647-874 ARCH Flashcards
(202 cards)
0
Q
When is a FHRP needed?
A
Only if the design implements Layer 2 between the access switch and the distribution switch. If Layer 3 is supported to the access switch, the default gateway for end devices is at the access level.
1
Q
What are the 3 layers of the Hierarchical Network Model?
A
- Access
- Distribution
- Core
2
Q
What is the function of the Access layer in the Hierarchical network Model?
A
- Grants user access to network devices.
- In the WAN environment , the access layer for teleworkers or remote sites may provide entry to the corporate network across WAN technology.
3
Q
What are some examples of devices that would attach to the Access layer?
A
- PCs (including virtualized desktops)
- IP Phones
- Servers
- Wireless Access Points
4
Q
What are some of the functions provided by Access Layer devices and what are some generic examples of those types of devices?
A
- Control traffic by localizing service requests to the access media.
- Must provide connectivity without compromising network integrity.
- Includes:
- WAN Routers
- Firewalls
- PSTN Gateways
- Multilayer or Layer 2 Access Switches
5
Q
What is the function of the Distribution layer in the Hierarchical network Model?
A
- Aggregates the wiring closets, using switches to segment workgroups and isolate network problems in a campus environment.
- Aggregates WAN connections at the edge of the campus and provides policy-based connectivity.
- Addresses QoS and Policy-based traffic control.
6
Q
What are some of the functions provided by Distribution Layer devices and what are some generic examples of those types of devices?
A
- Control access to resources that are available at the core layer and must, therefore, make efficient use of bandwidth.
- Must address the quality of service (QoS) needs for different protocols by implementing policy-based traffic control to isolate backbone and local environments.
- Includes:
- Multilayer Switches that connect up to Access Layer devices and down to Multilayer Core Switches.
7
Q
What is the function of the Core layer in the Hierarchical network Model?
A
- A high-speed backbone, designed to switch packets as fast as possible.
- Must provide a high level of availability and adapt quickly to changes.
- Provides scalability and fast convergence and an integration point for data center virtualization.
- Provides services that optimize communication transport within the network.
- Provides a high speed, layer 3 switching environment using hardware accelerated services.
- Critical for connectivity.
8
Q
What is another name for the Core Layer?
A
Backbone
9
Q
What are some examples of devices that would attach to the Core layer?
A
- Distribution Layer Devices.
- Servers
10
Q
What are some of the functions provided by Core Layer devices and what are some generic examples of those types of devices?
A
- Provide services that optimize communication transport within the network.
- Are expected to provide maximum availability and reliability with minimum packet processing.
- Should be able to maintain connectivity when the circuits that connect them fail.
Includes:
-Multilayer Switches that connect up to Distribution Layer Multilayer Switches and down to Servers/Data Center.
11
Q
What is Policy-Based Traffic Control?
A
A function of the Distribution Layer, it enables you to prioritize traffic to ensure the best performance for the most time-critical and time-dependent applications.
12
Q
What are the three overlapping architectures that Cisco developed as part of a holistic approach to network architecture and design?
A
- Borderless Networks
- Collaboration
- Virtualization (data center and desktop)
13
Q
What does the Borderless Networks Architecture address?
A
-Addresses increasing worker mobility and focuses on connecting anyone from anywhere , using any device, to any resource (securely, reliably, and seamlessly).
14
Q
What do the Borderless Networks technologies focus on and what are those technologies?
A
-Providing high-performance secure mobile connectivity.
- Routing
- Switching
- Mobility
- Security
- Application
- Performance
15
Q
What does the Collaboration Architecture address?
A
-Addresses the increased need for interaction among companies, including partners and suppliers.
16
Q
What do the Collaboration technologies focus on and what are those technologies?
A
-Integrating many different types of communication methods and devices.
- Unified Communications
- Tele???? (? is a placeholder for a variable)
- Conferencing
- Messaging
17
Q
What are the 3 major business challenges that the Data Center Architecture addresses?
A
- Business alignment
- Cost and power efficiency
- Risk management and compliance.
18
Q
What do the Virtualization technologies focus on and what are those technologies?
A
-Provisioning data storage and computing resources to applications in a highly scalable and resilient manner by leveraging virtualization technology.
- Virtualization
- Unified Fabric
- Unified Computing
19
Q
What are 2 advantages of virtualization technology?
A
- Enables more rapid application deployment and more-efficient use of resources, allowing you to do more with the same resources.
- Offers better protection against disasters and outages.
20
Q
What is a Medianet?
A
An intelligent network (IN) that is optimized for rich media, such as voice and video.
21
Q
What are the 6 Medianet services?
A
- Network Management
- High Availability
- QoS
- IP Multicasting
- Transcoding
- Authentication and Encryption
22
Q
What are some applications that leverage the Medianet architecture?
A
- Cisco Unified Communications
- Cisco Digital Media Systems
- Cisco IP Video Surveillance
- Cisco TelePresence
23
Q
What are the 5 modules you can commonly divide a network up into in order to facilitate gradual implementation and address specific requirements of each individual part?
A
- Campus
- Data Center
- WAN and MAN
- Branch
- Teleworker
24
What are the three overlapping Cisco network architectures for the enterprise and what does each do?
1. Borderless Networks - Solutions to increase work mobility. It focuses on connecting anyone from anywhere, using any device, to any resource (securely, reliably, and seamlessly).
2. Collaboration - Provides a framework that enables new applications to address the need to communicate and collaborate across corporate boundaries, companies, and continents.
3. Virtualization - Consolidates network, storage, and computing resources by leveraging virtualization technologies. Enables rapid deployment of new applications and services, scaling of existing services, and optimization of applications through flexible assignment of resources.
25
What are the three roles of the core layer in a LAN design?
1. Provides high speed data transport
2. Serves as a fast convergent infrastructure with a high level of redundancy.
3. Avoids data manipulation
26
What three sections provide network infrastructure and services for remote enterprise users?
1. Teleworker Branch Section
2. Enterprise Branch Section
3. Data Center Section
27
What are three basic steps of the design methodology under PPDIOO?
1. Identify customer requirements.
- Key decision makers identify initial requirements
- Typically done in the Prepare phase
2. Characterize the existing network and sites.
- Gap Analysis
- Network Audit & Analysis
- Typically done in the Plan phase
3. Design the network topology and solutions.
- Develop detailed design
- Maybe build a prototype network
28
What are three tasks that are involved in characterizing an existing network?
1. Collecting information using the existing documentation and direct organizational input.
2. Using tools to analyze network traffic.
3. Using tools for automated auditing of the network.
29
What are the 6 phases of the Cisco formalized Lifecycle?
1. Prepare
2. Plan
3. Design
4. Implement
5. Operate
6. Optimize
30
What is involved in the Prepare phase?
- Establishing organizational requirements
- Developing a network strategy
- Proposing a high-level conceptual architecture
- Identifying technologies to support the architecture
- Establishing financial justification
31
What is involved in the Plan phase?
- Identifying initial network requirements based on goals
- Characterizing sites
- Assessing existing networks
- Performing Gap analysis
- Creating a Project plan
32
What is involved in the Design phase?
```
Comprehensive, detail design that:
- Meets current business and technical requirements
- Incorporates specifications to support:
- Availability
- Reliability
- Security
- Scalability
- Performance
Basis for implementation activities.
```
33
What is involved in the Implement phase?
- Network components are built according to design specs.
- Avoids disrupting current network if possible
- Avoids creating points of vulnerability
34
What is involved in the Operate phase?
- Maintain network health through day to day operations
- Monitor:
- Fault detection
- Correction
- Performance
35
What is involved in the Optimize phase?
- Proactive management of the network
- Identify and resolve issues before they affect the organization.
- May require network redesign if too many problems or errors arise.
36
Where does Cisco NSF with SSO and redundant supervisors have the most impact in the campus?
Access layer
37
What hardware supports Cisco IOS Software Modularity?
Cisco Catalyst 6500 Series
NOT
3750
4500
XR
38
What is NSF?
Nonstop Forwarding (NSF)
A Layer 3 function that works with SSO to minimize the amount of time a network is unavailable to its users following a switchover.
The main objective of Cisco NSF is to continue forwarding IP packets following an RP (Route Processor) switchover.
39
What routing protocols support NSF?
- EIGRP
- OSPF
- IS-IS
- BGP
40
What is SSO?
Stateful Switchover (SSO)
Allows the standby route processor (RP) to take control of the device after a hardware or software fault on the active RP.
SSO synchronizes startup configuration, startup variables, and running configuration; and dynamic runtime data, including Layer 2 protocol states for trunks and ports, hardware Layer 2 and Layer 3 tables (MAC, Forwarding Information Base [FIB], and adjacency tables) and access control lists (ACL) and QoS tables.
```
Available with these devices:
4500 switches
6500 switches
7600 switches
Aggregation Services Routers (ASR)
```
41
What is Cisco NSF with SSO and how do they work together?
A supervisor redundancy mechanism in Cisco IOS Software that allows extremely fast switchover at Layers 2 to 4.
Designed to maintain a link-up Layer 3 up state during a routing convergence event.
42
What is the recommended version of STP to use for the enterprise campus?
RSTP - Rapid Spanning-Tree Protocol
43
What is UDLD and what is the enterprise recommendation regarding it?
Unidirectional Link Detection
Enables devices to monitor the physical configuration of the cables and detect when a unidirectional link exists where bidirectional communication has not been established.
Typically deployed on fiber topologies
Enable UDLD Aggressive mode in all environments where fiber-optic interconnections are used and enable it in Global mode to support every individual fiber-optic interface.
44
What are some routing protocol issues you may encounter when using EtherChannel?
- OSPF on an IOS switch could detect a failed link in the bundle and increase the link cost which causes a convergence event.
- EIGRP may not change the link cost if there is a failed link in a bundle.
45
How many links can be in a EtherChannel bundle?
8
46
What are two control mechanisms for EthernChannel?
1. LACP - Link Aggregation Control Protocol (IEEE 802.3ad)
| 2 PAgP - Port Aggregation Protocol (Cisco Proprietary)
47
What are the four modes for LACP and what do they do?
1. On - Forces it to be turned on. Only works with other ports set to On.
2. Active - Puts port in active negotiating state. Works with other ports set to Active or Passive.
3. Passive - Puts port in passive negotiating state. Works with other ports set to Active.
4. Off - Turns off LACP
48
What are the four modes for PAgP and what do they do?
1. On - Forces it to be turned on. Only works with other ports set to On.
2. Desirable - Puts port in active negotiating state. Works with other ports set to Desirable or Auto.
3. Auto - Puts port in passive negotiating state. Works with other ports set to Desirable.
4. Off - Turns off PAgP
49
What is ECMP?
Equal Cost Multipath
50
What are some details of EtherChannel load balancing?
- Load balancing using an alternate input hash can be tuned with the port-channel load-balance command.
- The default input hash value of Layer 3 for the source and destination does not load balance across the links.
- To achieve the best load balancing, use two, four, or eight ports in the port channel.
51
What are the reasons that passive interfaces should be implemented at distribution layer ports facing the access layer?
- To limit unnecessary peering across the access layer switches when the Layer 2 to Layer 3 boundary is in the distribution layer
- To avoid transit traffic through the access layer in the event of a link or node failure
52
What are 3 FHRPs?
First Hop Redundancy Protocols (FHRPs)
1. HSRP - Hot Standby Router Protocol (Cisco Proprietary)
2. VRRP - Virtual Router Redundancy Protocol (Standards Based)
3. GLBP - Gateway Load Balancing Protocol (Cisco Proprietary) - Allows packet load sharing among groups of redundant routers.
GLBP can more easily achieve load balancing on the uplinks from the access layer to the distribution layer, and first- hop redundancy and failure protection.
53
What FHRP does Cisco recommend?
HSRP is the recommended protocol over VRRP because it is a Cisco-owned standard , which allows for the rapid development of new features and functionality before VRRP.
Use VRRP when needing to interoperate with other vendors.
54
What are some advantages of GLBP in the Distribution Layer?
- GLBP provides all the benefits of HSRP and includes load balancing when VLANs do not span the access switches.
- A convergence event on the uplink affects only half as many hosts as compared to HSRP when VLANs do not span the access switches.
55
What is a potential issue you may run into when daisy chaining access switches?
There is a danger that black holes will occur in the event of a link or node failure when the distribution interconnection is Layer 3.
56
What is the best mechanism to prevent unicast flooding issues?
Do not span VLANs across multiple access switches.
57
Why should you not span VLANs across multiple access switches if possible?
Because it is the best mechanism to prevent unicast flooding issues.
58
What hardware is supported by the Cisco Power Calculator?
Cisco Catalyst 4500 and 6500 Series
59
What are some features that the Cisco Catalyst Integrated Security capabilities provide?
- DHCP snooping prevents rogue DHCP activities.
- Dynamic ARP inspection adds security to ARP to minimize the impact of ARP poisoning and spoofing attacks.
- IP source guard prevents IP spoofing using the dynamic ARP inspection table
60
Which three address blocks are summarizable?
a. 172.16.20.0/ 24 to 172.16.27.0/ 24
b. 172.16.20.0/ 24 to 172.16.23.0/ 24
c. 10.16.0.0/ 16 to 10.31.0.0/ 16
d. 10.16.0.0/ 16 to 10.47.0.0/ 16
e. 2001: 0DB8: C3B7: 10A0::/ 64 to 2001: 0DB8: C3B7: 10DF::/ 64
f. 2001: 0DB8: 1234: FB40::/ 64 to 2001: 0DB8: 1234: FB5F::/ 64
g. 10.96.0.0/ 16 to 10.159.0.0/ 16
b. 172.16.20.0/ 24 to 172.16.23.0/ 24
c. 10.16.0.0/ 16 to 10.31.0.0/ 16
f. 2001: 0DB8: 1234: FB40::/ 64 to 2001: 0DB8: 1234: FB5F::/ 64
61
What are 2 examples of what bit splitting could be used for?
1. OSPF Area Design
| 2. Summarizable address blocks with convenient role-based subnets
62
What is a recommended design approach for OSPF?
Originate the default at the edge and redistribute it into dynamic routing.
63
What is redistribution and some of its characteristics?
Redistribution is a powerful tool for manipulating and managing routing updates, particularly when two routing protocols are present in a network.
- Easy to create routing loops
- Works poorly with an arbitrary mix of routing protocols anywhere.
- Works well with a limited number of redistribution points.
64
What is Split Horizon?
A routing protocol feature. The idea behind it is that it is counterproductive to advertise information back to the source of that information, because the information may be out of date or incorrect, and because the source of the information is presumed to be better informed.
65
In what size network does routing design need to be most carefully done?
Large networks.
66
What three factors are the biggest influences on OSPF scalability?
1. Flooding paths and redundancy
2. Amount of routing information in the OSPF area or routing domain.
3. Number of adjacent neighbors
67
What are the different routing protocols and what classes do they fall into?
Distance Vector
- RIPv1
- RIPv2
Link State
- OSPF
- IS-IS
Hybrid Link State and Distance Vector
-EIGRP
Path Vector
-BGP
68
What does IBGP require and why?
IBGP requires a full mesh of peers because it has no other way to prevent looping of routing information.
69
What is a route reflector?
A BGP route reflector is an IBGP speaker that reflects or repeats routes learned from IBGP peers to some of its other IBGP peers.
70
What are 3 types of IBGP routers that will receive reflected routes from a route reflector client?
1. Nonclient routers
2. Other route reflector client routers
3. EBGP peers
71
What technique does SONET use for framing voice and data onto a single wavelength on fiber?
TDM
72
What is CWDM?
Coarse Wavelength-Division Multiplexing
An optical technology for transmitting up to 16 channels, each in a separate wavelength or color, over the same fiber strand using less-sophisticated and less-costly transceiver designs than DWDM.
73
What is WDM?
Wavelength-Division Multiplexing
Uses a multiplexer (mux) at the transmitter to place multiple optical signals on a fiber and a demultiplexer (demux) at the receiver to split them off of the fiber.
74
What is DWDM and CWDM?
Dense Wavelength-Division Multiplexing
Coarse Wavelength-Division Multiplexing
DWDM and CWDM are technologies that increase the information-carrying capacity of existing fiber-optic infrastructure by transmitting and receiving data on different light wavelengths on a single strand of fiber.
CWDM is an optical technology for transmitting up to 16 channels, each in a separate wavelength or color, over the same fiber strand using less-sophisticated and less-costly transceiver designs than DWDM.
75
What is DWDM?
Dense Wavelength-Division Multiplexing
A core technology in an optical transport network. The concepts of DWDM are similar to those for CWDM except DWDM spaces the wavelengths more tightly, yielding up to 160 channels. The tighter channels are more precise which is why it is more sophisticated and costly than CWDM.
76
What is SONET?
Synchronous Optical Network (SONET),
A time -division multiplexing (TDM) technique for framing voice and data onto a single wavelength on fiber.
77
What is SDH?
Synchronous Digital Hierarchy
78
What is a drawback to using SONET?
It requires provisioning double the protected bandwidth. Bandwidth along SONET is committed as circuits between two points on the ring.
79
What Ethernet-based services are point-to-point services?
1. EPL
2. ERS
3. EWS
80
What is EPL?
Ethernet Private Line
A port-based point-to-point Ethernet-line (E-line) service that maps Layer 2 traffic directly onto a TDM circuit.
81
What is ERS?
Ethernet Relay Service
A point-to-point VLAN-based E-line service that is used primarily for establishing a point-to-point connection between customer routers.
82
What is EWS?
Ethernet Wire Service
A point-to-point port-based E-line service that is used primarily to connect geographically remote LANs over a P-network.
83
What is EMS?
Ethernet Multipoint Service
A multipoint-to-multipoint port -based emulated LAN (ELAN) service that is used for transparent LAN applications.
Some characteristics are:
- The P-network acts as a virtual switch for the customer.
- All customer packets are transmitted to the destination ports transparently.
- Oversubscription of the P-network is handled using stat muxing.
84
What is ERMS?
Ethernet Relay Multipoint Service
A multipoint-to-multipoint VLAN-based ELAN service that is used primarily for establishing a multipoint-to-multipoint connection between customer routers
85
What is service multiplexing?
Ability to support multiple instances of services or EVCs (Ethernet Virtual Circuit) on a single customer UNI (User Network Interface)
86
Maybe add some characteristics to other Ethernet Services just like with EMS?
Maybe add some characteristics to other Ethernet Services just like with EMS?
87
What is a PW in MPLS?
Pseudo Wires (PW)
- Encapsulation of circuit data or PDUs at the ingress
- Carries encapsulated data across the tunnel and acts as a logical wire
88
What is Jitter?
The variation in delay in the interval between successive packets
89
Why is a business risk assessment needed?
As a basis for design decisions.
90
Which 3 factors should you consider when selecting a CPE device for a WAN service?
1. Physical interface that is used by the WAN service.
2. Performance limits of the CPE device
3. Required additional services , such as VPN and QoS
91
What is Pfr and what are its 5 operations?
Performance Routing (PfR) is the general term used for features that take into account diverse WAN characteristics and makes an informed-decision about the best path to reach a network or application.
1. Learn
2. Measure
3. Apply Policy
4. Optimize
5. Verify
92
What are four benefits of the three layer model for data center design?
1. Support for layer 2 domain sizing
2. Support for service modules
3. Support for a mix of access layer models
4. Support for NIC Teaming and HA clustering
93
What are three design recommendations for OSPF in the data center?
1. Use NSSA from the core layer down.
2. Adjust the default bandwidth value with the auto-cost reference-bandwidth command.
3. Tune the timers with the timers throttle spf command.
94
Which layer 2 loop-free design is most susceptible to black holing of service module traffic in the event of an uplink failure?
Layer 2 loop-free U
95
What are the two layer 2 loop-free topologies and their characteristics?
1. Loop-free U
- VLANs are contained in switch pairs (no extension outside of switch pairs).
- No STP blocking; all uplinks are active.
- Layer 2 service modules black hole traffic on uplink failure.
2. Loop-free inverted U
- Supports VLAN extension.
- No STP blocking; all uplinks are active.
- Access switch uplink failure black holes single attached servers.
- ISL scaling considerations.
- Supports all service module implementations.
Characteristics of both:
- Redundancy can be supported using a trunk between the access switches.
- VLANs are extended to the aggregation layer.
96
What are the two main disadvantages to the layer 2 loop-free U design?
1. VLANs cannot be extended between aggregation switches
| 2. Layer 2 service modules will black hole traffic in the event of an uplink failure.
97
What are three characteristics of a Layer 3 access design model?
1. VLANs do not extend to the aggregation layer.
2. All uplinks are active, and none are blocking.
3. Layer 2 server adjacency is supported across a single pair of access switches.
98
What are the characteristics of top-of-rack access switch designs as compared to end-of-rack access switch designs?
1. Cabling from the cabinet is minimized.
2. Cooling requirements are eased.
3. The number of devices to manage increases.
99
What are the 7 most common things to consider in choosing access layer platforms?
1. Cabling Design
2. Cooling Requirements
3. Power Requirements
4. Density
5. 10 GB Ethernet and 10 GB EtherChannel Support
6. Resiliency features
7. Intended use
100
What are some characteristics of a ToR design?
- Cooling is less than EoR
- Less cabling from the cabinet
- Higher STP Processing
- More devices to manage
- More port density
101
What are some characteristics of a EoR design?
- Decreased Management
- Fewer devices to manage
- Lower STP Processing
- Redundant switch power and CPUs
102
What are some disadvantages of the EoR design?
- More cabling needs to be routed and managed.
| - Cooling restraints due to the cable bulk coming into the cabinets and blocking airflow.
103
What command is used to enable an EtherChannel hash for Layer 3 IP plus Layer 4 port-based Cisco Express Forwarding?
port-channel load-balance
104
Where are service layer switches typically connected in the data center architecture?
At the aggregation layer in Layer 2 access layer designs
105
What are STP virtual ports?
A per-line card value that reflects the total number of spanning-tree processing instances used on a particular line card
106
The integral switch on a blade server is logically similar to what design?
1RU access switch design
107
Which component has the largest failover time?.
RSTP
```
As compared to:
ACE Module
FWSM
Tuned EIGRP
HSRP
```
108
What are three design options that are enabled by the use of VDCs on the Cisco Nexus 7000 series switches?
1. Split-core topology: building two separate data center cores using a single redundant pair of Cisco Nexus 7000 switches
2. Consolidated aggregation : using two VDCs of a single Cisco Nexus 7000 switch as a redundant pair of aggregation switches in an aggregation block
3. Multiple aggregation layers: using VDCs to create separate aggregation blocks by business unit or function from a single pair of Cisco Nexus 2000 FEXs.
109
What are three characteristics of Fibre Channel?
1. Full duplex
2. Addresses more than 16 million nodes
3. Segment lengths of up to 6 miles (10 km)
110
What technology allows multiple logical SANs to exist in the same physical fabric?
Virtual SAN (VSAN)
111
What is a means of restricting visibility and connectivity between devices connected to a common Fibre Channel SAN or VSAN?
Zoning
112
What are two characteristics of a large-scale SAN design?
1. Uses a core-edge design to support much larger port densities than the collapsed-core design.
2. Has a lower port-density efficiency as compared to small- or medium-scale designs.
113
What are three factors in SAN design?
1. Port density and topology
2. Fault isolation using VSAN
3. Simplified SAN management through storage captivity
114
What are three benefits of a unified fabric?
1. Reduced cabling
2. Fewer network port adapters per server
3. Power and cooling savings.
115
Which types of adapters is used by a server when deploying FCoE?
Ethernet NIC and CNA (Converged Network Adapter).
116
What are three best-practice guidelines for unified fabric design?
1. If you enable MST, you should use a separate MST instance for FCoE VLANs.
2. Use separate FCoE VLANs for SAN A and SAN B in dual-fabric SAN designs.
3. When using FCoE on the Cisco Nexus 2000 FEXs, these FEXs should be connected straight through.
117
What are the DCB Standards?
1. 802.1Qbb Priority Flow Control (PFC)
2. 802.1Qaz Enhanced Transmission Selection (ETS)
3. 802,1Qau Congestion Notification
4. 802.1ab Data Center Bridging Capability Exchange (DCBX) Protocol
118
Where is an e-commerce design typically implemented?
In the data center
119
What are three functions of SLB?
1. Providing a public IP address or virtual IP address for each service
2. Rewriting source and destination IP or MAC addresses, depending on SLB mode
3. Supporting scaling and high availability by distributing client requests for service across active servers
120
What are three characteristics of SLB one-armed mode?
1. The SLB VIP and the real servers are in the same VLAN or subnet.
2. The SLB VIP and the real servers are in the same VLAN or subnet.
3. Return traffic can use PBR to deflect appropriate outbound server traffic over to the SLB as next hop.
121
Where is the firewall perimeter in a basic e-commerce design?
At the core layer.
122
What are two characteristics of the e-commerce design with two firewall layers when the Cisco ACE is not in Routed mode?
1. The aggregation switch Cisco FWSM routes traffic to the server subnets.
2. The MSFC is not directly connected to the Cisco ACE.
123
What is a virtual firewall?
A logical separation of multiple firewall security contexts on a single firewall
124
What command provides support for asymmetric routing on the FWSM 3.0?
asr-group interface command on FWSM 3.0
125
What are three components of a PVLAN?
1. Community VLAN
2. Isolated VLAN
3. Primary VLAN
126
What are two methods to provide network security with access control?
1. IBNS authentication
| 2. NAC posture assessment
127
How many NAC Appliance Servers can Cisco NAC Appliance Super Manager manage?
40
128
What are two characteristics of real IP gateway mode?
1. The Cisco NAS has an IP address for every managed VLAN.
| 2. The Cisco NAS operates as the default gateway for untrusted network clients.
129
What are two typical NAC agentless hosts?
1. Scanners
| 2. Printers
130
What are two characteristics of an IPS sensor?
1. It is an active device in the traffic path.
| 2. Traffic arrives on one IPS interface and exits on another.
131
What are two challenges for IPS deployments?
1. Supporting asymmetric traffic flows
| 2. Supporting failover without dropping valid traffic
132
What mechanism can be used to scale Cisco Security MARS deployments?
A global controller to summarize multiple local controllers
133
Access control or admission control consists of which three elements?
1. Identity
2. Enforce
3. Isolate
134
What is the recommended practice for deploying the VPN termination device for best security?
To place the public side of the VPN termination device in a DMZ behind a firewall
135
What is the most common address assignment design for remote-access VPNs?
Using internal address pools per VPN headend and implementing a static route for these subnets to the VPN headend
136
What are two site to site VPN applications?
1. WAN replacement
| 2. Mandated or regulatory encryption
137
What is the typical IPsec deployment design?
Remote peers connected to the central site over a shared infrastructure in a hub-and-spoke topology
138
What are two characteristics of the Cisco Easy VPN solution?
1. Reduced management complexity for VPN deployments
| 2. Centralized VPN management across all Cisco VPN devices
139
What are some advantages of DMVPN tunnels?
- Dynamic mesh availability with fewer active tunnels on each spoke
- Spoke-to-spoke tunnel creation dynamically based on traffic requirements
140
What are some characteristics of a GET VPN?
- It is a set of software features that provides a tunnel-less technology for end-to-end security.
- It secures IP multicast group traffic or unicast traffic over a private WAN.
141
What are three recommendations for managing VPNs?
1. Use dedicated management interfaces if possible.
2. Use a different username for configuration management and for troubleshooting.
3. Use IPsec rather than SSH or SSL for access to VPN devices across the Internet.
142
What is the primary issue in scaling VPNs?
Packets-per-second capacity from remote routers
143
Which routing protocol is recommended for large-scale enterprise IPsec VPNs?
EIGRP
144
Which VPN type does not tunnel traffic?
IPsec direct encapsulation
145
What is a benefit of using IP multicast to deliver source traffic to multiple receivers?
It reduces network bandwidth consumption.
146
What does multicast routing use for a broadcast to flood packets out all interfaces except for those incoming from the source.
RPF - Route Path Forwarding
147
What is Route Path Forwarding (RPF)?
Forwarding multicast traffic away from the source, rather than to the receiver.
This is just the opposite of unicast routing.
148
When will a router forward a multicast packet?
Only if it is received on the upstream interface; this interface is also called the RPF interface.
149
What RPF checks does a router do to a mulicast packet?
- The router looks up the source address in the unicast routing table to determine whether the packet has arrived on the interface that is on the reverse path back to the source.
- If the packet has arrived on the interface leading back to the source, the RPF check succeeds and the packet is forwarded.
- If the RPF check fails, the packet is dropped.
150
Which purpose is served by IGMP in IP multicast?
To join hosts in a multicast group
151
What is IGMP and what are the differences between IGMP v1 - v3?
Internet Group Management Protocol
Used between hosts and their local router.
Hosts use IGMP to register with the router to join (and leave) specific multicast groups.
Version 1
- Has no Leave Group mechanism
Version 2
- Leave Group message
- Group-specific queries
- Querier election mechanism
- Query-interval response time
Version 3
- Adds the ability to filter multicasts based on the multicast source so that hosts can indicate that they want to receive traffic only from particular sources within a multicast group.
152
In which type of environments would PIM-SSM be efficiently used?
One-to-many applications
153
What are three characteristics of ASM?
1. Deployments use shared distribution trees.
2. Deployments use source distribution trees.
3. It is the traditional form for PIM deployments.
154
Which multicast deployment model does not track (S, G) state?
Bidir-PIM
155
Which two multicast protocols use candidate RPs?
1. Auto-RP
| 2. BSR
156
What are three characteristics of multicast state information?
1. It grows when sources and receivers run multicast applications.
2. It includes the unicast routing state information.
3. State changes affect CPU utilization.
157
How is packet filter-based access control typically deployed?
At the network ingress interface on the data plane before multicast processing.
158
In which two types of environments would PIM-SSM be efficiently used?
1. Deployments in which switches are used pervasively
| 2. One-to-many applications
159
What are three of the benefits of GET VPN?
1. It can take advantage of quick branch-to-branch connectivity while improving core meshing capability.
2. Encryption is supported for native multicast and unicast traffic with Group Encrypted Transport’s GDOI protocol.
3. It uses multicast to send the GET VPN packets to multiple destinations , which makes GET VPN very scalable.
160
Which port does syslog use for sending messages to a syslog server?
UDP 514
161
What are the four fields traditional Netflow uses to identify a flow?
1. Destination IP Address
2. Source IP Address
3. ToS Byte
4. Layer 3 Protocol Type
162
What is the definition of a flow?
A unidirectional stream of packets between a given source and destination (both defined by a network layer IP address and source and destination port numbers).
163
What are the 7 key fields that make up a flow?
1. IP Source Address
2. IP Destination Address
3. Source Port
4. Destination Port
5. Layer 3 Protocol Field
6. Type of Service (ToS) Byte
7. Input Interface (IfIndex)
164
What is Netflow?
An important embedded Cisco IOS Software technology that provides visibility into network behavior and how network assets are being used.
NetFlow answers the questions of what, when, where , and how traffic is flowing in the network.
165
What are the different version of Netflow exports?
Version 1
- The original version
```
Version 5 (Most Common)
- Adds autonomous system data and sequencing information to the NetFlow Data Export
```
Version 7
- Supports Cisco Catalyst 6500 series switches with an MSFC on Cisco Catalyst Operating System Version 5.5( 7) and later.
Version 8
- Is for on-router aggregation. It includes a choice of 11 aggregation schemes.
Version 9
- Supports dynamically defined fields.
166
What are three reasons for expiration of NetFlow cache entries?
1. As the cache becomes full, a number of heuristics are applied to aggressively age groups of flows simultaneously.
2. Flows that have been idle for a specified time are expired and removed from the cache.
3. TCP connections that have reached the end-of-byte stream (FIN) are expired.
167
Which NetFlow export record type does Flexible NetFlow use?
Version 9
168
What are three characteristics of Flexible NetFlow?
1. It is the basis for IPFIX.
2. It can monitor a wider range of packet information than traditional NetFlow.
3. It can track multiple NetFlow applications simultaneously by using different flow monitors.
169
What are two characteristics of NBAR?
1. It can only monitor applications that are built in or that it recognizes from a PDLM.
2. It can monitor a wider range of packet or protocol information than traditional NetFlow.
170
What are two advantages of shadow routers?
1. They allow scalability with many endpoints.
| 2. They provide separate memory and CPU from hardware in the switching path.
171
What are shadow routers?
A dedicated router that is used to perform the IP SLA measurement operations when the number of operations is high for an IP SLA source (such as for hundreds or thousands of measurements).
172
How many buildings should you have before deploying a dedicated campus core?
Three or more.
or four or more pairs of building distribution switches in a very large campus.
173
What is TX-queue starvation?
When incoming packets are received faster than outgoing packets are transmitted. Packets are queued as they wait to serialize out onto the slower link.
174
What is the current recommended practice for configuring a trunk?
- Use 802.1Q
- Set DTP to Desirable and Desireable with Encapsulation Negotiate to support DTP negotiation.
- Disable trunks on host ports because host devices do not need to negotiate trunk status. This practice speeds up PortFast and is a VLAN-hopping security measure.
175
What is the current recommended VTP mode and why?
Transparent because it decreases the potential for operational error.
176
What is the current best practice for Vlan pruning?
Manually prune unused VLANS from trunked interfaces. This allows you to avoid broadcast propagation.
177
Should you do automatic Vlan pruning?
No
178
What is the default setting for VTP on Cisco switches?
Server mode with no VTP domain name.
179
What would happen if you did not have a VTP domain name set and the switch was in client or server mode when you connected it to another switch that did have a domain set?
The switch you are connecting would accept the domain name of an adjacent VTP server and overwrite the local VLAN database.
180
What is the purpose of the data center core?
Serves as the gateway to the campus core , where other campus modules connect , including the enterprise edge and WAN modules.
181
How are the links connecting to the data center core terminated?
- Layer 3
- Use a distributed, low-latency forwarding architecture
- Use 10 GB interfaces
182
What is the recommended layer (2 or 3) that should be implemented for the core infrastructure in the data center?
Layer 3
183
Where should the layer 2/layer 3 boundary be implemented in the data center?
Either within or below the aggregation layer modules.
184
Should you implement layer 2 in the data center core? Why or why not?
No. Layer 2 should be avoided in the core because a Spanning Tree Protocol (STP) loop could cause a full data center outage.
185
Should the data center core run an interior routing protocol? If so, which ones?
Yes, such as OSPF or EIGRP.
186
What do you use to load balance traffic between the campus core and core aggregation layers and what is the command to enable it?
Using CEF (Cisco Express Forwarding) based hashing algorithms.
mls ip cef load-sharing
187
What is the rule-of-thumb recommendation for data oversubscription for access ports on the access-to-distribution uplink?
20:1
188
What is the rule-of-thumb recommendation for data oversubscription for access ports on the distribution-to-core links?
4:1
189
What are 3 Fibre Channel topologies?
1. Point to point
2. Arbitrated Loop
3. Switched
190
What are some characteristics of Fibre Channel Communication?
Similar to TCP communication in the following ways:
- Point to point oriented (similar to TCP session establishment.)
- Supports a logical node connection point between node ports (N_Ports). (Similar to TCP and UDP Sockets).
- Supports flow control on a hop-by-hop basis using a buffer-to-buffer credit (BB_Credit) method. (Similar to TCP flow control except the receiver calls the shots and there aren't any drops)
- Supports acknowledgements for certain classes of traffic. (Similar to TCP and UDP acknowledgement models).
- Enables multiple sessions to be maintained per device. (Similar to TCP and UDP Sockets).
192
What are the best practices for deploying VSS?
- Always use star topologies that are based on MEC (MultiChassis EtherChannels) with the VSS.
- Use unique VSS domain numbers for each VSS pair in your network, even if the pairs are not directly connected to each other.
- As with any EtherChannel, always use a number of links that is a power of 2 (2, 4, 8) to optimize the load balancing of traffic across the VSLs.
- Do not configure switch preemption.
- Do not tune the Link Management Protocol (LMP), LACP, and PAgP timers in an aggressive manner or it may adversely affect the system performance.
- Enable a dual-active detection mechanism to guard against VSL (Virtual Switch Link) failures.
193
Where is the most common point to deploy VSS in the campus?
In the Distribution Layer
194
What is VSS and what is the most important benefit of it?
Virtual Switched System (VSS)
- VSS is a network virtualization technology that combines two Cisco Catalyst 6500 switches (and other models such as the 4500) into a single logical entity.
- It enables loop-free logical star designs that retain full physical redundancy.
195
What is the recommended practice for the Virtual Switch Link (VSL) Etherchannel between two switches using Virtual Switched System (VSS)?
The VSL EtherChannel should consist of at least two 10-Gbps links, which should be terminated on different line cards in the chassis for maximum availability.
196
What are the 3 design models for the access-distribution block?
1. Layer 2 loop-free (current best practice)
2. Layer 2 looped
3. Layer 3 routed
197
What are the characteristics of the Layer 2 Loop-Free access-distribution design model?
- Access switches use layer 2 switching.
- Links between the access and distribution layers are configured as layer 2 trunks.
- Links between distribution layer switches are configured as Layer 3 routed links and use Etherchannel.
- All ports are in the Spanning-Tree Forwarding state
- Spanning-tree is not involved with load balancing or network convergence.
- Some flavor FHRP is used for load balancing traffic from the access to distribution layer.
- Reconvergence time in case of failure is primarily driven by the FHRP in use.
- VLANs should NOT be extended across multiple access switches.
198
What are the characteristics of the Layer 2 Looped access-distribution design model?
- Access switches use layer 2 switching.
- Links between the access and distribution layers are configured as layer 2 trunks.
- Links between distribution layer switches are configured as Layer 2 trunks routed links (and I believe use Etherchannel. The book didn't say).
- Not all ports are in the Spanning-Tree Forwarding state. Some are blocking to prevent the loop.
- Spanning-tree is involved with network convergence along with the FHRP being used.
- Load-balancing is limited using PVST root election tuning on a VLAN-by-VLAN basis. STP will still block one of the access switch uplinks within each VLAN.
- Some flavor FHRP is used
- VLANs can be extended across multiple access switches.
199
What are the characteristics of the Layer 3 Routed access-distribution design model?
- Access switches use layer 3 routing.
- Links between all switches are configured as layer 3 routed links.
- No Spanning-tree on inter-switch links and spanning-tree is not involved with load balancing or network convergence.
- No FHRP is in use. Hosts use access switch as their default gateway. Some flavor FHRP is used for load balancing traffic from the access to distribution layer.
- Reconvergence time in case of failure is dependent on the routing protocol being used.
- VLANs can NOT be extended across multiple access switches.
200
What is SLB?
A Server Load Balancer (SLB), also called a content load balancer, supports both scaling and high availability by distributing client requests for service across active servers.
The SLB provides a public IP address, also called a virtual IP (VIP) address, for each service.
201
What are the three SLB Design Models?
1. Router Mode - The SLB device routes between outside and inside subnets.
2. Bridge mode (inline): The SLB device operates in Transparent Bridging mode.
3 One-armed or two-armed mode: The one-armed or two-armed mode can be implemented in several ways such that replies from servers pass back through the SLB on their way to the end user. The server default gateway can be set to the SLB device, policy-based routing (PBR) can be used, or client NAT can be used.
202
What is the One-armed mode of the SLB Design Model?
- Out-of-band approach
- SLB connected to a switch with one or two connections.
- Not directly inline with the traffic path.
- SLB VIP and servers are in the same Vlan.
