Suggested Answer: CE

Active virtual gateway and active virtual forwarder are the two states defined in the Gateway Load Balancing Protocol (GLBP). The active virtual gateway (AVG) is elected by the members of the GLBP group. The AVG creates the virtual MAC addresses that are assigned to each of the routers in the group. Each router is responsible for handling packets sent to its virtual MAC address. A GLBP router that forwards packets sent to its virtual MAC address is known as the active virtual forwarder (AVF). GLBP members communicate through hello messages sent every 3 seconds to the multicast address 224.0.0.102.
The election of the AVG can be influenced by use of the priority command. By default, all routers configured for GLBP have a priority of 100. A higher value indicates a higher priority. The configured priority of a router can be seen in the show run command as shown below:

In the above scenario, all other members of the group were left to the default, which can be determined on those routers by the absence of any priority entry in the show run command. In that case, this router would become the AVG. To remove a priority configuration, execute the nostandby priority command. When this command is executed, the router will revert to the default of 100. When all routers are left to the default, the router with the highest configured IP address will become the active router.
GLBP is a Cisco-designed protocol that provides for the dynamic utilization of redundant routers in a broadcast network. It differs from HSRP and VRRP in that it is not necessary to configure multiple groups to fully use redundant paths or routers. GLBP has a configurable load-balancing mechanism that will distribute the use of redundant gateways servicing a broadcast network, such as an Ethernet LAN. Each host will have its gateway set to the address of the AVG. When a host issues an ARP to resolve its gateway’s MAC Address, the AVG will respond with the virtual MAC address of a selected AVF. The AVG will perform load balancing by varying which virtual MAC it selects to use in the response. The AVF will own that assigned virtual MAC as long as the gateway is active. If an AVF becomes unable to provide service as gateway, another AVF can assume ownership of the virtual MAC.
Consider the partial output of the show run command for two routers participating in the GLBP group shown below:

In the above scenario, both routers have the same priority, so Router B will become AVG. Hosts will use a gateway address of 192.168.5.5 (the GLBP virtual address in line 4 of both outputs). When hosts send an ARP message for the MAC address of the gateway, Router B will reply with the MAC address of the next
AVF.
The AVG can be configured to use one of three load-balancing algorithms:
Round-Robin Load-Balancing: Using round-robin load- balancing the AVG in turn points to each AVF virtual MAC address in its ARP reply (default method).
Weighted Load-Balancing: Using weighted load- balancing, the AVG selects an AVF virtual MAC address to use in the ARP reply proportionally based on the advertised weight value configured in a GLBP gateway.
Host Dependant Load-Balancing: Using host-dependant load- balancing, the AVG selects an AVF virtual MAC address to use in the ARP reply based on which one the host used previously. A host will use the same AVF as long as the GLBP group is unchanged.
GLBP allows better use of network resources by using the standby router through the load-balancing mechanism. The standby router is an available gateway for the network.
GLBP and HSRP are Cisco-developed solutions. VRRP is defined in RFC 2338.
Backup gateway, primary gateway, and active secondary gateway are not terms used when discussing GLBP.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Cisco > Cisco IOS IP Application Services Configuration Guide, Release 12.4 > Part 1: First Hop Redundancy Protocols > Configuring GLBP
Cisco > First Hop Redundancy Protocols Configuration Guide, Cisco IOS Release 12.4 > Configuring GLBP > GLBP Active Virtual Gateway

Suggested Answer:

Suggested Answer: Explanation

Lightweight access point protocol (LWAPP) is a protocol used to allow centralized management of access points (APs). The management components are removed from the APs and centralized into a wireless LAN controller. This controller can coordinate WLAN access, managing the load on the APs and user movement between APs. A lightweight AP receives control and configuration from the WLAN controller.
LWAPP defines the following activities:
Packet encapsulation, fragmentation, and formatting
Access point certification and software control
Access point discovery, information exchange, and configuration
The processing of 802.11 data and the handling of management protocols and access point capabilities is distributed between the lightweight access point and the
WLAN controller. For example, the AP handles the transmission of beacon frames and responses to probe request frames and the controller handles authentication. The WLC enhances:
Mobility –
Authentication –
Security management –
When lightweight APs are used, the data path from one wireless station to another includes the AP and its controller.
Wi-Fi protected access (WPA) is an encryption and authentication protocol for wireless access. It supports 802.1x authentication and EAP on a wireless client.
The AP would function as the authenticator.
WEP is a wireless encryption protocol that uses static keys and no authentication.
Ad hoc is a WLAN mode used for peer-to-peer connectivity. Ad hoc allows wireless-enabled computers to communicate with each other without having an AP involved.
Objective:
Layer 2 Technologies –
Sub-Objective:
Configure and verify other LAN switching technologies
References:
Cisco > Support > Product Support > Wireless > Cisco Aironet 1200 Series > Product Literature > Solution Overviews > Cisco Unified Wireless Network Overview

Suggested Answer: AC

Suggested Answer: BCD

The following commands should be included in the implementation plan to meet the given requirements: standby 1 preempt standby 1 priority 150 standby 1 timers 10 25
The standby 1 preempt command configures the preempt settings on the router. This command allows preemption without any delay. The standby 1 priority 150 command sets the priority of the router to 150. The default priority of HSRP routers is 100. This implies that this router becomes the active router if there are no other routers in the group with a higher priority. The standby 1 timers 10 25 command sets the Hello timer and the hold time on the local router. The first value, 10, specifies the Hello timer, and the second value, 25, indicates the hold time.
The most essential steps to configure HSRP on routers are as follows:
Assign IP addresses to the interfaces using the ip address command
Enable HSRP on the interfaces and assign the virtual IP address using the standby ip command
Set the HSRP priority of the interfaces using the standby priority command
Configure HSRP preempt settings on the interfaces using the standby preempt command
Set the Hello timers using the standby timers command
Enable interface tracking for other HSRP-enabled interfaces using the standby track command
The standby 1 preempt delay minimum 10 command should not be included in the implementation plan. This command causes the router to preempt the active router after a minimum of 10 seconds. However, the requirement states that there should be no delay in preemption (a delay of 0 seconds), which is the default behavior.
The standby 1 timers 25 10 command should not be included in the implementation plan. This command sets the Hello timer to 25 seconds and the hold time to
10 seconds. However, the requirement is to set the Hello timer to 10 seconds and the hold time to 25 seconds.
The standby track interface S0/1 command should not be included in the implementation plan. This command enables tracking of the S0/1 interface on the local router. However, there is no requirement in the scenario to track an interface. Tracking can be used to decrement the priority of an HSRP router when the interface goes down. Using the default decrement value, if S0/1 were to go down, the priority of the router would be reduced by 10.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Home > Support > Configuring HSRP > How to Configure HSRP
Internetworking Case Studies > Using HSRP for Fault-Tolerant IP Routing > Configuring HSRP

Suggested Answer: A

Suggested Answer: BCD

Suggested Answer: CD

To reset the configuration revision number to 0, you should change the VLAN Trunking Protocol (VTP) domain to a non-existent domain name, and then back to the correct domain name. To change the domain name, issue the vtp domain command.
Alternatively, you can change the VTP mode to transparent mode, then back to client or server mode. To change the VTP mode, issue the vtp mode command from global configuration mode. To verify that the configuration revision number has been reset to 0, you should issue the show vtp status command.
Before adding a new switch to a VTP domain, you should reset the configuration revision number to 0. If the configuration revision number is higher than that of the other switches in the domain, then the switch can propagate incorrect configuration information to the other switches. This can cause virtual local area networks (VLANs) to be modified or deleted on every switch in the VTP domain.
The VTP configuration revision number will not be reset to 0 if you disable and then re-enable VTP pruning. VTP pruning can eliminate the flooding of broadcast traffic to switches that have no ports assigned to the virtual local area network (VLAN).
The VTP configuration revision number will not be reset to 0 if you change the VTP mode to client and then back to server. Both server-mode and client-mode switches propagate VTP information. Therefore, client-mode switches can cause incorrect information to be propagated if the configuration revision number is higher than other switches in the domain. Transparent-mode switches will not propagate its own VTP configuration, but will forward VTP information received from other switches.
Objective:
Layer 2 Technologies –
Sub-Objective:
Configure and verify trunking –
References:
Cisco > Home > Support > Technology Support > LAN Switching > Virtual LANS/VLAN Trunking Protocol (VLANS/VTP) > Design > Design Technotes >
Understanding VLAN Trunk Protocol (VTP)
Cisco > Cisco IOS LAN Switching Command Reference > udld through vtp v2-mode > vtp
Cisco > Cisco IOS LAN Switching Command Reference > show vlan through ssl-proxy module allowed-vlan > show vtp

Suggested Answer: B

An etherchannel will form if one end is active and the other is passive. The table below summarizes the results for LACP channel establishment based on the configuration of each side of a link:
LACP Channel Establishment –

Load balancing can only be configured globally. As a result, all channels (manually configured, PagP, or LACP) use the same load-balancing. This is true for the switch globally, although each switch involved in the etherchannel can have non matching parameters for load balancing.
Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/channel.html#wp1020804

Suggested Answer: D

VTP should never need to have the switch reloaded or the VTP process to restart in order for it to work. The first thing that should be done is to verify that the trunk ports are connected and up.

Suggested Answer:

Suggested Answer: A

Type-Length-Value fields (TLVs) are blocks of information embedded in CDP advertisements. Table 21 summarizes the TLV definitions for CDP advertisements.

Reference: http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf015.html

Suggested Answer: BD

Suggested Answer: B

The command show ip dhcp snooping is used to verify trusted DHCP ports. This command is used to verify which ports are intended to have DHCP servers connected to them. DHCP snooping creates an IP address to MAC address database that Dynamic ARP Inspection (DAI) uses to validate ARP packets. It compares the MAC address and IP address in ARP packets and only permits the traffic if the addresses match. This eliminates attackers that are spoofing MAC addresses.
DHCP snooping is used to define ports as trusted for DHCP server connections. The purpose of DHCP snooping is to mitigate DHCP spoofing attacks. DHCP snooping can be used to determine what ports are able to send DHCP server packets, such as DHCPOFFER, DHCPACK, and DHCPNAK. DHCP snooping can also cache the MAC address to IP address mapping for clients receiving DHCP addresses from a valid DHCP server.
MLS QOS has no bearing on DHCP services, so show mls qos is not correct.
The other commands are incorrect because of invalid syntax.
Objective:
Infrastructure Security –
Sub-Objective:
Configure and verify switch security features
References:
Cisco > Cisco IOS IP Addressing Services Command Reference > DHCP Commands > show ip dhcp snooping

Suggested Answer: D

Based on the following output, we see that R1 is the active standby router for the Ethernet 0/0 link, so all outgoing traffic will be forwarded to R1.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27517500001.jpg” alt=”Reference Image” />

Suggested Answer: BD

Suggested Answer: Explanation

Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is 4000.0000.0010.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n18880200001.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n18880200002.jpg” alt=”Reference Image” />

Suggested Answer:

Suggested Answer: A

Suggested Answer: Explanation

The only address that will be removed or aged out of the secure MAC address list will be 0000.0000.aaaa. When port security is used on an interface, not only can you set a maximum number of MAC addresses that can use the interface, but you can also set the amount of time that an address can reside in the secure list.
When the switchport port-security command is used, you can specify whether the command applies to statically assigned MAC addresses or dynamically learned
MAC addresses, called sticky addresses. In this scenario, line 6 of the output specifies that the command applies to static addresses. Since 0000.0000.aaaa is the only statically assigned MAC address (assigned in line 8 of the output), it is the only address that will age out. The amount of time is configured in terms of minutes and is done on line 5 with the switchport port-security aging time 4 command.
The MAC address 0000.0000.bbbb will not age out because it is a sticky secure address. The aging command only applies to static MAC addresses.
Objective:
Infrastructure Security –
Sub-Objective:
Configure and verify switch security features
References:
Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide, 12.2(20)EWA > Configuring Port Security
Cisco > Cisco IOS Interface and Hardware Component Command Reference > switchport port-security

Suggested Answer: B

Suggested Answer: B

Suggested Answer: BE

Suggested Answer: CF

Switches such as the Catalyst 3550 that are capable of either 802.1Q or ISL trunking encapsulation, the switchport trunk encapsulation [dot1q | isl | negotiate] interface command must be used prior to the switchport mode trunk command.
Reference: https://learningnetwork.cisco.com/servlet/JiveServlet/previewBody/14792-102-1-57313/Dynamic%20Trunking%20Protocol.PDF

Suggested Answer: C

Suggested Answer: A

Suggested Answer: BD

Suggested Answer: B

GLBP Virtual MAC Address Assignment
A GLBP group allows up to four virtual MAC addresses per group. The AVG is responsible for assigning the virtual MAC addresses to each member of the group.
Other group members request a virtual MAC address after they discover the AVG through hello messages. Gateways are assigned the next MAC address in sequence. A virtual forwarder that is assigned a virtual MAC address by the AVG is known as a primary virtual forwarder. Other members of the GLBP group learn the virtual MAC addresses from hello messages. A virtual forwarder that has learned the virtual MAC address is referred to as a secondary virtual forwarder.
Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039651

Suggested Answer: C

Suggested Answer: CD

Suggested Answer: B

Suggested Answer:

Suggested Answer: A

Voice VLAN Configuration Guidelines
✑ You should configure voice VLAN on switch access ports. The voice VLAN should be present and active on the switch for the IP phone to correctly communicate on the voice VLAN. Use the show vlan privileged EXEC command to see if the VLAN is present (listed in the display).
✑ The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled.
Reference:
http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_22_ea11x/co
nfiguration/guide/swvoip.html

Suggested Answer: A

STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately, bypassing the listening and learning states.
However, the “Spanning-tree portfast bpdufilter default” command specifies that if a BPDU is received on that port, then the default action of STP of listening, learning, and forwarding states should be used.

Suggested Answer: CD

Suggested Answer: E

You should configure three HSRP groups on all three routers and select an active router for each of the groups. You can create up to 256 (0 to 255) groups. Each router should be the active router for one of the three groups and the standby router for the remaining two groups.
If you want to use HSRP on a Layer 3 switch, the switch ports must be one of the following:
EtherChannel port Refers to a Layer 3 switch port used for EtherChannel
Routed port Refers to a Layer 3 port on a switch used for routing and for inter-VLAN routing
Switch virtual interface (SVI) Refers to a Layer 2 switch port used for inter-VLAN routing
Routed ports are the physical Layer 3 interfaces that allow you to configure a switch as a router. The no switchport command allows the port to be used purely as a Layer 3 port. SVIs are Layer 3 logical interfaces of a switch that allow you to enable inter-VLAN routing on Layer 3 switches. An SVI is configured as a VLAN interface and has at least one physical interface assigned to the VLANs.
Creating a single HSRP group with all three routers as active routers for the group is incorrect. An HSRP group cannot have multiple active routers; it can have only one active router at a time.
Creating a single HSRP group with one active router for the group is incorrect because it does not allow load balancing between the three routers. All traffic will be passed through the active router.
Creating two HSRP groups with an active router each is incorrect because it only allows load balancing between two of the routers and not three of them.
Creating two HSRP groups with one active router for both groups, or three HSRP groups with one active router for all groups, is incorrect. Doing so does not enable load balancing on all three routers. Only the active router will be used for traffic forwarding.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Internetworking Case Studies > Using HSRP for Fault-Tolerant IP Routing > Configuring Multiple Hot Standby Groups > Load Sharing
Catalyst 3750 Switch Software Configuration Guide, 12.2(40)SE > Configuring HSRP > Configuring HSRP > HSRP Configuration Guidelines
Catalyst 3750 Switch Software Configuration Guide, 12.2(40)SE > Configuring HSRP > Configuring HSRP > Multiple HSRP

Suggested Answer: ADE

Suggested Answer: C

SDM Template Notes:
✑ All templates are predefined. There is no way to edit template category individual values.
✑ The switch reload is required to use a new SDM template.
✑ The ACL merge algorithm, as opposed to the original access control entries (ACEs) configured by the user, generate the number of TCAM entries listed for security and QoS ACEs.
✑ The first eight lines (up to Security ACEs) represent approximate hardware boundaries set when a template is used. If the boundary is exceeded, all processing overflow is sent to the CPU which can have a major impact on the performance of the switch.
Choosing the VLAN template will actually disable routing (number of entry for unicast or multicast route is zero) in hardware.
Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/44921-swdatabase-3750ss-44921.html

Suggested Answer: BF

Suggested Answer: AEF

The management domain name, password, and revision number are all checked before the VTP frame is processed. To propagate VTP information between switches, both switches must have a trunk port configured and must have a matching native VLAN, which is VLAN 1 by default.
VTP advertisements are flooded throughout the management domain every five minutes or whenever there is a change. These advertisements are originated from a switch that is in server mode and are propagated by switches that are in either client or transparent mode. Before a client or another server accepts or incorporates the information sent in the advertisement, it checks the management domain name and password (if defined) against its own configuration. The revision number is checked. If the revision number is higher than the last value store in the receiving switch, the receiving switch will overwrite its VLAN database with the information in the advertisement.
A VTP switch in transparent mode will receive and forward VTP advertisements. It will not use the contents of the advertisement to synchronize with its own VLAN database.
The VTP mode, IP address, and switch name are not found in VTP advertisements.
Objective:
Layer 2 Technologies –
Sub-Objective:
Configure and verify trunking –
References:
Cisco > Home > Support > Technology Support > LAN Switching > Virtual LANS/VLAN Trunking Protocol (VLANS/VTP) > Design > Design Technotes >
Understanding VLAN Trunk Protocol (VTP)

Suggested Answer: B

PAgP modes are off, auto, desirable, and on. Only the combinations auto-desirable, desirable-desirable, and on-on will allow a channel to be formed. .
1. on: PAgP will not run. The channel is forced to come up.
2. off: PAgP will not run. The channel is forced to remain down.
3. auto: PAgP is running passively. The formation of a channel is desired; however, it is not initiated.
4. desirable: PAgP is running actively. The formation of a channel is desired and initiated.
The Link Aggregate Control Protocol (LACP) trunking supports four modes of operation:
✑ On: The link aggregation is forced to be formed without any LACP negotiation .In other words, the switch neither sends the LACP packet nor processes any inbound LACP packet. This is similar to the on state for PAgP.
✑ Off: The link aggregation is not formed. We do not send or understand the LACP packet. This is similar to the off state for PAgP.
✑ Passive: The switch does not initiate the channel but does understand inbound LACP packets. The peer (in active state) initiates negotiation (when it sends out an LACP packet) which we receive and answer, eventually to form the aggregation channel with the peer. This is similar to the auto mode in PAgP.
✑ Active: We can form an aggregate link and initiate the negotiation. The link aggregate is formed if the other end runs in LACP active or passive mode. This is similar to the desirable mode of PAgP.
In this example, we see that fa 0/13, fa0/14, and fa0/15 are all in Port Channel 12, which is operating in desirable mode, which is only a PAgP mode.

Suggested Answer: B

The glbp ip interface configuration command enables Group Load Balancing Protocol (GLBP). The syntax for this command is as follows: switch(config-if)# glbp group-number ip ip-address
The following example activates GLBP for group 5 on Fast Ethernet interface 1/0. The virtual IP address to be used by the GLBP group is set to 10.5.5.5. The default gateway of each host should be set to the virtual IP address. switch(config)# interface FastEthernet 1/0 switch(config-if)# ip address 10.5.5.1 255.255.255.0 switch(config-if)# glbp 5 ip 10.5.5.5
GLBP is a Cisco-designed protocol that provides for the dynamic use of redundant routers in a broadcast network. It differs from HSRP and VRRP in that it is not necessary to configure multiple groups to fully use redundant paths or routers. GLBP has a configurable load-balancing mechanism that will distribute the use of redundant gateways servicing a broadcast network such as an Ethernet LAN. When a host issues an ARP to resolve its gateway’s MAC address, the active virtual gateway (AVG) will respond with the virtual MAC address of a selected active virtual forwarder (AVF). The AVG will perform load balancing by varying which virtual MAC it selects to use in the response. The AVF will own that assigned virtual MAC as long as the gateway is active. If an AVF becomes unable to provide service as gateway, then another AVF can assume ownership of the virtual MAC.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Cisco > Cisco IOS IP Application Services Configuration Guide, Release 12.4 > Part 1: First Hop Redundancy Protocols > Configuring GLBP

Suggested Answer: BE

Reference:
https://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/nxos/commands/l2/switchport-trunk-allowed-vlan.html

Suggested Answer: BC

Suggested Answer: A

The default decrement value for HSRP standby tracking is 10. There is no need to explicitly state the value if the desired value is the default value.

Suggested Answer: A

Suggested Answer: A

With port security, you can configure MAC addresses to be sticky. These can be dynamically learned or manually configured, stored in the address table, and added to the running configuration. If these addresses are saved in the configuration file, the interface does not need to dynamically relearn them when the switch restarts. Although sticky secure addresses can be manually configured, it is not recommended.
Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.pdf

Suggested Answer: D

Reference:
https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10591-77.html

Suggested Answer: A

Suggested Answer: C

RSTP can only achieve rapid transition to the forwarding state on edge ports and on point-to-point links, not on trunk links. The link type is automatically derived from the duplex mode of a port. A port that operates in full-duplex is assumed to be point-to-point, while a half-duplex port is considered as a shared port by default. This automatic link type setting can be overridden by explicit configuration. In switched networks today, most links operate in full-duplex mode and are treated as point-to-point links by RSTP. This makes them candidates for rapid transition to the forwarding state.
Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html