CCNP Practice Test 13 — 15 Questions

Question 1

A data center architect is designing a virtualized environment to host critical applications. The design must maximize performance by allowing virtual machines (VMs) to directly access physical CPU cores and memory without hypervisor overhead for latency-sensitive workloads. Which hypervisor configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure NUMA pinning and CPU pinning for each VM to dedicated cores and memory nodes. CPU pinning and NUMA pinning allow virtual machines to directly access dedicated physical CPU cores and memory nodes, eliminating hypervisor scheduling overhead and ensuring low-latency access to local memory. This configuration is essential for latency-sensitive workloads in a virtualized data center, as it provides near-bare-metal performance by avoiding resource contention and cross-NUMA memory access penalties.

Answer

Enable hyper-threading and overcommit CPU resources

Answer

Use a Type 2 hypervisor (e.g., VMware Workstation) for better isolation

Answer

Enable memory ballooning to reclaim unused memory from VMs

Question 2

A small business has a single router connected to the internet and a switch for the LAN. They want to implement VLANs to separate guest and corporate traffic. The router has only one physical interface to the switch. The network engineer proposes using subinterfaces with 802.1Q trunking on the router interface. Which configuration step is required on the switch port connected to the router?

Accepted Answer

Configure the port as a trunk port.. The router uses subinterfaces with 802.1Q trunking to carry multiple VLANs over a single physical link. For this to work, the switch port connected to the router must be configured as a trunk port, which tags frames with VLAN IDs as they traverse the link. This allows the router to route between VLANs using its subinterfaces, each associated with a specific VLAN.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port in VLAN 1.

Answer

Configure the port as a dynamic desirable port.

Question 3

A network administrator runs the following debug on a router:

R1# debug aaa authorization

*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Processing author request for user 'jdoe'
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Method=TACACS+
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): TACACS+ server 10.1.1.10:49, timeout 5
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Sent author request
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Received PASS response
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Pass

Based on this output, what can be concluded?

Accepted Answer

The TACACS+ server authorized the user successfully.. The debug output shows a 'Received PASS response' from the TACACS+ server at 10.1.1.10:49, followed by 'Pass'. This indicates that the TACACS+ authorization request for user 'jdoe' was successful. TACACS+ encrypts the entire packet and separates authentication, authorization, and accounting (AAA), allowing granular authorization control.

Answer

The user jdoe failed authorization.

Answer

Authorization was performed using RADIUS.

Answer

The user was authenticated but not authorized.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2      1   FULL/DR         00:00:38    10.0.0.2        GigabitEthernet0/0
192.168.1.3      1   2WAY/DROTHER    00:00:32    10.0.0.3        GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

R1 is the Backup Designated Router (BDR) on this segment.. The output shows two neighbors: one in FULL/DR state and one in 2WAY/DROTHER state. Since R1 sees a neighbor with state FULL/DR, that neighbor (192.168.1.2) is the Designated Router (DR). R1 itself is not the DR (otherwise it would show FULL/DR for itself), and it is not a DROTHER because it has a FULL adjacency with the DR. The only remaining role for R1 is Backup Designated Router (BDR), which is confirmed by the fact that the DR is listed as FULL/DR and the DROTHER is in 2WAY state, indicating R1 has full adjacency with the DR but only 2-way with the DROTHER, consistent with BDR behavior.

Answer

R1 is the Designated Router (DR) on this segment.

Answer

R1 is a DROTHER on this segment.

Answer

The OSPF network type is point-to-point.

Question 5

Which two statements about IP SLA with object tracking are true? (Choose two.)

Accepted Answer

A tracking object can monitor the state of an IP SLA operation and change state when the operation fails.. Object tracking allows IP SLA operations to influence routing decisions. The 'track' command is used to create a tracking object that monitors the state of an IP SLA operation. When the IP SLA operation fails, the tracked object changes state, which can then be used to adjust routing, such as floating static routes. The tracking object can be referenced by multiple routing protocols or static routes. The tracking object does not directly modify the routing table; it provides a state that other features use. The IP SLA operation must be configured before the tracking object can reference it.

Answer

Object tracking can only be used with static routes, not with dynamic routing protocols like EIGRP or OSPF.

Answer

The tracking object automatically modifies the routing table when the IP SLA operation fails.

Answer

An IP SLA operation can be configured after the tracking object that references it.

Question 6

Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.

Accepted Answer

Create extended ACL to match traffic. The correct order starts with creating an extended ACL to match the traffic (A), then defining a route-map using the match ip and set vrf commands (B), applying the route-map to the incoming interface (C), after which the router evaluates the policy for each packet (D), and finally matching packets are forwarded into the specified VRF (E). Configuration steps must precede operational steps.

Question 7

A network engineer runs the following command on Router R8:

R8# show ip pim neighbor vrf CUSTOMER-F

Neighbor          Interface                Uptime/Expires    Ver   DR
10.0.3.2          GigabitEthernet0/0.700   02:00:00/00:01:30 v2    1/ DR
10.0.4.2          GigabitEthernet0/0.800   01:30:00/00:01:45 v2    0/ NDR (BDR)

Based on this output, what can be concluded?

Accepted Answer

PIM is enabled in VRF CUSTOMER-F with a DR and BDR. The output shows two PIM neighbors (10.0.3.2 and 10.0.4.2) with their respective interfaces, uptimes, and DR/BDR roles. The presence of a DR (Designated Router) and BDR (Backup Designated Router) indicates that PIM is enabled and operating in VRF CUSTOMER-F, with the DR being 10.0.3.2 (as shown by '1/ DR') and the BDR being 10.0.4.2 (as shown by '0/ NDR (BDR)'). Therefore, option C is correct.

Answer

PIM is not configured for VRF CUSTOMER-F

Answer

The DR is 10.0.4.2

Answer

Both neighbors are using PIM version 1

Question 8

Which two statements about NetFlow flow records and export are correct? (Choose two.)

Accepted Answer

NetFlow v9 uses a template-based export format.. NetFlow v5 has a fixed format with 7 key fields, while v9 is template-based and flexible. IPFIX is the IETF standard based on v9. NetFlow export uses UDP by default (port 2055 for v5, 4729 for IPFIX). TCP is not the default transport.

Answer

NetFlow v5 supports variable-length fields and custom flow keys.

Answer

NetFlow export uses TCP by default to ensure reliable delivery.

Answer

NetFlow v5 can export IPv6 flow information.

Question 9

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

Accepted Answer

Tenant. In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.

Answer

VRF

Answer

Bridge Domain

Answer

Contract

Question 10

Drag and drop the steps of Unicast Reverse Path Forwarding (uRPF) check process into the correct order, from first to last.

Accepted Answer

Router receives packet on an interface. uRPF first receives a packet on an interface, then looks up the source IP in the routing table, verifies that the incoming interface matches the best reverse path, and if it matches, forwards the packet; otherwise, it drops the packet.

Question 11

Which TWO statements are true about IP SLA? (Choose two.)

Accepted Answer

IP SLA can be used with tracking objects to trigger route changes.. IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Answer

IP SLA is only supported on ASR routers.

Answer

IP SLA uses actual user traffic for measurements.

Answer

IP SLA can only measure round-trip time, not one-way delay.

Question 12

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

Accepted Answer

The IKEv2 profile is not attached to the crypto map or interface.. The IKEv2 profile must be attached to a crypto map or directly to an interface (using 'crypto ikev2 profile' under the crypto map or 'tunnel protection ipsec profile') to be used during IKEv2 negotiation. Without this attachment, the router does not know which profile (and thus which keyring and pre-shared key) to apply, so the IKEv2 SA never forms.

Answer

The IKEv2 proposal is not configured correctly.

Answer

The IPsec transform set is missing.

Answer

The pre-shared key is not defined in the keyring.

Question 13

A network engineer runs the following command on Switch SW2:

SW2# show monitor session 2
Session 2
---------
Type                   : Remote Source Session
Source Ports           :
    TX Only            : Gi1/0/5
    RX Only            : Gi1/0/6
Destination Ports     : Gi1/0/20
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

This is an RSPAN source session, sending mirrored traffic to a remote VLAN.. The output shows 'Type: Remote Source Session', which indicates this is an RSPAN source session. The source ports Gi1/0/5 and Gi1/0/6 are configured to send mirrored traffic (TX only and RX only, respectively) to a destination port Gi1/0/20 with encapsulation set to 'Replicate', meaning the traffic is replicated onto an RSPAN VLAN for transport to a remote switch. This matches the definition of an RSPAN source session, where mirrored traffic is sent to a remote VLAN rather than a local destination.

Answer

This is a local SPAN session with bidirectional capture.

Answer

The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.

Answer

Both source ports capture all traffic in both directions.

Question 14

Which THREE of the following are benefits of implementing a spine-leaf architecture in a data center?

Accepted Answer

Provides predictable latency for east-west traffic.. Spine-leaf architecture provides predictable latency for east-west traffic because every leaf switch connects to every spine switch, ensuring consistent hop count. It simplifies scalability: adding a new leaf switch requires connecting it to all spine switches without redesign. Additionally, spine-leaf eliminates the need for Spanning Tree Protocol (STP) because it uses Layer 3 routing between leaf and spine switches, removing Layer 2 loops. Therefore, options A, B, and D are correct. Option C is incorrect because spine-leaf increases cabling due to full mesh connectivity. Option E is incorrect because firewall appliances are still required for security.

Answer

Reduces the amount of cabling required.

Answer

Eliminates the need for firewall appliances.

Question 15

Drag and drop the steps of VNF service chain instantiation into the correct order, from first to last.

Accepted Answer

Define service chain requirements. Service chain instantiation begins with defining the chain, then selecting VNFs, allocating resources, connecting VNFs via virtual links, and finally testing the chain to verify functionality.