 

peer subnet 

A subnet and a subnet mask that specify a range of peer IP addresses. Relevant debug messages will be shown if the IP address of the current IPSec peer falls into the specified subnet range. 

peer username 

A username string. Relevant debug messages will be shown if the peer is using this username as its identity; for example, if the peer is enabling IKE Extended Authentication (Xauth) with this username. 

SPI 1 

A 32-bit unsigned integer. Relevant debug messages will be shown if the current IPSec operation uses this value as the SPI. 

Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-crypto-debug-sup.html 


Q440. Which two options are required parts of an EEM policy? (Choose two.) 

A. event register keyword 

B. body 

C. environment must defines 

D. namespace import 

E. entry status 

F. exit status 

Answer: A,B 

Explanation: 

EEM policies require two parts: the event register keyword and the body. The remaining 

parts of the policy are optional: environment must defines, namespace import, entry status, 

and exit status (Figure 5). 

Figure 5. EEM Policy Parts 

Reference: http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-

embedded-event-manager-eem/config_guide_eem_configuration_for_cisco_integrated_services_router_platforms.htm