Notice the wildcard mask here for the /21 – in binary it is: 00000000.00000000.00000111.11111111
REFERENCE: http://www.subnet-calculator.com/subnet.php?net_class=B

The network hierarchy consists of Sites, Buildings, and Floors. Sites can contain other sites. Be sure to spend some time with the sandbox DNA center that is available from Cisco DevNet.
Reference: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3/user_guide/b_cisco_dna_center_ug_1_3/b_cisco_dna_center_ug_1_3_chapter_0110.html

Traffic policing can be a single or dual rate. It can also involve three actions or colors. These are dropping, remarking, or sending.
Reference: https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html

The collinear and dipole are both examples of omnidirectional antenna.
Reference: https://www.cisco.com/c/en/us/products/collateral/wireless/aironet-antennas-accessories/prod_white_paper0900aecd806a1a3e.html

The overload keyword is an easy indicator for the presence of PAT in the NAT configuration. For example: 
ip nat inside source list 1 interface gi0/0 overload
Reference: https://www.cisco.com/c/en/us/support/docs/long-reach-ethernet-lre-digital-subscriber-line-xdsl/asymmetric-digital-subscriber-line-adsl/12905-827spat.html

Before adding a new node to the cluster, be sure that all the installed packages are deployed on the primary node. You can check this by using SSH to log in to the primary node‘s Cisco DNA Center Management port as the Linux User (maglev) and then running the maglev package status command. All the installed packages should appear in the command output as DEPLOYED.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3-3-0/install_guide/2ndGen/b_cisco_dna_center_install_guide_1_3_3_0_2ndGen/b_cisco_dna_center_install_guide_1_3_2_0_M5_chapter_0100.html

There are actually four data measurements given. There is per-direction jitter, per-direction packet-loss, per-direction delay, and the round-trip delay.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipsla/configuration/xe-16/sla-xe-16-book.html

Ansible is known for its simplicity and the fact that it is clientless and uses a push model. Ansible relies on SSH to send automation instructions to remote nodes.
Reference: https://www.ansible.com/resources/get-started

All of these are valid roles within the LISP architecture. The Ingress Tunnel Router (ITR) has the job of locating the correct mappings when receiving requests that are destined for the LISP site.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_lisp/configuration/xe-3s/irl-xe-3s-book/irl-overview.html

If both VRRP routers are configured with the priority of 100, the virtual router backup with the higher IP address is elected to become the virtual router master.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/xe-3se/3850/fhp-xe-3se-3850-book/fhp-vrrp.pdf

“The access point starts sniffing the air on a given channel. It captures and forwards all the packets from the clients on that channel to a remote machine that runs Airopeek or Wireshark (packet analyzers for IEEE 802.11 wireless LANs). It includes information on the time stamp, signal strength, packet size, and so on.“
Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-2/configuration/guide/cg/cg_lwap.html

Many Cisco switches support three options for the configuration of a LAG (EtherChannel). These options are manual (ON mode); LACP and PAgP.
REFERENCE: https://community.cisco.com/t5/wireless-mobility-documents/lag-link-aggregation/ta-p/3128669

101 110 are the markings for DSCP for EF traffic. This has a value of 46.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0/qos/configuration/guide/nexus1000v_qos/qos_6dscp_val.pdf

Some tests require the target to feature the IP SLA Responder feature. Note that many tests do not require this and the target can be any IP host on the network.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipsla/configuration/15-mt/sla-15-mt-book/sla_overview-0.html

REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/15-mt/irg-15-mt-book/irg-external-sp.html#GUID-C62D6C7A-BE13-493C-9BFB-171CBAE04627

The SNR is a calculation from the transmit power (or desired signal) and the noise floor. SNR calculations can be either simple or complex, and it depends on the devices in question and your available data.
REFERENCE: https://resources.pcb.cadence.com/blog/2020-what-is-signal-to-noise-ratio-and-how-to-calculate-it

Ansible is agentless. It does not need to install special software on the managed node. SSH is required to access and configure the remote device. REFERENCE: https://docs.ansible.com/ansible/latest/user_guide/connection_details.html

Security Group Tags in Cisco TrustSec offer many flexible methods of categorization and segmentation.
REFERENCE:   https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Segmentation-Design-Guide-2018MAY.pdf

Here the traffic to filter is TCP. The source of the traffic is the subnet 10.10.10.0/24. Note the use of the host keyword to simplify the destination definition. Here we specify the 443 (HTTPS) port on the webserver to be granular with the permissions.
REFERENCE: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html

“Before provisioning the template, ensure that the templates are associated with a network profile and the profile is assigned to a site.“
Reference: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3/user_guide/b_cisco_dna_center_ug_1_3/b_cisco_dna_center_ug_1_3_chapter_0111.html

Low Latency Queuing is the most modern congestion management approach in DiffServ. It uses a strict PQ for VoIP in a CBWFQ structure. The CBWFQ provides service for the many other forms of traffic.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_conmgt/configuration/xe-3s/qos-conmgt-xe-3s-book/qos-conmgt-llq-pps.pdf

In layer 3 roaming, the original controller marks the client with an “Anchor” entry in its own client database. The database entry is copied to the new controller client database and marked with a “Foreign” entry in the new controller.
Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/overview.html

Remember, REST APIs are protected with HTTPS. Two potential protocols, therefore, are AES and SHA-384.
Reference: https://en.wikipedia.org/wiki/Transport_Layer_Security

In this case, the device returns a 401 error – this error indicates that the user is unauthorized.
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/ftd-api/guide/ftd-rest-api/auth-ftd-rest-api.pdf

This regular expression matches those AS paths that begin (far right) with AS 65000. This position in the AS path indicates the prefix originated from that AS.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/15-mt/irg-15-mt-book/irg-external-sp.html#GUID-BDECC44A-630D-4E5B-9FEC-7FC4ACE6130F

This is the results of the show debugging condition command. You can define conditions to restrict debug output. REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/debug/command/a1/db-a1-cr-book/db-c1.html

This JSON syntax is missing commas after the key-value pairs.
REFERENCE: https://www.w3schools.com/js/js_json_syntax.asp

While not necessarily recommended, you can mix and match configuration styles with OSPF. For example, your local router can use the network command, while the remote router can use the interface-level configuration.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-15-sy-book/iro-imode-ospfv2.html

When using RSPAN, the monitor session destination at the mirrored traffic location is the remote SPAN VLAN. Remember, you must create this VLAN in your topology. It is a special purpose VLAN for RSPAN.
At SW3, the monitor session source is the RSPAN VLAN and the destination is the protocol analyzer port.
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/span.html

“A Yagi–Uda antenna, commonly known as a Yagi antenna, is a directional antenna consisting of multiple parallel elements in a line, usually half-wave dipoles made of metal rods. Yagi–Uda antennas consist of a single driven element connected to the transmitter or receiver with a transmission line, and additional “parasitic elements“ which are not connected to the transmitter or receiver: a so-called reflector and one or more directors.“
Reference: https://www.cisco.com/c/en/us/products/collateral/wireless/aironet-antennas-accessories/prod_white_paper0900aecd806a1a3e.html

VXLAN is the data plane technology chosen for the SD-Access solution. Note that it is actually VXLAN will several modifications to accommodate the components of the SD-Access solution. LISP serves at the control plane, while CTS (Cisco TrustSec) is the policy plane.
Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html

The tough one here might be the OMP routing protocol which is used in the SD-WAN solution. Note that BGP is often considered a path vector protocol.
Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#OrchestrationPlane

Time ranges are most often used in ACL configurations that need to be tied to time. Other uses include port settings, 802.1X configs, and time-based PoE.
Reference: https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-small-business-300-series-managed-switches/smb5660-configure-time-range-settings-on-a-switch-through-the-comman.html

MACsec allows unauthorized LAN connections to be identified and excluded from communication within the network. In common with IPsec and TLS, MACsec defines a security infrastructure to provide data confidentiality, data integrity, and data origin authentication. By assuring that a frame comes from the station that claimed to send it, MACSec can mitigate attacks on Layer 2 protocols.
REFERENCE: https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/white-paper-c11-737544.html

The typical enterprise would be hard-pressed to achieve the levels of scalability that can be achieved in the cloud. In fact, the cloud enables flexible elasticity – permitting the dynamic scaling in or out of resources based on demand.
Reference: https://www.ibm.com/cloud/learn/benefits-of-cloud-computing

The Firepower Management Center (FMC) is the recommended tool, especially when multiple devices are to be managed. Local management of a single system is possible using the FDM, if desired.
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp1010/firepower-1010-gsg/ftd-fmc.html

Preemption is the default in VRRP and the priority value ranges from 0 to 255.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/xe-3s/fhp-xe-3s-book/fhp-vrrp.html

Traffic policing will often be set to drop traffic above a defined threshold. The dropped traffic will cause TCP retransmissions. REFERENCE: https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html

OSPF is a true link-state routing protocol. It uses a very strict hierarchical area structure that consists of a backbone and normal or special areas. EIGRP is a hybrid routing protocol that uses bandwidth and delay fro a composite metric.
Reference: https://www.kwtrain.com/blog/ospf-basics-pt1

Debugging are level 7 and are considered the least severe. Emergencies are level 0 and are the most severe.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html

“The Intent API is a Northbound REST API that exposes specific capabilities of the Cisco DNA Center platform. The Intent API provides policy-based abstraction of business intent, allowing focus on an outcome rather than struggling with individual mechanisms steps. The RESTful Cisco DNA Center Intent API uses HTTPS verbs (GET, POST, PUT, and DELETE) with JSON structures to discover and control the network.
Reference: https://developer.cisco.com/docs/dna-center/#!cisco-dna-center-platform-overview/cisco-dna-center-platform-overview

YANG is a standards based data modeling language used to create device configuration requests or the requests for operational (show command) data. It has a structured format similar to a computer program that is human readable. Several applications are available that can be run on a centralized management platform (for example a laptop) to create these configuration and operational data requests.
REFERENCE: https://www.cisco.com/c/en/us/support/docs/storage-networking/management/200933-YANG-NETCONF-Configuration-Validation.html

The none keyword indicates that no authentication is used.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-mt/sec-usr-aaa-15-mt-book/configuring_authentication.html

There are four post-infection technologies – Cognitive Threat Analytics, Device Flow Correlation, Cloud Indication of Compromise, and Endpoint IOC.
Reference: https://www.cisco.com/c/dam/en/us/products/collateral/security/amp-for-endpoints/white-paper-c11-740980.pdf

RESTCONF uses structured data (XML or JSON) and YANG to provide a REST-like APIs, enabling you to programmatically access different network devices. RESTCONF APIs use HTTPs methods.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/prog/configuration/169/b_169_programmability_cg/restconf_programmable_interface.html

You can use object tracking to incorporate the status of an interface in the HSRP calculations. For example: standby 10 track 1 decrement 20 In this configuration, there could be an object tracker (ID 1) that is tracking the interface status. Downing of the interface decrements priority by 20.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-mt/iap-15-mt-book/iap-eot.pdf

These APs will still use CAPWAP tunnels to the WLC. They will be in local mode. They will directly connect to the fabric edge node. These APs can still honor the access and QoS policies like normal.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html

Note that RESTCONF is not really a replacement for NETCONF. It uses principles of NETCONF and adds the HTTP functionality. REFERENCE: https://tools.ietf.org/html/rfc8040

“A Cisco ISE node with pxGrid persona shares the context-sensitive information from Cisco ISE session directory with other network systems such as ISE ecosystem partner systems and Cisco platforms. The pxGrid framework can also be used to exchange policy and configuration data between nodes like sharing tags and policy objects. TrustSec information like tag definition, value, and description can be passed from Cisco ISE to other Cisco management platforms such as Cisco DNA Center and Cisco Stealthwatch.“
Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html

NTP relies upon UDP for its operation.
Reference: https://www.cisco.com/c/en/us/td/docs/iosxr/ncs560/timing-and-sync/70x/b-network-sync-70x-ncs560/implementing_ntp.pdf

Remember, the 200 codes are for various successes. The 400 codes involve client issues, while the 500 codes involve server-side issues. Here, the most likely code would be 401 – UNAUTHORIZED.
REFERENCE: https://restfulapi.net/http-status-codes/

“802.11r introduces a new concept of roaming where the initial handshake with the new AP is done even before the client roams to the target AP, which is called Fast Transition (FT). The initial handshake allows the client and APs to do the Pairwise Transient Key (PTK) calculation in advance. These PTK keys are applied to the client and AP after the client does the reassociation request or response exchange with new target AP. In a FlexConnect Deployment scenario, 802.11r BSS FT roaming is supported between APs within the same FlexConnect group. To enable seamless roaming, the 802.11r Key Cache is distributed to all the APs in the same FlexConnect Group. The Key Cache distribution is done by the WLC after the client device does the initial FT association through Central Authentication.“
REFERENCE: https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html

Remember, like policing under DiffServ, you use a class-map, policy-map, and service-policy approach to the configuration. Here, we use the show policy-map control-plane command to review the CoPP configuration.
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/control_plane_policing_copp.pdf

“If the AP is in Bridge mode, then the same Bridge mode is retained after the factory reset of the AP; if the AP is in FlexConnect, Local, Sniffer, or any other mode, then the AP mode is set to Local mode after the factory reset of the AP. If you press the Reset button on the AP and perform a true factory reset, then the AP moves to a cookie configured mode.“
Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/managing_aps.html

You can arrive at the two correct answers by eliminating the two options that are not correct. The RP can be configured manually, or with AUTO-RP or BSR. Also, note that PIM-DM did not use a concept of an RP.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/ip_multicast/White_papers/rps.html

The show ip vrf command displays three columns of information – Name, Default RD, and Interfaces.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mpls/command/mp-cr-book/mp-s2.html#wp3611153965

SSH is not a valid option here. SSH is for remote connections that are secure. All the other options listed are valid options for WLAN security.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-7/config-guide/b_cg87/wlan_security.html

Only traffic policing can be configured for inbound and outbound traffic flows.
Reference: https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html

The Active Virtual Gateway (AVG) is responsible for the load balancing, as well as how the load balancing will take place. This system can also simultaneously be an Active Virtual Forwarder (AVF) system.
Reference: https://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html

Most devices will default to a broadcast of the SSID for all clients to see.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-7/config-guide/b_cg87/wlans.html#ID72

vSmart – “This software-based component is responsible for the centralized control plane of the SD-WAN network. It maintains a secure connection to each WAN Edge router and distributes routes and policy information via the Overlay Management Protocol (OMP), acting as a route reflector. It also orchestrates the secure data plane connectivity between the WAN Edge routers by reflecting crypto key information originating from WAN Edge routers, allowing for a very scalable, IKE-less architecture.“
Reference: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html

This is the array data type. An array is an ordered collection of values. They begin with [ (left bracket) and end with ] (right bracket). The values are separated by , (commas).
REFERENCE: https://restfulapi.net/json-data-types/

“The keyword def introduces a function definition. It must be followed by the function name and the parenthesized list of formal parameters. The statements that form the body of the function start at the next line, and must be indented.“
Reference: https://docs.python.org/3/tutorial/controlflow.html#defining-functions

Option 43 in DHCP can carry the WLC IP address for the lightweight APs to call upon.
REFERENCE: https://www.cisco.com/c/en/us/td/docs/wireless/access_point/1000/installation/guide/1000hig4/1000h_f.pdf

The alternate port can quickly replace the root port in an event of a failure or other type of topology change in the network. This type of functionality had previously been provided to 802.1D thanks to the Cisco invention of UplinkFast.
Reference: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html