Suggested Answer: AEF

The management domain name, password, and revision number are all checked before the VTP frame is processed. To propagate VTP information between switches, both switches must have a trunk port configured and must have a matching native VLAN, which is VLAN 1 by default.
VTP advertisements are flooded throughout the management domain every five minutes or whenever there is a change. These advertisements are originated from a switch that is in server mode and are propagated by switches that are in either client or transparent mode. Before a client or another server accepts or incorporates the information sent in the advertisement, it checks the management domain name and password (if defined) against its own configuration. The revision number is checked. If the revision number is higher than the last value store in the receiving switch, the receiving switch will overwrite its VLAN database with the information in the advertisement.
A VTP switch in transparent mode will receive and forward VTP advertisements. It will not use the contents of the advertisement to synchronize with its own VLAN database.
The VTP mode, IP address, and switch name are not found in VTP advertisements.
Objective:
Layer 2 Technologies –
Sub-Objective:
Configure and verify trunking –
References:
Cisco > Home > Support > Technology Support > LAN Switching > Virtual LANS/VLAN Trunking Protocol (VLANS/VTP) > Design > Design Technotes >
Understanding VLAN Trunk Protocol (VTP)

Suggested Answer: C

Suggested Answer: CD

Suggested Answer: C

Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/configuration/guide/2960scg/swspan.pdf

Suggested Answer: A

Reference:
https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-switch-stks.html

Suggested Answer: A

Virtual local area network (VLAN) 1 and VLANs 101 through 200 are allowed on the trunk. The switchport trunk allowed vlan command configures a trunk to carry one or more VLANs. The syntax for the switchport trunk allowed vlan command is switchport trunk allowed vlan {vlan-list | all | {add | except | remove} vlan-list}.
VLANs specified in the vlan-list parameter should be separated by commas. However, if a contiguous group of VLANs is specified, the starting and ending VLAN numbers can be separated by a hyphen.
If no keywords are specified with the switchport trunk allowed vlan command, then only the VLANs contained within the vlan-list parameter will be allowed on the trunk. The all keyword specifies that all VLANs from 1 through 4094 should be allowed on the trunk. The add keyword specifies the VLANs that should be added to the list of VLANs that are already allowed by the trunk. The except keyword specifies that all VLANs from 1 through 4094 are allowed except the listed VLANs.
The remove keyword specifies the VLANs that should be removed from the list of VLANs that are already allowed by the trunk.
In this scenario, the first command issued is switchport trunk allowed vlan all, which allows VLANs 1 through 4094. The second command issued is switchport trunk allowed vlan remove 1,101-4094, which removes VLAN 1 and VLANs 101-4094. Therefore, VLANs 2 through 100 are allowed. The third command issued is switchport trunk allowed vlan except 3001-4094, which specifies that all VLANs should be allowed except VLANs 3001 through 4094. Therefore, VLANs 1 through
3000 are allowed. The fourth command issued is switchport trunk allowed vlan 1, which specifies that only VLAN 1 should be allowed. The fifth command issued is switchport trunk allowed vlan add 101-200, which adds VLANs 101 through 200 to the list of allowed VLANs. Therefore, VLAN 1 and VLANs 101 through 200 are allowed on the trunk.
Objective:
Layer 2 Technologies –
Sub-Objective:
Configure and verify trunking –
References:
Cisco > Cisco IOS Interface and Hardware Component Command Reference > squelch through system jumbomtu > switchport trunk

Suggested Answer: AD

Suggested Answer: C

VTP pruning enhances network bandwidth use by reducing unnecessary flooded traffic, such as broadcast, multicast, unknown, and flooded unicast packets to only the switches that require it. VTP pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. By default, VTP pruning is disabled.
Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vtp.html#wp1020444

Suggested Answer:

Suggested Answer: Explanation

A key element of NSF is packet forwarding. In a Cisco networking device, packet forwarding is provided by Cisco Express Forwarding (CEF). CEF maintains the
FIB, and uses the FIB information that was current at the time of the switchover to continue forwarding packets during a switchover. This feature reduces traffic interruption during the switchover.
During normal NSF operation, CEF on the active supervisor engine synchronizes its current FIB and adjacency databases with the FIB and adjacency databases on the redundant supervisor engine. Upon switchover of the active supervisor engine, the redundant supervisor engine initially has FIB and adjacency databases that are mirror images of those that were current on the active supervisor engine. For platforms with intelligent modules, the modules will maintain the current forwarding information over a switchover. For platforms with forwarding engines, CEF will keep the forwarding engine on the redundant supervisor engine current with changes that are sent to it by CEF on the active supervisor engine. The modules or forwarding engines will be able to continue forwarding after a switchover as soon as the interfaces and a data path are available.
As the routing protocols start to repopulate the RIB on a prefix-by-prefix basis, the updates will cause prefix-by-prefix updates to CEF, which it uses to update the
FIB and adjacency databases. Existing and new entries will receive the new version (“epoch”) number, indicating that they have been refreshed. The forwarding information is updated on the modules or forwarding engine during convergence. The supervisor engine signals when the RIB has converged. The software removes all FIB and adjacency entries that have an epoch older than the current switchover epoch. The FIB now represents the newest routing protocol forwarding information.

Suggested Answer: C

The command show glbp displays detailed information about GLBP groups on the switch. This information includes the GLBP groups the switch is a member of, whether this is the active switch, the virtual IP address, and whether preemption is enabled. Below is an example of the command output.

The following can be learned from this output:
This router is the active virtual forwarder (AVF). In line 3, the output indicates the state is listen. This is the state of the active AVF.
As indicated in line 14, this router is configured with a weighting for tracking of 105. It also is configured with an upper limit of 100 and a lower limit of 90. When a tracked object goes down, the value of 105 will be reduced by the decrement value associated with that object. If this results in the weighting dropping below the lower limit (90), this router will give up its role as AVF.
The router is tracking two objects, and both have decrement values of 10. This means that ONLY if both objects go down will this router relinquish its role as AVF.
As there is another router to take the role of AVF, there will be no disruption of traffic, even if hosts were using the tracked interface that went down.
The show glbp state will only display the glbp state of the router (standby, listen etc). Detailed output is accomplished with the command show glbp.
The command show standby can be used to display detailed information about HSRP groups to which a switch belongs. This command is for HSRP only.
The command show standby detail provides the same output as show standby. It can be used to display detailed information about HSRP groups to which a switch belongs. This command is for HSRP only.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Cisco > Cisco IOS IP Application Services Configuration Guide, Release 12.4 > Part 1: First Hop Redundancy Protocols > Configuring GLBP

Suggested Answer: CF

Switches such as the Catalyst 3550 that are capable of either 802.1Q or ISL trunking encapsulation, the switchport trunk encapsulation [dot1q | isl | negotiate] interface command must be used prior to the switchport mode trunk command.
Reference: https://learningnetwork.cisco.com/servlet/JiveServlet/previewBody/14792-102-1-57313/Dynamic%20Trunking%20Protocol.PDF

Suggested Answer:

Suggested Answer: AC

Suggested Answer: A

Suggested Answer: B

Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/configuration/guide/3750xscg/swsdm.html

Suggested Answer: Explanation

The following two statements are TRUE:
HSRP works only on Cisco routers and VRRP works on both Cisco and non- Cisco routers.
HSRP-enabled routers need to be configured manually to preempt the active router and VRRP-enabled routers preempt it automatically.
HSRP was developed by Cisco intended for only Cisco routers and VRRP was developed by IEFT intended as a standard for routers. HSRP was defined in RFC
2281 and VRRP was defined in RFC 2338. Both these protocols provide a fault tolerance solution by grouping several routers together but presenting them as a single router. One of the routers in the group acts as the active or master router. A second router is selected as the standby router. In case the active or master router fails, the standby router takes over the responsibilities of the active router.
The router with the highest priority is automatically selected as the active or master router. In HSRP, preempt settings have to be manually configured on every router in the group, even if the routers have a priority higher than that of the active router. However, in VRRP, the routers with higher priority automatically preempt the master router. Another advantage that VRRP has over HSRP is a faster Hello timer (1 second). HSRP has a Hello timer of 3 seconds
Two other protocols ICMP Router Discovery Protocol (IRDP) and Gateway Load Balancing Protocol (GLBP) provide redundancy for first-hop router failure. IRDP also allows the selection of a new router if the active router fails, while GLBP provides load balancing in addition to redundancy.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Home > Articles > Cisco Certification > CCDP > CCDP Self Study: Designing High-Availability Services
Cisco First Hop Redundancy Protocols Configuration Guide, Cisco Release 15MT

Suggested Answer: C

Here we see that the native VLAN has been configured as 2013 on one switch, but 1 (the default native VLAN) on the other switch. If you use 802.1Q trunks, you must ensure that you choose a common native VLAN for each port in the trunk. Failure to do this causes Cisco switches to partially shut down the trunk port because having mismatched native VLANs can result in spanning-tree loops. Native VLAN mismatches are detected via spanning tree and Cisco Discovery
Protocol (CDP), not via DTP messages. If spanning tree detects a native VLAN mismatch, spanning tree blocks local native VLAN traffic and the remote switch native VLAN traffic on the trunk; however, the trunk still remains up for other VLANs.
Reference: http://www.informit.com/library/content.aspx?b=CCNP_Studies_Switching&seqNum=25

Suggested Answer: C

Suggested Answer: B

Suggested Answer: Answer:

There are two ways to configure interVLAN routing in this case:
+ Use RouterC as a “router on a stick” and SwitchC as a pure Layer2 switch. Trunking must be established between RouterC and SwitchC.
+ Only use SwitchC for interVLAN routing without using RouterC, SwitchC should be configured as a Layer 3 switch (which supports ip routing function as a router). No trunking requires.
The question clearly states “No trunking has been configured on RouterC” so RouterC does not contribute to interVLAN routing of hosts H1 & H2 -> SwitchC must be configured as a Layer 3 switch with SVIs for interVLAN routing.
We should check the default gateways on H1 & H2. Click on H1 and H2 and type the “ipconfig” command to get their default gateways.
>ipconfig
We will get the default gateways as follows:
:
Host1 –
+ Default gateway: 190.200.250.33
:
Host2 –
+ Default gateway: 190.200.250.65
Now we have enough information to configure SwitchC (notice the EIGRP AS in this case is 650)
Note: VLAN2 and VLAN3 were created and gi0/10, gi0/11 interfaces were configured as access ports so we dont need to configure them in this sim.
SwitchC# configure terminal –
SwitchC(config)# int gi0/1 –
SwitchC(config-if)#no switchport -> without using this command, the simulator does not let you assign IP address on Gi0/1 interface.
SwitchC(config-if)# ip address 10.10.10.2 255.255.255.0 ->RouterC has used IP 10.10.10.1 so this is the lowest usable IP address.
SwitchC(config-if)# no shutdown –
SwitchC(config-if)# exit –
SwitchC(config)# int vlan 2 –
SwitchC(config-if)# ip address 190.200.250.33 255.255.255.224
SwitchC(config-if)# no shutdown –
SwitchC(config-if)# int vlan 3 –
SwitchC(config-if)# ip address 190.200.250.65 255.255.255.224
SwitchC(config-if)# no shutdown –
SwitchC(config-if)#exit –
SwitchC(config)# ip routing (Notice: MLS will not work without this command)
SwitchC(config)# router eigrp 65010
SwitchC(config-router)# network 10.10.10.0 0.0.0.255
SwitchC(config-router)# network 190.200.250.32 0.0.0.31
SwitchC(config-router)# network 190.200.250.64 0.0.0.31
NOTE: THE ROUTER IS CORRECTLY CONFIGURED, so you will not miss within it in the exam, also dont modify/delete any port just do the above configuration.
Also some reports said the “no auto-summary” command can’t be used in the simulator, in fact it is not necessary because the network 190.200.0.0/16 is not used anywhere else in this topology.
In order to complete the lab, you should expect the ping to SERVER to succeed from the MLS, and from the PCs as well.
Also make sure you use the correct EIGRP AS number (in the configuration above it is 650 but it will change when you take the exam) but we are not allowed to access RouterC so the only way to find out the EIGRP AS is to look at the exhibit above. If you use wrong AS number, no neighbor relationship is formed between
RouterC and SwitchC.
In fact, we are pretty sure instead of using two commands “network 190.200.250.32 0.0.0.31″ and “network 190.200.250.64 0.0.0.31″ we can use one simple command “network 190.200.0.0″ because it is the nature of distance vector routing protocol like EIGRP: only major networks need to be advertised; even without
“no auto-summary” command the network still works correctly. But in the exam the sim is just a flash based simulator so we should use two above commands, just for sure. But after finishing the configuration, we can use “show run” command to verify, only the summarized network 190.200.0.0 is shown.

Suggested Answer: Explanation

Within any VTP, the VTP domain name must match. So, step one is to find the correct VTP name on the other switches. Logging in to SW1 and using the “show vtp status” command we see this:
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n18888000005.png” alt=”Reference Image” />
So we know that the VTP domain must be CCNP. This leaves only choice D and E. We also see from the topology diagram that eth 0/0 of the new switch connects to a PC in VLNA 100, so we know that this port must be an access port in VLAN 100, leaving only choice D as correct. Note that the VTP versions supported in this network are 1, 2, 3 so either VTP version 2 or 3 can be configured on the new switch.

Suggested Answer: A

VTP transparent switches do not participate in VTP. A VTP transparent switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements, but transparent switches do forward VTP advertisements that they receive out their trunk ports in VTP Version 2.
Reference: http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080094c52.shtml

Suggested Answer: D

Understanding EtherChannel Guard
You can use EtherChannel guard to detect an EtherChannel misconfiguration between the switch and a connected device. A misconfiguration can occur if the switch interfaces are configured in an EtherChannel, but the interfaces on the other device are not. A misconfiguration can also occur if the channel parameters are not the same at both ends of the EtherChannel. For EtherChannel configuration guidelines, see the “EtherChannel Configuration Guidelines” section.
If the switch detects a misconfiguration on the other device, EtherChannel guard places the switch interfaces in the error-disabled state, and displays an error message.
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstpopt.html

Suggested Answer: B

Suggested Answer: D

Within any VTP, the VTP domain name must match. So, step one is to find the correct VTP name on the other switches. Logging in to SW1 and using the “show vtp status” command we see this:
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27553100002.png” alt=”Reference Image” />
So we know that the VTP domain must be CCNP. This leaves only choice D and E. We also see from the topology diagram that eth 0/0 of the new switch connects to a PC in VLNA 100, so we know that this port must be an access port in VLAN 100, leaving only choice D as correct. Note that the VTP versions supported in this network are 1, 2, 3 so either VTP version 2 or 3 can be configured on the new switch.

Suggested Answer: E

Suggested Answer: AD

Suggested Answer: CE

Suggested Answer: AB

Reference:
https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html

Suggested Answer: BD

Suggested Answer: D

Suggested Answer: B

Suggested Answer: AD

Dynamic ARP inspection (DAI) and DHCP snooping are Cisco features designed to work together to mitigate ARP spoofing attacks. DAI validates ARP packets in a network. DAI determines the validity of an ARP packet based on the valid MAC address-to-IP-address bindings stored in the DHCP snooping database. This capability protects the network from some man-in-the-middle attacks. The following global configuration command instructs the switch to intercept, log, and discard packets with invalid IP-to-MAC address bindings for the specified VLANs. switch(config)# ip arp inspection vlan 10-12,15
When configuring DAI, ports are configured as either trusted or untrusted. DAI forwards all packets received on a trusted interface without checks but intercepts all packets on an untrusted port.
DHCP snooping creates an IP address to MAC address database that DAI uses to validate ARP packets. It compares the MAC address and IP address in ARP packets and only permits the traffic if the addresses match. This eliminates attackers spoofing MAC addresses. The following command enables DHCP MAC address verification: router(config)# ip dhcp snooping verify mac-address
DHCP Authorized ARP can also be used to mitigate ARP spoofing. When implemented, the server assigns an IP address to a client and then creates a static mapping. The DHCP server then sends periodic ARPs to clients to make sure that the clients are still active. Clients respond with an ARP reply. Unauthorized clients cannot respond to these periodic ARPs. The unauthorized ARP responses are blocked at the DHCP server.
DHCP snooping also is used to define ports as trusted for DHCP server connections. The purpose of DHCP snooping is to mitigate DHCP spoofing attacks.
DHCP snooping can be used to determine what ports are able to send DHCP server packets such as DHCPOFFER, DHCPACK, and DHCPNAK. DHCP snooping can also cache the MAC address to IP address mapping for clients receiving DHCP addresses from a valid DHCP server.
Port security is a method of only permitting specified MAC addresses access to a switch port. This can be used to define what computer or device can be connected to a port, but not eliminate ARP spoofing.
802.1x is a method of determining authentication before permitting access to a switch port. This is useful in restricting who can connect to the switch; it does not inspect ARP packets.
Objective:
Infrastructure Security –
Sub-Objective:
Configure and verify switch security features
References:
Catalyst 6500 Release 12.2SXF and Rebuilds Software Configuration Guide > Configuring Dynamic ARP Inspection (DAI)
Cisco > Cisco IOS IP Addressing Services Command Reference > ARP Commands > ip arp inspection vlan

Suggested Answer: C

Suggested Answer: DE

Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstack.pdf

Suggested Answer: BD

Suggested Answer: EF

Reference:
https://learningnetwork.cisco.com/docs/DOC-26851

Suggested Answer: DE

Entering the IOS commands switchport mode trunk and switchport trunk encapsulation dot1q in interface configuration mode will allow a switch port to actively negotiate to be an 802.1Q trunk port. This allows Dynamic Trunking Protocol (DTP) to actively negotiate to be a trunk if the other side is set to trunk, desirable, or auto.
Use the following steps to configure a port as an 802.1Q trunk:
1. Enter the interface configuration.
switch(config)# interface interface-id
2. Configure the port to use 802.1Q encapsulation.
switch(config-if)# switchport trunk encapsulation dot1q
3. Configure the port as a trunk port.
switch(config-if)# switchport mode trunk
Note: Trunking modes can be configured as dynamic desirable, dynamic auto, trunk, access, and nonegotiate. If both sides are set to auto, no negotiations will occur.
Verification of the configuration can be done by executing the show run command on both switches. An example partial output for two switches is shown below:

In the above partial output, the following can be determined:
Since it is configured as dynamic desirable, SwitchB will send DTP packets to SwitchA
Since the two switches are set to dynamic desirable and dynamic auto, they will form a trunk. When one end is set to desirable, the other must be set to trunk, desirable, or auto for a trunk link to form.
The native VLAN for SwitchA is VLAN 5 as indicated in the last line of its output. SwitchB is set to the default, which is VLAN 1. This configuration would result in a failure of the switches to form a trunk since the native VLANs do not match.
The switchport allowed vlan command is also valid for configuring dot1q trunks, but is not required. By default, all VLANs are allowed on the trunk.
Objective:
Layer 2 Technologies –
Sub-Objective:
Configure and verify trunking –
References:
Cisco IOS Master Command List, Release 12.4T>switchport mode

Suggested Answer: C

Suggested Answer: B

Suggested Answer:

Suggested Answer:

Suggested Answer: E

EtherChannel load balancing can use MAC addresses, IP addresses, or Layer 4 port numbers, and either source mode, destination mode, or both. The mode you select applies to all EtherChannels that you configure on the switch. Use the option that provides the greatest variety in your configuration. For example, if the traffic on a channel only goes to a single MAC address (which is the case in this example, since all traffic is going to the same web server), use of the destination
MAC address results in the choice of the same link in the channel each time. Use of source addresses or IP addresses can result in a better load balance.
Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html

Suggested Answer: Explanation

IP Source Guard Configuration Guidelines
You can configure static IP bindings only on nonrouted ports. If you enter the ip source binding mac-address vlan vlan-id ip-address interface interface-id

global configuration command on a routed interface, this error message appears:
Static IP source binding can only be configured on switch port.

When IP source guard with source IP filtering is enabled on an interface, DHCP snooping must be enabled on the access VLAN for that interface.

If you are enabling IP source guard on a trunk interface with multiple VLANs and DHCP snooping is enabled on all the VLANs, the source IP address filter is

applied on all the VLANs.
You can enable this feature when 802.1x port-based authentication is enabled. Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/

<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n18880500004.png” alt=”Reference Image” />
software/15- 0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960- x_cg_chapter_01110.html

Suggested Answer: B

Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is 4000.0000.0010.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27571400000.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27571400001.jpg” alt=”Reference Image” />

Suggested Answer: A

Suggested Answer: AD

protect – The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value. restrict – The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the security violation counter to increment. shutdown – Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.
Restrict increments the counter and sends an SNMP trap. And shutdown puts the interface in err-disabled state.

Suggested Answer: CD

Suggested Answer: C

The command show interfaces switchport is used to verify private VLANs configured on ports and the private VLAN mappings. The following is a sample of the output:

This output reveals that Fa3/1 is a promiscuous port in private VLAN (PVLAN) 20. PVLAN 20 is a member of the primary VLAN 200. Since this is a promiscuous port, it is able to exchange information with all other PVLANs associated with VLAN 200.
The show vlan brief command is only used to view the VLANs that exist and the ports that are members of them. No information about PVLANs and member association is included.
The show mac-address-table command is used to view the MAC addresses stored in the switches memory and the port and VLAN they are members of. No information about PVLANs is included in this output.
The command show pvlan is incorrect due to invalid syntax.
Objective:
Infrastructure Security –
Sub-Objective:
Configure and verify switch security features
References:
Cisco > Cisco IOS Interface and Hardware Component Command Reference > show hw-module slot tech-support through show interfaces vg-anylan > show interfaces fastethernet