QUESTION NO: 1
According to the ITIL. v3 framework, what triggers an incident?
A. whenever a severity 3 incident is closed
B. when the problem is identified as urgent
C. when a problem is discovered during a change window
D. when an outage is called into a service center
Answer: D Explanation:
QUESTION NO: 2
According to the ITIL. v3 framework, what is the primary reason for implementing SLAs?
A. Ensure accurate measurement of response times.
B. Establish an open line of communication between the customer and the service provider
C. Reduce network latency.
D. Provide a legal contract between the customer and the service provider.
Answer: D Explanation:

QUESTION NO: 3
Each syslog message has a numerical severity level assigned to generate error messages about software or hardware malfunctions. Which of these messages has the highest numeric severity level?
A. Error
B. Emergency
C. Debug
D. Critical
E. Alert
Answer: C Explanation: QUESTION NO: 4



Which three of these methods can you use to back up a configuration running Cisco IOS Software Release 12.2 Mainline? (Choose three)
A. SNMP
B. SFTP
C. TFTP
D. KRON
E. SSH
Answer: A,C,D Explanation:
QUESTION NO: 5
A router is causing problems in the network and you want to capture as much information as you can before you manually reload or power-cycle the router. What command would you type at the CLI of the router to capture information that would be lost when the router is rebooted?
A. show crashinfo
B. show syslog
C. show tech-support
D. show stacks
E. show memory
Answer: C Explanation:

QUESTION NO: 6
Which three steps are best practices in accurately documenting a network? (Choose three).
A. Document separate Layer 2 and Layer 3 topologies.
B. Document Layer 3 topology to include all switches and routers.
C. Clearly document the port identifiers on all of the links.
D. Clearly depict different routing domains with appropriate information such as the routing protocol and process number.
E. Avoid defining router-id commands and loopbacks in the router label.
F. Use connectivity details of all layers of the OSI model in diagrams.

Answer: A,C,D Explanation:

QUESTION NO: 7
Which three steps would you use to troubleshoot a performance-related problem in the network core? (Choose three.)
A. define problem
B. analyze problem
C. determine affected users
D. create action plan
E. verify service-level requirements
Answer: A,B,D Explanation:

QUESTION NO: 8
Which two steps are best practices to be followed while documenting a network. (Choose two.)
A. Use proper icons for different devices in the network.
B. Use different colors and widths for denoting different links of different bandwidth.
C. Use same icons for all types of routers and switches in the network.
D. Avoid defining the router-id in the router label.
E. Use connectivity details of all layers of the OSI model in diagrams.
Answer: A,B Explanation:

QUESTION NO: 9
What is the advantage of using a passive monitoring technique?
A. does not require continuous measurement of traffic types
B. measures application-specific parameters per traffic classes
C. identifies issues and bottlenecks before they occur
D. no interference with live traffic

Answer: D Explanation:

QUESTION NO: 10
The command below was executed on a Cisco 12000 Series Router running Cisco IOS XR. Which statement is true about the output of the command?

A. 71.44.1.66 is an IP address local to the router.
B. OSPF is not running on this router.
C. There are no static routes in the routing table.

D. The last route entry for Loopback causes routing loops
Answer: C Explanation:

QUESTION NO: 11
According to the ITIL. v3 framework, after an incident is resolved and the root cause identified, what should be the next step?
A. Enter the problem in the problem management system and close the ticket.
B. Use functional escalation to escalate root cause analysis.
C. Update the closure categorization for the incident.
D. Record the root cause analysis in the known error database to identify and resolve potential incidents.
Answer: D Explanation:

QUESTION NO: 12
While looking at a Cisco CRS syslog, you see this message:
%ROUTING-FIB-1-FIBTBLINIT
Based on the message alone, should you consider it a high-priority message?
A. Yes, because router syslog messages require immediate action.
B. Yes, because the severity of the syslog message requires immediate action.
C. No, because router syslog messages are informational only.
D. No, because the severity of the syslog message is informational only.
Answer: B Explanation:

QUESTION NO: 13
According to the ITIL. v3 framework, how does problem management contribute to network availability?

A. by maintaining optimal levels of service quality
B. by developing and documenting workarounds to known problems
C. by providing inputs for calculating SLA penalties
D. by restoring normal service operation as quickly as possible

Answer: B Explanation:
QUESTION NO: 14

Refer to the Gigabit Ethernet link in the exhibit. Which of the following IP address schemes would allow for IP reachability across this link?
A. Router A with IP 10.1.1.0/31 to Router B with IP 10.1.1.1/31
B. Router A with IP 10.1.1.1/31 to Router B with IP 10.1.1.2/31
C. Router A with IP 10.1.1.7/30 to Router B with IP 10.1.1.8/30
D. Router A with IP 10.1.1.255/31 to Router B with IP 10.1.1.253/31
Answer: A Explanation:

QUESTION NO: 15
Which one of these items is used to define key elements for successfully building obtainable service levels?
A. critical success factors
B. key performance indicators
C. key quality indicators
D. metrics

Answer: A Explanation: QUESTION NO: 16



What action should you take if the NMS is receiving temperature alarms from a router?
A. Check the fan tray to ensure that all of the fans are functioning properly.
B. Check the line card to ensure that it is not generating excessive heat.
C. Check the interfaces to ensure that they are not generating excessive heat.
D. Check the grounding wire to ensure that it is attached properly.
Answer: A Explanation:
QUESTION NO: 17
According to the ITIL. v3 framework, what five characteristics can you use to identify effective KPIs? (Choose five.)
A. specific
B. agreed
C. realistic
D. budget-based
E. heuristic
F. time-based
G. measurable
H. Boolean
Answer: A,B,C,F,G Explanation:

QUESTION NO: 18
Which one of the following statements is true for syslog messages?
A. A syslog packet is limited to 1024 bytes.
B. Syslog messages use UDP port 520.
C. At the application layer, syslog sends acknowledgments.
D. Syslog is a peer-to-peer protocol.
Answer: A Explanation: QUESTION NO: 19



You are responsible for monitoring the IP network. You have noticed since the beginning of your shift that a particular interface on a network switch has been flapping, and it has finally gone down. You open an incident ticket. According to the ITIL. v3 framework, what should you do to determine if it is a recurring issue?
A. Use Telnet to connect to the device and troubleshoot.
B. Ping the device to verify connectivity.
C. Perform a search of the known-error database.
D. Clear the alarm from the event system to see if it recurs.
E. Clear the interface counters and see if additional errors are incurred
Answer: C Explanation:
QUESTION NO: 20
Which of these items enables an agent to notify the management station of significant events by sending an unsolicited message?
A. syslog message
B. SNMP trap
C. managed object code
D. RMON notification
Answer: B Explanation:


QUESTION NO: 21
When connecting to the console port, you see this message:
%SYS-2-MALLOCFAIL: Memory allocation of 1028 bytes failed from 0x6015EC84, Pool Processor, alignment 0
What two situations could cause this message? (Choose two.)

A. The router does not have the minimum amount of I/O memory to support certain interface processors.
B. The memory has fragmented into such small pieces that the router cannot find a usable available block.
C. The router has temporarily or permanently used all available memory.
D. The router ran out of "fast" memory, and will use its main DRAM instead.
Answer: B,C
Reference:http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a0 0800a6f3a.shtml#topic1


QUESTION NO: 22
An outage occurs in location "A" due to a router crash. This is not the first time that the router has had this problem. In fact, it crashed three times within the past 20 days. According to the ITIL. v3 framework, what type of record should be created to resolve this issue?
A. incident ticket
B. change ticket
C. service ticket
D. problem ticket
Answer: D Explanation:
QUESTION NO: 23
In troubleshooting a network incident, you found that the incident is the result of a known error. According to the ITIL. v3 framework, which of the following is an appropriate way to resolve the issue?
A. Understand the business case and get approval.
B. Fix the incident and open a request for change immediately.
C. Update the incident report with closure categorization.
D. Test it in the development environment.
Answer: B Explanation: QUESTION NO: 24



According to the ITIL. v3 framework, how would you prioritize an incident ticket?
A. based on the impact and urgency
B. based on the impact of the incident
C. based on customer urgency
D. based on the business unit
Answer: A
Reference:http://wiki.service-now.com/index.php?title=ITIL_Incident_Management#Prioritization_of_Incidents


QUESTION NO: 25
Which of these Microsoft Windows commands will allow you to look up the hostname for a given IP address?
A. ping -a 10.1.1.1
B. netstat -ano
C. tracert
D. net start \\10.1.1.1
E. ipconfig -i 10.1.1.1
Answer: A Explanation:
QUESTION NO: 26
According to the ITIL. v3 framework, what are two possible benefits of generating a detailed root cause analysis using chronological timelines? (Choose two.)
A. helps to identify the number of problems opened
B. identifies process deficiencies and breakdowns
C. identifies staffing, skills, and expertise
D. identifies SLA risk fulfillment
Answer: B,C Explanation: QUESTION NO: 27



According to the ITIL. v3 framework, when an issue is reported to a service desk, which system is it recorded in?
A. incident management system
B. problem management system
C. availability management system
D. change management system
E. performance management system
Answer: A Explanation:
QUESTION NO: 28
A customer calls complaining about the level of service being received. The customer produces a log showing service-level measurements that were collected over the past week. Which three questions should be asked at a minimum in order to assess the validity of the claim? (Choose three.)
A. Who took the measurements?
B. How were the measurements taken?
C. Why were the measurements taken?
D. Are the measurements statistically relevant?
E. What were the measurements taken?
Answer: B,D,E Explanation:

QUESTION NO: 29
What does the log message "%IPNAT-6-DELETED:" indicate?
A. A Network Address Translation has been lost, requiring immediate action.
B. An unauthorized user possibly attempted to gain access.
C. The message is for information only and requires no further action.
D. A port on the device has been administratively shut down, requiring no further action

Answer: C Reference:http://www.cisco.com/en/US/docs/ios/12_2sx/system/messages/sm2sx05.html
QUESTION NO: 30

Refer to the exhibit. The following is a shell script for a UNIX-based server. Which three of these files on the UNIX server will be updated or created when this script is executed? (Choose three.)
A. /etc/hostname.hme0
B. /etc/hosts
C. /etc/hostname.hme0:1
D. /etc/netmasks
E. /10.1.0.$LAST_IP_OCT
F. /etc/loghost
Answer: B,C,D Explanation:

QUESTION NO: 31
According to best practices, what are three reasons for escalating a ticket? (Choose three.)
A. immediate escalation based on severity
B. when automated escalation does not occur within prescribed time frame
C. management escalation due to business reasons
D. customer escalation because customer feels that they are very important
E. sales team escalation based on potential for future business

Answer: A,B,C Explanation:

QUESTION NO: 32
According to the ITIL. v3 framework, what is the nature of the method used to escalate an issue that is very serious in nature or an issue that could potentially require an excessive amount of time to resolve?
A. both hierarchical and functional
B. both conceptual and procedural
C. both hierarchical and procedural
D. both conceptual and functional
Answer: A Explanation:

QUESTION NO: 33
How often should device configurations be backed up? (Choose two.)
A. at predetermined intervals
B. at intervals specified in the SLA
C. at daily intervals
D. when disk space is full
E. when a configuration change is detected
Answer: A,E Explanation:

QUESTION NO: 34
The command logging trap informational instructs a device to perform which of these actions?
A. Log only messages with a severity of 0-6.
B. Send syslog messages as traps.
C. Send informational-only SNMP traps.
D. Log all messages to the destination server.

Answer: A Explanation:

QUESTION NO: 35
A "device unreachable" event has been detected by the NMS. The NMS has also performed automated routines and determined that no interfaces are reachable (routed or directly connected).
The last few log entries stored on the logging server for this device are as follows:

What is the most probable cause of the outage?
A. The device overheated, causing a system shutdown.
B. An unauthorized change was made, which caused the outage.
C. Routing flaps are causing the device to become unreachable.
D. An OSPF dead timer has caused the device to lose its adjacency.
Answer: A Explanation:

QUESTION NO: 36
What tool generates synthetic traffic to measure network performance?
A. RMON
B. IP SLA
C. SNMP
D. NetFlow

Answer: B Explanation: QUESTION NO: 37



What is an incremental backup?
A. a backup of all files that have changed since the last full backup
B. a complete backup of all files on a particular partition
C. a backup of all files at set increments of time
D. a backup of all files that have changed since the last full or incremental backup
Answer: D Explanation:
QUESTION NO: 38
What are two differences between using FTP or TFTP to copy files? (Choose two.)
A. FTP uses a reliable transport protocol and TFTP uses an unreliable transport protocol.
B. TFTP uses a reliable transport protocol and FTP uses an unreliable transport protocol.
C. FTP requires a username and password.
D. TFTP requires a username and password.
E. FTP transfers are encrypted by default.
F. FTP uses a single port for control and data transfer while TFTP uses a different port for control and data transfer
Answer: A,C Explanation:

QUESTION NO: 39
You are a Tier I NOC staff working on a severity 1 issue. The escalation timeline is defined as 60 minutes. After 55 minutes, you think you are close to resolving the issue. What would you do in this situation?
A. Continue to work and resolve the issue, even after 60 minutes has passed.
B. Call your manager and report your progress.
C. Escalate to Tier II support staff.
D. Call the user and let them know that you will resolve the issue in 10 minutes.
Answer: C Explanation: QUESTION NO: 40



Which one of the following features will allow the severity of a syslog message to be altered prior to leaving a Cisco IOS device?
A. EEM/ESM
B. NetFlow
C. IP SLA
D. SNMP
E. debug
Answer: A Explanation:
QUESTION NO: 41
According to the ITIL. v3 framework, the problem management process can deal with which two types of issues? (Choose two.)
A. current outages
B. prevention of future outages
C. mitigating outage severity
D. reclamation of IP addresses
Answer: A,B Explanation:

QUESTION NO: 42
A robust trouble ticketing system includes which of these critical components?
A. requires separate passwords to maintain separation of duties
B. integrated with financial management systems; unique reference numbers; and urgency, priority, and callback methods
C. unique reference numbers, urgency, device serial numbers
D. integrated with both asset and event management systems, unique reference numbers, and priority and closure categories

Answer: D Explanation:

QUESTION NO: 43
What three things can a network change MOP be used for? (Choose three.)
A. configuration change
B. summarizing SNMP-based performance statistics
C. troubleshooting customer-reported issues
D. software image upgrade
E. installing new hardware
F. escalating connectivity issues
Answer: A,D,E Explanation:

QUESTION NO: 44
The NMS has missed three of the last five polls to a device. If your choices are limited to the options below, how would you proceed with troubleshooting?
A. Verify that information from the NMS is accurate.
B. Reboot the device.
C. Verify that no changes have been made recently on the device.
D. Upgrade the device to the latest software release.
Answer: A Explanation:

QUESTION NO: 45
What is the purpose of a rollback procedure in a method of procedure?
A. to provide verification steps when the procedure has completed
B. to provide an alternative procedure for completing a migration
C. to provide the NOC with a standard template for resolving customer issues
D. to revert back all changes made during the procedure

Answer: D Explanation:

QUESTION NO: 46
Which of these items would not be tracked in the Inventory Manager?
A. SLAs
B. line cards
C. serial numbers
D. IP address
E. owner
Answer: A Explanation:

QUESTION NO: 47
Which statement is true about the script below?

A. This is a C shell UNIX script.
B. When executing the echo command, the script will always look for the command in the directory from which it is run.
C. When executing the echo command, the script will always look for the command in /usr/bin before looking in the directory from which the script was run.
D. The variable HOSTNAME will be set to hostname.
Answer: C Explanation:

QUESTION NO: 48

According to the ITIL. v3 framework, which of these factors should trigger the creation of a problem record?
A. recurring incidents
B. user acceptance testing
C. changes to the network
D. resolution of a ticket
Answer: A Explanation:

QUESTION NO: 49
Which section of the network change method of procedure will contain instructions to reverse the network change?
A. Implementation
B. Backout/Rollback
C. Verification
D. Testing
Answer: B Explanation:

QUESTION NO: 50
The following is the beginning of a shell script. Which statement is true if the user issues "./send_traps.sh 10.1.1.1" at the CLI without the quotes?

A. The script will fail because only one variable is specified by the user at the CLI.
B. The trapgenScripts variable will be set to /opt/MWFM_Automation/trapgen_scripts/10.1.1.1.
C. The trapgenScripts variable will not be set.
D. The simulation_IP variable will be set to 10.1.1.1.

Answer: B Explanation:

QUESTION NO: 51
A parameter in an SLA must meet which three criteria? (Choose three.)
A. quality
B. significance
C. measurability
D. reliability
E. relevance
Answer: B,C,E Explanation:

QUESTION NO: 52
The Cisco IOS command, logging buffered 65536, performs which one of these tasks?
A. provides a memory buffer for spooling messages to remote syslog daemons
B. instructs the device to limit UDP messages to 64 KB
C. indicates the number of log messages kept for viewing during a show logging command on the console
D. provides flash-based buffering of messages when no receiver is available
Answer: C Explanation:

QUESTION NO: 53
According to the ITIL. v3 framework, what is considered a problem management task?
A. proactive review of syslog summary report
B. performance of changes needed to remove a known error
C. restoration of service
D. closing of the incident tickets
Answer: A Explanation:


QUESTION NO: 54
In inventory management, what is the primary responsibility of a "master poller��?
A. to obtain device lists from child pollers
B. to provide a source for NTP queries
C. to provide authoritative information for all other managers
D. to provide device serial numbers to other managers
Answer: C Explanation:

QUESTION NO: 55
Why do SNMP counters often show different numbers than Cisco IOS CLI show commands?
A. The counter output from a CLI show command cannot be reset on interfaces.
B. SNMP counters use SNMPv3 values, whereas CLI show commands use SNMPv2 values
C. SNMP uses 64-bit counters, whereas CLI show commands use 32-bit counters.
D. The only way to reset the SNMP counters is to reload the box.
Answer: D Explanation:

QUESTION NO: 56
When closing a trouble ticket, why is closure categorization very important?
A. It helps to identify the person who opened the ticket.
B. It helps to identify the name of the staff who worked on the incident
C. It clearly identifies ticket open time.
D. It helps to identify the cause of an outage.
Answer: D Explanation: QUESTION NO: 57



According to the ITIL. v3 framework, which two formulas are commonly used to calculate priority? (Choose two.)
A. priority = urgency + impact
B. priority = severity + impact
C. priority = urgency x impact
D. priority = severity x urgency
Answer: A,C Explanation:
QUESTION NO: 58
Which three protocols can you use to collect detailed configuration information on network devices for inventory purposes? (Choose three.)
A. SNMP
B. IP SLA
C. RMON
D. Cisco Discovery Protocol
E. NetFlow
F. SSH
Answer: A,D,F Explanation:

QUESTION NO: 59
According to the ITIL. v3 framework, what activity is required to implement reboots, repairs, or workarounds?
A. initiate connection to the device and enter privileged mode at the CLI
B. initiate a request for change
C. full documentation and closure of the incident record
D. ensure fix or workaround is compliant with existing configuration standards
Answer: B Explanation:


QUESTION NO: 60
After notifying the customer about an SLA issue, what should you do?
A. Notify the SLA manager so that they can issue a credit to the customer.
B. Document who you contacted about the SLA issue by opening or updating a ticket
C. Log the call and wait for a response from the customer.
D. Open a trouble ticket with the information collected from the customer.
Answer: B Explanation:

QUESTION NO: 61
According to the ITIL. v3 framework, which of these three processes are common inputs to root cause analysis? (Choose three.)
A. event management
B. incident management
C. proactive problem management
D. change management
Answer: A,B,C Explanation:

QUESTION NO: 62
Which technique is used to set up an early warning system for impending service-level violations?
A. MOS scoring
B. configuration change events
C. threshold-crossing events
D. event-based alarming
Answer: C Explanation: QUESTION NO: 63



Which three of these factors are important information in a network change document? (Choose three.)
A. detailed information about the steps required to carry out the process of network change
B. steps to verify the accuracy of the network change after the change has taken place
C. a rollback plan, in case the network change is not successful
D. a detailed inventory of all types of hardware and devices used in the network
E. a complete list of all types of software used in the network
Answer: A,B,C Explanation:
QUESTION NO: 64
A software upgrade is performed on some of the routers in a network. What would be your first major verification step after the upgrade?
A. check show version
B. check config-register
C. check routing table
D. check logs for errors
E. check if router prompt has changed
Answer: A Explanation:
QUESTION NO: 65 DRAG DROP Answer:



Explanation:



QUESTION NO: 66
According to the ITIL. v3 framework, which three statements are true with regard to effective problem management? (Choose three.)
A. The goal of problem management is similar to the goal of incident management.
B. Resources dedicated to problem management are more effective than resources dedicated solely to managing incidents.
C. A problem ticket can be opened as a result of a single incident ticket.
D. It is desirable to align incident and problem management categories.
E. Like incident management, problem management is reactive in nature.
F. All incidents ultimately require a problem ticket for final closure.
Answer: B,C,D Explanation:
QUESTION NO: 67
Network inventory is polled once per week on Saturdays.

A new router is being installed on Sunday.
Which of these network managers should be synchronized with the inventory manager in order to have the most up-to-date device list as soon as possible?
A. Cisco Performance Manager
B. CMDB
C. Syslog Manager
D. Manager of Managers
E. CiscoWorks Fault Manager
Answer: C Explanation:

QUESTION NO: 68
Your fault management system indicates that an "interface down" event was received five minutes ago, followed by an "interface up" event three minutes later. What should you do?
A. Open a trouble ticket and begin troubleshooting the outage.
B. Verify that there were no changes made to the device recently.
C. Monitor the device for additional interface events before taking any action.
D. Escalate to a level 2 NOC engineer immediately.
Answer: C Explanation:

QUESTION NO: 69
A customer complained about their network performance. You scheduled a change request that will reroute their traffic through a different node to improve performance. What must you do to verify that this change had the desired results?
A. Validate the customer SLA for performance through the network.
B. Collect baseline performance data before and after the change.
C. Contact the customer to ensure that their performance has improved
D. Document the change request so that there is an audit trail.
Answer: B Explanation: QUESTION NO: 70



When you receive a change document for a network change, what information would you make sure to have?
A. detailed information about the steps required to carry out the process of network change, and a rollback plan
B. an explanation of the business case for the change
C. an understanding of how long-term performance will be improved
D. a list of test cases that were conducted in the lab for this network change
Answer: A Explanation:


QUESTION NO: 71
Why is it important to have a single trouble ticketing system?
A. It is easy to back up the data from the single system.
B. It is easy to transfer tickets back and forth between the support groups.
C. It eliminates the need to learn and use multiple systems.
D. It increases the total cost of ownership.
Answer: B Explanation:
QUESTION NO: 72
According to the ITIL. v3 framework, what are three types of metrics to support continual service improvement and other process activities? (Choose three.)
A. technology metrics
B. component metrics
C. firmware metrics

D. harmonic metrics
E. process metrics
F. service metrics
Answer: A,E,F Explanation:

QUESTION NO: 73
According to the ITIL. v3 framework, how is urgency defined regarding an incident, problem, or change?
A. a measure of how long it will be until there is significant impact on the business
B. a measure of time before a customer SLA will be in jeopardy
C. a term used to identify relative importance to the business
D. a measure of how long the incident has been listed as a severity 1 problem
Answer: A Explanation:

QUESTION NO: 74
According to the ITIL. v3 framework, what three criteria can you use to qualify an incident? (Choose three.)
A. an introduction that is chronic in nature
B. unplanned interruption to a service
C. a reduction in the quality of service
D. a failure of a configuration item that has not yet impacted service
E. a change that must be backed out
Answer: B,C,D Explanation:
QUESTION NO: 75

According to the ITIL. v3 framework continual service improvement perspective, what is the most critical information that needs to be captured in the trouble ticketing system?
A. customer contact information
B. support engineer contact information
C. closure categorization
D. incident number
Answer: C Explanation:

QUESTION NO: 76
According to the ITIL. v3 framework, what information is typically reported in an NOC incident report?
A. incident number, priority, incident start time, SLA, incident status
B. problem number, number of successful changes
C. major incident review
D. network performance and capacity metrics
Answer: A Explanation:

QUESTION NO: 77
According to the ITIL. v3 framework, which two formulas are commonly used to calculate priority? (Choose two.)
A. priority = urgency + impact
B. priority = severity + impact
C. priority = urgency . impact
D. priority = severity . urgency
Answer: A,C Explanation: QUESTION NO: 78



According to the ITIL. v3 framework, how would you prioritize workload when dealing with multiple high-urgency incident tickets?
A. Prioritize it based on the user who reported the incident.
B. Close low-impact tickets quickly to reduce workload.
C. Take impact into account to adjust your workload.
D. Work each urgent ticket on a a�.first-in, first-outa� basis.
Answer: C Explanation:
QUESTION NO: 79
According to the ITIL. v3 framework, what are two types of high priority escalation processes within incident management? (Choose two.)
A. functional
B. procedural
C. conceptual
D. hierarchical
E. remedial
Answer: A,D Explanation:

QUESTION NO: 80
According to the ITIL. v3 framework, what type of escalation occurs when the service desk is unable to resolve the incident?
A. procedural
B. conceptual
C. functional
D. hierarchical
Answer: C Explanation:



QUESTION NO: 81
You are working on a network outage issue and you realize that you need to make a change to the configuration. What should you do in this situation?
A. Inform your supervisor about the configuration change.
B. Implement the change, restore service as soon as possible, and close the ticket.
C. Wait for the maintenance window to make the change.
D. Make the necessary change and open a change ticket as soon as possible.
Answer: D Explanation:
QUESTION NO: 82
According to the ITIL. v3 framework, which task is a responsibility of problem management?
A. determine appropriate control action
B. detect and analyze events
C. optimize levels of service quality and availability
D. restore normal service operation as soon as possible
E. coordinate root cause analysis
Answer: E Explanation:

QUESTION NO: 83
According to the ITIL. v3 framework, which process deals with the investigation of recurring network issues?
A. incident management
B. problem management
C. change management

D. event management
Answer: B Explanation:

QUESTION NO: 84
What information is typically captured in the network root cause analysis report?
A. incident start time, resolution time, outage impact, chronological events with timelines
B. incident symptoms, incident impact, names of the staff involved
C. network documentation update
D. application recovery time
Answer: A Explanation:

QUESTION NO: 85
A major location was down for several minutes. In your experience, you know that this same location has experienced outages two other times during the past month. As an engineer working on the most recent incident, according to the ITIL. v3 framework, what would you do next?
A. Close the ticket with an appropriate note.
B. Pass on the cause of the outage to the user and close the ticket.
C. Open a problem ticket, citing a potential chronic issue.
D. Inform your colleague during shift turnover and close the ticket.
Answer: C Explanation:

QUESTION NO: 86
Your organization is in the process of creating a root cause analysis process as part of problem management. According to the ITIL. v3 framework, which two of these actions would you recommend that they include in the process to clearly identify the root cause? (Choose two.)

A. Capture the chronological information timeline.
B. Use Ishikawa diagrams to identify the root cause.
C. Use Markov analysis to identify the root cause.
D. Use Pareto analysis to identify the root cause.
Answer: A,B Explanation:

QUESTION NO: 87
According to the ITIL. v3 framework, which of these events is a valid reason to open a problem ticket?
A. The incident is opened as severity 3 or higher.
B. The incident is opened as high impact.
C. A device reports a fan failure.
D. There is a slow response time between escalations.
Answer: C Explanation:

QUESTION NO: 88
According to the ITIL. v3 framework, which of the following attributes or activities can you use to define and analyze a problem in the network?
A. Pareto analysis, Ishikawa diagrams, brainstorming, and flowcharting
B. information collected using network management tools
C. trouble ticket data
D. known errors in a knowledge database
Answer: D Explanation:
QUESTION NO: 89

According to the ITIL. v3 framework, which process will improve first-line resolution rates for incidents reported to the service desk?
A. event management
B. incident management
C. problem management
D. service management
E. access management
Answer: C Explanation:

QUESTION NO: 90
Which statement is true about ping?
A. monitors device status at both the transport and network layers
B. provides the ability to monitor any network device, regardless of operating system
C. monitors information on multiple services, including HTTP, FTP, and SMTP
D. provides round-trip times and mean-time-to-respond information
Answer: B Explanation:

QUESTION NO: 91
Which one of these can you use to verify an open port on a remote device?
A. the netstat command
B. Telnet
C. ping
D. traceroute
Answer: B Explanation: QUESTION NO: 92



Which of these can be used to determine the number of errors on a router interface?
A. NBAR
B. NetFlow
C. SNMP
D. ping
E. traceroute
Answer: C Explanation:
QUESTION NO: 93
Which part of a syslog message contains detailed information about the event, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space?
A. group
B. mnemonic
C. message-text
D. severity
E. category
Answer: C Explanation:

QUESTION NO: 94
While viewing the output of a show logging command on a Cisco Catalyst 6500 Series Switch, you notice the following entry:
%SYS-0-SYS_LCPERR0:Module 6: Linecard received system exception.
From this message, you can determine that the facility code is which of these?



A. 0
B. 6
C. LCPERR0
D. Module
E. SYS
Answer: E Explanation:
QUESTION NO: 95
During a review of syslog messages, you notice that the backup power supply in router A is down. According to the ITIL. v3 framework, what would be your next step?
A. Inform your escalation contact.
B. Schedule a maintenance window.
C. Open a problem ticket.
D. Open an incident ticket.
Answer: C Explanation:

QUESTION NO: 96
Your NMS is reporting a device outage. You recall seeing this before but are not completely sure.
According to the ITIL. v3 framework, what is the next step that you should take to begin working on the issue?
A. Inform your escalation contact and request that they look into it.
B. Contact your supervisor.
C. Look at the known-error database for troubleshooting steps.
D. Call Tier II support and work with them to resolve the problem.
Answer: C Explanation: QUESTION NO: 97



According to the ITIL. v3 framework, when a resolution is unknown, what should be the first step that you follow when troubleshooting an incident?
A. Check the incident management system to identify prior history.
B. Check the known-error database for an incident match.
C. Analyze and escalate to Tier II.
D. Discuss with fellow engineers to identify a resolution process.
Answer: B Explanation:
QUESTION NO: 98
A Cisco network router crashes and you want to do as much first-level troubleshooting as quickly as you can so that the router can return to service. Which Cisco troubleshooting tool can you use that reports potential problems by analyzing supported show command output?
A. Output Interpreter
B. Syslog Interpreter
C. CLI Interpreter
D. Command Interpreter
Answer: A Explanation:

QUESTION NO: 99
Cisco routers provide numerous integrated commands to assist you in monitoring and troubleshooting your internetwork. Which of these actions describes the debug set of commands?
A. monitors normal network behavior and isolates problem areas
B. provides a method of determining the route by which packets reach their destination from one device to another
C. helps determine connectivity between devices on the network
D. assists in the isolation of protocol and configuration problems

Answer: D Explanation:

QUESTION NO: 100
A network alarm is reported. What is the first task that you should perform?
A. Verify that the event actually occurred to eliminate any false-positives.
B. Open a trouble ticket and begin troubleshooting the outage.
C. Verify that there were no changes made to the device recently.
D. Wait for another event to occur to verify the alarm.
Answer: A Explanation:

QUESTION NO: 101
Which two of these actions can you take to determine performance degradation on a Cisco router? (Choose two.)
A. Poll the IfInOctects and IfOutOctects objects.
B. Enable debug on the device.
C. Ping the affected device.
D. Check your Incident Manager for events from this device.
E. Perform a show interface command on the affected device.
Answer: C,E Explanation:

QUESTION NO: 102
What is the default syslog facility used to display log messages for a Cisco switch running Cisco IOS Software Release 12.2.18(SXF)?
A. kernel
B. system daemons

C. network news subsystem
D. Local7

Answer: D Explanation:
QUESTION NO: 103
Refer to the exhibit.


A Cisco 7200 Series Router is directly connected to a Cisco Catalyst 3560 Series Switch over a Gigabit Ethernet link. It takes an average of 50 seconds after bringing up both ends of the link for data traffic to flow across the link. Which of the following would allow the link to forward data traffic within a few seconds after bringing up both ends of the link?
A. On the switch, enable PortFast.
B. On the router, disable ARP on the interface.
C. On both the router and the switch, set the interface duplex to half.
D. On both the router and the switch, manually configure the MAC addresses.
Answer: A Explanation:

QUESTION NO: 104
While at the CLI on a Cisco ASR 9000 Series router, you notice the following message appear on your screen:

2w6d: %SYS-5-CONFIG_I: Configured from console by cisco on vty0 (10.10.20.100)
Which statement is true about this message?
A. User cisco logged into the router via the console port and made a configuration change.
B. User cisco used Telnet to connect to IP 10.10.20.100 and made a configuration change.
C. This is a Warning-level syslog.
D. The router has been up for 20 days.
Answer: D Explanation:

QUESTION NO: 105
You need to monitor a connection between two PE routers for packet jitter and delay. Which tool enables this type of monitoring on a Cisco 7600 Series Router?
A. IP SLA
B. multicast
C. syslog

D. SNMP
E. NetFlow
F. RMON
Answer: A Explanation:

QUESTION NO: 106
A performance manager is no longer able to poll a single device. Which two of the following might be causes? (Choose two.)
A. An access list is denying access.
B. The device has been removed from inventory.
C. The device is down.
D. The vty password has been changed.
E. The default gateway on the performance management server has been altered.
Answer: A,C Explanation:

QUESTION NO: 107
Which verification step would help in troubleshooting a large number of CRC errors observed on an interface?
A. Verify that the physical link connected to the interface is not defective.
B. Verify that encapsulation type on the interface matches on both ends of the link.
C. Verify that the interface is in shutdown and cannot receive data.
D. Verify that the clock rate on the interface does not match the other end of the link.
Answer: A Explanation:
QUESTION NO: 108

Why is it a best practice to have occasional operational readiness tests to access backed up files?
A. to ensure that a fire or other disaster does not affect data
B. to verify that your backup process is working correctly
C. to reduce the amount of space required for each backup
D. to prevent accidental file deletion and disk failures
Answer: B Explanation:

QUESTION NO: 109
What are two protocols that you can use to copy configurations from a Cisco ASR 9000 Series router? (Choose two.)
A. DHCP
B. FTP
C. TFTP
D. HSRP
E. NetFlow

Answer: B,C Explanation:
QUESTION NO: 110
Which two statements about the UNIX script are true? (Choose two.)
#!/bin/sh
tc=1
while [ $tc -le 10 ]
do
#/opt/trapSender -e 1.3.6.1.6.3.1.1.5.1 -s 1 -g 1 -i 10.1.1.1 -D 10.1.1.5 -n 10
tc=`expr $tc + 1` echo "tc:$tc\n"; sleep 1 done


A. This is a Perl script.
B. The command /opt/trapSender will execute 10 times.
C. Within the while loop, the script will pause and wait for one second.
D. Within the while loop, the script will pause and wait for one minute.
E. The last number to be printed to the screen when running this script is 11.
Answer: C,E Explanation:

QUESTION NO: 111
The following UNIX shell script was created to generate a configuration for the Cisco GGSN. Which statement is true about this script?
#!/bin/sh echo "gprs access-point-list AC" x=1000 y=1501 while [ $x -lt $y ]; do . echo " access-point $x" . echo " access-point-name AutomationApn$x" . echo " access-type real" . echo " access-mode non-transparent" . echo " service-mode operational" . echo " vrf CHARGING" . echo " aaa-group accounting AAAactServer" . echo " aaa-group authentication AAAautServer"

. echo " charging profile any 6 override" . echo " aggregate auto" . echo " gtp response-message wait-accounting" . echo " gtp pdp-context timeout idle 600 uplink" . echo " exit" . echo " !" . x=`expr $x + 1` done echo "!"
A. The first access point to be configured will be 1000, unless the user calls the script with a parameter of a different number.
B. The line "gprs access-point-list AC" will be printed without the quotes 500 times.
C. This is a Perl script.
D. The last access-point-name will be AutomationApn1500.
Answer: D Explanation:

QUESTION NO: 112
Refer to the UNIX shell script below. Which one of the statements is true?
dir=/var/adm/CSCOpx/files/rme/dcma/devfiles log=/tmp/removeDcmaFiles.log echo "Starting removeDcmaFiles cron job `date`" >> $log for i in `ls $dir`; do . length=`ls -lrt $dir/$i/PRIMARY/RUNNING/ | wc -l` . h=`expr $length - 3` . for j in `ls -rt $dir/$i/PRIMARY/RUNNING/ | head -$h`;do .. echo "rm -rf $dir/$i/PRIMARY/RUNNING/$j" >> $log .. rm -rf $dir/$i/PRIMARY/RUNNING/$j

. done

done
A. The following will be printed to the screen when the script is executed: Starting removeDcmaFiles cron job `date`
B. The following will be printed to the screen when the script is executed, but `date` will be replaced by the actual date as known by the operating system: Starting removeDcmaFiles cron job `date`
C. The following will be printed to the screen multiple times: rm -rf $dir/$i/PRIMARY/RUNNING/$j
D. Nothing will be printed to the screen if the script executes without error.
Answer: D Explanation:

QUESTION NO: 113
Which protocol can you use to dynamically discover directly connected neighbors in the network for inventory purposes?
A. Simple Network Management Protocol
B. Cisco Discovery Protocol
C. Remote Monitoring
D. Secure Shell
Answer: B Explanation:

QUESTION NO: 114
Which of these items would not be tracked in the Inventory Manager?
A. SLAs
B. line cards
C. serial numbers
D. IP address
E. owner

Answer: A Explanation:

QUESTION NO: 115
What is the correct order of the procedural steps for a network change MOP?
A. Initial Checks, 2. Procedure, 3. Verification, 4. Backout Procedure, 5. Backout Verification
B. Verification, 2. Procedure, 3. Initial Checks, 4. Backout Verification, 5. Backout Procedure
C. Initial Checks, 2. Verification, 3. Procedure, 4. Backout Procedure, 5. Backout Verification
D. Initial Checks, 2. Verification, 3. Procedure, 4. Backout Verification, 5. Backout Procedure
Answer: A Explanation:

QUESTION NO: 116
Why do service providers have a difficult time guaranteeing performance levels in SLAs?
A. Response times are not easily measured.
B. Network outages cannot be avoided.
C. Performance parameters are not available.
D. The shared infrastructure is dynamic.
Answer: D Explanation:

QUESTION NO: 117
When monitoring service levels against the requirements of an SLA, which three questions should you ask when defining the data collection methodology? (Choose three.)
A. How should the data records be collected?
B. What security is required for the data records?
C. Where in the network should you collect the data records?
D. What type of information should be collected?

Answer: A,C,D Explanation:

QUESTION NO: 118
Which of the following would be best suited for providing accurate service-level measurements?
A. SNMP
B. IP SLA
C. RMON
D. NetFlow
Answer: B Explanation:

QUESTION NO: 119
According to the ITIL. v3 framework, which four of these statements are characteristics of effective problem management? (Choose four.)
A. It will reduce incidents.
B. It will decrease mean-time-to-repair.
C. It can be either reactive or proactive in nature.
D. It will help improve the change management process.
E. It raises productivity and decreases cost in the long term.
Answer: A,B,C,E Explanation:

QUESTION NO: 120
You are Tier 1 support and are actively working a high-priority ticket. Troubleshooting efforts have not isolated the issue and you think that rebooting the device will resolve it. What should you do first?
A. Clear all logs to ensure that the device is reporting the correct information.

B. Collect more information to determine the impact.
C. Escalate to the next-level support.
D. Disconnect all cables.
E. Power-cycle the device.

Answer: B Explanation:
QUESTION NO: 121 DRAG DROP

Answer:

Explanation: