NEW QUESTION 1
Which in-depth approach is used when deploying defense in an industrial zone?

• A. Besides using a dedicated firewall / DMZ construction use an IOS based firewall on the WAN router connecting the industrial site to the Internet.
• B. Use NTP to make sure that time stamps of log messages are synchronized such that you can do root cause analysis.
• C. Deploy an IDS solution with knowledge about industrial protocols in the industrial zone in combination with a firewall.
• D. Use multiple firewalls from different vendors in such a way that network traffic will have to traverse both firewalls so that security holes of one firewall is caught by the other firewall.

Answer: C

NEW QUESTION 2
A cookie cutter machine requires 2 standard controllers and a safety controller. All of these controllers and machine level I/O have been placed on VLAN 104. Both standard controllers must monitor a photocell on this machine. Which IP address is used to transfer this status information?

• A. 10.17.104.16
• B. 192.168.1.16
• C. 239.192.3.16
• D. 239.192.254.16

Answer: C

NEW QUESTION 3
Which three network mechanisms can be used for securely segmenting an industrial network? (Choose three)

• A. VLANs
• B. OSPF
• C. REP
• D. VRFs
• E. Firewalls
• F. Spanning-tree

Answer: ADE

NEW QUESTION 4
Which is an issue with running CIP Motion on a REP network and identifies an alternate resiliency protocol that works for CIP Motion?

• A. CIP Motion requires a star topology which is not supported by RE
• B. DLR is a suitable resiliency protocol for CIP motion.
• C. REP convergence is not fast enoug
• D. DLR is a suitable resiliency protocol for CIP motion.
• E. CIP Motion requires a star topology which is not supported by RE
• F. RPVST+ is a suitable resiliency protocol for CIP motion.
• G. REP convergence is not fast enoug
• H. RPVST+ is a suitable resiliency protocol for CIP motion.

Answer: B

NEW QUESTION 5
Which five are characteristics that describe Cisco Industrial switches? (Choose five)

• A. Din rail mount
• B. 19 inch rack mount
• C. Fanless
• D. Fans
• E. Swappable SD flash card
• F. Alarm relay
• G. -5ºC to 45ºC operating environment
• H. ProfiNET conformance class C compliance

Answer: ABCEF

NEW QUESTION 6
Refer to the exhibit.

The control system depicted in the exhibit uses VLAN 300 for all of its device ports and PVST is enabled on each switch to switch connection. L2SW4 was inserted between L2SW3 and L2SW5. Links FO2 and FO3 were added and FO1 was disconnected.
Prior to the installation of L2SW4, PanelView was able to communicate with PLC#1. After the change, PLC#1 and PanelView are still able to communicate but neither PLC#1 or PanelView are able to communicate with I/O #1.
L2SW4# show run interfaces FastEthernet 1/1 description I/O#1
switchport access vlan 300 switchport mode access spanning-tree portfast
spanning-tree bpduguard enable
L2SW4# show interfaces trunk
Port Mode Encapsulation Status Native vlan Gi1/1 on 802.1q trunking 1 Gi1/2 on 802.1q trunking 1 Port Vlans allowed on trunk Gi1/1 1,3-9, 301-305,400 Gi1/2 1,3-9, 301-305,400 Port Vlans allowed and active in management domain Gi1/1 1,3-9, 301-305,400 Gi1/2 1,3- 9, 301-305,400 Port Vlans in spanning tree forwarding state and not pruned Gi1/1 1,3-9, 301-305,400 Gi1/2
Based on the output from the switch, what is preventing I/O#1 from communicating with PLC#1 and PanelView?

• A. Interface FastEthernet 1/1 on LWSW4 should be configured as a trunk port
• B. The trunks connecting L2SW4 to L2SW3 and L2SW5 have the wrong encapsulation type
• C. The trunks connecting L2SW4 to L2SW3 and L2SW5 don't allow VLAN 300 traffic
• D. BPDU guard has error-disabled interface FastEthernet 1/1 on LWSW4

Answer: C

NEW QUESTION 7
A ProfiNET management system operator is unable to see diagnostic information for a Cisco Industrial Ethernet switch that has been added to a SIMATIC management station. Based on the provided CLI output, which statement is correct?
switch# show profinet status State : Enabled
Vlan : 201
Id : IE2000-Switch Connected : Yes ReductRatio : 128
GSD version : Mis-match

• A. The assigned ProfiNET VLAN is not valid and should be less than 100
• B. LLDP has been disabled on this switch
• C. The GSD file version on the switch does not match the GSD file version on the management station
• D. The Reduction Ration has been set too low

Answer: C

NEW QUESTION 8
What is the reason that ProfiNET frames are discarded by default on Catalyst switches?

• A. ProfiNET uses a nonstandard Ethernet frame format
• B. The frames have an 802.1q tag with VLAN ID equal to 0 (zero)
• C. Catalyst switches do not support ProfiNET traffic
• D. A ProfiNET VLAN must be configured and enabled on a Catalyst switch

Answer: B

NEW QUESTION 9
A cookie cutter machine requires 2 standard controllers and a safety controller. All of these controllers and machine level I/O have been placed on VLAN 104. The safety controller must monitor an emergency stop connected to an I/O adapter on an adjacent machine (VLAN 105). Which packet type will be used?

• A. UDP Multicast TTL = 1
• B. UDP Multicast TTL = 2
• C. UDP Unicast
• D. TCP Unicast

Answer: C

NEW QUESTION 10
Refer to the exhibit.

L3SW1 has a spanning-tree priority of 8192 set on VLANs 1, 300, and 301, and these VLANs are configured on and trunked between all switches. Executing the command show spanning-tree blockedports on L2SW5 results in:
L2SW5# show spanning-tree blockedports Name Blocked Interfaces List
-------------------- ------------------------------------
VLAN0001 Gi1/1 VLAN0300 Gi1/1 VLAN0301 Gi1/1
An additional VLAN, VLAN302, is defined on all switches and trunked between them. VLAN302 access ports are set up on each of the switches and PLC#1, I/O#1, and the PanelView are attached. You expect the new VLAN to be listed as blocked on interface GigabitEthernet1/1 of L2SW5 but it is not. The three new devices are able to communicate with each other.
After executing the same command on all switches you see this output on L2SW4: L2SW4# show spanning-tree blockedports
Name Blocked Interfaces List
-------------------- ------------------------------------ VLAN0001 Gi1/2
VLAN0300 Gi1/2 VLAN0301 Gi1/2
Why is VLAN302 forwarding on L2SW5 interface GigabitEthernet 1/1 and L2SW4 interface GigabitEthernet 1/1 and 1/2?

• A. VLAN302 is not configured in the VLAN database on L2SW5
• B. VLAN302 is not in the allowed list on the L2SW5 interface GigabitEthernet1/1 trunk
• C. L2SW4 is the spanning tree root for VLAN 302
• D. The FO3 fiber-optic cable between L2SW4 and L2SW5 is damaged

Answer: C

NEW QUESTION 11
Which CLI command will display IGMP snooping information in a Cisco IE2000 or Stratix 5700 switch?

• A. switch#show snooping ip igmp
• B. switch#show igmp snooping
• C. switch#show ip igmp snooping
• D. switch#show ip snooping

Answer: C

NEW QUESTION 12
To ensure ProfiNET Layer 2 Class-of-Service markings from ProfiNET devices are trusted by the switch, which command must be entered on the interface attached to the device?

• A. switch(config-if)#mls qos trust cos
• B. switch(config-if)#qos trust cos
• C. switch(config-if)#profinet cos trust
• D. switch(config-if)#trust qos cos

Answer: A

NEW QUESTION 13
Which statement is correct regarding ProfiNET communication classes?

• A. ProfiNET-RT traffic is carried in UDP and TCP packets
• B. ProfiNET-NRT is used to carry time critical status information
• C. ProfiNET-IRT requires switches with hardware time scheduling capabilities
• D. ProfiNET-NRT is prioritized as Layer-2 Class-of-Service 1 (CoS 1)

Answer: C

NEW QUESTION 14
Refer to the exhibit.

SW1, SW2 and virtual switch are connected in a loop. SW1 and SW2 are standard layer-2 switches. Which loop prevention mechanism is best suited for use within this topology?

• A. Per-VLAN Rapid Spanning Tree Protocol+
• B. End-Host Mode
• C. Multi-chassis EtherChannel
• D. BPDU Guard

Answer: B

NEW QUESTION 15
Which configuration enables an Industrial Ethernet switch to participate in PTP clock selection and sets the priority value that would break the tie between switches with matching default criteria to 50?

• A. ptp mode boundary ptp priority1 10ptp priority2 50
• B. ptp mode boundary ptp priority1 50ptp priority2 10
• C. ptp mode e2etransparent ptp priority1 50ptp priority2 10
• D. ptp mode e2etransparent ptp priority1 10ptp priority2 50

Answer: A

NEW QUESTION 16
Which selection is a reason why IGMP snooping should be configured on a switched network?

• A. IGMP snooping populates the snooping table with the results of DHCP requests and can be used by Dynamic ARP Inspection to block IP spoofing attacks at Layer-2.
• B. IGMP snooping verifies the source IP address of every IPv4 packet to ensure that it hasn't been originated from a port different than its return path.
• C. IGMP snooping is used to filter ping requests and results to avoid overflowing the MAC address table of the switch.
• D. IGMP snooping allows a Layer-2 switch to limit the transmission of multicast frames to only the ports that have members of the relevant IGMP group.

Answer: D