Tài liệu TestKing''''s Cisco Internetwork Troubleshooting Version 9.1 pdf

Answer: D QUESTION NO: 10 A network administrator has determined that a problem exists in the transport layer.. Answer: B, D Incorrect answers: A - there can only be one media type p

642-831 (CIT®)

TestKing's Cisco® Internetwork Troubleshooting

Version 9.1

For this test TestKing plans to provide:

* Study Guide Concepts and labs Provides a foundation of knowledge

* Online Testing Practice the questions in an exam environment

Try a demo: http://www.testking.com/index.cfm?pageid=724

Latest Version

We are constantly reviewing our products New material is added and old material is revised Free updates are available for 90 days after the purchase You should check your member zone at TestKing an update 3-4 days before the scheduled exam date

Here is the procedure to get the latest version:

1 Go to www.testking.com

2 Click on Member zone/Log in

3 The latest versions of all purchased products are downloadable from here Just click the links

For most updates, it is enough just to print the new questions at the end of the new version, not the whole document

Note:

Section A contains 72 questions

Section B contains 125 questions

The total number of questions is 197

Each section starts with QUESTION NO :1 There are no missing questions

Section A

QUESTION NO: 1

Which troubleshooting tool is included in Cisco Connection Online (CCO)?

A Cisco Technical Information Center (TIC) web site

B Cisco Technical Assistance Center (TAC) web site

C Cisco Center for Assisted Troubleshooting (CAT) web site

D Cisco Internetworking Troubleshooting Center (ITC) web site

Answer: B

Explanation: this is an obvious question as this is the name of the cisco technical assistance web site To me

this is an easy question and no problem to verify as I did by going to the Cisco site just to be thorough

Explanation: This is a Cisco recommended technique for troubleshooting and it is a good way none-the-less I

have designed digital electronics in a previous career and this is the quickest way to get to the root of the

problem Any other way would simply be a waste of time If you go to this site you will see that this is precisely the way Cisco recommends to troubleshoot an issue They dissect it which is divide and conquer all the way

Example:

http://www.cisco.com/en/US/products/hw/routers/ps352/products_installation_and_configuration_guide_chapter09186a008007e1d1.html#21487

QUESTION NO: 3

What does a logical layered network model allows a troubleshooter to do?

A Focus on physical layers to isolate a problem

B Focus on specific elements to isolate a problem

C Focus on physical, data link and network layers to isolate a problem

D Focus on transport and application layers to isolate a problem

Answer: B

Explanation:

I use the previous example as well here

You must focus on specific elements or you will never isolate the problem (s)

http://www.cisco.com/en/US/products/hw/routers/ps352/products_installation_and_configuration_guide_chapter09186a008007e1d1.html#21487

QUESTION NO: 4

Match the correct stage to its description for the process of creating network documentation

Answer:

Explanation: To me this only makes sense as well

Login: means login no need for further info (silly description)

Interface discovery: you need to find out as much about the connections as possible to construct a cogent

theory of what you wish to accomplish,

Document, If you have this then you are in good shape and can “see” a network diagram but for a lot of areas

you must do this yourself and the result will be a more thorough understanding of the issues and the processes

to solve them

Diagram: This applies to my previous answer in that you will need to add any new info to the current (if any)

diagrams you have

Device discovery: To check out any relevant devices that pertain to the issue is always a necessary step But

after seeing that you have inadequate documentation you may want to proceed to get this situation together asap So this is ALWAYS a necessary step, even if you do not have any issues at all this should have been done

If you go to this url you will find that I am right though you will have to dig some to get it all:

http://www.cisco.com/en/US/products/hw/switches/ps2246/prod_troubleshooting_guide_chapter09186a00800ea8aa.html#45390

QUESTION NO: 5

Users report slow response time for TestKing's Intranet web server While trying to isolate the problem, you find that attempts to use ping and tracert to reach the server’s IP address are unsuccessful You are able to successfully Telnet to the server, although the response is very slow At this point, what

assumptions can you make from the results of your attempts to further isolate the problem? (Choose three)

A Divide and conquer troubleshooting approach should be taken

B Physical layer issues have been eliminated as a possible cause of the slow response

C The IP address configuration has been eliminated as a possible cause of the slow response

D ICMP may be blocked by an access list somewhere on the path between the users and the Intranet web server

E TCP may be blocked by an access list somewhere on the path between the users and the Intranet web server

F Application layer issues have been eliminated as a possible cause of the slow response

Answer: C, D, F

Explanation: First off if you can telnet then you have talked via an application layer until so you do not have an

application layer issue

Second you could not telnet without ip so this is good, at least at the device itself This would not totally explain slowdowns but we will put that aside for now

Icmp could definitely be blocked as ping and tracert use this protocol

To the other answers:

You do not know if the physical layer is good as this is a slowdown issue at least initially, so you know that there is connectivity but this does not mean there are no physical layer issues There could be lots of data being transferred at this time, a router or switch could have lost a connection (cable) and you are talking through an alternate route thus the slowdown There could be other things as well Too many to list here

TCP blocked: This could not be or ther would be NO ACCESS instead of slow access to the users

This is all you can know at this point without further investigation but this should be a simple issue to fix

B Document a policy

C Gathering symptoms

D Correcting the problem

E Isolating the problem

B Switch error logs

C Server event logs

D Client patch levels

E Recent configuration changes

Answer: A, B, E

QUESTION NO: 9

Which action should you consider when implementing an action plan?

A Document the topology of the network

B Delete access lists on routers to isolate traffic

C Create troubleshooting steps as needed during the process

D Restore your network to a known previous state if the action item does not solve the problem

Answer: D

QUESTION NO: 10

A network administrator has determined that a problem exists in the transport layer

Which two of the following network devices should the administrator focus on to isolate the problem? (Choose two)

Which two are troubleshooting targets for connection-oriented protocols? (Choose two)

A Verify time-to-live fields

B Verify protocol numbers

C Verify sequence numbers

D Verify acknowledgment numbers

A Stop making changes and return to the Gathering Symptoms stage

B Continue to make changes, documenting each change as it is made until the problem is corrected

C Undo all changes, returning the device to their known initial state

D Perform a core dump to send to Cisco technical support for analysis

0x1 MS TCP Loopback interface

0x1000003 00 d0 09 f4 32 a0 NDIS 5.0 driver

===========================================================================

=========================================================================== Active Routes:

Network Destination Netmask Gateway Interface Metric

Default Gateway: 172.16.26.1

=========================================================================== Persistent Routes:

What information should be included in a network topology diagram? (Choose two)

A Location of configuration files

B Speed and duplex of individual switch ports

C Illustrations of each network device

D Representations of logical and physical connections

E Individual end user systems

QUESTION NO: 17

Exhibit:

The exhibit illustrates the output of a command used to troubleshoot data-link targets

Which command generated this output?

A show cdp neighbor

B show cdp neighbor detail

C show interfaces serial 0/1

D show interfaces serial 0/1 summary

Answer: B

QUESTION NO: 18

What does P in a trace output mean?

A The port us unreachable

B The PSTN is unreachable

C The packet is unreachable

D The protocol is unreachable

Answer: D

The capital letter P is the message for protocol unreachable

See URL:

Which two steps should be taken when troubleshooting external router connections to switches

supporting inter-VLAN routing? (Choose two)

A Verify the correct media-type statement for each VLAN subinterface

B Verify that the subinterface for each VLAN has the correct IP address

C Ensure that the correct IP address if configured on the main interface

D Ensure that the full duplex setting on the main router interface matches that on the switch port

Answer: B, D

Incorrect answers:

A - there can only be one media type per physical interface

C - the main interface (fasteth 0/0 for example) is to be left un-numbered

A At the end of the day

B At the end of the month

C At the end of the year

D At the time changes are applied

E Before making any changes

Answer: D

Explanation:

This is correct per:

http://www.cisco.com/en/US/products/hw/univgate/ps509/products_configuration_example09186a008009 4148.shtml

Specifically Notes:

• Ensure logging is not turned on for the line from which you are collecting output (use the show logging command)

This states that you are getting info from a particular line and as a result this would allow you to find out if you had duplicate ip addresses

QUESTION NO: 24

Switch>show version

Cisco Internetwork Operating System Software

IOS(tm)C2950 Software(C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE(fc1)

Copyright(c) 1986-2002 by cisco Systems, Inc

Compiled Web 28-Aug-02 10:25 by antonino

Image text-base: 0x80010000, data-base: 0x80528000

ROM: Bootstrap program is CALHOUN boot loader

Switch uptime is 8 hours, 34 minutes

System returned to ROM by power-on

System image file is “flash:/c2950-i6q412-mz.121-11-EA1.bin”

cisco WS-C2950-24 (RC32300) processor (revision G0) with 20402K bytes of memory

Processor board ID FHK0645Z0TE

Last reset from system-reset

Running Standard Image

24 FastEthernet/IEEE 802.3 interface(s)

32K byes of flash-simulated non-volatile configuration memory

Base ethernet MAC Address: 00:0B:5F:4D:77:80

Motherboard assembly number: 73-5781-11

Power supply part number: 34-0965-01

Motherboard serial number: F0C064507AL

Power supply serial number: PHI0638059E

Model revision number: G0

Motherboard revision number: A0

Model number: WS-C2950-24

System serial number: FHK0645Z0TE

Configuration register is 0xF

Switch>

Examine the output of the show version command

Which of the following pieces of information can be discovered about the network configuration of this switch? (Choose two)

A Spanning-tree version

B Model of the device

C MAC addresses of any interfaces or ports

D Active routing protocol

Which two problems might produce this set of symptoms? (Choose two)

A Incorrect default gateway configured on the new PCs

B Incorrect default gateway configured on the intranet web server

C Incorrect routing protocol configuration on the remote site router

D Incorrect routing protocol configuration on the router connected to the subnet where the intranet web server is installed

Answer: A, C

QUESTION NO: 26

What are the components that should be included in an End-system Topology Diagram? (Choose four)

B Bundle idle time out

C Bundle flapping record

D Bundle disconnect reason

Answer: A

QUESTION NO: 29

Which command is used to display active TCP/IP connections on a Microsoft Windows end system?

A Streaming video players

B Email clients

C Internet browsers

D IPTV multicast applications

E Calendar software clients

What should you check next?

QUESTION NO: 35

Which type of network documentation would contain a list of high-bandwidth applications?

A A network topology diagram

B An end-system topology diagram

C A network configuration table

D An end-system configuration table

Which two statements about EIGRP are true? (Choose two)

A EIGRP routers maintain en EIGRP Neighbor Table and an EIGRP Topology table

B On Ethernet (Broadcast) networks, EIGRP routers only establish adjacencies with the DR and BDR

C An EIGRP route will be in the active state if it lost the successor and no feasible successor is available

D EIGRP triggered updates are flooded to every EIGRP router within the EIGRP AS

Answer: A, C

QUESTION NO: 38

You have diagnosed a Frame Relay issue as a flapping link

Which two problems could cause this condition? (Choose two)

A Too much line noise

B Improperly configured keepalives

C Mismatched encapsulation types

D Improperly configured IP addresses

QUESTION NO: 40

You are having difficulty reaching a remote network or host Someone at the remote end pings your router to assist you in troubleshooting

You want to view the output of the pings being sent to you

Which IOS command should you use on your router?

A show icmp traffic

B show icmp ip ping

C debug icmp ip ping

D debug ip icmp traffic

Answer: D

Is closest: debug ip icmp

Not one of these commands exist But as stated previously “D” is the closest.

QUESTION NO: 41

A performance problem on a TCP/IP network has been isolated above the data link layer

Which command will display information about TCP events such as state changes, retransmissions, and duplicate packets?

The correct answer is “C”

Check this site for proof:

http://www.cisco.com/en/US/tech/tk870/tk136/tk885/technologies_configuration_example09186a00801b777e.shtml

QUESTION NO: 42

Which two criteria does a standard access-list use? (Choose two)

A Full MAC address only

Mar 23 12:10:20 %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to down

Mar 23 12:10:20 %DUAL-5-NBRCHANGE: IP-EIGRP 101: Neighbor 172.21.177.1 (Serial1/0) is down: interface down

C show frame-relay lmi

D show frame-relay fecn and show frame-relay becn

Answer: B

QUESTION NO: 45

After implementing and testing a network change what is the next step?

A Gather statistics

B Identify the affected network layer

C Compare the result to the baseline

D Document the solution

Answer: D

QUESTION NO: 46

A Catalyst 2500 series switch has been attached to a Cisco 2600 series router that will perform inter-vlan routing for devices connected to the switch Reports indicate that the routing between vlans is not taking place

What may be a possible cause for this?

A Interface Ethernet 0 on the Cisco 2600 does not have the speed and duplex manually set

B Trunking using ISL has not been enabled on the Catalyst 2950

C Trunking using IEEE 802.1q has not been enabled on the Cisco 2600

D Sub-interfaces have not been configured on the Catalyst 2950

Answer: C

Reference:

http://www.cisco.com/en/US/tech/tk389/tk390/technologies_configuration_example09186a00800949fd.sht ml#c2600

C debug ip arp events

D debug ip arp packets

Answer: A

“A” is the only answer that is correct The other commands do not exist

QUESTION NO: 48

What should you do to minimize debug output?

A Apply an access list to contain the focus

B Apply service timestamps to sort messages

C Configure the router to run optimum switching

D Only debug packets when using this command

At which TCP/IP model layer would you begin your troubleshooting process?

A Network interface

In which two ways are Topology Diagrams and Network Configuration Tables similar? (Choose two)

A Both share few components

B Both are used for troubleshooting

C Both use lines and symbols to represent network components

D Both share many of the same components

E Both define physical memory components

Answer: B, D

QUESTION NO: 57

RouterTestK#show interface fas0/1

FastEthernet0/1 is up, line protocol is up

Hardware is Fast Ethernet, address is 0005.7428.0e01 (bia 9995.7428.0e01)

MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s

input flow-control is off, output flow-c control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:33, output 00:00:03, outgoing hang never

Last clearing of “show interface” counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queuing strategy: fifo

Output queue:0/40 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

371 494 packets input, 29182104 bytes, 0 no buffer

Received 371379 broadcasts, 63459 runts, 0 giants, 0 throttles

119899 input errors, 56440 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 371374 multicast, 0 pause input

0 input packets with dribble condition detected

929 671 packets output, 69998797 bytes, 0 underruns

0 output errors, 0 collisions, 2 interface resets

0 babbles, 0 late collisions, 0 deferred

0 lost carried, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

A new workstation is connected to the switch The workstation seems to be very slow compared to other workstations connected to the same switch accessing the same server From the output of the show

interface command, what is the probable cause of the problem?

A Duplex mismatch issue

B Speed mismatch issue

Where is the output of debug and system error messages sent by default?

A Output is written to a Syslog server

B Output is sent to the console terminal

C Output goes to the remote console if logging is off

D Output configuration requires a TFTP server to write files

E Error logging automatically invokes debug output to the designated TFTP server

Answer: B

QUESTION NO: 59

How can a network administrator control the designation of the spanning-tree root bridge in a switched network?

A By raising the bridge ID on one switch

B By lowering the bridge priority on the desired switch

C By enabling uplink-fast on the ports of the desired switch

D By setting a lower MAC address on the designated switch

C Higher routing update overhead

D Lower routing update overhead

E No hop count limitation

QUESTION NO: 64

The output from the Cisco IOS show buffers command has a count of overruns

Where in the router would you most likely find the cause of the problem?

A The router bus

B The processor

C Shared NVRAM

D The route processor

E The interface hardware

Answer: E

QUESTION NO: 65

The MCP certified network technician at the TestKing1 office used a telnet session to load a

configuration file on the TestKing2 router Halfway through executing the configuration file the

technician lost the telnet session to the TestKing2 router Although the interface on the TestKing1 routers shows both line and protocol as being up, the technician cannot re-establish the telnet session, nor can he ping the TestKing2 router A call to the Network Administrator at the TestKing3 site confirms that the TestKing2 router is not accessible from the TestKing3 router either The interface on the TestKing3 router also indicates that the line and protocol are up

The TestKing company need an expert to resolve this problem They have hired you to fix this problem

It is your task to re-establish the IP connection from TestKing2 to TestKing1 and TestKing3 and to insure that routing updates are passed between the two routers The configuration on the TestKing1 and TestKing3 routers are locked Only show commands are available It would be necessary to discover the incorrect IP address that was sat by the technician and to correct the configuration to include the routing protocol and the correct IP addresses The task is complete when the routes are updated correctly on all routers Passwords for all routers are the same

Privileged mode password: testking

VTY password: testking

IP Addresses are shown below:

TestKing1

S0 10.16.15.10/24

TestKing2

1 Login with management PC to router Testking 3

2 show cdp neighbor detail (if this works layers 1 and 2 are ok)

3 read output and see neighbor address x.x.x.60

4 telnet to x.x.x.60 (telnet to Testking2)

(Telnet to Tetking 2 was suddenly disconnected or There was command show cdp neighbor

incorrect output (no address from neighbor) (2 questions with this same format and scenario)

5 show running config

6 there is no rip running, so do it

14 ip address 10.16.15.2 255.255.255.0 (note: the connection was lost from BOTH routers (testking 1 and

3 ) so this needs to be reset as well just to be sure)

15 exit

16 copy run start

QUESTION NO: 66

Which symptom will indicate if a network problem is in the physical layer?

A Output of a show ip interface brief command shows DOWN/DOWN

B The interface LED is amber on the affected device

C Pings succeed only a percentage of the time

D Output of show ip interface brief command shows UP/DOWN

Which troubleshooting method is being applied?

A Divide-and-conquer

B Bottom-up

C Top-down

D Experience based

Answer: C

Note: Perhaps as this person is going from the router down to the physical layer

QUESTION NO: 69

You work as a network administrator at TestKing.com A user reports slow response sending and

receiving email, and when browsing the Internet The out put of a ping command issued from user's PC indicates intermitted success and failures messages, when attempting to contact the email server A tracert to the corporate Internet gateway router shows high latency and occasional time out messages Which troubleshooting approach would be effective in determining the cause of the slow response time?

A Bottom-up approach

B Random access approach

C Divide and conquer approach

A network administrator at TestKing has determined that a problem exist in the transport layer

Which two of the following network devices should the administrator focus to isolate the problem?

C debug ip arp events

D debug ip arp packets

Explanation: Because metrics for different protocols cannot be directly compared, you must specify the default

metric in order to designate the cost of the redistributed route used in RIP updates All routes that are

redistributed will use the default metric

Reference: RIP and OSPF Redistribution

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/cs001.htm

QUESTION NO: 3

You have issued the command to display LMI type The display includes the following

-

LMI enq sent 2, LMI stat recvd 0, LMI upd recvd 0, DTE LMI up

LMI enq recvd 0, LMI stat sent 0, LMI upd sent 0

LMI DLCI 0 LMI type is (output omitted) frame relay DTE

Which LMI type is used on this interface?

Explanation: LMI type Q933 must use DLCI 0

(Whereas LMI type Cisco uses DLCI 1023)

Note: Only three LMI types can currently be used These are ANSI T1.617, Cisco, and ITU-T Q.933

The syntax of the command that sets the lmi type is:

frame-relay lmi-type {ansi | cisco | q933a}

Reference: Configuring Frame Relay

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/wan_c/wcdfrely.htm

Incorrect Answers

A, B: IETF or IEEE ore not valid LMI types

D: DLCI 0 is not used for LMI type Cisco

PVC Statistics for interface Serial0 (Frame Relay DTE)

dlci = 145, dlci USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0

<Etc – rest of output deleted>

Incorrect Answers

A: The show interfaces command is too general to be used for this purpose

B: The show frame-relay lmi command displays LMI statistics However, the output does not include any

LMI DLCI number

D: There is no such command

QUESTION NO: 5

You have diagnosed a Frame Relay issue as a flapping link Which two problems could cause this

condition? (Choose two.)

A faulty cable

B improperly configured keepalives

C mismatched encapsulation types

D improperly configured IP addresses

Answer: A, C

Explanation: Link flapping refers to losing and re-gaining link

A: Link flapping can be an indication of a physical error (A), for example a faulty cable

C: Trunking changes the formatting of the packet The ports need to be in agreement as to what format they are

using on the link or they will not understand each other Mismatched encapsulation types can cause link flapping

Note: Typical causes of link flapping on a switch port include:

• Speed/duplex mismatch

• Faulty cable/loose connector

• Faulty NIC or other end station problem

• Faulty switch port

• Other misconfiguration

Reference: Troubleshooting Switch Port Problems

http://www.cisco.com/warp/public/473/53.shtml

QUESTION NO: 6

Exhibit

Which statement is true about the debug ppp negotiation shown in the exhibit?

A This shows the debug information for PPP PAP authentication

B The local router sent out the termination request to disconnect the link

C You should check to see if the passwords on the two sides are identical for this authentication to

succeed

D Only the remote router is trying to authenticate the local router, the local router does not request

authentication to the peer

Answer: C

Explanation: The exhibit shows a PPP authentication attempt, which uses a three-way handshake with CHAP

The threeway handshake fails however The PPP partners does not agree on the password

Note the “MD/DES compare” line This is a password issue as the encryption verification failed This does not mean the encryption does not match as much as the comparison could not be made So the first thing you would

do is check the passwords to make sure they are identical

Incorrect Answers

A: CHAP is used not PAP

B: This is a PPP authentication using CHAP, not a termination request issued by the local router

D: The local router is not involved in the authentication process

QUESTION NO: 7

Users are reporting that they’re not able to browse the Internet What step might you take to determine that the clients are resolving the correct address from the DNS server?

A ping the DNS server

B run a trace route to the DNS server

C browse to the IP address of the web server

D release and renew the DHCP address on the client

Answer: C

Explanation: If it is possible to browse the web server by IP address and not by host name, we would know

that we have a name resolution problem

Note: You can do this with ping as well The answer to this could be “A” too You can ping with the ip address

or the dns name thus testing both scenarios with one utility But the MOST right answer would seem to be “C” for your first step

Incorrect Answers

A: Pinging the DNS server only checks if the DNS is reachable, not whether the client has the correct name

resolution configuration

B: A trace route to the DNS server will only check if the DNS server is reachable (and which route was used),

not whether the client has the correct name resolution configuration

D: Renewing the IP configuration on the client would not helpin this scenario

QUESTION NO: 8

With VLAN translation, a Catalyst 5000 can forward frames between which pair of protocols?

A ISL to VTP

B HSRP to HDLC

C Fast Ethernet to 802.10 FDDI

D ARPA encapsulation to SNAP

Answer: C

Explanation: VLAN translation is able to work between Fast Ethernet and 802.10 FDDI

Reference: Catalyst 5000, Product Overview

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_2_1/sccrc5k/prodover.htm

Incorrect Answers

A: VLAN Trunk Protocol (VTP) is not an encapsulation protocol

B, D: VTP requires a protocol type (Ethernet, FDDI, or Token Ring) to be configured for each VLAN

QUESTION NO: 9

Which two statements about VTP domains are true? (Choose two.)

A A switch can support up to 1024 VTP domains

B Many switches can be in the same VTP domain

C A VLAN can participate in up to 16 VTP domains

D VLAN configurations remain consistent within a VTP domain

A: A switch can be configured to be in one and only one VTP domain

C: A VTP domain is a VLAN management domain A VLAN cannot participate in several VTP domains

QUESTION NO: 10

After a minor router configuration change, users complain that they are not getting any email from the Internet, yet they can still browse the Web What is the likely cause of the problem?

A IP RIP filters

B IP access list is misconfigured

C IPX encapsulation conflicts with IP

D Buffer size are configured too small

E EIGRP is not configured on the WAN interface

Answer: B