鸿鹄论坛_CCNA中文版本题库(谷歌翻译,有错误自行纠正)

1、请参见图示。

当收到下列帧将会怎么做？（选择三项。

）ACFA. Router1的将剥离的源MAC地址，并将其与MAC地址0000.0c36.6965取代。

B. Router1的将剥离的源IP地址，并将其与IP地址192.168.40.1取代。

C.router1将剥离的目的MAC地址，并将其与MAC地址代替0000.0c07.4320。

D.router1将剥离的目的IP地址，并将其与192.168.40.1的IP地址替换。

E. Router1的将转发数据包输出接口的FastEthernet0/1。

F.router1将转发数据包输出接口的FastEthernet0/2。

2、请参见图示。

哪三种说法正确描述了网络设备A？（选择三项。

）BDEA.使用255.255.255.128子网掩码时，在各接口不需要的IP地址。

B.使用255.255.255.128子网掩码时，在各接口确实需要一个唯一的IP地址IP子网。

C.为255.255.255.0的子网掩码时，必须是一个二层设备的电脑进行通信彼此。

D.为255.255.255.0的子网掩码时，必须是一个三层设备的电脑进行通信彼此。

E.使用255.255.254.0的子网掩码时，每个接口并不需要一个IP地址。

3、OSI中那一层负责决定一个进程的可用性并查看是否有可用的资源分给该进程？EA.传输B.网络D.会话E.应用4、以下哪项描述了WAN设备的角色？（选择三项。

）A.CSU/ DSU用于端接本地数字环路B.调制解调器端接本地数字环路C.一个CSU/ DSU终止模拟本地环路D.调制解调器终止模拟本地环路E.路由器通常被视为DTE设备F.路由器通常被视为DCE设备注：SU/DSU是用于连接终端和数字专线的设备，属于DCE设备modem用于数字信号和模拟信号的转换，属于DCE设备路由器一般是DTE设备5、请参见图示，主机A ping接口S0/0的router3，什么是该ping的TTL值？A. 253B. 252C. 255D. 2546、网络管理员可以通过建立一个FTP连接到远程服务器验证新安装的主机的配置。

学网络技术去鸿鹄论坛命运的改变从技术开始鸿鹄团队致力于为每一位网络技术爱好者提供帮助有事您发帖，斑竹为您跑腿，给您答疑。

CCNA题库战报交流群：82327397欢迎备考CCNA的朋友加入，一起讨论交流，通过CCNA考试！CCNA最新题库/最新战报发布区：/forum-261-1.htmlCCNA考试代号：640-802考试时间：中文110分钟英文110+30=140分钟通过分数：825题库版本：V104.2Exam AQUESTION 1Which two commands correctly verify whether port security has been configured on port FastEthernet 0/12on a switch?(choose two)A.SW1#show swithport port-security interface FastEthernet 0/12B.SW1# show swithport port-secure interface FastEthernet 0/12C.SW1# show port-secure interface FastEthernet 0/12D.SW1#show running-configAnswer: CDQUESTION 2Which component of VPN technology ensures that data can be read only by its intended recipient?A.data integrity B.encryption C.key exchange D.authenticationAnswer: DQUESTION 3Refer to the exhibit.What is the effect of the configuration that is shown?A.It tells the router or switch to try establish an SSH connection first and if that fail to use telnet.B.Itconfigures a cisco network device to use the SSH protocol on incoming communications via the virtualterminal ports.C.It allows seven failed login attempts before the VTY lines are temporarily shutdown.D.It configures the virtual terminal lines with the password 030752180500.E.It configures SSH globally for all logins.Answer: BQUESTION 4Which IPV6 routing protocol uses multicast group FFO2::8 to send updates?A.RIPng B.OSPFv3C.IS-IS for IPv6D.staticAnswer: Cb b s .h h 010.co mWhich of the following are true regarding the debug output shown in the graphic?(choose two)A.This router was configured with the commands:RtrA(config)#router ripRtrA(config-router)#version 2RtrA(config-router)#network 172.16.0.0RtrA(config-router)#network 10.0.0.0B.This router was configured with the commands:RtrA(config)#router ripRtrA(config-router)#network 172.16.0.0RtrA(config-router)#network 10.0.0.0C.etwork 10.0.0.0 will be displayed in the routing table.work 192.168.168.0 will be displayed in the routing table.E.This router was configured with the commands:RtrA(config)#router ripRtrA(config-router)#network 192.168.1.0RtrA(config-router)#network 10.0.0.0RtrA(config-router)#network 192.168.168.0F.split-horizon was disabled on this router.Answer: BCQUESTION 6The network administrator is asked to configure 113 point-to-point links.Which IP addressing scheme best defines the address range and subnet mask that meet the requirement and waste the fewest subnet and host addresses?A.10.10.0.0/18 subnetted with mask 255.255.255.252B.10.10.0.0/25 subnetted with mask 255.255.255.252C.10.10.0.0/24 subnetted with mask 255.255.255.252D.10.10.0.0/23 subnetted with mask 255.255.255.252E.10.10.0.0/16 subnetted with mask 255.255.255.252Answer: Db b s .h h 010.co mVLAN 3 is not yet configured on your switch.What happens if you set the switchport access vlan 3commmand interface configuration mode?A.The command is accepted and the respective VLAN is added to vlan dat.B.The command is rejected.C.The command is accepted and you must configure the VLAN manually.D.The port turns amber.Answer: AQUESTION 8Which parameter can be tuned to affect the selection of a static route as a backup.when a dynamic protocol is also being used?A.link bandwidth B.hop count C.link costD.administrative distanceE.link delayAnswer: DQUESTION 9Refer to the exhibit. In the Frame Relay network, which ip address would be assigned to the interfaces with point-to-poin PVCs?A.DLCI 16:192.168.10.1/24DLCI 17:192.168.10.2/24DLCI 99:192.168.10.3/24DLCI 28:192.168.10.4/24b b s .h h 010.co mB.DLCI 16:192.168.10.1/24DLCI 17:192.168.11.1/24DLCI 99:192.168.10.2/24DLCI 28:192.168.11.2/24C.DLCI 16:192.168.10.1/24DLCI 17:192.168.11.1/24DLCI 99:192.168.12.1/24DLCI 28:192.168.13.1/24D.DLCI 16:192.168.10.1/24DLCI 17:192.168.10.1/24DLCI 99:192.168.10.2/24DLCI 28:192.168.10.3/24Answer: BQUESTION 10Why will a switch never learn a broadcast address?A.Broadcast frames are never sent to swiches.B.Broadcast addresses use an incorrect format for the switching table.C. A broadcast address will never be the source address of a frame.D.Broadcasts only use network layer addressing.E.A broadcast frame is never forwarded by a switch.Answer: CQUESTION 11Wich command can you use to manually assign a static IPV6 address to a muter interface?A.ipv6 address PREFIX_1::1/64B.ipv6 autoconfig 2001:db8:2222:7272::72/64C.ipv6 autoconfigD.ipv6 address 2001:db8:2222:7272::72/64Answer: DQUESTION 12The EIGRP configuration in the Glencoe router uses a single network statement.From the output shown in the graph would advertise these networks in EIGRP?b b s .h h 010.co mwork 172.26.168.0 area 478work 172.26.0.0work 172.26.168.128 0.0.0.127work 172.26.168.128 area 478Answer: BQUESTION 13Which IPsec security protocol should be used when confidentiality is required?A.AH B.MD5C.PSK D.ESPAnswer: DQUESTION 14What is the function of the command switchport trunk native vlan 999 on a…(此处文字不清楚).?A.It designates VLAN 999 for untagged traffic.B.It blocks VLAN 999 traffic from passing on the trunk.C.It creates a VLAN 999 interface.D.It designates VLAN 999 as the default for all unkown tagged traffic.Answer: DQUESTION 15Which command can be used from a PC to verfy the connectivity between host that connect thro…(字体不清)…?A.tracert address B.ping address C.arp addressD.traceroute addressAnswer: AQUESTION 16In which solution is a router ACL used?A.protecting a server frome unauthorized accesB.controlling path selection,based on the route metricC.reducing router CPU utilizationD.filterring packets that are passing through a routerAnswer: DQUESTION 17Which statement is true, as relates to classful or classless routing?b b s .h h 010.co mA.RIPV1 and OSPF are classless routing protocols.B.Classful routing protocols send the subnet mask in routing updates.C.Automatic summarization at classful boundaries can cause problems on disc……D.EIGRP and OSPF are classful routing protocols and summarize routes by def……Answer: CQUESTION 18A router has two FastEthernet interfaces and needs to connect to four vlans in the local network.How can you accomplish this task,using the fewest physical interfaces and without decreasing network performance?A.Add two more FastEthernet interfaces.B.Add a second router to handle the vlan traffic.e a hub to connect the four vlans with a FastEthernet interface on router.D.Implement a router-on-a-stick configuration.Answer: DQUESTION 19Refer to the exhibit.How many broadcast domains are configured on switch2?A.5B.20C.4D.1Answer: CQUESTION 20What is the effect of using the service password-encryption command?A.nly passwords configured after the command has been entered will be encrypted.B.Only the enable password will be encrypted.C.Only the enable secret password will be encryptedD.It will encrypt the secret password and remove the enable secret password from the configuration.E.It will encrypt all current and future passwords.Answer: Eb b s .h h 010.co mQUESTION 21Refer to the exhibit.A technician has installed SwithchB and needs to configure it for remote access from the management workstation connected SwitchA Which set of commands is required to accomplish this task?A.SwitchB(config)#interface FastEthernet 0/1SwitchB(config)#ip address 192.168.8.252 255.255.255.0SwitchB(config)#no shutdownB.SwitchB(config)#ip default-gateway 192.168.8.254SwitchB(config)#interface vlan 1SwitchB(config)#ip address 192.168.8.252 255.255.255.0SwitchB(config)#no shutdown C.SwitchB(config)#interface vlan 1SwitchB(config)#ip address 192.168.8.252 255.255.255.0SwitchB(config)#ip default-gateway 192.168.8.254 255.255.255.0SwitchB(config)#no shutdownD.SwitchB(config)#ip default-network 192.168.8.254SwitchB(config)#interface vlan 1SwitchB(config)#ip address 192.168.8.252 255.255.255.0SwitchB(config)#no shutdownAnswer: BQUESTION 22Refer to the exhibit.The speed of all serial links is E1 and the speed of the all Ethernet links is 100Mb/s.A static route will be established on the Manchester router to the direct traffic toward the internet over the most direct path available.What configuration on the Manchester router will establish a router toward the internet for traffic that originates from workstation on the Manchester LAN?b b s .h h 010.co mA.ip route 0.0.0.0 255.255.255.0 172.16.100.2B.ip route 0.0.0.0 255.255.255.252 128.107.1.1C.ip route 0.0.0.0 0.0.0.0 128.107.1.1D.ip route 0.0.0.0 0.0.0.0 172.16.100.1E.ip route 0.0.0.0 255.255.255.255 172.16.100.2F.ip route 0.0.0.0 0.0.0.0 172.16.100.2Answer: FQUESTION 23What Frame Relay mechanism is used to build the map illustrated in the accompanying graphic?A.inverse multiplexingB.LMI mapingC.Inverse ARPD.ARPE.Proxy ARPAnswer: CQUESTION 24Refer to the exhibit.A network engineer is troubleshooting an internet connectivity problem on the computer.What is causing the problem?b b s .h h 010.co mA.wrong DNS serverB.wrong default gatewayC.incorrect IP addressD.incorrect subnet maskAnswer: CQUESTION 25How many broadcast domains are shown in the graphic assuming only the default vlan is configured on the switches?b b s .h h 010.co mA.oneB.sixC.twelveD.twoAnswer: AQUESTION 26How dose a DHCP server dynamically assign IP address to host?A.Addresses are allocated after a negotiation between the server and the host to determine the length ofthe agreement.B.Addresses are assigned for a fixed period of time.At the end of period,a newquest for an address mustbe made ,and another address is then assigned.C.Addresses are leased to host.A host will usually keep the same address by periodically contacting theDHCP sever to renew the lease.D.Addresses are permanently assigned so that the host uses the same address at all times.Answer: CQUESTION 27Which type of EIGRP route entry describes a feasible successor?A. a primary route,stored in the routing table B. a backup route,stored in the routing table C. a backup route,stored in the topology table D.a primary route,stored in the topology tableAnswer: CQUESTION 28What is the purpose of the inverse ARP?A.to map a known DLCI to an IP addressB.to map a known IP address to a MAC addressC.to map known SPID to a MACaddressD.to map a known DLCI to a MAC addressE.to map a known IP address to a SPID.F.to map a known MAC address to an IP addressAnswer: AQUESTION 29What is the default maximum number of equal-cost paths that can be placed into the routing of a cisco OSPF router?A.16B.2C.unlimitedD.4Answer: Db b s .h h 010.co mQUESTION 30Which IPV6 routing protocol uses multicast group FF02::9 to send updates?A.RIPng B.OSPFv3C.staticD.IS-IS for IPv6Answer: AQUESTION 31What are two benefits of using NAT?(choose two)A.NAT protects network security because private networks are not advertised.B.NAT accelerates the routing process because no modifications are made on the packets.C.Dynamic NAT facilitates connections from the outside of the network.D.NAT facilitates end-to-end communication when IPsec is enable.E.NAT eliminates the need to re-address all host that require extemal access.F.NAT conserves addresses through host MAC-level multiplexing.Answer: AEQUESTION 32Which three statements about RSTP are true?(choose three)A.RSTP significantly reduces topology reconverging time after a link failure.B.RSTP expends the STP port roles by adding the alternate and backup roles.C.RSTP port atates are blocking,discarding,learing,or forwarding.D.RSTP also uses the STP proprsal-agreement sequence.E.RSTP use the same timer-baseed process as STP on point-to-point links.F.RSTP provides a faster transition to the forwarding state on point-to-point links than STP does.Answer: ABFQUESTION 33Refer to the exhibit.The serial0/0 interface of the Tampa router connects the Oriando router.Which two statements are true about the connection between these two routers?(choose two)b b s .h h 010.co mA.The only device with which the Tampa router will negotiate a data link is the Orlando router.B.The link is addressed on the *zero*subnet 10.0.0.0 network.C.The link uses a three-way handshake for authentication.D.The link uses a two-way handshake for authentication.E.Data exchanges between the Oriando and Tampa routers are encrypted.Answer: BCQUESTION 34A switch is configured as a vtp sever with a domain name of CCNA.Which cisco ios privileged modecommand,followed by a reload of the swith,will reset the VTP management domain name of the switch to a NULL value?A.#vtp domain unset B.#delete vlan.dat C.#no vtp domain D.#vtp domain nullAnswer: BQUESTION 35If an Ethernet port on a router was assigned an IP address of 172.1.1.1/20,what is the maximum number of hosts allowed on this subnet?A.4094B.1024C.8190D.2046b b s .h h 010.co mE.4096Answer: AQUESTION 36Which two statements about static NAT translations are true?(choose two)A.They are always present in the NAT table.B.They allow connection to be initiated from the outside.C.They can be configured with access lists, to allow two or more connections to be initiated from theoutside.D.They require no inside or outside interface markings because addresses are statically defined.Answer: ABQUESTION 37Which of these represents an IPv6 link-local address?A.FE08::280e:611:a:f14f:3d69B.FE81::280f:512b:e14f:3d69C.FE80::380e:611a:e14f:3d69D.FEFE:0345:5f1b::e14d:3d69Answer: CQUESTION 38What are three features of the IPV6 protocol?(choose three)plicated header B.plug-and-play C.no broadcasts D.checksums E.optional IPsec F.autoconfigurationAnswer: BCFQUESTION 39Assuming default setting,how can you erase the VTP database of VLANs on a CISCO IOS switch running in VTP server mode?A.Enable VTP pruningB.From privileged mode ,erase the startup configuration file,then reload.C.From privileged mode ,erase the vlan date file, then reload.D.Cycle the switch power.Answer: CQUESTION 40Refer to the exhibit.which address and mask combination a summary of the routes learned by EIGRP?b b s .h h 010.co mA.192.168.25.0 255.255.255.240B.192.168.25.16 255.255.255.252C.192.168.25.0 255.255.255.252D.192.168.25.28 255.255.255.240E.192.168.25.16 255.255.255.240F.192.168.25.28 255.255.255.240Answer: EQUESTION 41Refer to the exhibit A frame on vlan 1on switch s1 is sent to switch s2 when the frame is received on vlan 2,what causes this behavior?A.trunk mode mismatchesb b s .h h 010.co mB.vlans that do not correspond to a unique IP subnetC.native vlan mismatchesD.allowing only vlan 2 on the destination.Answer: CQUESTION 42Refer to the exhibit.The network administrator normally establishes a telnet session with the switch from host A.However,host A is unavailable.The administrator ′s attempt to the switch from host B fails,but pings to the other two hosts are successful.what is the issue?A.Host B and the switch need to be in the same subnet.B.The switch needs and appropriate default gateway assigned.C.The switch interface connected to the router is down.D.Host B need to be assigned an IP address in vlan 1.Answer: BQUESTION 43What value is primarily used to determine which port becomes the root port on each nonroot switch in a spanning-tree topology?A.lowest port MAC addressB.port priority number and MAC address.C.VTP revision numberD.highest port priority number.E.path costAnswer: EQUESTION 44Refer to the exhibit.Router 1 was just successfully rebooted.identify the current OSPF router ID for Router 1.b b s .h h 010.co mA.208.149.23.194B.220.173.149.10C.208.149.23.162D.190.172.32.10Answer: AQUESTION 45Why do large OSPF networks use a hierarchical design?(choose three)A.to confine network instability to single areas of the network.B.to reduce the complexity of router configuration C.to speed up convergenceD.to lower costs by replacing routers with distribution layer switchesE.to decrease latency by increasing bandwidthF.to reduce routing overheadAnswer: ACFQUESTION 46A network administrator receives an error message while tring to configure the Ethernet interface of a router with IP address 10.24.24.24/29.which statement explains the reason for this issue?A.The address is a broadcast address B.The Ehernet interface is faultyC.VLSM-capable routing protocols must be enable first on the router.D.This address is a network address.Answer: DQUESTION 47Which two are advantages of static routing when compared to dynamic routing?(choose two)A.Security increases because only the network administrator may change the routing tables.B.Configuration complexity decreases as network size increases.C.Routing updates are automatically sent to neighbors.D.Route summarization iscompued automatically by the router.E.Routing traffic load is reduced when used in stub network linksF.An efficient algorithm is used to build routing tables,using automatic updates.G.Routing tables adapt automatically to topology changes.b b s .h h 010.co mAnswer: AEQUESTION 48A company has a small network,consisting of a single switch and a single router.The switch has been configured with two vlans,and route-on-a-stick is being configured on the router for inter-vlan routing.A trunk is configured to connect the switch to the router.What is the minimum number of router subinterfaces that are required for all the vlans to communicate?A.one B.three C.two D.zeroAnswer: CQUESTION 49Which command can be a router to verify the layer 3 path to a host?A.traceroute address B.tracert address C.ssh address D.telnet addressAnswer: AQUESTION 50Which dose the frame-relay interface-dlc i command configure?A.remote DLCI on the main interface B.local DLCI on the main interface C.local DLCI on the subinterface D.remote DLCI on the subinterfaceAnswer: CQUESTION 51What is the OSPF default frequency,in seconds,at which a cisco router sends hello packets on a multi-access network?A.10B.40C.30D.20Answer: AQUESTION 52Refer to the exhibt.Host A has tested connectivity to a remote network.What is the default gateway for host A?b b s .h h 010.co mA.172.16.182.1B.192.168.1.1C.10.16.176.1D.192.168.1.6Answer: AQUESTION 53Which commands is necessary to permit SSH or Telnet access to a cisco switch that is otherwise configured for these vty line protocols?A.transport type allB.transport output allC.transport preferred allD.transport input allAnswer: DQUESTION 54Which command shows your active Telnet connections?A.show sessionB.show cdp neighborsC.show usersD.show queueAnswer: AQUESTION 55Which two states are the port states when RSTP has converged?(choose two)A.blocking B.learning C.disabled D.forwarding E.listeningAnswer: ADb b s .h h 010.co mQUESTION 56There are no boot system commands in a router configuration in NVRAM.What is the fallback sequence that router will use to find an ios during reload?A.Flash,TFTP server,ROM B.Flash,NVRAM,ROMC.ROM,NVRAM,TFTP serverD.NVRAM,TFTP server,ROME.TFTP server,Flash,NVRAMAnswer: A QUESTION 57Refer to the graphic.A host is connected to switch port Fa0/3 with a crossover cable.The host and switch have…as shown.However,the port indicator on switch port Fa0/3 is not on,and the host can notcommunicate with…to vlan 2 on the same switch.Based on the information given.what is the problem?A.The switch has been assigned an incorrect subnet mask.B.Switch port FA0/3 is not configured as a trunk port C.Switch port FA0/3 has been blocked by STPD.The switch and the hosts must be in the same subnetE.The cable is the wrong typeAnswer: E QUESTION 58Refer to the exhibit.Which user-mode password has just been set?A.Telnet B.Auxiliary C.SSH D.Consoleb b s .h h 010.co mAnswer: AQUESTION 59DNS servers provide what service?A.they run a spell check on host names to ensure accurate routingB.they map individual hosts to their specific IP addressC.they convert domain names into IP addressD.Given an IP address,they determine the name of the host that is…Answer: CQUESTION 60Which command enables RSTP on a switch?A.spanning-tree mode rapid-pvstB.spanning-tree uplinkfastC.spanning-tree backbonefastD.spanning-tree mode mst Answer: A QUESTION 61Which two are features of IPv6?(choose two)A.multicast B.broadcast C.allcastD.podcastE.anycast Answer: AE QUESTION 62Which statement about access lists that are applied to an interface is true?A.you can apply multiple access lists with the same protocol or in different…B.you can config one access list,per direction,per layer 3 protocolC.you can place as many access lists as you want on any interfaceD.you can apply ony one access list on any interfaceAnswer: DQUESTION 63Which item represents the standard IP ACL?A.access-list 50 deny 192.168.1.1 0.0.0.255B.access-list 110 permit ip any anyC.access-list 2500 deny tcp any host 192.168.1.1 eq 22D.access-list 101 deny tcp any host 192.168.1.1bbs.hh1.c o mAnswer: AQUESTION 64What is one benefit of PVST+?A.PVST+reduces the CPU cycles for all the switches in the networkB.PVST+automatically selects the root bridge location,to provide optimiz…C.PVST+allow the root switch location to be optimized per vlan.D.PVST+supports Layer 3 load balancing without loops.Answer: Cmoc.1hh.sbb。

培训大讲堂官方YY 频道：3660mCCNA题库考试代号： 640-802考试时间：英文110+30=140分钟通过分数： 825题库版本： V104.4鸿鹄论坛招募CCNA、CCNP答疑讲师答疑地点：鸿鹄官方YY频道3660鸿鹄大讲堂：bbs.hh010./thread-46172-1-1.htmlCCNA题库战报交流QQ群：144288127 （500人超级群）CCNA题库战报交流区： bbs.hh010./forum-261-1.html1000 G视频教程免费下载：bbs.hh010./forum-228-1.htmlCCNA（640-802）题库V104.4CCNA（640-802）题库V104.4（情人节版）CCNA 题库战报500人超级QQ群 144288127V104系列是官方的终结版本，以后不会再出V105 V106 V108等等CCNA 最新题库/最新战报发布区： bbs.hh010./forum-261-1.html下载官方正版题库、看最新考试战报，请随时关注鸿鹄论坛 bbs.hh010.CCNA考试报名1900，详情请联系鸿鹄全国区十七名客服 QQ 71202306========================================更新容：V104.1修正V104中错误题目，确定经典争议题目答案；V104.2增加拖图题并可完美模拟考试，VCE题库增加中文注释；V104.3针对思科CCNA考试变题，更新考试新增题目93Q,更新V104.2实验题；V104.4增加全文中文注释，汇总V104.3九次更新，删除部分旧题目，为目前最新官方正版题库；2011.8.1 增加每日新题，修订部分错误。

2012.2.14 情人节版增加5道新题，分别是519、520、521、522、523题修改176题、375题、443题、482题答案错误修改59题、88题、453题、107题、270题注释错误增加个别疑难拖图题注释，优化实验题=============================================QUESTION 1When you are logged into a switch, which prompt indicates that you are in privileged mode?(当您登录到交换机，哪种提示表明你在特权模式？)A. %B.C. >D. $E. #Answer: ESection: Chapter 4: Introduction to Cisco IOSExplanation/Reference:特权模式就是#提示符QUESTION 2Which command shows system hardware and software version information?(哪些命令显示系统硬件和软件的版本信息？)A. show configurationB. show environmentC. show inventoryD. show platformE. show versionAnswer: ESection: Chapter 4: Introduction to Cisco IOSExplanation/Reference:查看系统的软件和硬件信息使用的命令是show versionQUESTION 3Cisco Catalyst switches CAT1 and CAT2 have a connection between them using ports FA0/13. An 802. 1Q trunk is configured between the two switches. On CAT1, VLAN 10 is chosen as native, but on CAT2 the native VLAN is not specified.What will happen in this scenario?(思科 Catalyst 交换机 CAT1 和 CAT2 有它们之间的连接使用端口FA0/13。

▲ Ҳ ԟ ԇThe safer , easier way to help you pass any IT exams.Exam : 642-637Title:Version : V8.02Securing Networks with Cisco Routers and Switches (SECURE) v1.0The safer , easier way to help you pass any IT exams.1.What will the authentication event fail retry 0 action authorize vlan 300 command accomplish?A. assigns clients that fail 802.1X authentication into the restricted VLAN 300B. assigns clients to VLAN 300 and attempts reauthorizationC. assigns a client to the guest VLAN 300 if it does not receive a response from the client to its EAPOL request/identity frameD. locks out a user who fails an 802.1X authentication and does not allow the user to try to gain network access again for 300 secondsAnswer: A2.Refer to the exhibit. Given the partial output of the debug command, what can be determined?A. There is no ID payload in the packet, as indicated by the message ID = 0.B. The peer has not matched any offered profiles.C. This is an IKE quick mode negotiation.D. This is normal output of a successful Phase 1 IKE exchange.Answer: B3.DRAG DROPAnswer:The safer , easier way to help you pass any IT exams.4.Refer to the exhibit. Which two Cisco IOS WebVPN features are enabled with the partial configuration shown? (Choose two.)A. The end-user CiscoAnyConnect VPN software will remain installed on the end system.B. If the CiscoAnyConnect VPN software fails to install on the end-user PC, the end user cannot use other modes.C. Client based full tunnel access has been enabled.D. Traffic destined to the 10.0.0.0/8 network will not be tunneled and will be allowed access via a split tunnel.E. Clients will be assigned IP addresses in the 10.10.0.0/16 range.Answer: A,C5.Which two of these are benefits of implementing a zone-based policy firewall in transparent mode? (Choose two.)A. Less firewall management is needed.B. It can be easily introduced into an existing network.C. IP readdressing is unnecessary.D. It adds the ability tostatefully inspect non-IP traffic.E. It has less impact on data flows.Answer: B,C6.When configuring a zone-based policy firewall, what will be the resulting action if you do not specify any zone pairs for a possible pair of zones?A. All sessions will pass through the zone without being inspected.B. All sessions will be denied between these two zones by default.C. All sessions will have to pass through the router "self zone" for inspection before being allowed to pass to the destination zone.D. This configurationstatelessly allows packets to be delivered to the destination zone.Answer: B7.Refer to the exhibit. What can be determined from the output of this show command?A. The IPsec connection is in an idle state.B. The IKE association is in the process of being set up.C. The IKE status is authenticated.D. The ISAKMP state is waiting for quick mode status to authenticate before IPsec parameters are passed between peersE. IKE Quick Mode is in the idle state, indicating a problem with IKE phase 1.Answer: C8.DRAG DROPAnswer:The safer , easier way to help you pass any IT exams.9.You are running Cisco lOS IPS software on your edge router. A new threat has become an issue.The Cisco lOS IPS software has a signature that can address the new threat, but you previously retired the signature. You decide to unretire that signature to regain the desired protection level.How should you act on your decision?A. Retired signatures are not present in the routers memory. You will need to download a new signature package to regain the retired signature.B. You should re-enable the signature and start inspecting traffic for signs of the new threat.C. Unretiring a signature will cause the router to recompile the signature database, which can temporarily affect performance.D. You cannotunretire a signature. To avoid a disruption in traffic flow, it's best to create a custom signature until you can download a new signature package and reload the router.Answer: C10.Which statement best describes inside policy based NAT?A. Policy NAT rules are those that determine which addresses need to be translated per the enterprise security policyB. Policy NAT consists of policy rules based on outside sources attempting to communicate with inside endpoints.C. These rules use source addresses as the decision for translation policies.D. These rules are sensitive to all communicating endpoints.Answer: A11.Refer to the exhibit. What can be determined about the IPS category configuration shown?A. All categories are disabled.B. All categories are retired.C. After all other categories weredisabled, a custom category named "os ios" was createdD. Only attacks on the Cisco IOS system result in preventative actions.Answer: D12.When Cisco IOS IPS is configured to use SDEE for event notification, how are events managed?A. They are stored in the router's event store and will allow authenticated remote systems to pull events from the event store.B. All events are immediately sent to the remote SDEE server.C. Events are sent viasyslog over a secure SSUTLS communications channel.D. When the event store reaches its maximum configured number of event notifications, the stored events are sent via SDEE to a remote authenticated server and a new event store is created.Answer: A13.Which two of these will match a regular expression with the following configuration parameters?[a-zA-Z][0-9][a-z] (Choose two.)A. Q3hB. B4MnC. aaB132AAD. c7lmE. BBpjnrITAnswer: A,D14.Which of these is a configurable Cisco IOS feature that triggers notifications if an attack attempts to exhaust critical router resources and if preventative controls have been bypassed or are not working correctly?A. Control Plane ProtectionB. Management Plane ProtectionC. CPU and memorythresholdingD. SNMPv3Answer: A15.Which Cisco IOS IPS feature allows to you remove one or more actions from all active signatures based on the attacker and/or target address criteria, as well as the event risk rating criteria?A. signature event action filtersB. signature event action overridesC. signature attack severity ratingD. signature event risk ratingAnswer: A16.You are troubleshooting reported connectivity issues from remote users who are accessing corporate headquarters via an IPsec VPN connection. What should be your first step in troubleshooting these issues?A. issue a show cryptoisakmp policy command to verify matching policies of the tunnel endpointsB. ping the tunnel endpointC. run a traceroute to verify the tunnel pathD. debug the connection process and look for any error messages in tunnel establishmentAnswer: B17.Which of these is correct regarding the configuration of virtual-access interfaces?A. They cannot be saved to the startup configuration.B. You must use static routes inside the tunnels.C. DVTI interfaces should be assigned a unique IP address range.D. The Virtual-Access 1 interface must be enabled in an up/up state administrativelyAnswer: A18.Refer to the exhibit. The INSIDE zone has been configured and assigned to two separate router interfaces. All other zones and interfaces have been properly configured. Given the configuration example shown, what can be determined.A. Hosts in the INSIDE zone, with addresses in the 10.10.10.0/24 network, can access any host in the10.10.10.0/24 network using the SSH protocol.B. If a host in the INSIDE zone attempts to communicate via SSH with another host on a different interface within the INSIDE zone, communications must pass through the router self zone using the INTRAZONE policy.C. This is an illegal configuration. You cannot have the same source and destination zones.D. This policy configuration is notneeded, traffic within the same zone is allowed to pass by default. Answer: D19.Which action does the command private-vlan association 100,200 take?A. configures VLANs 100 and 200 and associates them as a communityB. associates VLANs 100 and 200 with the primary VLANC. creates two private VLANs with the designation of VLAN 100 and VLAN 200D. assigns VLANs 100 and 200 as an association of private VLANsAnswer: B20.Which of these allows you to add event actions globally based on the risk rating of each event, without having to configure each signature individually?A. event action summarizationB. event action filterC. event action overrideD. signature event action processorAnswer: C21.When using Cisco Easy VPN, what are the three options for entering an XAUTH username and password for establishing a VPN connection from the Cisco Easy VPN remote router? (Choose three.)A. using an external AAA serverB. entering the information via the router cryptoipsec client ezvpn connect CLI command in privileged EXEC modeC. using the router local user databaseD. entering the information from the PC via a browserE. storing the XAUTH credentials in the router configuration fileAnswer: B,C,E22.Which of these is true regarding tunnel configuration when deploying a Cisco ISR as a DMVPN hub router?A. Only one tunnel can be created per tunnel source interface.B. Only one tunnel can be created and should be associated with a loopback interface for dynamic redundancyC. The GRE tunnel key is used to encrypt the traffic going through the tunnel through the hub.D. You can run multiple parallel DMVPNs on the hub router, but each tunnel requires a unique tunnel key. Answer: D23.Given the Cisco IOS command crypto key generate rsa label MY_KEYS modulus 2048, which additional command keyword should be added if you would like to use these keys on another router or have the ability to back them up to another device?A. redundancyB. exportableC. on:USB smart-tokenD. usage-keysAnswer: B24.Which two types of deployments can be implemented for a zone-based policy firewall? (Choose two.)A. routed modeB. interzone modeC. fail open modeD. transparent modeE. inspection modeAnswer: A,E25.DRAG DROPAnswer:26.What is the result of configuring the command dotlx system-auth-control on a Cisco Catalyst switch?A. enables the switch to operate as the 802.1X supplicantB. globally enables 802.1X on the switchC. globally enables 802.1X and defines ports as 802.1X-capableD. places the configuration sub-mode intodotix-auth mode, in which you can identify theauthentication server parametersAnswer: B27.Which information is displayed when you enter the Cisco IOS command show epm session?A. Enforcement Policy Module sessionsB. External Proxy Mappings, per authenticated sessionsC. Encrypted Policy Management sessionsD. Enhanced Protected Mode sessionsAnswer: A28.Refer to the exhibit. Based on the partial configuration shown, which additional configuration parameter is needed under the GET VPN group member GDOI configuration?A. key server IP addressB. local priorityC. mapping of theIPsec profile to the IPsec SAD. mapping of theIPsec transform set to the GDOI groupAnswer: A29.Refer to the exhibit. Given the partial configuration shown, which two statements are correct? (Choose two.)A. The tunnel will use the routing protocol configured forGigabitEthemet 1/1 for all tunnel communication with the peer.B. The IP route statement to reach the remote network behind the DMVPN peer is incorrect, it should beip route 192.168.2.0 255.255.255.0 tunnel 0.C. This is an example of a static point-to-point VTI tunnel.D. The tunnel will useesp-sha-hmac encryption in ESP tunnel mode.E. The tunnel will use 128-bit AES encryption in ESP tunnel mode.Answer: C,E30.You are troubleshooting a Cisco Easy VPN installation that is experiencing session establishment problems. You have verified that matching IKE and IPsec polices exist on both peers. The remote client has also successfully entered authentication credentials. What is the next step to take in troubleshooting this problem?A. verify that the router is not denying traffic from the tunnelB. verify that the router is able to assign an IP address to the clientC. examine routing tablesD. issue a ping from the client to the router to verifyreachabilityAnswer: B31.Which of these is a result of using the same routing protocol process for routing outside and inside the VPN tunnel?A. This will provide for routing-protocol-based failover redundancy.B. Spoke routers will able to dynamically learn routes to peer networks.C. This will allow VPN-encapsulated packets to be routed out the correct physical interface used to reach the remote peerD. The tunnel will constantly flap.Answer: B32.DRAG DROPAnswer:The safer , easier way to help you pass any IT exams.33.Refer to the exhibit. What can be determined from the output of this show command?A. The switch port interface is enabled and operating as a community port.B. The interface is acting as an isolated switch port operating in VLAN 1.C. The interface is configured for Private VLAN Edge.D. The switch port interface is not a trusted port.Answer: D34.You are troubleshooting a problem related to IPsec connectivity issues. You see that there is no ISAKMP security association established between peers. You debug the connection process and see an error message of 1d00h: ISAKMP (0:1): atts are not acceptable. Next payload is 0. What does this message indicate?A. This indicates a policy mismatch.B. This indicates that the offered attributes did not contain a payload.C. IKE has failed initial attempts and will resend policy offerings to the peer router.D. The time stamp of the message shows that it is one day old. This could indicate a possible mismatch of system clocks and invalidate the connection attempt.Answer: A35.Refer to the exhibit. Given the output shown, what can be determined?A. An attacker has sent a spoofed DHCP address.B. An attacker has sent a spoofed ARP response that violates a static mapping.C. The MAC address has matched a deny rule within the ACL.D. This is an invalid proxy ARP packet, as indicated by the 0000.0000.0000 MAC address on the destinationAnswer: C36.Which command will enable a SCEP interface when you are configuring a Cisco router to be a certificate server?A. seep enable (under interface configuration mode)B. cryptopki seep enableC. grant autoD. ip http serverAnswer: D37.When 802.1X is implemented, how do the client (supplicant) and authenticator communicate?A. RADIUSB. TACACS+C. MABD. EAPOLAnswer: D38.Refer to the exhibit. Assuming that all other supporting configurations are correct, what can be determined from the partial IP admission configuration shown?A. The router will forward authentication requests toa AAA server for authentication and authorization.B. The local user password is thl3F4ftvA.C. The router will intercept incoming HTTP sessions on interface G0/0 for authentication.D. The SUPERUSER's privilege level is being restricted.E. The attribute type supplicant-group "SUPERUSER" configuration can be used to match criteria in the "inspect" class-map type using the match access-group option.Answer: C39.Which of these is an implementation guideline when deploying the IP Source Guard feature in an environment with multiple switches?A. Do not configure IP Source Guard oninterswitch links.B. Configure PACLs for DHCP-addressed end devices.C. IP Source Guard must be configured in the trunksubconfiguration mode to work on interswitch links.D. Configure static IP Source Guard mapping for all access ports.Answer: A40.DRAG DROPAnswer:41.What does the command errdisable recovery cause arp-inspe ction interval 300 provide for?A. It will disable a port when the ARP rate limit of 300 packets per second is received and wait a configured interval time before placing the port back in normal operation.B. It will inspect for ARP-disabled ports every 300 seconds.C. It will recover a disabled port and limit ARP traffic to 300 packets per second to avoid potential ARP attacks from reoccurring.D. It will recover a disabled port due to an ARP inspection condition in 5 minutes.Answer: D42.You have configured Management Plane Protection on an interface on a Cisco router. What is the resulting action on implementing MPP?A. Inspection of protected management interfaces is automatically configured to ensure that management protocols comply with standa rds.B. The router gives preference to the configured management interface. If that interface becomes unavailable, management protocols will be allowed on alternate interfaces.C. Along with normal user data traffic, management traffic is also allowed on ly on the protected interface.D. Only management protocols are allowed on the protected interface.Answer: C43.DRAG DROPAnswer:44.Refer to the exhibit. What can be determined from the configuration shown?A. The community SNMP string is SNMP-MGMT-VIEW.B. All interfaces will be included in the SNMP GETs.C. This SNMP group will only allow read access to interface MIBs.D. The SNMP server group is using 128-bit SHA authentication.Answer: C45.When enabling the Cisco IOS IPS feature, which step should you perform to prevent rogue signature updates from being installed on the router?A. configure authentication and authorization for maintaining signature updatesB. install a known RSA public key that correlates to a private key used by CiscoC. manually import signature updates from Cisco to a secure server, and then transfer files from the secure server to the routerD. use the SDEE protocol for all signature updates from a known secure management station Answer: B46.A user has requested a connection to an external website. After initiating the connection, a message appears in the user's browser stating that access to the requested website has been denied by the company usage policy. What is the most likely reason for this message to appear?A. An antivirus software program has blocked the session request due to potential malicious content.B. The network has been configured with a URL filtering service.C. The network has been configured for 802.1X authentication and the user has failed toauthenticateD. The user's configured policy access level does not contain proper permissionsAnswer: B47.Refer to the exhibit. Given the partial configuration shown, what can be determined.A. This is an example of a dynamic policy PAT rule.B. This is an example of a static policy NAT rule.C. Addresses in the 10.10.30.0 network will be exempt from translation when destined for the10.100.100.0 network.D. The extended access list provides for one-to-one translation mapping of the 10.10.30.0 network to the10.100.100.0 networkAnswer: A48.When is it most appropriate to choose IPS functionality based on Cisco IOS software?A. when traffic rates are low and a complete signature is not requiredB. when accelerated, integrated performance is required using hardware ASIC-based IPSinspectionsC. when integrated policy virtualization is requiredD. when promiscuous inspection meets security requirementsAnswer: A49.When performing NAT, which of these is a limitation you need to account for?A. exhaustion of port number translationsB. embedded IP addressesC. security payload identifiersD. inability to provide mutual connectivity to networks with overlapping address spacesAnswer: B50 DRAG DROPAnswer:51.You have enabled Cisco IOS IPS on a router in your network. However, you are not seeing expected events on your monitoring system (such as Cisco IME). On the router, you see events being captured. What is the next step in troubleshooting the problem?A. verify thatsyslog is configured to send events to the correct serverB. verify SDEE communicationsC. verify event action rulesD. verify that the IPS license is validAnswer: B52.Which two of these are features of control plane security on a Cisco ISR? (Choose two.A. CoPPB. RBACC. AAAD. CPPrE. uRPFF. FPMAnswer: A,D53.Which two of these are potential results of an attacker performing a DHCP server spoofing attack? (Choose two.)The safer , easier way to help you pass any IT exams.A. DHCP snoopingB. DoSC. confidentiality breachD. spoofed MAC addressesE. switch ports being converted to anuntrusted stateAnswer: B,C54.When Cisco IOS IPS signatures are being tuned, how is the Target Value Rating assigned?A. It is calculated from the Event Risk Rating.B. It is calculated from a combination of the Attack Severity Rating and Signature Fidelity RatingC. It is manually set by the administrator.D. It is set based upon SEAP functions.Answer: C55.Which of these should you do before configuring IP Source Guard on a Cisco Catalyst switch?A. enable NTP for event correlationB. enable IP routing authenticationC. configure an access list with exempt DHCP-initiated IP address rangesD. turn DHCP snooping on at least 24 hours in advanceAnswer: D56.What action will the parameter-map type ooo global command enable?A. globally initiates tuning of the router's TCPnormalizer parameters for out-of-order packetsB. globally classifies typeooo packets within the parameter map and subsequent policy mapC. enables a parameter map namedoooD. configures a global parameter map for traffic destined to the router itselfAnswer: A57.DRAG DROPAnswer:58 HOTSPOTAnswer:59 HOTSPOTAnswer:60 HOTSPOTAnswer:61.HOTSPOTAnswer:62.HOTSPOTAnswer:63.Which protocol is EAP encapsulated in for communications between the authenticator and the authentication server?A. EAP-MD5B. IPsecC. EAPOLD. RADIUSAnswer: D64.You are loading a basic IPS signature package onto a Cisco router. After a period of time, you see this message:%IPS-6-ALL_ENGINE_BUILDS_COMPLETE: elapsed time 275013 ms. What do you expect happened during downloading and compilation of the files?A. The files were successfully copied with an elapse time of 275013 ms.The router will continue with extraction and compilation of the signature database.B. The signature engines were compiles, but there is no indication that the actual signatures were compiled.C. The compilation failed for some of the signature engines. There are 16 engines, but only 6 were completed according to the %IPS-6 messageD. The files were compiled without error.Answer: D65.Refer to the exhibit. Given the configuration shown, which of these statements is correct?The safer , easier way to help you pass any IT exams.A. An external service is providing URL filtering via a subscription service.B. All HTTP traffic to websites with the name "Gambling" included in the URL will be reset.C. A service policy on the zone pair needs to be configured in the opposite direction or all return HTTP traffic will be blocked by policyD. The URL filter policy has been configured in a fail-closed scenario.Answer: A66.DRAG DROPAnswer:67.Refer to the exhibit. Which two of these are most likely to have caused the issue with NHRP, given this output of the show command? (Choose two.)A. There was a network ID mismatch.B. The spoke router has not yet sent a request via Tunnel0.C. The spoke router received a malformed NHRP packet.D. There was an authentication key mismatch.E. The registration request was expecting a return request ID of 1201, but received an ID of 120. Answer: A,D68.DRAG DROPAnswer:69.You have configured a guest VLAN using 802.1X on a Cisco Catalyst switch. A client incapable of using 802.1X has accessed the port and has been assigned to the guest VLAN. What happens when a client capable of using 802.1Xjoins the network on the same port?A. The client capable of using 802.1X is allowed access and proper security policies are applied to the client.B. EAPOL packets will not be allowed on the guest VLAN and the access attempt with fail.C. The port is put into the unauthorized state in the user-configured access VLAN, and authentication is restarted.D. This is considered a security breach by the authentication server and all users on the access port will be placed into the restricted VLAN.Answer: C70.Refer to the exhibit. What can be determined from the information shown?A. The user has been restricted to privilege level 1.B. The standard access list should be reconfigured as an extended access list to allow desired user permissionsC. RBAC has been configured with restricted views.D. IP access list DMZ_ACL has not yet been configured with proper permissions.Answer: C71.Refer to the exhibit. Assuming that all other supporting configurations are correct, what can be determined from the partial IP admission configuration shown?A. The router will forward authentication requests toa AAA server for authentication and authorization.B. The user maint3nanc3 will have complete CLI command access once authenticated.C. After a period of 20 minutes, the user will again be required to provide authenticationcredentials.D. The authentication proxy will fail, because the router's HTTP server has not been enabled.E. All traffic entering interface GO/1 will be intercepted for authentication, but only Telnet traffic will be authorized.Answer: C72.DRAG DROPAnswer:。

CCNP考试总结及心得体会紧张而又刺激的cisco认证CCNP（Route and Switch）考证终于宣告一段落，总共用时一个月，以下是我的三门的考试成绩：CCNP ROUTE（642-902）——862分CCNP SWITCH（642-813）——912分CCNP TSHOOT（642-832）——1000分总的来说，CCNP的考试还是比较简单的，当然题量略多，尤其是路由部分，主要是考验一个人的耐心、毅力！所谓贵在坚持，我记得有人曾经说过这样一句话：“人不去逼自己，永远不知道自己有多强大！”。

话不多说，接下来介绍一下我考NP的一些心得和方法，仅供参考(*^__^*) 嘻嘻……首先是CCNP ROUTE（642-902）路由部分：1> 个人认为路由部分是最简单的，虽说我考的分数是最低的，但是考过的人都知道，路由虽说题库给的题量很多，背起来非常辛苦，很累。

但是，考试的时候就会发现，真的很简单。

我背题库的方法，跟大多数人大同小异，首先解决的当然是数量最多的选择题，NP路由选择题总共是380道，全英文，不解释，谁让他是美国佬的东西呢！我背这380道题的方法就是按照题库给的分类的方法：先背第一个Routing部分，不要直接去看题库（PDF文件），从这里面打开，一个部分一个部分按照上面的顺序依次往下背，全部背完之后再回过头来总的看一遍，然后全部画上对号，整体做一遍，不要在乎得了多少分，关键是做错的题，点击Eed Exan交卷之后，左下角打开Retake会看到下面这个被红色区域圈起来的部分就是做错的题，记住错题要反复去做，当你做题的正确率达到95%以上（所有的选择题加在一起），时间不超过40分钟，那么此时说明选择题已经ok，可以看拖图题了。

（我这个方法只适合于急着拿证书的，想完全弄懂每一题，建议去鸿鹄论坛，下载相应的解题视频，边看边记）。

2> 拖图题部分，题库总共给了23题，我的方法是看一题、做一题，把这题库完全ok再去看下一题，所谓的完全ok就是记住每一个选项对应的答案以及答案的位置，比如下面这一题答案：把左边的每一个答案对应右边的每一个提示都记住，完全ok 之后，做多做几遍，然后再看下一题，待全部看完之后，再总体的做一遍，有错误的题一定要反复去做、去看，知道完全会位置，考试的时候拖图题是一题不能错的（不过可能我人品比较好，加上考CCNA，四次考试，我只考到一次拖图题）！3> 实验题部分，这个其实没什么好的方法，就是多敲，理解题目的要求，鸿鹄论坛上有相应的解题视频，视频讲的很好，而且很容易懂，回过头来自己再好好想想，多敲几遍就行了，考试的时候五个实验题全部都会考，所以不要存在侥幸心理，一定要完全弄会，（EIGRP重分发的这个实验题，可能会变题，要注意）！！！我考试的时候R2-R3之间的S线变成了以E线，我同学考试的时候，R1-R2、R2-R3之间的两条线都变成E线，这点需注意！！！其次是CCNP SWITCH（642-813）交换部分：1> 选择题，题库总共157题，相比路由少了一大半儿，相对简单；2> 拖图题，题库总共19题，相比路由又少了几题；（由于方法跟上面路由的方法基本相同，我就不多说了，想完全弄懂，还要自己找资料、视频等来仔细的看、做）。

CCNA（200-301）题库V1.0(2020.11.23)Exam AQUESTION 1A network engineer must create a diagram of a multivendor network.which command must be configured on the Cisco devices so that the topology of the network can be mapped?网络工程师必须创建一个多供应商网络图。

必须在Cisco设备上配置哪个命令才能映射网络拓扑？A. Device(config)#lldp runB. Device(config)#cdp runC. Device(config)# cdp enableD. Device(config)# flow-sampler-map topologyCorrect Answer: A Section:choice E xplanationExplanation/Reference:QUESTION 2Which feature on the Cisco Wireless LAN Controller when enabled restricts management access from specific networks?启用时，思科无线局域网控制器上的哪个功能会限制来自特定网络的管理访问？A. CPU ACLB. TACACSC. Flex ACLD. RADIUSCorrect Answer: A Section:choice E xplanationExplanation/Reference:Reference:https:///c/en/us/support/docs/wireless-mobility/wlan-security/71978-acl-wlc.htmlQUESTION 3When a site-to-site VPN is used, which protocol is responsible for the transport of user data?使用站点到站点VPN时，哪个协议负责用户数据的传输？A. IKEv2B. IKEv1C. IPsecD. MD5Correct Answer: C Section:choice E xplanationExplanation/Reference:QUESTION 4How do TCP and UDP differ in the way that they establish a connection between two endpoints？TCP和UDP在两个端点之间建立连接的方式有何不同？A. TCP use the three-way handshake,and UDP dose no guarantee message deliveryA. TCP使用三向握手，而UDP不保证消息传递B. TCP use synchronization packets,and UDP uses acknowledgement packetsC. UDP provides reliable message transfer,and TCP is a connectionless protocol.D. UDP use SYN,SYN ACK,and FIN bits in the frame header while TCP uses SYN,SYN ACK,and ACK bis.Correct Answer: A Section:choice E xplanationExplanation/Reference:QUESTION 5What are two reasons that cause late collisions to increment on an Ethernet interface?(choose two) 导致延迟冲突在以太网接口上增加的两个原因是什么？（选择两个）A. when the sending device waits 15 seconds before sending the frame againB. when the cable length limits are exceeded超出电缆长度限制时C. when one side of the connection is configured for half-duplexD. when Carner Sense Multiple Access/Collision Detection is used使用Carner Sense多路访问/冲突检测时E. when a collision occurs after the 32nd byte of a frame has been transmittedCorrect Answer: BDSection: choiceExplanationExplanation/Reference:QUESTION 6A Cisco IP phone receive untagged data traffic from an attached PC. Which action is taken by the phone? 思科IP电话从连接的PC接收未标记的数据流量。

HCNP H12-222 V200HCNP-R&S-IESN(Huawei Certified Network Professional-Implementing Enterprise Switching Network)鸿鹤论坛http：//华为题库战报区http：///forum-huawei-1.html1.本题库为鸿鹄论坛提供，具体见上；2.鉴于鸿鹄论坛提供的题库存在少量的错误（指错别字，个别题目没答案），重新校对；3.鸿鹄论坛提供的是无解析的vce，本人私下手工将其转换为解析版WORD、解析版PDF，方便查阅。

4.由于本人手工转换、解读及校对，难免存在错误，尽情指出。

5.也顺手将其制作成方便检测和练习的VCE版本，附件可下载。

6.其他事宜可联系：x120952576@1.判断：采用VLAN方式进行组网，能够将网络划分为多个广播域，减少了广播流量，避免了广播风暴的产生，并且增强了信息的安全性。

A. TrueB. FalseAnswer：B2.关于华为交换机设备中的Hybrid端口下面说法正确的是：A. Hybrid端口只能用来连接网络设备B. Hybrid端口只能用来连接主机C. Hybrid端口既可以用来连接主机，又可以用来连接网络设备D. Hybrid端口上不能配置默认VLANAnswer：C3.MUX VLAN提供了一种通过VLAN进行网络资源控制的机制，以下概念中不属于MUX VLAN的是A. 主VLANB. 从VLANC. Guest VLAND. 互通型VLANAnswer：C4.下面是一段MUX VLAN中关于主VLAN和从VLAN的配置，关于此配置说法正确的是：(请选择3个答案)[Quidway]VLAN10[Quidway-VLAN10] mux-VLAN[Quidway-VLAN10] subordinate group 11[Quidway-VLAN10] subordinateseparate 12A. VLAN10为主VLANB. VLAN11为主VLANC. VLAN12为隔离型从VLAND. VLAN11和VLAN12都为从VLANE，VLAN10和11都为MUX VLANAnswer：A C D5.关于VLAN聚合说法不正确的是：(请选择2个答案)A. VLAN聚合就是在一个物理网络内，用多个VLAN隔离广播域，使不同的VLAN属于同一个子网B. VLAN聚合可以节省IP地址，解决了IP地址资源浪费的问题C. VLAN聚合只需要在super-VLAN上配置IP地址，而不必在sub-VLAN上配置，super-VLAN中是可以添加物理端口的。