2016NEW Cisco.CCIE.(400-101)EXAM] CCIE Routing and Switching EXAM A PART16 (361-380) VCE DUMPS FOR FREE DOWNLOAD WITH 100%PASS ENSURE

Do you want to pass the 400-101 Examsavior exam? What are the new questions of the latest 400-101 exam? Examsavior 400-101 VCE dumps and 400-101 PDF dumps will tell you all about the 400-101 Examsavior exam.Here are the Examsavior newest and covered all new added questions and answers, which will help you 100% passing  400-101 Examsavior exam.Hurry up and get the free exam from here!

NOW FREE DOWNLOAD

QUESTION 361

Refer to the exhibit.

What is a possible reason for the IPSEC tunnel not establishing?

A. The peer is unreachable.

B. The transform sets do not match.

C. The proxy IDs are invalid.

D. The access lists do not match.

Correct Answer: D

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

Proxy Identities Not Supported

This message appears in debugs if the access list for IPsec traffic does not match.

1d00h: IPSec(validate_transform_proposal): proxy identities not supported

1d00h: ISAKMP: IPSec policy invalidated proposal

1d00h: ISAKMP (0:2): SA not acceptable!

The access lists on each peer needs to mirror each other (all entries need to be reversible). This example illustrates this point.

Peer A

access-list 150 permit ip 172.21.113.0 0.0.0.255 172.21.114.0 0.0.0.255

access-list 150 permit ip host 15.15.15.1 host 172.21.114.123

Peer B

access-list 150 permit ip 172.21.114.0 0.0.0.255 172.21.113.0 0.0.0.255

access-list 150 permit ip host 172.21.114.123 host 15.15.15.1

Reference. http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike- protocols/5409-ipsec-debug-00.html#proxy

QUESTION 362

What is a key advantage of Cisco GET VPN over DMVPN?

A. Cisco GET VPN provides zero-touch deployment of IPSEC VPNs.

B. Cisco GET VPN supports certificate authentication for tunnel establishment.

C. Cisco GET VPN has a better anti-replay mechanism.

D. Cisco GET VPN does not require a secondary overlay routing infrastructure.

Correct Answer: D

Section: VPN TechnologiesExplanation

Explanation/Reference:

Explanation:

DMVPN requires overlaying a secondary routing infrastructure through the tunnels, which results in suboptimal routing while the dynamic tunnels are built. The

overlay routing topology also reduces the inherent scalability of the underlying IP VPN network topology.

Traditional point-to-point IPsec tunneling solutions suffer from multicast replication issues because multicast replication must be performed before tunnel

encapsulation and encryption at the IPsec CE (customer edge) router closest to the multicast source. Multicast replication cannot be performed in the provider

network because encapsulated multicasts appear to the core network as unicast data.

Cisco’s Group Encrypted Transport VPN (GET VPN) introduces the concept of a trusted group to eliminate point-to-point tunnels and their associated overlay

routing. All group members (GMs) share a common security association (SA), also known as a group SA. This enables GMs to decrypt traffic that was encrypted

by any other GM. (Note that IPsec CE acts as a GM.) In GET VPN networks, there is no need to negotiate point-to- point IPsec tunnels between the members of a

group, because GET VPN is “tunnel-less.”

Reference. Group Encrypted Transport VPN (Get VPN) Design and Implementation Guide PDF

QUESTION 363

Refer to the exhibit.

What is wrong with the configuration of the tunnel interface of this DMVPN Phase II spoke router?

A. The interface MTU is too high.

B. The tunnel destination is missing.

C. The NHRP NHS IP address is wrong.

D. The tunnel mode is wrong.

Correct Answer: D

Section: VPN Technologies

ExplanationExplanation/Reference:

Explanation:

By default, tunnel interfaces use GRE as the tunnel mode, but a DMVPN router needs to be configured for GRE multipoint by using the “tunnel mode gre

multipoint” interface command.

QUESTION 364

Which two statements are true about VPLS? (Choose two.)

A. It can work over any transport that can forward IP packets.

B. It provides integrated mechanisms to maintain First Hop Resiliency Protocols such as HSRP, VRRP, or GLBP.

C. It includes automatic detection of multihoming.

D. It relies on flooding to propagate MAC address reachability information.

E. It can carry a single VLAN per VPLS instance.

Correct Answer: DE

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

VPLS relies on flooding to propagate MAC address reachability information. Therefore, flooding cannot be prevented.

VPLS can carry a single VLAN per VPLS instance. To multiplex multiple VLANs on a single instance, VPLS uses IEEE QinQ.

Reference. http://www.cisco.com/c/en/us/products/collateral/switches/nexus-7000-series- switches/white_paper_c11-574984.html

QUESTION 365

Refer to the exhibit.

What will be the extended community value of this route?

A. RT:200:3000 RT:200:9999

B. RT:200:9999 RT:200:3000

C. RT:200:3000

D. RT:200:9999

Correct Answer: D

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

Here the route map is being used to manually set the extended community RT to 200:9999

QUESTION 366

Refer to the exhibit.

Which statement is true?

A. There is an MPLS network that is running 6PE, and the ingress PE router has no mpls ip propagate-ttl.

B. There is an MPLS network that is running 6VPE, and the ingress PE router has no mpls ip propagate-ttl.

C. There is an MPLS network that is running 6PE or 6VPE, and the ingress PE router has mpls ip propagate-ttl.

D. There is an MPLS network that is running 6PE, and the ingress PE router has mpls ip propagate- ttl.

E. There is an MPLS network that is running 6VPE, and the ingress PE router has mpls ip propagate-ttl.

Correct Answer: C

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

The second hop shows and IPV6 address over MPLS, so we know that there is an MPLS network running 6PE or 6VPE. And because the second and third hopsshow up in the traceroute. Then TTL is being propagated because if the “no ip propagate-ttl” command was used these devices would be hidden in the traceroute.

QUESTION 367

Refer to the exhibit.

Which statement is true about a VPNv4 prefix that is present in the routing table of vrf one and is advertised from this router?

A. The prefix is advertised only with route target 100:1.

B. The prefix is advertised with route targets 100:1 and 100:2.

C. The prefix is advertised only with route target 100:3.

D. The prefix is not advertised.

E. The prefix is advertised with route targets 100:1, 100:2, and 100:3.

Correct Answer: A

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

The route target used for prefix advertisements to other routers is defined on the route-target export command, which shows 100:1 in this case for VPNv4 routes.

QUESTION 368

Which is the way to enable the control word in an L2 VPN dynamic pseudowire connection on router R1?A. R1(config)# pseudowire-class cw-enable

R1(config-pw-class)# encapsulation mpls

R1(config-pw-class)# set control-word

B. R1(config)# pseudowire-class cw-enable

R1(config-pw-class)# encapsulation mpls

R1(config-pw-class)# enable control-word

C. R1(config)# pseudowire-class cw-enable

R1(config-pw-class)# encapsulation mpls

R1(config-pw-class)# default control-word

D. R1(config)# pseudowire-class cw-enable

R1(config-pw-class)# encapsulation mpls

R1(config-pw-class)# control-word

Correct Answer: D

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

The following example shows how to enable the control word in an AToM dynamic pseudowire connection:

Device(config)# pseudowire-class cw-enable

Device(config-pw-class)# encapsulation mpls

Device(config-pw-class)# control-word

Device(config-pw-class)# exit

Reference. http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mpls/command/mp-cr-book/mp- a1.html

QUESTION 369

Where is multicast traffic sent, when it is originated from a spoke site in a DMVPN phase 2 cloud?

A. spoke-spoke

B. nowhere, because multicast does not work over DMVPN

C. spoke-spoke and spoke-hub

D. spoke-hub

Correct Answer: D

Section: VPN Technologies

ExplanationExplanation/Reference:

Explanation:

Spokes map multicasts to the static NBMA IP address of the hub, but hub maps multicast packets to the “dynamic” mappings that is, the hub replicates multicast

packets to all spokes registered via NHRP, so multicast traffic is sent to the hub from a spoke instead of to the other spokes directly.

QUESTION 370

Refer to the exhibit.

A spoke site that is connected to Router-A cannot reach a spoke site that is connected to Router-B, but both spoke sites can reach the hub. What is the likely

cause of this issue?

A. There is a router doing PAT at site B.

B. There is a router doing PAT at site A.

C. NHRP is learning the IP address of the remote spoke site as a /32 address rather than a /24 address.

D. There is a routing issue, as NHRP registration is working.

Correct Answer: B

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

If one spoke is behind one NAT device and another different spoke is behind another NAT device, and Peer Address Translation (PAT) is the type of NAT used on

both NAT devices, then a session initiated between the two spokes cannot be established.Reference.

http://www.cisco.com/c/en/us/td/docs/ios/ios_xe/sec_secure_connectivity/configuration/guide/conv ert/sec_dmvpn_xe_3s_book/

sec_dmvpn_dt_spokes_b_nat_xe.html

QUESTION 371

Which three statements are functions that are performed by IKE phase 1? (Choose three.)

A. It builds a secure tunnel to negotiate IKE phase 1 parameters.

B. It establishes IPsec security associations.

C. It authenticates the identities of the IPsec peers.

D. It protects the IKE exchange by negotiating a matching IKE SA policy.

E. It protects the identities of IPsec peers.

F. It negotiates IPsec SA parameters.

Correct Answer: CDE

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

The basic purpose of IKE phase 1 is to authenticate the IPSec peers and to set up a secure channel between the peers to enable IKE exchanges. IKE phase 1

performs the following functions:

Authenticates and protects the identities of the IPSec peers

Negotiates a matching IKE SA policy between peers to protect the IKE exchange

Performs an authenticated Diffie-Hellman exchange with the end result of having matching shared secret keys

Sets up a secure tunnel to negotiate IKE phase 2 parameters

Reference. http://www.ciscopress.com/articles/article.asp?p=25474&seqNum=7

QUESTION 372

The session status for an IPsec tunnel with IPv6-in-IPv4 is down with the error message IKE message from 10.10.1.1 failed its sanity check or is malformed.

Which statement describes a possible cause of this error?

A. There is a verification failure on the IPsec packet.

B. The SA has expired or has been cleared.

C. The pre-shared keys on the peers are mismatched.

D. There is a failure due to a transform set mismatch.

E. An incorrect packet was sent by an IPsec peer.Correct Answer: C

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

IKE Message from X.X.X.X Failed its Sanity Check or is Malformed

This debug error appears if the pre-shared keys on the peers do not match. In order to fix this issue, check the pre-shared keys on both sides.

1d00H:%CRPTO-4-IKMP_BAD_MESSAGE. IKE message from 150.150.150.1 failed its sanity check or is malformed.

Reference. http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike- protocols/5409-ipsec-debug-00.html#ike

QUESTION 373

Which three statements describe the characteristics of a VPLS architecture? (Choose three.)

A. It forwards Ethernet frames.

B. It maps MAC address destinations to IP next hops.

C. It supports MAC address aging.

D. It replicates broadcast and multicast frames to multiple ports.

E. It conveys MAC address reachability information in a separate control protocol.

F. It can suppress the flooding of traffic.

Correct Answer: ACD

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

As a VPLS forwards Ethernet frames at Layer 2, the operation of VPLS is exactly the same as that found within IEEE 802.1 bridges in that VPLS will self learn

source MAC address to port associations, and frames are forwarded based upon the destination MAC address. Like other 802.1 bridges, MAC address aging is

supported.

Reference.

http://www.cisco.com/en/US/products/hw/routers/ps368/products_white_paper09186a00801f6084.

shtml

QUESTION 374

A GRE tunnel is down with the error message %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing error.Which two options describe possible causes of the error? (Choose two.)

A. Incorrect destination IP addresses are configured on the tunnel.

B. There is link flapping on the tunnel.

C. There is instability in the network due to route flapping.

D. The tunnel mode and tunnel IP address are misconfigured.

E. The tunnel destination is being routed out of the tunnel interface.

Correct Answer: CE

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

The %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing error message means that the generic routing encapsulation (GRE) tunnel

router has discovered a recursive routing problem. This condition is usually due to one of these causes:

A misconfiguration that causes the router to try to route to the tunnel destination address using the tunnel interface itself (recursive routing)

A temporary instability caused by route flapping elsewhere in the network

Reference. http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing- protocol-eigrp/22327-gre-flap.html

QUESTION 375

Refer to the exhibit.

Which two statements about the VPN solution are true? (Choose two.)

A. Customer A and customer B will exchange routes with each other.

B. R3 will advertise routes received from R1 to R2.

C. Customer C will communicate with customer A and B.

D. Communication between sites in VPN1 and VPN2 will be blocked.

E. R1 and R2 will receive VPN routes advertised by R3.

Correct Answer: CE

Section: VPN Technologies

ExplanationExplanation/Reference:

Explanation:

+ VPN1 exports 10:1 while VPN3 imports 10:1 so VPN3 can learn routes of VPN1. + VNP1 imports 10:1 while VNP3 export 10:1 so VNP1 can learn routes of

VPN3.

-> Customer A can communicate with Customer C

+ VPN2 exports 20:1 while VPN3 imports 20:1 so VPN3 can learn routes of VPN2. + VPN2 imports 20:1 while VPN3 exports 20:1 so VPN2 can learn routes of

VPN3.

-> Customer B can communicate with Customer C

Therefore answer C is correct.

Also answer E is correct because R1 & R2 import R3 routes.

Answer A is not correct because Customer A & Customer B do not import routes which are exported by other router. Customer A & B can only see Customer C.

Answer B is not correct because a router never exports what it has learned through importation. It only exports its own routes.

Answer D is correct because two VPN1 and VPN2 cannot see each other. Maybe in this question there are three correct answers.

QUESTION 376

Which mechanism does Cisco recommend for CE router interfaces that face the service provider for an EVPL circuit with multiple EVCs and multiple traffic

classes?

A. HCBWFQ

B. LLQ

C. tail drop

D. WRED

Correct Answer: A

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

In a simple handoff, packets may be discarded in the service provider network, either because of congestion on a link without an appropriate QoS policy or

because of a policer QoS configuration on the service provider network that serves to rate limit traffic accessing the WAN core. To address these issues, QoS on

the CE device is applied at a per-port level. A QoS service policy is configured on the outside Ethernet interface, and this parent policy includes a shaper that then

references a second or subordinate (child) policy that enables queueing within the shaped rate. This is called a hierarchical CBWFQ (HCBWFQ) configuration.

Reference.

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/Ethernet_Access_for_ NG_MAN_WAN_V3-1_external.htmlQUESTION 377

Which Carrier Ethernet service supports the multiplexing of multiple point-to-point EVCs across as a single UNI?

A. EPL

B. EVPL

C. EMS

D. ERMS

Correct Answer: B

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

Ethernet Relay Service (ERS or EVPL)

An Ethernet Virtual Circuit (EVC) is used to logically connect endpoints, but multiple EVCs could exist per single UNI. Each EVC is distinguished by 802.1q VLAN

tag identification. The ERS network acts as if the Ethernet frames have crossed a switched network, and certain control traffic is not carried between ends of the

EVC. ERS is analogous to Frame Relay where the CE-VLAN tag plays the role of a Data-Link Connection Identifier (DLCI). The MEF term for this service is EVPL.

Reference. http://www.cisco.com/c/en/us/td/docs/net_mgmt/ip_solution_center/5- 1/carrier_ethernet/user/guide/l2vpn51book/concepts.html

QUESTION 378

What is the purpose of Route Target Constraint?

A. to avoid using route reflectors in MPLS VPN networks

B. to avoid using multiple route distinguishers per VPN in MPLS VPN networks

C. to be able to implement VPLS with BGP signaling

D. to avoid sending unnecessary BGP VPNv4 or VPNv6 updates to the PE router

E. to avoid BGP having to perform route refreshes

Correct Answer: D

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

Some service providers have a very large number of routing updates being sent from RRs to PEs, using considerable resources. A PE does not need routing

updates for VRFs that are not on the PE; therefore, the PE determines that many routing updates it receives are “unwanted.” The PE can filter out the unwantedupdates using Route Target Constraint.

Reference.

http://www.cisco.com/c/en/us/td/docs/ios/ios_xe/iproute_bgp/configuration/guide/2_xe/irg_xe_boo k/irg_rt_filter_xe.html.

QUESTION 379

Refer to the exhibit.

Which statement is true?

A. This is an MPLS TE point-to-multipoint LSP in an MPLS network.

B. This is an MPLS TE multipoint-to-point LSP in an MPLS network.

C. This is a point-to-multipoint LSP in an MPLS network.

D. This is a multipoint-to-multipoint LSP in an MPLS network.

Correct Answer: D

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

Same example of this provided on slide 24 at the reference link below:

Reference. “mVPN Deployment Models” Cisco Live Presentation http://d2zmdbbm9feqrf.cloudfront.net/2014/eur/pdf/BRKIPM-2011.pdf, slide 24

QUESTION 380

Refer to the exhibit.

Which statement is true?

A. R1 routes this pseudowire over MPLS TE tunnel 1 with transport label 20.

B. The default route 0.0.0.0/0 is available in the IPv4 routing table.

C. R1 is using an MPLS TE tunnel for this pseudowire, because the IP path is not available.

D. R1 has preferred-path configured for the pseudowire.

Correct Answer: D

Section: VPN Technologies

Explanation

Explanation/Reference:

Explanation:

Verifying the Configuration: Example

In the following example, the show mpls l2transport vc command shows the following information (in bold) about the VCs:

VC 101 has been assigned a preferred path called Tunnel1. The default path is disabled because the preferred path specified that the default path should not

be used if the preferred path fails.VC 150 has been assigned an IP address of a loopback address on PE2. The default path can be used if the preferred path fails.

Router# show mpls l2transport vc detail

Local interfacE. Gi0/0/0.1 up, line protocol up, Eth VLAN 222 up

Destination address: 10.16.16.16, VC ID. 101, VC status: up

Preferred path: Tunnel1, active

Default path: disabled

Tunnel label: 3, next hop point2point

Output interfacE. Tu1, imposed label stack {17 16}

Create timE. 00:27:31, last status change timE. 00:27:31

Signaling protocol: LDP, peer 10.16.16.16:0 up

MPLS VC labels: local 25, remote 16

Group ID. local 0, remote 6

MTU: local 1500, remote 1500

Remote interface description:

Sequencing: receive disabled, send disabled

VC statistics:

packet totals: receive 10, send 10

byte totals: receive 1260, send 1300

packet drops: receive 0, send 0

Reference.

http://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srtunsel.html#wp1057815

Latest online browsing the 400-101 exam!

400-101 PDF dumps & 400-101 VCE dumps: http://examsavior.com/400-101

	Examsavior	Test King	Pass4sure	Actual Tests	Other Brands
Customer Reviews
	$89.99	$124.99	$125.99	$189.00	$29.99~$49.99
Up-To-Dated
Real Questions & Answers
Correct All Error
Premium VCE Dumps
Free VCE Simulator
Unlimited After One Time Purchasing
Instant Download
Printable PDF Dumps
100% Pass Guarantee
100% Money Back

100% Pass:http://examsavior.com/