Proper study guides for Most up-to-date Cisco CCIE Routing and Switching (v5.0) certified begins with Cisco cisco 400 101 preparation products which designed to deliver the Real ccie 400 101 questions by making you pass the cisco 400 101 test at your first time. Try the free ccie 400 101 dumps demo right now.
2026 New 400-101 Exam Dumps with PDF and VCE Free: https://www.2passeasy.com/dumps/400-101/
Q1. Where is multicast traffic sent, when it is originated from a spoke site in a DMVPN phase 2 cloud?
A. spoke-spoke
B. nowhere, because multicast does not work over DMVPN
C. spoke-spoke and spoke-hub
D. spoke-hub
Answer: D
Explanation:
Spokes map multicasts to the static NBMA IP address of the hub, but hub maps multicast packets to the “dynamic” mappings – that is, the hub replicates multicast packets to all spokes registered via NHRP, so multicast traffic is sent to the hub from a spoke instead of to the other spokes directly.
Q2. Which three features are considered part of the IPv6 first-hop security suite? (Choose three.)
A. DNS guard
B. destination guard
C. DHCP guard
D. ICMP guard
E. RA guard
F. DoS guard
Answer: B,C,E
Explanation:
Cisco IOS has (at least) these IPv6 first-hop security features: IPv6 RA Guard rejects fake RA messages coming from host (non-router) ports (not sure whether it handles all possible IPv6 header fragmentation attacks). Interestingly, it can also validate the contents of RA messages (configuration flags, list of prefixes) received through router-facing ports, potentially giving you a safeguard against an attack of fat fingers. DHCPv6 Guard blocks DHCPv6 messages coming from unauthorized DHCPv6 servers and relays. Like IPv6 RA Guard it also validates the DHCPv6 replies coming from authorized DHCPv6 servers, potentially providing protection against DHCPv6 server misconfiguration. IPv6 Snooping and device tracking builds a IPv6 First-Hop Security Binding Table (nicer name for ND table) by monitoring DHCPv6 and ND messages as well as regular IPv6 traffic. The binding table can be used to stop ND spoofing (in IPv4 world we’d call this feature DHCP Snooping and Dynamic ARP Inspection). IPv6 Source Guard uses the IPv6 First-Hop Security Binding Table to drop traffic from unknown sources or bogus IPv6 addresses not in the binding table. The switch also tries to recover from lost address information, querying DHCPv6 server or using IPv6 neighbor discovery to verify the source IPv6 address after dropping the offending packet(s). IPv6 Prefix Guard is denies illegal off-subnet traffic. It uses information gleaned from RA messages and IA_PD option of DHCPv6 replies (delegated prefixes) to build the table of valid prefixes. IPv6 Destination Guard drops IPv6 traffic sent to directly connected destination addresses not in IPv6 First-Hop Security Binding Table, effectively stopping ND exhaustion attacks.
Reference: http://blog.ipspace.net/2013/07/first-hop-ipv6-security-features-in.html
Q3. Which two options are causes of out-of-order packets? (Choose two.)
A. a routing loop
B. a router in the packet flow path that is intermittently dropping packets
C. high latency
D. packets in a flow traversing multiple paths through the network
E. some packets in a flow being process-switched and others being interrupt-switched on a transit router
Answer: D,E
Explanation:
In traditional packet forwarding systems, using different paths have varying latencies that cause out of order packets, eventually resulting in far lower performance for the network application. Also, if some packets are process switched quickly by the routing engine of the router while others are interrupt switched (which takes more time) then it could result in out of order packets. The other options would cause packet drops or latency, but not out of order packets.
Q4. Which two statements about the protected ports feature and the private VLAN feature are true? (Choose two.)
A. The protected ports feature is limited to the local switch.
B. The protected ports feature can isolate traffic between two "protected" ports on different switches.
C. The private VLAN feature is limited to the local switch.
D. The private VLAN feature prevents interhost communication within a VLAN across one or more switches.
Answer: A,D
Explanation:
Protected Ports (PVLAN Edge) In some network environments, there is a requirement for no traffic to be seen or forwarded between host(s) on the same LAN segment, thereby preventing interhost communications. The PVLAN edge feature provisions this isolation by creating a firewall-like barrier, thereby blocking any unicast, broadcast, or multicast traffic among the protected ports on the switch. Note that the significance of the protected port feature is limited to the local switch, and there is no provision in the PVLAN edge feature to isolate traffic between two "protected" ports located on different switches. For this purpose, the PVLAN feature can be used.
Reference: http://www.ciscopress.com/articles/article.asp?p=1181682&seqNum=2
Q5. What is a reason to use DHCPv6 on a network that uses SLAAC?
A. To get a record of the IPs that are used by the clients
B. To push DNS and other information to the clients
C. No reason, because there is no need for DHCPv6 when using SLAAC
D. Because DHCPv6 can be used only in stateful mode with SLAAC to record the IPs of the clients
E. Because DHCPv6 can be used only in stateless mode with SLAAC to record the IPs of the clients
F. Because DHCPv6 is required to use first-hop security features on the switches
Answer: B
Explanation:
SLAAC is by far the easiest way to configure IPv6 addresses, simply because you don’t have to configure any IPv6 address. With SLAAC, a host uses the IPv6 Neighbor Discovery Protocol (NDP) to determine its IP address and default routers. Using SLAAC, a host requests and listens for Router Advertisements (RA) messages, and then taking the prefix that is advertised to form a unique address that can be used on the network. For this to work, the prefix that is advertised must advertise a prefix length of 64 bits (i.e., /64). But the most significant of Stateless Address Autoconfiguration (SLAAC) is it provided no mechanism for configuring DNS resolver information.Therefore SLACC can be used along with DHCPv6 (Stateless) to push DNS and other information to the clients.
Q6. Refer to the exhibit.
Which two statements about the VPN solution are true? (Choose two.)
A. Customer A and customer B will exchange routes with each other.
B. R3 will advertise routes received from R1 to R2.
C. Customer C will communicate with customer A and B.
D. Communication between sites in VPN1 and VPN2 will be blocked.
E. R1 and R2 will receive VPN routes advertised by R3.
Answer: C,E
Explanation:
+ VPN1 exports 10:1 while VPN3 imports 10:1 so VPN3 can learn routes of VPN1.
+ VNP1 imports 10:1 while VNP3 export 10:1 so VNP1 can learn routes of VPN3.
-> Customer A can communicate with Customer C
+ VPN2 exports 20:1 while VPN3 imports 20:1 so VPN3 can learn routes of VPN2.
+ VPN2 imports 20:1 while VPN3 exports 20:1 so VPN2 can learn routes of VPN3.
-> Customer B can communicate with Customer C
Therefore answer C is correct.
Also answer E is correct because R1 & R2 import R3 routes.
Answer A is not correct because Customer A & Customer B do not import routes which are exported by other router. Customer A & B can only see Customer C.
Answer B is not correct because a router never exports what it has learned through importation. It only exports its own routes.
Answer D is correct because two VPN1 and VPN2 cannot see each other. Maybe in this question there are three correct answers.
Q7. Which two fields reside in the initial CHAP challenge packet? (Choose two.)
A. the authentication name of the challenger
B. a random hash value generated by the device
C. the hashed packet type ID
D. the packet type ID in clear text
Answer: A,D
Explanation:
When a caller A dials in to an access server B, The Access server sends across the link an initial Type 1 authentication packet called a Challenge. This Challenge packet contains a randomly generated number, an ID sequence number to identify the challenge (sent in clear text) and the authentication name of the challenger.
Reference: http://www.rhyshaden.com/ppp.htm
Q8. Refer to the exhibit.
Which AS paths are matched by this access list?
A. the origin AS 64496 only
B. the origin AS 64496 and any ASs after AS 64496
C. the directly attached AS 64496 and any ASs directly attached to AS 64496
D. the directly attached AS 64496 and any longer AS paths
Answer: C
Explanation:
If you want AS 1 to get networks originated from AS 4 and all directly attached ASs of AS 4, apply the following inbound filter on Router 1. ip as-path access-list 1 permit ^4_[0-9]*$ router bgp 1 neighbor 4.4.4.4 remote-as 4 neighbor 4.4.4.4 route-map foo in route-map foo permit 10 match as-path 1 In the ip as-path access-list command, the carat (^) starts the input string and designates "AS". The underscore (_) means there is a a null string in the string that follows "AS 4". The [0-9]* specifies that any connected AS with a valid AS number can pass the filter. The advantage of using the [0-9]* syntax is that it gives you the flexibility to add any number of ASs without modifying this command string.
Reference: http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13754-26.html
Q9. DRAG DROP
Drag and drop the Metro Ethernet circuit on the left to the corresponding Service Type category on the right.
Answer:
Q10. When you migrate a network from PVST+ to rapid-PVST+, which two features become inactive? (Choose two.)
A. Root guard
B. Loop guard
C. UplinkFast
D. UDLD
E. BackboneFast
F. Bridge Assurance
Answer: C,E
Explanation:
It is good to know the UplinkFast and BackboneFast behavior before you start the migration process.
Here, the Access1 switch runs Cisco IOS. This output is taken before migration to the rapid-PVST+ mode:
Access1#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol ieee
Root ID Priority 24586
Address 0015.63f6.b700
Cost 3019
Port 107 (FastEthernet3/0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 49162 (priority 49152 sys-id-ext 10)
Address 000f.f794.3d00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300
Uplinkfast enabled
Interface Role Sts Cost Prio.Nbr Type
Fa3/0/1 Root FWD 3019 128.107 P2p
Fa3/0/2 Altn BLK 3019 128.108 P2p
Access1#show spanning-tree summary
Switch is in pvst mode
Root bridge for: none
Extended system ID is enabled
Portfast Default is disabled
PortFast BPDU Guard Default is enabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
EtherChannel misconfig guard is enabled
UplinkFast is enabled
BackboneFast is enabled
Configured Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
VLAN0010 1 0 0 1 2
VLAN0020 1 0 0 1 2
2 vlans 2 0 0 2 4
This output is taken after the mode is changed to rapid-PVST+:
Access1#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 24586
Address 0015.63f6.b700
Cost 3019
Port 107 (FastEthernet3/0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 49162 (priority 49152 sys-id-ext 10)
Address 000f.f794.3d00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300
UplinkFast enabled but inactive in rapid-pvst mode
Interface Role Sts Cost Prio.Nbr Type
Fa3/0/1 Root FWD 3019 128.107 P2p
Fa3/0/2 Altn BLK 3019 128.108 P2p
Access1#show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: none
Extended system ID is enabled
Portfast Default is disabled
PortFast BPDU Guard Default is enabled
Portfast BPDU Filter Default is disabled
Loopguard Default is disabled
EtherChannel misconfig guard is enabled
UplinkFast is enabled but inactive in rapid-pvst mode
BackboneFast is enabled but inactive in rapid-pvst mode
Configured Pathcost method used is short
Name Blocking Listening Learning Forwarding STP Active
VLAN0010 1 0 0 1 2
VLAN0020 1 0 0 1 2
2 vlans 2 0 0 2 4
You can see in the show spanning-tree summary command output that UplinkFast and BackboneFast are enabled, but are inactive in rapid-PVST mode.
Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/72836-rapidpvst-mig-config.html#upback1