CCNP Practice Test 10 — 10 Questions

Question 1

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gRPC (Google Remote Procedure Call).. Cisco DNA Center uses gRPC (Google Remote Procedure Call) as the transport protocol for model-driven telemetry from IOS-XE devices like the Catalyst 9000 series. gRPC leverages HTTP/2 and Protocol Buffers to efficiently stream structured YANG-modeled data, providing the real-time visibility required by DNA Center. This is the standard method for streaming telemetry in modern Cisco SD-Access and intent-based networking architectures.

Answer

NetFlow v9.

Answer

SNMPv3.

Answer

Syslog.

Question 2

Review the following IP SLA configuration on Router R1:

ip sla 3
 icmp-echo 10.3.3.3
 frequency 30
ip sla schedule 3 life forever start-time now
ip sla reaction-configuration 3 react rtt threshold-type xof 5 threshold-value 100 action-type triggerAndReset

What is the purpose of the 'threshold-type xof 5' parameter?

Accepted Answer

It triggers an event if 5 consecutive RTT measurements exceed 100 ms.. The 'threshold-type xof 5' parameter in IP SLA triggers an action when 5 consecutive RTT measurements exceed the specified threshold of 100 ms. This is a 'consecutive violations' threshold, meaning the event fires only after a sustained pattern of failures, not based on a sliding window or time duration. The 'xof' keyword specifically indicates the number of consecutive probe results that must exceed the threshold before the reaction is triggered.

Answer

It triggers an event if 5 out of the last 10 RTT measurements exceed 100 ms.

Answer

It triggers an event if the RTT exceeds 100 ms for 5 seconds.

Answer

It triggers an event if the RTT exceeds 100 ms and then repeats 5 times.

Question 3

A network engineer is configuring 802.1X on a Cisco switch for a guest network. The engineer wants to allow guests to access the internet after authentication but restrict access to internal resources. The engineer configures the switch with 'authentication port-control auto' and a downloadable ACL (dACL) from the RADIUS server. After a guest authenticates, the engineer tests connectivity and finds that the guest can access internal servers. What is the most likely cause?

Accepted Answer

The RADIUS server is not sending the dACL attributes in the Access-Accept message.. The most likely cause is that the RADIUS server is not sending the dACL attributes in the Access-Accept message. For a downloadable ACL to be applied, the RADIUS server must include specific attributes (e.g., Cisco-AVPair with 'ip:inacl#<seq>=permit/deny...' or using IETF attributes like Filter-ID referencing a dACL name) in the Access-Accept. Without these attributes, the switch cannot apply the dACL, and the guest retains default access, which may include internal resources if no other ACL is in place.

Answer

The switchport is configured as 'switchport mode trunk', which does not support dACLs.

Answer

The guest is not being authenticated; the switch is using MAB instead.

Answer

The switch is not configured with 'ip access-group' to apply the dACL.

Question 4

An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?

Accepted Answer

Cisco ISE. Cisco ISE is the policy decision point in a TrustSec-enabled SD-Access fabric. When an endpoint authenticates via 802.1X, MAB, or web authentication, ISE evaluates the authentication result and the applicable authorization policy, then dynamically assigns a Security Group Tag (SGT) to the endpoint. This SGT is passed to the network access device (e.g., fabric edge node) via RADIUS attributes in the Access-Accept message, enabling consistent policy enforcement throughout the fabric.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Cisco DNA Center

Question 5

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Accepted Answer

start-time: Defines when the operation begins. Start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration of the operation.

Question 6

A data center architect is designing a virtualized environment to host critical applications. The design must maximize performance by allowing virtual machines (VMs) to directly access physical CPU cores and memory without hypervisor overhead for latency-sensitive workloads. Which hypervisor configuration should be used?

Accepted Answer

Configure NUMA pinning and CPU pinning for each VM to dedicated cores and memory nodes. CPU pinning and NUMA pinning allow virtual machines to directly access dedicated physical CPU cores and memory nodes, eliminating hypervisor scheduling overhead and ensuring low-latency access to local memory. This configuration is essential for latency-sensitive workloads in a virtualized data center, as it provides near-bare-metal performance by avoiding resource contention and cross-NUMA memory access penalties.

Answer

Enable hyper-threading and overcommit CPU resources

Answer

Use a Type 2 hypervisor (e.g., VMware Workstation) for better isolation

Answer

Enable memory ballooning to reclaim unused memory from VMs

Question 7

An engineer is automating the configuration of SNMPv3 on a large number of Cisco IOS-XE devices using Ansible. The playbook uses the ios_snmp_server module. The engineer wants to ensure that the SNMP configuration is applied only if the device is running a specific IOS version that supports SNMPv3. Which Ansible feature should the engineer use to conditionally execute the task?

Accepted Answer

Use the 'when' clause with a condition on the 'ansible_net_version' fact.. The 'when' clause in Ansible allows conditional execution of a task based on a fact or variable. The 'ansible_net_version' fact, gathered by the ios_facts module, contains the exact IOS version string. By using 'when: ansible_net_version is version('X.Y.Z', '>=')', the engineer can ensure the SNMPv3 configuration task runs only on devices running a supported IOS version, avoiding errors on unsupported platforms.

Answer

Use the 'tags' feature to selectively run the SNMP task only on certain devices.

Answer

Use the 'register' directive to capture the output and then use 'failed_when' to skip the task.

Answer

Use the 'block' and 'rescue' structure to handle version mismatches.

Question 8

An engineer is writing a Python script to parse the output of 'show ip interface brief' from multiple Cisco routers. The engineer uses the netmiko library to collect the output and then uses regular expressions to extract the interface name, IP address, and status. The script works correctly for most routers, but on one router, the output format is slightly different (e.g., extra spaces or different column headers). The engineer wants to make the parsing more robust. What is the best approach?

Accepted Answer

Use the 'textfsm' library with a pre-defined template for 'show ip interface brief'.. TextFSM is specifically designed to parse semi-structured CLI output from network devices. By using a pre-defined template for 'show ip interface brief', the engineer can handle variations in whitespace, column headers, and formatting without writing custom code for each router. This approach is more maintainable and robust than manual parsing methods.

Answer

Write a custom parser that handles each router's output format individually.

Answer

Use the 'split()' method to tokenize each line and then extract the relevant fields by position.

Answer

Use the 're' module with a more complex regular expression that accounts for optional whitespace.

Question 9

A network engineer is configuring a new switch that will be used as an access layer switch. The switch connects to two distribution switches via trunk links. The engineer wants to ensure that the access switch does not become the root bridge for any VLAN. The engineer also wants to provide redundancy so that if one uplink fails, the other uplink takes over quickly. The engineer is using Rapid PVST+. What configuration should the engineer apply on the access switch?

Accepted Answer

Configure 'spanning-tree vlan vlan-list priority 61440' on the access switch.. Setting the spanning-tree priority to 61440 (which is 0xF000 in hex) makes the switch a very unlikely root bridge candidate. In Rapid PVST+, the bridge priority is a 4-bit value (0-15) multiplied by 4096, so 61440 corresponds to priority 15 — the highest possible value. This ensures the access switch will never become the root bridge for any VLAN, while Rapid PVST+ provides fast failover (sub-second convergence) via its alternate/backup port mechanism without needing UplinkFast.

Answer

Configure 'spanning-tree vlan vlan-list priority 0' on the access switch.

Answer

Enable UplinkFast on the access switch to provide fast failover.

Answer

Enable PortFast on the trunk ports to speed up convergence.

Question 10

Drag and drop each broadband type on the left to its matching technology on the right.

Accepted Answer

DSL: Uses telephone line with ADSL or VDSL. DSL uses telephone lines with frequencies above voice. Cable uses coaxial cable with DOCSIS. Fiber uses optical fiber with GPON or active Ethernet. 4G LTE uses cellular radio. Satellite uses geostationary or LEO satellites.