CCNP Practice Test 14 — 15 Questions

Question 1

Drag and drop the steps of SD-WAN overlay routing protocol (OMP) route advertisement sequence into the correct order, from first to last.

Accepted Answer

Edge device learns local routes via connected/static/dynamic. In OMP, the sequence starts with the edge device learning routes locally (connected, static, or dynamic), then redistributing them into OMP and sending to vSmart. vSmart processes and installs routes in its RIB, then advertises the best routes to other edge devices. The receiving edge device installs the route in its forwarding table and optionally redistributes into its local routing protocol.

Question 2

Drag and drop the steps of NFV MANO (VNFM/NFVO/VIM) interaction flow into the correct order, from first to last.

Accepted Answer

NFVO receives service request from OSS/BSS. The interaction flow begins with the NFVO receiving a service request from OSS/BSS. The NFVO then requests resource allocation from the VIM. The VIM allocates resources and reports back. Next, the NFVO instructs the VNFM to instantiate the VNF. Finally, the VNFM configures and starts the VNF on the allocated resources.

Question 3

Drag and drop the steps of Cisco ISE profiling and policy assignment flow into the correct order, from first to last.

Accepted Answer

Endpoint authenticates via 802.1X or MAB. The flow starts with endpoint authentication via 802.1X/MAB, then ISE collects profiling data (e.g., DHCP, HTTP). ISE matches the endpoint to a profiling policy, assigns an identity group, and finally applies the appropriate authorization policy (e.g., SGT, VLAN).

Question 4

A network engineer is troubleshooting connectivity issues in a multi-tenant environment where each tenant's traffic is isolated using VRF-Lite. The engineer notices that tenants in the same VRF cannot communicate with each other across different access switches. Which design change should be implemented to enable inter-switch VRF communication?

Accepted Answer

Create trunk links with 802.1Q subinterfaces on each switch and assign each subinterface to the appropriate VRF.. VRF-Lite requires 802.1Q trunking to extend Layer 3 VRF boundaries across switches. By creating subinterfaces on trunk links and assigning each subinterface to the appropriate VRF, traffic from the same VRF on different switches can be routed through the VRF-specific routing table, enabling inter-switch communication while maintaining isolation.

Answer

Use the same VLAN for all tenants and rely on VLAN ACLs.

Answer

Configure static routes on each switch pointing to the next-hop IP in the global routing table.

Answer

Enable OSPF with a single area on all switches and redistribute between VRFs.

Question 5

A network engineer runs the following command on Switch SW7:

SW7# show interfaces port-channel 1
Port-channel1 is up, line protocol is up (connected)
  Hardware is EtherChannel, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc)
  Description: Link to Core
  Internet address is 192.168.1.1/30
  MTU 1500 bytes, BW 2000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 1000Mb/s, link type is auto, media type is unknown
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 1000 bits/sec, 2 packets/sec
  5 minute output rate 500 bits/sec, 1 packets/sec
     12345 packets input, 1234567 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     67890 packets output, 9876543 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

Based on this output, what can be concluded?

Accepted Answer

The bandwidth of 2 Gbps suggests that two 1 Gbps links are aggregated.. The output shows a bandwidth of 2000000 Kbit/sec, which equals 2 Gbps. Since each individual link in the EtherChannel is operating at 1000 Mb/s (1 Gbps) and full-duplex, the total bandwidth of 2 Gbps indicates that two 1 Gbps links have been successfully aggregated into the Port-channel 1. This is a direct conclusion from the 'BW 2000000 Kbit/sec' field in the show interfaces port-channel output.

Answer

The port-channel is a Layer 2 interface because it has an IP address.

Answer

The interface is experiencing input errors due to CRC errors.

Answer

The port-channel is operating at half-duplex.

Question 6

Drag and drop each SD-Access fabric role on the left to its matching function on the right.

Accepted Answer

Fabric Border Node: Connects the SD-Access fabric to external Layer 2 or Layer 3 networks. The fabric border node connects the fabric to external networks, the fabric edge node connects endpoints to the fabric, and the fabric control node manages LISP mapping and VXLAN tunnels.

Question 7

Consider the following IPv6 access-list on a Cisco IOS-XE router:
```
ipv6 access-list PERMIT_ICMP
 permit icmp any any echo-request
 permit icmp any any echo-reply
 deny ipv6 any any
!
interface GigabitEthernet0/0
 ipv6 traffic-filter PERMIT_ICMP in
```
What is the effect of this configuration?

Accepted Answer

Only IPv6 ping (echo-request and echo-reply) is allowed inbound on Gi0/0; all other IPv6 traffic is dropped.. The ACL explicitly permits only ICMPv6 echo-request and echo-reply messages, which are the packets used by IPv6 ping. The final 'deny ipv6 any any' statement drops all other IPv6 traffic. Since the ACL is applied inbound on GigabitEthernet0/0 via the 'ipv6 traffic-filter' command, only IPv6 ping is allowed in; all other IPv6 packets are denied.

Answer

All ICMPv6 traffic is permitted inbound on Gi0/0.

Answer

The ACL is applied outbound, so it filters traffic leaving Gi0/0.

Answer

The ACL permits all IPv6 traffic because the deny statement is at the end.

Question 8

Drag and drop each DNA Center Intent API on the left to its matching use on the right.

Accepted Answer

inventory: Retrieves network device details, serial numbers, and software versions. Intent APIs: inventory retrieves device details; topology provides network maps; issues reports network problems; events tracks changes and alerts.

Question 9

Consider this AAA configuration:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default stop-only group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
tacacs-server host 10.0.0.2 key SecretKey

What is the effect of the accounting command?

Accepted Answer

Accounting records are sent to TACACS+ only when the exec session ends.. The `aaa accounting exec default stop-only group tacacs+` command configures TACACS+ accounting to send records only when an exec session ends. The `stop-only` keyword explicitly instructs the device to generate a single accounting record at session termination, not at session start. This is a standard TACACS+ accounting feature used to minimize network overhead while still capturing session duration and resource usage.

Answer

Accounting records are sent to TACACS+ at both session start and end.

Answer

Accounting records are sent to TACACS+ only at session start.

Answer

Accounting is disabled because the command uses 'stop-only' incorrectly.

Question 10

Drag and drop the steps of SD-WAN edge device (vEdge/cEdge) bring-up sequence into the correct order, from first to last.

Accepted Answer

Obtain IP address via DHCP. The correct order follows the Cisco SD-WAN device bootstrapping process: first the device obtains an IP address via DHCP, then it discovers the vManage using DNS or a redirect server, establishes a DTLS/TLS control connection to vManage, downloads its configuration, and finally establishes OMP sessions with vSmart controllers.

Question 11

Drag and drop each QoS model on the left to its matching characteristic on the right.

Accepted Answer

IntServ: Uses RSVP to signal per-flow reservations. IntServ uses RSVP for per-flow signaling, DiffServ uses DSCP marking for per-hop behavior, Best Effort provides no guarantees, IntServ requires state in routers, and DiffServ scales well for large networks.

Question 12

Drag and drop the steps of Unicast Reverse Path Forwarding (uRPF) check process into the correct order, from first to last.

Accepted Answer

Router receives packet on an interface. uRPF first receives a packet on an interface, then looks up the source IP in the routing table, verifies that the incoming interface matches the best reverse path, and if it matches, forwards the packet; otherwise, it drops the packet.

Question 13

Drag and drop each STP timer on the left to its matching default value on the right.

Accepted Answer

Hello timer: 2 seconds. Hello timer defaults to 2 seconds; Forward delay defaults to 15 seconds; Max age defaults to 20 seconds.

Question 14

Drag and drop each EIGRP router role on the left to its matching definition on the right.

Accepted Answer

Successor: Next-hop router for the best route to a destination. In EIGRP, successors are the next-hop routers for the best path to a destination. Feasible successors serve as backup next-hop routers that meet the feasibility condition. Neighbors are directly connected EIGRP routers that exchange Hello packets. Feasible Distance is the lowest metric from the local router to a destination. Reported Distance is the metric that a neighbor advertises for a specific route.

Question 15

Drag and drop each VM network mode on the left to its matching behavior description on the right.

Accepted Answer

Bridged: VM appears as a separate device on the physical network. Bridged mode connects the VM to the physical network as if it were a separate host. NAT mode allows the VM to share the host’s IP address for outbound access. Host-only mode creates an isolated network between the host and VMs. Internal mode isolates VMs from the host. Custom mode allows the user to select a specific virtual switch.