Cisco CCNP 350-401 ENCOR Flexible NetFlow, SPAN/RSPAN/ERSPAN, and IP SLA Practice Test 1

 

Topic 14 Practice Test 1 covers Flexible NetFlow, SPAN/RSPAN/ERSPAN, and IP SLA for Cisco 350-401 ENCOR. For broader exam preparation, review the Cisco 350-401 ENCOR Exam Dumps. Every option includes focused technical reasoning explaining both the Cisco enterprise networking concept and its fit to the scenario.

Question 1

Operations wants byte totals in every flow record but does not want byte count to create new flow keys. Which Flexible NetFlow field type should the engineer add? Choose ONE.

1. collect counter bytes long
2. flow monitor
3. match transport source-port
4. flow exporter

Correct Answer(s)

 

A

Rationale

1. A nonkey collect field records byte totals as metadata while leaving the selected match fields as the flow key. collect counter bytes long fits because the design must retain byte totals without changing how flows are keyed.
2. A flow monitor binds a record, cache behavior, and optional exporter, then is attached to traffic on an interface. Here the task is to retain byte totals without changing how flows are keyed, not to use flow monitor for its normal role. The evidence instead points to collect counter bytes long at this control point.
3. A match field becomes part of the flow key, so different source-port values create separate cache entries. The evidence calls for a way to retain byte totals without changing how flows are keyed; match transport source-port does not supply it. This cannot replace the collect counter bytes long function required here.
4. A flow exporter defines where and how cached flow records leave the device for an external collector. The required outcome is to retain byte totals without changing how flows are keyed; flow exporter serves a different purpose. This scenario depends on collect counter bytes long for the requested result.

 

Question 2

A collector ACL accepts exports only from 10.10.10.10, which is Loopback0 on the router. The export destination is reachable through multiple uplinks. What should the engineer configure in the Flexible NetFlow exporter? Choose ONE.

1. exporter destination address
2. input flow monitor attachment
3. exporter source Loopback0
4. active timeout

Correct Answer(s)

 

C

Rationale

1. The exporter destination identifies the collector that will receive NetFlow export datagrams. The required outcome is to collector policy requires a predictable loopback source address despite uplink changes; exporter destination address addresses another function. That leaves exporter source Loopback0 as the mechanism that must be addressed.
2. Applying a monitor in the input direction classifies traffic as it enters the selected interface. Collector policy requires a predictable loopback source address despite uplink changes is the controlling need; input flow monitor attachment operates elsewhere in the workflow. The relevant dependency is exporter source Loopback0, so this change misses it.
3. Selecting a stable loopback as the exporter source gives the collector a predictable source address when routing is available. exporter source Loopback0 fits because the design must collector policy requires a predictable loopback source address despite uplink changes.
4. The active timeout expires and exports long-lived flows periodically even while packets continue to arrive. Here the task is to collector policy requires a predictable loopback source address despite uplink changes, not to use active timeout for its normal role. This would not supply the exporter source Loopback0 behavior the design needs.

 

Question 3

A monitor must measure client traffic as packets arrive from an access segment before any outbound policy changes the traffic. Where should the monitor be attached? Choose ONE.

1. flow exporter
2. input flow monitor attachment
3. show flow monitor cache
4. output flow monitor attachment

Correct Answer(s)

 

B

Rationale

1. A flow exporter defines where and how cached flow records leave the device for an external collector. Here the task is to observe packets entering the access-facing interface before outbound processing, not to use flow exporter for its normal role. input flow monitor attachment is still necessary to satisfy the stated constraint.
2. Applying a monitor in the input direction classifies traffic as it enters the selected interface. For this case, observe packets entering the access-facing interface before outbound processing is the constraint that input flow monitor attachment satisfies.
3. The monitor cache display confirms whether the device is actually learning and retaining flow entries locally. The required outcome is to observe packets entering the access-facing interface before outbound processing; show flow monitor cache addresses another function. This option does not perform the input flow monitor attachment role required here.
4. Applying a monitor in the output direction classifies traffic as it leaves the selected interface. Observe packets entering the access-facing interface before outbound processing is the controlling need; output flow monitor attachment operates elsewhere in the workflow. The scenario’s missing function is input flow monitor attachment, so this is insufficient.

 

Question 4

A Catalyst EtherChannel carries routed traffic, and the team needs Flexible NetFlow for the bundle. Where should the monitor be applied on the cited platform? Choose ONE.

1. collector dashboard
2. member-port flow monitor attachment
3. SPAN destination interface
4. Port-channel flow monitor attachment

Correct Answer(s)

 

D

Rationale

1. The collector dashboard can prove receipt and parsing, but it cannot by itself establish whether the source device learned flows. Monitor the logical bundle without using unsupported member-port fnf attachment is the controlling need; collector dashboard operates elsewhere in the workflow. The actual control point is Port-channel flow monitor attachment, which this choice bypasses.
2. Attaching FNF directly to an EtherChannel member is not the supported method on the cited Catalyst IOS XE platform. Mismatch for member-port flow monitor attachment: the design must monitor the logical bundle without using unsupported member-port FNF attachment. This can coexist with Port-channel flow monitor attachment, but it cannot substitute for it.
3. The SPAN destination is the analyzer-facing port to which the switch sends replicated packets from the configured source. Here the task is to monitor the logical bundle without using unsupported member-port FNF attachment, not to use SPAN destination interface for its normal role. The requirement maps to Port-channel flow monitor attachment; this option serves another purpose.
4. Catalyst Flexible NetFlow supports monitoring on the logical port-channel; member ports are not supported for that attachment. For this case, monitor the logical bundle without using unsupported member-port FNF attachment is the constraint that Port-channel flow monitor attachment satisfies.

 

Question 5

A database replication session can stay active for hours, but operations needs updated flow records at the collector every five minutes even while the session continues. Which cache behavior addresses this? Choose ONE.

1. inactive timeout
2. active timeout
3. collector dashboard
4. match transport source-port

Correct Answer(s)

 

B

Rationale

1. The inactive timeout ages a cache entry after no matching packets arrive for the configured interval. The evidence calls for a way to periodically export a still-active conversation without waiting for it to stop; inactive timeout does not supply it. The needed result comes from active timeout, not from this mechanism.
2. The active timeout expires and exports long-lived flows periodically even while packets continue to arrive. The scenario needs to periodically export a still-active conversation without waiting for it to stop, which is exactly where active timeout applies.
3. The collector dashboard can prove receipt and parsing, but it cannot by itself establish whether the source device learned flows. Periodically export a still-active conversation without waiting for it to stop is the controlling need; collector dashboard operates elsewhere in the workflow. The scenario calls for active timeout; changing this feature would not help.
4. A match field becomes part of the flow key, so different source-port values create separate cache entries. Mismatch for match transport source-port: the design must periodically export a still-active conversation without waiting for it to stop. active timeout directly governs the condition that this choice cannot satisfy.

 

Question 6

Thousands of short connections finish quickly, yet stale cache entries remain after their last packet. Which Flexible NetFlow timer should be shortened to age those idle entries sooner? Choose ONE.

1. inactive timeout
2. exporter source Loopback0
3. flow monitor
4. active timeout

Correct Answer(s)

 

A

Rationale

1. The inactive timeout ages a cache entry after no matching packets arrive for the configured interval. inactive timeout fits because the design must remove entries after traffic stops rather than periodically exporting active sessions.
2. Selecting a stable loopback as the exporter source gives the collector a predictable source address when routing is available. Here the task is to remove entries after traffic stops rather than periodically exporting active sessions, not to use exporter source Loopback0 for its normal role. The evidence instead points to inactive timeout at this control point.
3. A flow monitor binds a record, cache behavior, and optional exporter, then is attached to traffic on an interface. The evidence calls for a way to remove entries after traffic stops rather than periodically exporting active sessions; flow monitor does not supply it. This cannot replace the inactive timeout function required here.
4. The active timeout expires and exports long-lived flows periodically even while packets continue to arrive. The required outcome is to remove entries after traffic stops rather than periodically exporting active sessions; active timeout addresses another function. The scenario still depends on inactive timeout for the requested result.

 

Question 7

A standards-based analytics platform explicitly accepts IPFIX and rejects NetFlow v9 templates. Which exporter setting should the engineer select? Choose ONE.

1. SPAN receive (rx) direction
2. NetFlow version 9 export
3. active timeout
4. export-protocol ipfix

Correct Answer(s)

 

D

Rationale

1. An rx SPAN source copies frames received on the monitored source and excludes egress-only traffic. The required outcome is to collector explicitly requires IPFIX rather than NetFlow version 9; SPAN receive (rx) direction addresses another function. That leaves export-protocol ipfix as the mechanism that must be addressed.
2. NetFlow v9 is template-based flow export, but it is not interchangeable with a collector explicitly requiring IPFIX. Collector explicitly requires ipfix rather than netflow version 9 is the controlling need; NetFlow version 9 export operates elsewhere in the workflow. The relevant dependency is export-protocol ipfix, so this change misses it.
3. The active timeout expires and exports long-lived flows periodically even while packets continue to arrive. Mismatch for active timeout: the design must collector explicitly requires IPFIX rather than NetFlow version 9. The case is governed by export-protocol ipfix, not this adjacent feature.
4. An exporter using IPFIX sends flow records in the standards-based IPFIX format when the receiving collector requires that protocol. The decisive goal is to collector explicitly requires IPFIX rather than NetFlow version 9; export-protocol ipfix supplies that behavior.

 

Question 8

The remote collector is empty. Before changing routes or firewall rules, the engineer wants to prove whether the switch is learning flows locally. What should be checked first? Choose ONE.

1. collector dashboard
2. exporter destination address
3. show flow monitor cache
4. IP SLA ICMP echo

Correct Answer(s)

 

C

Rationale

1. The collector dashboard can prove receipt and parsing, but it cannot by itself establish whether the source device learned flows. Here the task is to determine whether cache entries exist on the source device before troubleshooting export transport, not to use collector dashboard for its normal role. show flow monitor cache is still necessary to satisfy the stated constraint.
2. The exporter destination identifies the collector that will receive NetFlow export datagrams. The evidence calls for a way to determine whether cache entries exist on the source device before troubleshooting export transport; exporter destination address does not supply it. The symptom remains until the show flow monitor cache behavior is present.
3. The monitor cache display confirms whether the device is actually learning and retaining flow entries locally. The scenario needs to determine whether cache entries exist on the source device before troubleshooting export transport, which is exactly where show flow monitor cache applies.
4. An ICMP echo operation actively measures basic IP reachability and round-trip response time to a target. Determine whether cache entries exist on the source device before troubleshooting export transport is the controlling need; IP SLA ICMP echo operates elsewhere in the workflow. The scenario’s missing function is show flow monitor cache, so this is insufficient.

 

Question 9

A SPAN session should capture only frames arriving on interface Gi1/0/24 from a test host; outbound responses must be excluded. Which source direction fits? Choose ONE.

1. SPAN receive (rx) direction
2. SPAN both direction
3. SPAN destination interface
4. SPAN transmit (tx) direction

Correct Answer(s)

 

A

Rationale

1. An rx SPAN source copies frames received on the monitored source and excludes egress-only traffic. SPAN receive (rx) direction is appropriate here because operations must capture only frames received on the source interface.
2. A both-direction SPAN source mirrors ingress and egress traffic and is useful when the analysis needs both sides. Mismatch for SPAN both direction: the design must capture only frames received on the source interface. This can coexist with SPAN receive (rx) direction, but it cannot substitute for it.
3. The SPAN destination is the analyzer-facing port to which the switch sends replicated packets from the configured source. Here the task is to capture only frames received on the source interface, not to use SPAN destination interface for its normal role. The requirement maps to SPAN receive (rx) direction; this option serves another purpose.
4. A tx SPAN source copies frames transmitted from the monitored source and excludes ingress-only traffic. The evidence calls for a way to capture only frames received on the source interface; SPAN transmit (tx) direction does not supply it. That would leave the SPAN receive (rx) direction dependency unresolved in this design.

 

Question 10

A packet analyzer is physically connected to Gi1/0/48. Production traffic from Gi1/0/12 must be copied to that analyzer. Which SPAN role should Gi1/0/48 have? Choose ONE.

1. RSPAN remote-span VLAN
2. SPAN source interface
3. SPAN source VLAN
4. SPAN destination interface

Correct Answer(s)

 

D

Rationale

1. RSPAN carries mirrored frames between switches over a specially designated remote-span VLAN in the Layer 2 domain. The evidence calls for a way to send replicated packets out the port connected to the analyzer; RSPAN remote-span VLAN does not supply it. The needed result comes from SPAN destination interface, not from this mechanism.
2. A SPAN source interface identifies the production port whose traffic is copied; it is not the analyzer egress port. The required outcome is to send replicated packets out the port connected to the analyzer; SPAN source interface addresses another function. This option targets another layer while SPAN destination interface controls the outcome.
3. A VLAN source mirrors traffic associated with the selected VLAN, which is useful when endpoints can move among several access ports. Send replicated packets out the port connected to the analyzer is the controlling need; SPAN source VLAN operates elsewhere in the workflow. The scenario calls for SPAN destination interface; changing this feature would not help.
4. The SPAN destination is the analyzer-facing port to which the switch sends replicated packets from the configured source. SPAN destination interface fits because the design must send replicated packets out the port connected to the analyzer.

 

Question 11

Two switches share the same Layer 2 campus domain. The analyzer is attached to the second switch, and mirrored traffic must traverse trunks without GRE. Which transport should be used? Choose ONE.

1. ERSPAN source session
2. ordinary access VLAN
3. RSPAN remote-span VLAN
4. IP SLA UDP jitter

Correct Answer(s)

 

C

Rationale

1. An ERSPAN source encapsulates mirrored traffic for transport to a remote ERSPAN destination across routed IP connectivity. Mismatch for ERSPAN source session: the design must carry mirrored frames between switches over trunks without routed encapsulation. RSPAN remote-span VLAN remains the required control for this case.
2. A normal access VLAN carries endpoint traffic and lacks the special remote-span role needed by an RSPAN design. Here the task is to carry mirrored frames between switches over trunks without routed encapsulation, not to use ordinary access VLAN for its normal role. The evidence instead points to RSPAN remote-span VLAN at this control point.
3. RSPAN carries mirrored frames between switches over a specially designated remote-span VLAN in the Layer 2 domain. For this case, carry mirrored frames between switches over trunks without routed encapsulation is the constraint that RSPAN remote-span VLAN satisfies.
4. A UDP jitter operation generates timed UDP probes to measure delay variation, loss, and latency characteristics relevant to real-time traffic. The required outcome is to carry mirrored frames between switches over trunks without routed encapsulation; IP SLA UDP jitter addresses another function. The scenario still depends on RSPAN remote-span VLAN for the requested result.

 

Question 12

A remote-span VLAN already crosses the trunks. The source switch must inject mirrored frames into it, and the analyzer switch must extract them to a local port. What is required? Choose ONE.

1. ERSPAN source session
2. RSPAN source and destination sessions
3. SPAN source physical port
4. single local SPAN session

Correct Answer(s)

 

B

Rationale

1. An ERSPAN source encapsulates mirrored traffic for transport to a remote ERSPAN destination across routed IP connectivity. The required outcome is to place copies into the remote-span VLAN on one switch and deliver them to the analyzer on another; ERSPAN source session addresses another function. That leaves RSPAN source and destination sessions as the mechanism that must be addressed.
2. RSPAN uses a source session to place copies into the remote-span VLAN and a destination session to deliver them to the analyzer. RSPAN source and destination sessions is appropriate here because operations must place copies into the remote-span VLAN on one switch and deliver them to the analyzer on another.
3. A physical-port source follows one interface; it is useful for a fixed link but misses traffic after an endpoint moves elsewhere. Mismatch for SPAN source physical port: the design must place copies into the remote-span VLAN on one switch and deliver them to the analyzer on another. The case is governed by RSPAN source and destination sessions, not this adjacent feature.
4. Local SPAN copies traffic to a destination on the same switch and does not create the remote transport needed across switches. Here the task is to place copies into the remote-span VLAN on one switch and deliver them to the analyzer on another, not to use single local SPAN session for its normal role. This would not supply the RSPAN source and destination sessions behavior the design needs.

 

Question 13

The security analyzer is three routed hops away and no common Layer 2 VLAN spans the path. Which mirroring method best fits? Choose ONE.

1. SPAN source VLAN
2. RSPAN source session
3. single local SPAN session
4. ERSPAN source session

Correct Answer(s)

 

D

Rationale

1. A VLAN source mirrors traffic associated with the selected VLAN, which is useful when endpoints can move among several access ports. Here the task is to transport mirrored packets across Layer 3 connectivity, not to use SPAN source VLAN for its normal role. ERSPAN source session is still necessary to satisfy the stated constraint.
2. An RSPAN source places replicated frames into a remote-span VLAN and therefore depends on Layer 2 transport of that VLAN. The evidence calls for a way to transport mirrored packets across Layer 3 connectivity; RSPAN source session does not supply it. The symptom remains until the ERSPAN source session behavior is present.
3. Local SPAN copies traffic to a destination on the same switch and does not create the remote transport needed across switches. The required outcome is to transport mirrored packets across Layer 3 connectivity; single local SPAN session addresses another function. This option does not perform the ERSPAN source session role required here.
4. An ERSPAN source encapsulates mirrored traffic for transport to a remote ERSPAN destination across routed IP connectivity. ERSPAN source session is appropriate here because operations must transport mirrored packets across Layer 3 connectivity.

 

Question 14

An ERSPAN source and destination are configured, but the receiver never recognizes the stream. The path is routed. Which pairing is essential to validate? Choose ONE.

1. matching RSPAN VLAN only
2. matching ERSPAN ID plus reachable origin/destination IPs
3. SPAN source VLAN
4. active timeout

Correct Answer(s)

 

B

Rationale

1. An RSPAN VLAN can transport Layer 2 mirrored traffic, but it does not establish the routed GRE-based path used by ERSPAN. Ensure both session identification and routed gre path prerequisites align is the controlling need; matching RSPAN VLAN only operates elsewhere in the workflow. The actual control point is matching ERSPAN ID plus reachable origin/destination IPs, which this choice bypasses.
2. ERSPAN endpoints must agree on the session identifier and have IP reachability between the configured origin and destination addresses. matching ERSPAN ID plus reachable origin/destination IPs fits because the design must ensure both session identification and routed GRE path prerequisites align.
3. A VLAN source mirrors traffic associated with the selected VLAN, which is useful when endpoints can move among several access ports. Here the task is to ensure both session identification and routed GRE path prerequisites align, not to use SPAN source VLAN for its normal role. The requirement maps to matching ERSPAN ID plus reachable origin/destination IPs; this option serves another purpose.
4. The active timeout expires and exports long-lived flows periodically even while packets continue to arrive. The evidence calls for a way to ensure both session identification and routed GRE path prerequisites align; active timeout does not supply it. That would leave the matching ERSPAN ID plus reachable origin/destination IPs dependency unresolved in this design.

 

Question 15

Users in VLAN 30 can move between several access ports during a test. The analyzer must keep seeing VLAN 30 traffic without editing the session after each move. What should be the SPAN source? Choose ONE.

1. SPAN source VLAN
2. SPAN destination interface
3. RSPAN remote-span VLAN
4. SPAN source physical port

Correct Answer(s)

 

A

Rationale

1. A VLAN source mirrors traffic associated with the selected VLAN, which is useful when endpoints can move among several access ports. For this case, observe the whole VLAN rather than one fixed access interface is the constraint that SPAN source VLAN satisfies.
2. The SPAN destination is the analyzer-facing port to which the switch sends replicated packets from the configured source. The required outcome is to observe the whole VLAN rather than one fixed access interface; SPAN destination interface addresses another function. This option targets another layer while SPAN source VLAN controls the outcome.
3. RSPAN carries mirrored frames between switches over a specially designated remote-span VLAN in the Layer 2 domain. Observe the whole vlan rather than one fixed access interface is the controlling need; RSPAN remote-span VLAN operates elsewhere in the workflow. The scenario calls for SPAN source VLAN; changing this feature would not help.
4. A physical-port source follows one interface; it is useful for a fixed link but misses traffic after an endpoint moves elsewhere. Mismatch for SPAN source physical port: the design must observe the whole VLAN rather than one fixed access interface. SPAN source VLAN directly governs the condition that this choice cannot satisfy.

 

Question 16

A SPAN capture looks wrong and the team needs to confirm the configured source, destination, direction, and session status before checking ASIC programming. Which command is the best first verification? Choose ONE.

1. collector dashboard
2. show ip route
3. show monitor session all
4. show flow monitor cache

Correct Answer(s)

 

C

Rationale

1. The collector dashboard can prove receipt and parsing, but it cannot by itself establish whether the source device learned flows. Mismatch for collector dashboard: the design must inspect session type, source, destination, direction, and state before lower-level debugging. show monitor session all remains the required control for this case.
2. The routing table is important for ERSPAN reachability, but it does not verify the SPAN session source, destination, or direction itself. Here the task is to inspect session type, source, destination, direction, and state before lower-level debugging, not to use show ip route for its normal role. The evidence instead points to show monitor session all at this control point.
3. This command exposes the configured SPAN session type, source, destination, direction, and operational status before deeper hardware troubleshooting. For this case, inspect session type, source, destination, direction, and state before lower-level debugging is the constraint that show monitor session all satisfies.
4. The monitor cache display confirms whether the device is actually learning and retaining flow entries locally. The required outcome is to inspect session type, source, destination, direction, and state before lower-level debugging; show flow monitor cache addresses another function. The scenario still depends on show monitor session all for the requested result.

 

Question 17

A branch router must continuously measure basic IP reachability and round-trip delay to 192.0.2.50. Which IP SLA operation is the direct fit? Choose ONE.

1. IP SLA UDP jitter
2. IP SLA DNS operation
3. IP SLA ICMP echo
4. object tracking tied to IP SLA

Correct Answer(s)

 

C

Rationale

1. A UDP jitter operation generates timed UDP probes to measure delay variation, loss, and latency characteristics relevant to real-time traffic. The required outcome is to measure ICMP reachability and round-trip response time to an IP target; IP SLA UDP jitter addresses another function. That leaves IP SLA ICMP echo as the mechanism that must be addressed.
2. A DNS IP SLA operation actively measures name-resolution behavior against the configured DNS service rather than merely testing host reachability. Measure icmp reachability and round-trip response time to an ip target is the controlling need; IP SLA DNS operation operates elsewhere in the workflow. The relevant dependency is IP SLA ICMP echo, so this change misses it.
3. An ICMP echo operation actively measures basic IP reachability and round-trip response time to a target. IP SLA ICMP echo fits because the design must measure ICMP reachability and round-trip response time to an IP target.
4. A track object can consume IP SLA reachability state so routing or gateway behavior changes when the measured path fails. Here the task is to measure ICMP reachability and round-trip response time to an IP target, not to use object tracking tied to IP SLA for its normal role. This would not supply the IP SLA ICMP echo behavior the design needs.

 

Question 18

Voice users report variable delay even though ordinary pings succeed. The team needs active measurements of jitter and packet loss along the path. Which IP SLA operation should be used? Choose ONE.

1. IP SLA UDP jitter
2. IP SLA TCP connect
3. show monitor session all
4. IP SLA ICMP echo

Correct Answer(s)

 

A

Rationale

1. A UDP jitter operation generates timed UDP probes to measure delay variation, loss, and latency characteristics relevant to real-time traffic. The decisive goal is to measure delay variation and loss rather than only basic reachability; IP SLA UDP jitter supplies that behavior.
2. A TCP connect operation tests whether a specific TCP service can complete a connection, making it more application-specific than an ICMP ping. The evidence calls for a way to measure delay variation and loss rather than only basic reachability; IP SLA TCP connect does not supply it. The symptom remains until the IP SLA UDP jitter behavior is present.
3. This command exposes the configured SPAN session type, source, destination, direction, and operational status before deeper hardware troubleshooting. The required outcome is to measure delay variation and loss rather than only basic reachability; show monitor session all addresses another function. This option does not perform the IP SLA UDP jitter role required here.
4. An ICMP echo operation actively measures basic IP reachability and round-trip response time to a target. Measure delay variation and loss rather than only basic reachability is the controlling need; IP SLA ICMP echo operates elsewhere in the workflow. The scenario’s missing function is IP SLA UDP jitter, so this is insufficient.

 

Question 19

An `ip sla 20` operation is fully defined, but the engineer has not told IOS XE when to start it. Which configuration element makes the probe run? Choose ONE.

1. active timeout
2. IP SLA schedule
3. IP SLA operation definition
4. object tracking tied to IP SLA

Correct Answer(s)

 

B

Rationale

1. The active timeout expires and exports long-lived flows periodically even while packets continue to arrive. Start an already-defined ip sla operation at the intended time and lifetime is the controlling need; active timeout operates elsewhere in the workflow. The actual control point is IP SLA schedule, which this choice bypasses.
2. The schedule activates an already-defined IP SLA operation and controls when and how long it runs. IP SLA schedule fits because the design must start an already-defined IP SLA operation at the intended time and lifetime.
3. The operation definition specifies the probe type and target, but it does not by itself guarantee that the operation has been scheduled to run. Here the task is to start an already-defined IP SLA operation at the intended time and lifetime, not to use IP SLA operation definition for its normal role. The requirement maps to IP SLA schedule; this option serves another purpose.
4. A track object can consume IP SLA reachability state so routing or gateway behavior changes when the measured path fails. The evidence calls for a way to start an already-defined IP SLA operation at the intended time and lifetime; object tracking tied to IP SLA does not supply it. That would leave the IP SLA schedule dependency unresolved in this design.

 

Question 20

A backup static route should be removed when a remote probe target becomes unreachable and restored when reachability returns. Which integration supplies that state to routing? Choose ONE.

1. static route without tracking
2. IP SLA schedule
3. SPAN destination interface
4. object tracking tied to IP SLA

Correct Answer(s)

 

D

Rationale

1. An ordinary static route remains installed based on its configuration and next-hop resolution; it does not directly react to an IP SLA result. The evidence calls for a way to make route behavior follow the result of an IP SLA reachability test; static route without tracking does not supply it. The needed result comes from object tracking tied to IP SLA, not from this mechanism.
2. The schedule activates an already-defined IP SLA operation and controls when and how long it runs. The required outcome is to make route behavior follow the result of an IP SLA reachability test; IP SLA schedule addresses another function. This option targets another layer while object tracking tied to IP SLA controls the outcome.
3. The SPAN destination is the analyzer-facing port to which the switch sends replicated packets from the configured source. Make route behavior follow the result of an ip sla reachability test is the controlling need; SPAN destination interface operates elsewhere in the workflow. The scenario calls for object tracking tied to IP SLA; changing this feature would not help.
4. A track object can consume IP SLA reachability state so routing or gateway behavior changes when the measured path fails. object tracking tied to IP SLA fits because the design must make route behavior follow the result of an IP SLA reachability test.

• < Cisco CCNP 350-401 ENCOR Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog Practice Test 2
• Cisco CCNP 350-401 ENCOR Flexible NetFlow, SPAN/RSPAN/ERSPAN, and IP SLA Practice Test 2 >