Q321. Which three statements about GET VPN are true? (Choose three.)
A. It encrypts WAN traffic to increase data security and provide transport authentication.
B. It provides direct communication between sites, which reduces latency and jitter.
C. It can secure IP multicast, unicast, and broadcast group traffic.
D. It uses a centralized key server for membership control.
E. It enables the router to configure tunnels.
F. It maintains full-mesh connectivity for IP networks.
Answer: A,B,D
Explanation:
Cisco GET VPN Features and Benefits
Feature
Description and Benefit
Key Services
Key Servers are responsible for ensuring that keys are granted to authenticated and authorized devices only. They maintain the freshness of the key material, pushing re-key messages as well as security policies on a regular basis. The chief characteristics include:
. Key Servers can be located centrally, granting easy control over membership.
. Key Servers are not in the "line of fire" - encrypted application traffic flows directly between VPN end points without a bottleneck or an additional point of failure.
. Supports both local and global policies, applicable to all members in a group - such as "Permit any any", a policy to encrypt all traffic.
. Supports IP Multicast to distribute and manage keys, for improved efficiency; Unicast is also supported where IP Multicast is not possible.
Scalability and Throughput
. The full mesh nature of the solution allows devices to communicate directly with each other, without requiring transport through a central hub; this minimizes extra encrypts and decrypts at the hub router; it also helps minimize latency and jitter.
. Efficient handling of IP Multicast traffic by using the core network for replication can boost effective throughput further
Security
Provides data security and transport authentication, helping to meet security compliance and internal regulation by encrypting all WAN traffic
Reference: http://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/product_data_sheet0900aecd80582067.html
Q322. What is a reason for an EIGRP router to send an SIA reply to a peer?
A. to respond to an SIA query with the alternative path requested
B. to respond to a query reporting that the prefix has gone stuck-in-active
C. to respond to an SIA query that the router is still waiting on replies from its peers
D. to respond to a reply reporting that the prefix has gone stuck-in-active
Answer: C
Q323. DRAG DROP
Drag and drop the StackWise stack master election rule on the left into the correct priority order on the right.
Answer:
Q324. Which three statements describe the characteristics of a VPLS architecture? (Choose three.)
A. It forwards Ethernet frames.
B. It maps MAC address destinations to IP next hops.
C. It supports MAC address aging.
D. It replicates broadcast and multicast frames to multiple ports.
E. It conveys MAC address reachability information in a separate control protocol.
F. It can suppress the flooding of traffic.
Answer: A,C,D
Explanation:
As a VPLS forwards Ethernet frames at Layer 2, the operation of VPLS is exactly the same as that found within IEEE 802.1 bridges in that VPLS will self learn source MAC address to port associations, and frames are forwarded based upon the destination MAC address. Like other 802.1 bridges, MAC address aging is supported.
Reference: http://www.cisco.com/en/US/products/hw/routers/ps368/products_white_paper09186a0080 1f6084.shtml
Q325. In which two modes do IPv6-in-IPv4 tunnels operate? (Choose two.)
A. tunnel mode
B. transport mode
C. 6to4 mode
D. 4to6 mode
E. ISATAP mode
Answer: C,E
Explanation:
*There are 5 tunneling solution in IPv6:*
*1. Using the “Tunnel mode ipv6ip”, in this case the tunnel source and destination are configured with IPv4 addressing and the tunnel interface is configured with IPv6. This will use protocol 41. This is used for IPv6/IPv4.
*
R1(config)#int tunnel 1
R1(config-if)#ipv6 address 12:1:12::1/64
R1(config-if)#tunnel source 10.1.12.1
R1(config-if)#tunnel destination 10.1.12.2
R1(config-if)#*tunnel mode ipv6ip*
*
2. Using the “Tunnel mode gre ipv6, in this case the tunnel source and destination are all configured with IPv6 addressing. This is used for IPv6/IPv6.
*
BB1(config)#int tunnel 1
BB1(config-if)#ipv6 address 121:1:121::111/64
BB1(config-if)#tunnel source 10:1:111::111
BB1(config-if)#tunnel destination 10:1:112::112
BB1(config-if)#*tunnel mode gre ipv6*
*3.
In this case, the third type, the tunnel mode is NOT used at all, note that the tunnel interface is configured with IPv6 and the tunnel source and destination is configured with IPv4 but no mention of tunnel mode. This configuration will use protocol 47. This is used for IPv6/IPv4.
*
R1(config)#int tunnel 13
R1(config-if)#ipv6 address 13:1:13::1/64
R1(config-if)#tunnel source 10.1.13.1
R1(config-if)#tunnel destination 10.1.13.3
*4. Note in this case a special addressing is assigned to the tunnel interface which is a concatenation of a reserved IPv6 address of 2002followed by the translated IPv4 address of a given interface on the router. In this configuration ONLY the tunnel source address is used and since the tunnel is automatic, the destination address is NOT configured. The tunnel mode is set to “Tunnel mode ipv6ip 6to4. Note the IPv4 address of 10.1.1.1 is translated to 0A.01.01.01 and once concatenated, it will be “2002:0A01:0101: or 2002:A01:101. This is used for IPv6/IPv4.
*
R1(config)#interface Tunnel14
R1(config-if)#ipv6 address 2002:A01:101::/128
R1(config-if)#tunnel source 10.1.1.1
R1(config-if)#*tunnel mode ipv6ip 6to4*
*5. ISATAP, ISATAP works like 6to4 tunnels, with one major difference, it uses a special IPv6 address which is formed as follows: *
*In this tunnel mode, the network portion can be any IPv6 address, whereas in 6to4 it had to start with 2002.*
*Note when the IPv6 address is assigned to the tunnel interface, the “eui-64 is used, in this case the host portion of the IPv6 address starts with “0000.5EFE” and then the rest of the host portion is the translated IPv4 address of the tunnel’s source IPv4 address. This translation is performed automatically unlike 6to4. This is used for IPv6/IPv4.*
R4(config)#int tunnel 46
R4(config-if)#ipv6 address 46:1:46::/64 eui-64
R4(config-if)#tunnel source 10.44.44.44
R4(config-if)#*tunnel mode ipv6ip ISATAP*
Q326. Refer to the exhibit.
R3 is failing to join the multicast group 224.1.1.1 that is sourcing from R1. Which two actions can you take to allow multicast traffic to flow correctly? (Choose two.)
A. Remove the static multicast route on R1.
B. Configure OSPF on R1 and R3 to include the tunnel interfaces.
C. Add an additional static multicast route on R2 for multicast group 224.1.1.1 toward R3.
D. Replace the static multicast route on R1 to send traffic toward R2.
E. Remove the static unicast route on R1.
F. Add an additional static unicast route on R2 toward the loopback interface of R3.
Answer: A,B
Explanation:
Since the tunnel interfaces are not part of OSPF, the best path to the multicast source of R1 from R3 would be over the Gi0/0 path via OSPF. However, the static mroute is configured to use the tunnel, so this causes an RPF failure used in Sparse Mode. Best fix is to add the tunnel interfaces into OSPF and remove the static mroute so that that the RPF check no longer fails.
Q327. Refer to the exhibit.
Which two pieces of information in this Wireshark capture indicate that you are viewing EIGRP traffic? (Choose two.)
A. the header length
B. the protocol number
C. the destination address
D. the Class Selector
E. the source address
F. the header checksum
Answer: B,C
Explanation:
EIGRP uses protocol number 88, which shows as EIGRP in the capture. Also, we in the capture that the destination IP address is 224.0.0.10, which is the Enhanced Interior Gateway Routing Protocol (EIGRP) group address is used to send routing information to all EIGRP routers on a network segment.
Q328. Which two statements about 802.1Q tunneling are true? (Choose two.)
A. It requires a system MTU of at least 1504 bytes.
B. The default configuration sends Cisco Discovery Protocol, STP, and VTP information.
C. Traffic that traverses the tunnel is encrypted.
D. It is supported on private VLAN ports.
E. MAC-based QoS and UDLD are supported on tunnel ports.
F. Its maximum allowable system MTU is 1546 bytes.
Answer: A,E
Q329. Refer to the exhibit.
Assuming that the peer is configured correctly and the interface is up, how many neighbors will be seen in the EIGRPv6 neighbor table on this IPv6-only router?
A. one neighbor, which will use a local router-id of 6010. AB8. . /64
B. one neighbor, which will use a local router-id of 6020. AB8. . /64
C. none, because EIGRPv6 only supports authenticated peers
D. none, because of the mismatch of timers
E. none, because there is no EIGRP router ID configured
Answer: E
Explanation:
Configuring EIGRP for IPv6 has some restrictions; they are listed below:
. The interfaces can be directly configured with EIGRP for IPv6, without the use of a global IPv6 address. There is no network statement in EIGRP for IPv6.
. The router ID needs to be configured for an EIGRPv6 protocol instance before it can run.
. EIGRP for IPv6 has a shutdown feature. Ensure that the routing process is in "no shut" mode to start running the protocol.
Reference: http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/113267-eigrp-ipv6-00.html
Q330. Which statement is true about conditional advertisements?
A. Conditional advertisements create routes when a predefined condition is met.
B. Conditional advertisements create routes when a predefined condition is not met.
C. Conditional advertisements delete routes when a predefined condition is met.
D. Conditional advertisements create routes and withhold them until a predefined condition is met.
E. Conditional advertisements do not create routes, they only withhold them until a predefined condition is met.
Answer: E
Explanation:
The Border Gateway Protocol (BGP) conditional advertisement feature provides additional control of route advertisement, depending on the existence of other prefixes in the BGP table. Normally, routes are propagated regardless of the existence of a different path. The BGP conditional advertisement feature uses the non-exist-map and the advertise-map keywords of the neighbor advertise-map command in order to track routes by the route prefix. If a route prefix is not present in output of the non-exist-map command, then the route specified by the advertise-map command is announced. This feature is useful for multihomed networks, in which some prefixes are advertised to one of the providers only if information from the other provider is not present (this indicates a failure in the peering session or partial reachability).
Reference: http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/16137-cond-adv.html