Pass the Cisco CCNA 200-301 Questions and answers with CertsForce

The short syntax of static IPv6 route is:

ipv6 route < destination-IPv6-address > {next-hop-IPv6-address | exit-interface}

Answer as below configuration:

Sw1

enbale

config t

Vlan 210

Name FINANCE

Inter e0/1

Switchport access vlan 210

do wr

Sw2

Enable

config t

Vlan 110

Name MARKITING

Int e0/1

Switchport acees vlan 110

do wr

Sw3

Enable

config t

Vlan 110

Name MARKITING

Vlan 210

Name FINANCE

Int e0/0

Switchport access vlan 110

Int e0/1

Switchport access vlan 210

Sw1

Int e0/1

Switchport allowed vlan 210

Sw2

Int e0/2

Switchport trunk allowed vlan 210

Sw3

Int e0/3

Switchport trunk allowed vlan 210

Switchport trunk allowed vlan 210,110

WPA3 uses stronger encryption and security mechanisms than WPA2. The protocol associated with WPA3 is GCMP.

GCMP (Galois/Counter Mode Protocol) is used with WPA3.

It provides stronger security and better performance than older protocols.

A. CCMP: associated mainly with WPA2, not WPA3.

B. MD5: a hashing algorithm, not a WPA3 wireless encryption protocol.

C. TKIP: older and insecure; used with WPA/WPA2 legacy environments, not WPA3.

WPA2 → CCMP

WPA3 → GCMP

Why D is correct:Why the others are incorrect:CCNA takeaway:

“Encapsulating Security Payload

…

Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. However, in Tunnel Mode, where the entire original IP packet is encapsulated with a new packet header added, ESP protection is afforded to the whole inner IP packet (including the inner header) while the outer header (including any outer IPv4 options or IPv6 extension headers) remains unprotected.

JSON data is written as name/value pairs.

A name/value pair consists of a field name (in double quotes), followed by a colon, followed by a value:

“name”:”Mark”

JSON can use arrays. Array values must be of type string, number, object, array, boolean or null.

For example:

{

“name”:”John”,

“age”:30,

“cars”:[ “Ford”, “BMW”, “Fiat” ]

}

JSON can have empty object like “taskId”:{}

https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-5/configuration-guide/b_cg75/b_cg75_chapter_0100010.html

Cisco DNA Center Device Management

3. Monitor the cloud for software update

5. Uses CLI templates to apply a consistent configuration to multiple devices at an individual location

6. Uses NetFlow to analyse potential security threats throughout the network and take appropriate action on that traffic

Traditional device management

2. Manages device configuration on a per-device basis

4. Security is managed near the perimeter of the network with firewalls, VPNs, and IPS

Implements changes via an SSH terminal

Double-Tagging attack:

In this attack, the attacking computer generates frames with two 802.1Q tags. The first tag matches the native VLAN of the trunk port (VLAN 10 in this case), and the second matches the VLAN of a host it wants to attack (VLAN 20).

When the packet from the attacker reaches Switch A, Switch A only sees the first VLAN 10 and it matches with its native VLAN 10 so this VLAN tag is removed. Switch A forwards the frame out all links with the same native VLAN 10. Switch B receives the frame with an tag of VLAN 20 so it removes this tag and forwards out to the Victim computer.

Note: This attack only works if the trunk (between two switches) has the same native VLAN as the attacker.

To mitigate this type of attack, you can use VLAN access control lists (VACLs, which applies to all traffic within a VLAN. We can use VACL to drop attacker traffic to specific victims/servers) or implement Private VLANs.

ARP attack (like ARP poisoning/spoofing) is a type of attack in which a malicious actor sends falsified ARP messages over a local area network as ARP allows a gratuitous reply from a host even if an ARP request was not received. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network. This is an attack based on ARP which is at Layer 2.

Dynamic ARP inspection (DAI) is a security feature that validates ARP packets in a network which can be used to mitigate this type of attack.

Answer as below configuration:

1.- on R3

config terminal

ip route 192.168.1.1 255.255.255.255 209.165.200.229

end

copy running start

2.- on R2

config terminal

ip route 0.0.0.0 0.0.0.0 209.165.202.130

end

copy running start

3.- on R2

config terminal

ipv6 route ::/0 2001:db8:abcd::2

end

copy running start

We can see in this picture we have to type 64 hexadecimal characters (256 bit) for the WPA2 passphrase so we can deduce the encryption is AES-256, not AES-128.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/67134-wpa2-config.html

Router2 does not have an entry for the subnet 10.10.13.128/25. It only has an entry for 10.10.13.0/25, which ranges from 10.10.13.0 to 10.10.13.127.

https://study-ccna.com/administrative-distance-metric/

The virtual router MAC address associated with a virtual router is an

  IEEE 802 MAC Address in the following format:

   00-00-5E-00-01-{VRID} (in hex in internet standard bit-order)

https://www.geeksforgeeks.org/how-dhcp-server-dynamically-assigns-ip-address-to-a-host/#:~:text=DHCP%20is%20an%20abbreviation%20for,subnet%20mask%20and%20gateway%20address.

FHRP is layer 3 protocol whose purpose is to protect the default gateway by offering redundancy of the gateway in a subnet. This is achieved by allowing two or more routers to provide a backup for the first-hop IP router address. If a failure of an active router occurs, the backup router will take over the address. The routers negotiate their roles (Active/Standby) with each other by multicast hello messages to share the VIP (virtual IP address) between the FHRP routers. The terms Active/Standby vary between the different types of FHRP. The active router will act as the default gateway and the standby router acts as a backup the active router.

To subnet 172.25.0.0/16 to meet the subnet requirements and maximize the number of hosts, you need to determine how many bits you need to borrow from the host portion of the address to create enough subnets for 32 sites. Since 32 is 2^5, you need to borrow 5 bits, which means your new subnet mask will be /21 or 255.255.248.0. To find the second subnet, you need to add the value of the fifth bit (32) to the third octet of the network address (0), which gives you 172.25.32.0/21 as the second subnet. The first usable IP address in this subnet is 172.25.32.1, and the last usable IP address is 172.25.39.254.

To assign the first usable IP address to e0/0 on Sw101, you need to enter the following commands on the device console:

Sw101#configure terminal Sw101(config)#interface e0/0 Sw101(config-if)#ip address 172.25.32.1 255.255.248.0 Sw101(config-if)#no shutdown Sw101(config-if)#end

To assign the last usable IP address to e0/0 on Sw102, you need to enter the following commands on the device console:

Sw102#configure terminal Sw102(config)#interface e0/0 Sw102(config-if)#ip address 172.25.39.254 255.255.248.0 Sw102(config-if)#no shutdown Sw102(config-if)#end

To subnet an IPv6 GUA to meet the subnet requirements and maximize the number of hosts, you need to determine how many bits you need to borrow from the interface identifier portion of the address to create enough subnets for 32 sites. Since 32 is 2^5, you need to borrow 5 bits, which means your new prefix length will be /69 or ffff:ffff:ffff:fff8::/69 (assuming that your IPv6 GUA has a /64 prefix by default). To find the second subnet, you need to add the value of the fifth bit (32) to the fourth hextet of the network address (0000), which gives you xxxx:xxxx:xxxx:0020::/69 as the second subnet (where xxxx:xxxx:xxxx is your IPv6 GUA prefix). The first and last IPv6 addresses in this subnet are xxxx:xxxx:xxxx:0020::1 and xxxx:xxxx:xxxx:0027:ffff:ffff:ffff:fffe respectively.

To assign an IPv6 GUA using a unique 64-bit interface identifier on e0/0 on Sw101, you need to enter the following commands on the device console (assuming that your IPv6 GUA prefix is 2001:db8::/64):

Sw101#configure terminal Sw101(config)#interface e0/0 Sw101(config-if)#ipv6 address 2001:db8::20::1/69 Sw101(config-if)#no shutdown Sw101(config-if)#end

To assign an IPv6 GUA using a unique 64-bit interface identifier on e0/0 on Sw102, you need to enter the following commands on the device console (assuming that your IPv6 GUA prefix is 2001:db8::/64):

Sw102#configure terminal Sw102(config)#interface e0/0 Sw102(config-if)#ipv6 address 2001:db8::27::fffe/69 Sw102(config-if)#no shutdown Sw102(config-if)#end