Question 1

An engineer must configure RBAC in Cisco UCS Manager in an existing data center environment. Which two roles are suitable for configuring LAN connectivity policies? (Choose two.)
A) server-profile
B) network-admin
C) operations
D) enable
E) admin

Accepted Answer

The network-admin and admin roles are suitable for configuring LAN connectivity policies in Cisco UCS Manager.

Question 2

An engineer must use the python module in the guest shell of the Cisco Nexus 9000 Series switch to shutdown port Ethernet 1/4. Which command set will accomplish this?
A) from cli import * cli(''conf t'') cli(''interface eth1/4'') cli(''shutdown'')
B) from cisco import cli cli(''conf t'' ; ''interface eth1/4'' ; ''shut")
C) cli(''conf t ; interface eth1/4 ; shut'')
D) cli(''conf t ; interface eth1/4")

Accepted Answer

The answer of  An engineer must use the python...

Question 3

A network engineer must enable port security on all Cisco MDS Series Switches in the fabric. The requirement is to avoid the extensive manual configuration of the switch ports. Which action must be taken to meet these requirements?
A) Enable the auto-learning port security feature.
B) Enable the auto-learning port security feature on a per-VSAN basis.
C) Activate CFS distribution and the auto-learning port security feature.
D) Activate CFS distribution and the auto-learning port security feature on a per-VSAN basis.

Accepted Answer

Activating CFS (Cisco Fabric Services) distribution along with the auto-learning port security feature allows for centralized management and distribution of port security configurations across the fabric, reducing manual configuration efforts.

Question 4

An engineer is using REST API calls to configure the Cisco APIC. Which data structure must be used within a POST message to receive a login token? A) {"aaaUser":{"attributes":{"name":"apiuser","pwd":"cisco123"}}} B) C) {aaaUser:{attributes:{name:apiuser,pwd:cisco123}}} D) apiusercisco123

Accepted Answer

The correct data structure for a POST message in a REST API call to receive a login token is JSON, as shown in option A.

Question 5

A customer reports Fibre Channel login requests to a Cisco MDS 9000 Series Switch from an unauthorized source. The customer requires a feature that will allow all devices already logged in and learned to be added to the Fibre Channel active database. Which two features must be enabled to accomplish this goal? (Choose two.)
A) auto-learning
B) smart aliases
C) port security
D) enhanced zoning
E) device aliases

Accepted Answer

The answer of A customer reports Fibre Channel login requests...

Question 6

A network engineer needs to configure system logging on the Cisco MDS Series switch. The messages must be displayed with the severity level of "warning" and above. For security reasons, the users must be logged out of the console after 5 minutes of inactivity. Which configuration must be applied to meet these requirements?
A) MDS-A(config)# logging console 5 MDS-A(config-console)# exec-timeout 300
B) MDS-A(config)# line console MDS-A(config-console)# speed 38400 MDS-A(config-console)# exec-timeout 5 MDS-A(config)# logging console 4
C) MDS-A(config)# logging line 4 MDS-A(config-console)# session-limit 300
D) MDS-A(config)# console MDS-A(config-console)# session-limit 5

Accepted Answer

The command "logging console 4" sets the logging level to "warning" and above. The "exec-timeout 5" command logs users out after 5 minutes of inactivity.

Question 7

Refer to the exhibit.  What is the result of implementing this configuration?
A) The switch queries the TACACS+ server by using an encrypted text PAP login.
B) The TACACS+ server uses the type-6 encrypted format.
C) The switch queries the TACACS+ server by using a clear text PAP login.
D) The timeout value on the TACACS+ server is 10 seconds.

Accepted Answer

The answer of Refer to the exhibit.  What is...

Question 8

A company is running a pair of Cisco Nexus 7706 Series Switches as part of a data center segment. All network engineers have restricted read-write access to the core switches. A network engineer must add a new FCoE VLAN to allow traffic from servers toward FCoE storage. Which set of actions must be taken to meet these requirements?
A) 1. Assign the network-admin role to a user. 2. Commit the role to the switch to the active user database.
B) 1. Modify a network-operator role and add the required privileges. 2. Assign a VDC-operator role to a user.
C) 1. Create a user-defined role and add the required privileges. 2. Assign a role to a user.
D) 1. Add the required privilege to the VDC-admin role. 2. Commit the changes to the active user database.

Accepted Answer

The answer of A company is running a pair of...

Question 9

An engineer must implement an automation solution to allow the backup of the configuration of Cisco Nexus Series Switches to a centralized location. The solution must: • support the team-developed custom monitoring scripts that are packaged using RPM packaging that the framework must support. • be decoupled from the underlying Cisco Nexus operating system. • have no impact on the operating system of the underlying switch if the resource contention occurs. • use Python to expand the existing automation framework. Which solution meets these requirements?
A) Guest Shell
B) Vegas Shell
C) Bash Shell
D) TCL Shell

Accepted Answer

Guest Shell is a Linux-based container environment on Cisco Nexus switches that allows users to run custom scripts and applications, such as RPM-packaged monitoring scripts, without affecting the underlying operating system. It supports Python and is decoupled from the switch's OS, meeting all the specified requirements.

Question 10

Refer to the exhibit.  A network engineer is setting up a multihomed OTV network. The first site has been set up with a primary and secondary adjacency server. Which configuration must be added on the remote OTV AEDs site?
A) 
B) 
C) 
D)

Accepted Answer

The answer of Refer to the exhibit.  A network...

Question 11

Which configuration generates a syslog message when CPU utilization is higher than 60%?
A) event manager applet HIGH-CPU event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type exact entry-op gt 60 poll-interval 5 action 1.0 syslog priority notifications msg "cpu high"
B) event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type exact entry-op lt 60 poll-interval 5
C) event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type next entry-op gt 60 poll-interval 5
D) event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.6.1 get-type next entry-op lt 60 poll-interval 5

Accepted Answer

The configuration in choice A uses an event manager applet to monitor the SNMP OID for CPU utilization. It specifies that if the CPU utilization is greater than 60% (entry-op gt 60), a syslog message with the specified priority and message will be generated.

Question 12

Which feature must be enabled to support the use of JSON and XML encodings when a Cisco Nexus 7000 Series Switch is deployed?
A) Bash shell
B) NX-API
C) Open Agent Container
D) LLDP

Accepted Answer

NX-API must be enabled on a Cisco Nexus 7000 Series Switch to support the use of JSON and XML encodings for programmatic access and management.

Question 13

A company is investigating different options for IT automation tools. The IT team has experience with Python programming language and scripting using a declarative language. The proposed tool should be easy to set up and should not require installing an agent on target devices. The team will also need to build custom modules based on the Python programming language to extend the tool's functionality. Which automation tool should be used to meet these requirements?
A) Ansible
B) Chef
C) Puppet
D) NX-API

Accepted Answer

Ansible is agentless, easy to set up, uses a declarative language (YAML), and allows for custom module development in Python, making it suitable for the team's requirements.

Question 14

An engineer must use the Embedded Event Manager to monitor events that occur on a Cisco Nexus 9000 Series Switch. An environment variable needs to be created so that several policies use the monitored events in their actions. The external email server is represented by IP address 10.10.10.10. Which command sets the environment variable?
A) n9k2# event manager environment mailserver "10.10.10.10" n9k2# event manager environment mailserver "10.10.10.10"
B) n9k2(config)# event manager environment mailserver "10.10.10.10" n9k2(config)#
C) n9k2(config-applet)# environment mailserver "10.10.10.10" n9k2(config-applet)# environment mailserver "10.10.10.10"
D) n9k2(config)# event manager policy environment mailserver "10.10.10.10" event manager policy environment mailserver "10.10.10.10"

Accepted Answer

The command to set an environment variable in the Embedded Event Manager on a Cisco Nexus switch is done in global configuration mode using the "event manager environment" command.

Question 15

A network administrator must perform a system upgrade on a Cisco MDS 9000 Series Switch. Due to the recent changes by the security team: • The AAA server is unreachable. • All TCP communication between the MDS 9000 Series Switch and AAA servers is disabled. Which actions must be used to perform the upgrade?
A) Log in locally to the MDS 9000 Series Switch using a network-admin role and download the upgrade files from the remote TFTP server.
B) Log in locally to the MDS 9000 Series Switch using a server-admin role and download the upgrade files from the remote FTP server.
C) Log in to a server storing the upgrade files remotely using a server-admin role and download the files to the MDS 9000 Series Switch using SFTP.
D) Log in to a server storing the upgrade files remotely using a network-admin role and download the files to the MDS 9000 Series Switch using HTTP.

Accepted Answer

The answer of A network administrator must perform a system...

Question 16

Which two components should be checked when a Cisco Nexus 9000 Series Switch fails to boot using POAP? (Choose two.)
A) POAP feature license
B) DHCP server to bootstrap IP information
C) image noted in the script file against switch bootflash
D) script signed with security key
E) TFTP server that contains the configuration script

Accepted Answer

The DHCP server is needed to provide the switch with an IP address and other network information, and the TFTP server is required to host the configuration script that the switch will download and execute during the POAP process.

Question 17

Refer to the exhibit. What is the result of executing this Python code?
A) It sends the switch configuration to Cisco TAC
B) It sends a Cisco device backup to a remote destination
C) It schedules a backup on a Cisco switch using EEM
D) It backs up Cisco switches to Cisco Prime Infrastructure

Accepted Answer

The answer of  Refer to the exhibit. What is...

Question 18

Refer to the exhibit.  Which statement about the ERSPAN configuration in this environment is true?
A) The session number of the source of ERSPAN spanned traffic must have a session ID of 47 for the traffic analyzer to receive the traffic.
B) Host B is the source of ERSPAN spanned traffic and host A is the traffic analyzer.
C) The session number of the source of ERSPAN spanned traffic must have a session ID of 48 for the traffic analyzer to receive the traffic.
D) Host A is the source of ERSPAN spanned traffic and host B is the traffic analyzer.

Accepted Answer

The answer of Refer to the exhibit.  Which statement...

Question 19

Port security is statically configured on a Cisco Nexus 7700 Series switch and F3 line card. The switch is configured with an Advanced Services license. Which two actions delete secured MAC addresses from the interface? (Choose two.)
A) The address must be removed from the configuration.
B) Shutdown and then no shutdown must be run on the interface. Shutdown and then no shutdown must be run on the interface.
C) The device must be restarted manually.
D) The address must reach the age limit that is configured for the interface.
E) The interface must be converted to a routed port.

Accepted Answer

The answer of Port security is statically configured on a...

Question 20

An engineer is configuring AAA authentication on a Cisco MDS 9000 Series switch. The LDAP server is located under the IP 10.10.2.2. The data sent to the LDAP server should be encrypted. Which command should be used to meet these requirements?
A) ldap-server 10.10.2.2 port 443
B) ldap-server 10.10.2.2 key SSL_KEY
C) ldap-server host 10.10.2.2 key SSL_KEY
D) ldap-server host 10.10.2.2 enable-ssl

Accepted Answer

The command "ldap-server host 10.10.2.2 enable-ssl" is used to configure the switch to communicate with the LDAP server using SSL, ensuring that the data sent is encrypted.

Exam 40: Implementing and Operating Cisco Security Core Technologies

An engineer must configure RBAC in Cisco UCS Manager in an existing data center environment. Which two roles are suitable for configuring LAN connectivity policies? (Choose two.)

An engineer must use the python module in the guest shell of the Cisco Nexus 9000 Series switch to shutdown port Ethernet 1/4. Which command set will accomplish this?

A network engineer must enable port security on all Cisco MDS Series Switches in the fabric. The requirement is to avoid the extensive manual configuration of the switch ports. Which action must be taken to meet these requirements?

An engineer is using REST API calls to configure the Cisco APIC. Which data structure must be used within a POST message to receive a login token?

Refer to the exhibit. What is the result of implementing this configuration?

Refer to the exhibit. A network engineer is setting up a multihomed OTV network. The first site has been set up with a primary and secondary adjacency server. Which configuration must be added on the remote OTV AEDs site?

Which configuration generates a syslog message when CPU utilization is higher than 60%?

Which feature must be enabled to support the use of JSON and XML encodings when a Cisco Nexus 7000 Series Switch is deployed?

Which two components should be checked when a Cisco Nexus 9000 Series Switch fails to boot using POAP? (Choose two.)

Refer to the exhibit. What is the result of executing this Python code?

Refer to the exhibit. Which statement about the ERSPAN configuration in this environment is true?

Port security is statically configured on a Cisco Nexus 7700 Series switch and F3 line card. The switch is configured with an Advanced Services license. Which two actions delete secured MAC addresses from the interface? (Choose two.)

An engineer is configuring AAA authentication on a Cisco MDS 9000 Series switch. The LDAP server is located under the IP 10.10.2.2. The data sent to the LDAP server should be encrypted. Which command should be used to meet these requirements?