CCNP Practice Test 13 — 15 Questions

Question 1

Consider the following configuration snippet:

policy-map QOS_POLICY
 class VOICE
  priority percent 30
 class VIDEO
  bandwidth percent 20
  queue-limit 50 packets
 class class-default
  fair-queue
  queue-limit 100 packets

What is the effect of this configuration?

Accepted Answer

The VOICE class traffic is always sent before other classes, but if it exceeds 30% of the interface bandwidth, excess traffic is dropped.. The 'priority percent 30' command under the VOICE class enables strict priority queuing, meaning VOICE traffic is always transmitted before any other class. However, the priority queue is policed at 30% of the interface bandwidth; any traffic exceeding this rate is dropped, not queued. This is a fundamental behavior of the priority command in Cisco IOS — excess priority traffic is dropped to prevent starvation of other queues.

Answer

The VOICE class traffic is always sent before other classes, and excess traffic beyond 30% is queued in the default class.

Answer

The VIDEO class traffic is treated with strict priority after the VOICE class.

Answer

The class-default uses Weighted Fair Queuing with a maximum queue size of 100 packets, and all classes share the remaining bandwidth equally.

Question 2

An architect is designing an SD-WAN policy to ensure that real-time video traffic from headquarters to branch offices is always sent over the most reliable transport, while all other traffic uses the least-cost path. Which type of policy should be used to achieve this?

Accepted Answer

Centralized data policy configured on vSmart.. A centralized data policy configured on vSmart is correct because it allows the SD-WAN controller to enforce application-aware routing decisions across the fabric. By matching real-time video traffic and steering it over the transport with the highest loss/reachability metrics (most reliable), while using a separate rule to direct all other traffic over the least-cost path, the policy is applied globally from the vSmart controller without requiring per-router configuration.

Answer

Localized data policy applied on the vEdge router.

Answer

Centralized control policy for route manipulation.

Answer

Localized app-route policy on the branch vEdge.

Question 3

Drag and drop the steps of a RESTCONF PUT transaction on IOS-XE into the correct order, from first to last.

Accepted Answer

Authenticate with the IOS-XE device. The correct order ensures the RESTCONF PUT request is properly authenticated, targeted, and validated before the device applies the configuration. First, the client must authenticate with the device. Then it constructs the PUT request with the target URI. The device validates the request, applies the configuration, and finally sends a success response.

Question 4

A network engineer runs the following command on Router R3:

R3# show ip route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
O IA     10.1.1.0/24 [110/20] via 192.168.1.1, 00:12:34, GigabitEthernet0/0
O        10.2.2.0/24 [110/10] via 192.168.1.2, 00:15:22, GigabitEthernet0/0
O E2     10.3.3.0/24 [110/20] via 192.168.1.3, 00:08:11, GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

The route to 10.3.3.0/24 is an external route redistributed into OSPF.. The route to 10.3.3.0/24 is marked as 'O E2' in the output, which stands for OSPF external type 2. This indicates that the route was redistributed into OSPF from another routing protocol or a different OSPF process, making it an external route. The 'E2' designation confirms it is an external route with a fixed metric that does not include the internal cost to the ASBR.

Answer

The route to 10.1.1.0/24 is in the same OSPF area as R3.

Answer

The metric for 10.3.3.0/24 includes the internal cost to the ASBR.

Answer

R3 is an ASBR.

Question 5

In Cisco TrustSec, which component is responsible for assigning a Security Group Tag (SGT) to a user or device based on authentication?

Accepted Answer

The RADIUS server (ISE) assigns the SGT during authentication.. In Cisco TrustSec, the Security Group Tag (SGT) is assigned by the RADIUS server—specifically Cisco ISE—during the 802.1X authentication process. When a user or device authenticates, ISE evaluates the authentication result and policy, then returns the SGT as a RADIUS attribute (e.g., Cisco-AVPair or MS-MPPE-Send-Key) in the Access-Accept message. The switch then uses this SGT to enforce security group-based access control (SGACL) for traffic from that endpoint.

Answer

The switch dynamically assigns the SGT based on the MAC address.

Answer

The endpoint device sends its SGT in the EAPOL-Start message.

Answer

The SGT is derived from the VLAN ID assigned to the port.

Question 6

What is the default syslog severity level for console logging on a Cisco IOS device?

Accepted Answer

debugging (level 7). By default, Cisco IOS devices log messages with severity levels 0 through 7 (emergencies through debugging) to the console. This is because the console logging default is set to 'debugging' (level 7), meaning all syslog messages, regardless of severity, are displayed on the console. This behavior is controlled by the 'logging console debugging' command, which is the default configuration.

Answer

informational (level 6)

Answer

warnings (level 4)

Answer

errors (level 3)

Question 7

A network engineer runs the following command on Router R1:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "ospf 1", distance 110, metric 20, type inter area
  Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago
      Route metric is 20, traffic share count is 1

Based on this output, what can be concluded?

Accepted Answer

The route is an OSPF inter-area route. The output shows 'type inter area' and a metric of 20, which is the default OSPF metric for inter-area routes (type 3 LSAs). The administrative distance of 110 confirms OSPF as the routing protocol. Therefore, the route is an OSPF inter-area route, making option B correct.

Answer

The route is an OSPF intra-area route

Answer

The route is an OSPF external route

Answer

The route is learned via EIGRP

Question 8

Drag and drop the steps of Jinja2 template rendering for device config generation into the correct order, from first to last.

Accepted Answer

Import Environment and FileSystemLoader from jinja2. The process begins by importing the Jinja2 Environment and FileSystemLoader, creating an environment with a loader pointing to the template directory, loading the template file, defining a dictionary with variables, and finally calling render() to produce the configuration string.

Question 9

Drag and drop the steps of PPPoE session establishment into the correct order, from first to last.

Accepted Answer

Client sends PADI broadcast. PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

Question 10

Drag and drop each HTTP method on the left to its matching REST operation on the right.

Accepted Answer

GET: Retrieve a resource. GET retrieves; POST creates; PUT replaces; DELETE removes; PATCH partially updates.

Question 11

Drag and drop the steps of the gRPC dial-out telemetry subscription flow into the correct order, from first to last.

Accepted Answer

Configure telemetry receiver with IP and port. The correct order is: first, configure the telemetry receiver (destination) on the network device. Next, define a sensor group to specify which YANG data paths to collect. Then, create a subscription associating the sensor group with the receiver. After that, enable the subscription to start streaming data. Finally, the device streams telemetry data to the receiver.

Question 12

Drag and drop each TACACS+ packet type on the left to its matching function on the right.

Accepted Answer

START: Initiates an authentication session and contains the username. START begins authentication and contains username; REPLY sends challenge or result; CONTINUE sends response to challenge; ACCEPT indicates successful authentication; REJECT indicates authentication failure.

Question 13

Drag and drop the steps of the 802.1X EAP-TLS authentication exchange into the correct order, from first to last.

Accepted Answer

Supplicant sends EAPoL-Start. In the 802.1X EAP-TLS authentication exchange, the process begins with the supplicant sending an EAPoL-Start message to initiate authentication. The authenticator then sends an EAP-Request/Identity. The supplicant replies with EAP-Response/Identity, which the authenticator forwards to the RADIUS server. Finally, the RADIUS server sends an EAP-Request for the client certificate to begin the TLS handshake.

Question 14

Drag and drop the steps of AAA method list fallback from RADIUS to local into the correct order, from first to last.

Accepted Answer

User attempts to authenticate to network device. When a method list specifies RADIUS then local, the device first attempts RADIUS authentication. If the RADIUS server is unreachable (timeout), the device falls back to the next method in the list, which is local authentication using the local user database.

Question 15

Which of the following is a valid AP mode on Cisco 9800 WLCs that allows the AP to function as a standalone access point without controller management?

Accepted Answer

FlexConnect mode. FlexConnect mode (option B) is the correct answer because it allows a Cisco AP to switch client traffic locally at the AP and continue forwarding traffic even if the connection to the Cisco 9800 WLC is lost, effectively functioning as a standalone access point without controller management. In this mode, the AP can operate in a 'connected' or 'standalone' state, with the latter providing full local switching and authentication when the CAPWAP tunnel to the controller is down.

Answer

Local mode

Answer

Monitor mode

Answer

Sniffer mode