Improved Cisco 300-101 braindumps

Answer: B 

Explanation: 

The switch validates DHCP packets received on the untrusted interfaces of VLANs with DHCP snooping

enabled. The switch forwards the DHCP packet unless any of the following conditions occur (in which case the packet is dropped):

The switch receives a packet (such as a DHCPOFFER, DHCPACK, DHCPNAK, or DHCPLEASEQUERY

packet) from a DHCP server outside the network or firewall.

The switch receives a packet on an untrusted interface, and the source MAC address and the DHCP client

hardware address do not match. This check is performed only if the DHCP snooping MAC address

verification option is turned on. · The switch receives a DHCPRELEASE or DHCPDECLINE message from an untrusted host with an entry in the DHCP snooping binding table, and the interface information in the binding table does not match the interface on which the message was received.

The switch receives a DHCP packet that includes a relay agent IP address that is not 0.0.0.0. To support

trusted edge switches that are connected to untrusted aggregation-switch ports, you can enable the DHCP

option-82 on untrusted port feature, which enables untrusted aggregation- switch ports to accept DHCP

packets that include option-82 information. Configure the port on the edge switch that connects to the

aggregation switch as a trusted port. Reference: http:// www.cisco.com/c/en/us/td/docs/switches/lan/

catalyst6500/ios/12- 2SX/configuration/guide/book/snoodhcp.html

Topic 7, Mix Questions 

83. Which two commands would be used to troubleshoot high memory usage for a process? (Choose two.) 

A. router#show memory allocating-process table 

B. router#show memory summary 

C. router#show memory dead 

D. router#show memory events 

E. router#show memory processor statistics 

Answer: D 

Explanation: 

PPPoE is composed of two main phases:

Active Discovery Phase--In this phase, the PPPoE client locates a PPPoE server, called an access

concentrator. During this phase, a Session ID is assigned and the PPPoE layer is established.

PPP Session Phase--In this phase, PPP options are negotiated and authentication is performed. Once the

link setup is completed, PPPoE functions as a Layer 2 encapsulation method, allowing data to be transferred over the PPP link within PPPoE headers.

Reference: 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/vpn/asa-vpn- cli/vpn-pppoe.html

Topic 3, Layer 3 Technologies 

20. Refer to the exhibit. 

Which one statement is true? 

A. Traffic from the 172.16.0.0/16 network will be blocked by the ACL. 

B. The 10.0.0.0/8 network will not be advertised by Router B because the network statement for the 10.0.0.0/8 network is missing from Router B. 

C. The 10.0.0.0/8 network will not be in the routing table on Router B. 

D. Users on the 10.0.0.0/8 network can successfully ping users on the 192.168.5.0/24 network, but users on the 192.168.5.0/24 cannot successfully ping users on the 10.0.0.0/8 network. 

E. Router B will not advertise the 10.0.0.0/8 network because it is blocked by the ACL. 

Answer: B 

Explanation: 

Answer: A 

Explanation: 

Network administrators can use Unicast Reverse Path Forwarding (Unicast RPF) to help limit

the malicious traffic on an enterprise network. This security feature works by enabling a router to verify the

reachability of the source address in packets being forwarded. This capability can limit the appearance of

spoofed addresses on a network. If the source IP address is not valid, the packet is discarded. Unicast

RPF works in one of three different modes: strict mode, loose mode, or VRF mode. Note that not all

network devices support all three modes of operation. Unicast RPF in VRF mode will not be covered in this

document. When administrators use Unicast RPF in strict mode, the packet must be received on the

interface that the router would use to forward the return packet. Unicast RPF configured in strict mode may

drop legitimate traffic that is received on an interface that was not the router's choice for sending return

traffic. Dropping this legitimate traffic could occur when asymmetric routing paths are present in the

network. When administrators use Unicast RPF in loose mode, the source address must appear in the

routing table. Administrators can change this behavior using the allow-default option, which allows the use

of the default route in the source verification process. Additionally, a packet that contains a source address

for which the return route points to the Null 0 interface will be dropped. An access list may also be

specified that permits or denies certain source addresses in Unicast RPF loose mode. Care must be taken

to ensure that the appropriate Unicast RPF mode (loose or strict) is configured during the deployment of

this feature because it can drop legitimate traffic. Although asymmetric traffic flows may be of concern

when deploying this feature, Unicast RPF loose mode is a scalable option for networks that contain

asymmetric routing paths. Reference: http://www.cisco.com/web/about/security/intelligence/unicastrpf.

html

Answer: A,B 

Explanation: 

Answer: A,C,E 

Explanation: 

It is a general best practice not to mix TCP-based traffic with UDP-based traffic (especially

streaming video) within a single service provider class due to the behaviors of these protocols during

periods of congestion. Specifically, TCP transmitters will throttle-back flows when drops have been

detected. Although some UDP applications have application-level windowing, flow control, and

retransmission capabilities, most UDP transmitters are completely oblivious to drops and thus never lower

transmission rates due to dropping. When TCP flows are combined with UDP flows in a single service

provider class and the class experiences congestion, then TCP flows will continually lower their rates,

potentially giving up their bandwidth to drop-oblivious UDP flows. This effect is called TCP-starvation/

UDP-dominance. This can increase latency and lower the overall throughput. TCP-starvation/UDPdominance

likely occurs if (TCP-based) mission-critical data is assigned to the same service provider class

as (UDP-based) streaming video and the class experiences sustained congestion. Even if WRED is

enabled on the service provider class, the same behavior would be observed, as WRED (for the most part)

only affects TCP-based flows. Granted, it is not always possible to separate TCP-based flows from UDPbased

flows, but it is beneficial to be aware of this behavior when making such application-mixing

decisions. Reference: http://www.cisco.com/warp/public/cc/so/neso/vpn/vpnsp/spqsd_wp.htm

Answer: C 

Explanation: 

The debug ip packet command generates a substantial amount of output and uses a substantial amount of

system resources. This command should be used with caution in production networks. Always use with the access-list command to apply an extended ACL to the debug output. Reference: http://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html

Answer: A 

Explanation: R4 and R2 configs are as shown below: 

Clearly we see the actual key chain is named CISCO. 

Answer: A 

Explanation: 

The Unicast RPF feature helps to mitigate problems that are caused by the introduction of

malformed or forged (spoofed) IP source addresses into a network by discarding IP packets that lack a

verifiable IP source address. For example, a number of common types of denial-of-service (DoS) attacks,

including Smurf and Tribal Flood Network (TFN), can take advantage of forged or rapidly changing source

IP addresses to allow attackers to thwart efforts to locate or filter the attacks. For Internet service providers

(ISPs) that provide public access, Unicast RPF deflects such attacks by forwarding only packets that have

source addresses that are valid and consistent with the IP routing table. This action protects the network of

the ISP, its customer, and the rest of the Internet. Reference: http://www.cisco.com/en/US/docs/ios/12_2/

security/configuration/guide/scfrpf.html

Answer: B,C,D 

Explanation: 

TCP Selective Acknowledgment

The TCP Selective Acknowledgment feature improves performance if multiple packets are lost from one

TCP window of data.

Prior to this feature, because of limited information available from cumulative acknowledgments, a TCP

sender could learn about only one lost packet per-round-trip

time. An aggressive sender could choose to resend packets early, but such re-sent segments might have

already been successfully received.

The TCP selective acknowledgment mechanism helps improve performance. The receiving TCP host

returns selective acknowledgment packets to the sender,

informing the sender of data that has been received. In other words, the receiver can acknowledge packets

received out of order. The sender can then resend only

missing data segments (instead of everything since the first missing packet).

Prior to selective acknowledgment, if TCP lost packets 4 and 7 out of an 8-packet window, TCP would

receive acknowledgment of only packets 1, 2, and 3. Packets

4 through 8 would need to be re-sent. With selective acknowledgment, TCP receives acknowledgment of

packets 1, 2, 3, 5, 6, and 8. Only packets 4 and 7 must be

re-sent.

TCP selective acknowledgment is used only when multiple packets are dropped within one TCP window.

There is no performance impact when the feature is

enabled but not used. Use the ip tcp selective-ack command in global configuration mode to enable TCP

selective acknowledgment.

Refer to RFC 2021 for more details about TCP selective acknowledgment.

TCP Time Stamp

The TCP time-stamp option provides improved TCP round-trip time measurements. Because the time

stamps are always sent and echoed in both directions and the time-stamp value in the header is always

changing, TCP header compression will not compress the outgoing packet. To allow TCP header

compression over a serial link, the TCP time-stamp option is disabled. Use the ip tcp timestamp command

to enable the TCP time-stamp option.

TCP Explicit Congestion Notification

The TCP Explicit Congestion Notification (ECN) feature allows an intermediate router to notify end hosts of

impending network congestion. It also provides enhanced support for TCP sessions associated with

applications, such as Telnet, web browsing, and transfer of audio and video data that are sensitive to delay

or packet loss. The benefit of this feature is the reduction of delay and packet loss in data transmissions.

Use the ip tcp ecn command in global configuration mode to enable TCP ECN.

TCP Keepalive Timer

The TCP Keepalive Timer feature provides a mechanism to identify dead connections. When a TCP

connection on a routing device is idle for too long, the device sends a TCP keepalive packet to the peer

with only the Acknowledgment (ACK) flag turned on. If a response packet (a TCP ACK packet) is not

received after the device sends a specific number of probes, the connection is considered dead and the

device initiating the probes frees resources used by the TCP connection. Reference: http://www.cisco.com/

c/en/us/td/docs/ios-xml/ios/ipapp/configuration/xe-3s/asr1000/iap-xe-3s-asr1000-book/iap-tcp.html#GUID-22A82C5F-631F-4390-9838-F2E48FFEEA01