CCNP Practice Test 14 — 15 Questions

Question 1

Drag and drop the steps of deploying a virtual router as a VNF into the correct order, from first to last.

Accepted Answer

Upload virtual router image to hypervisor. Deploying a virtual router VNF starts with uploading the image, then creating the VM, attaching virtual interfaces, configuring routing protocols, and finally verifying connectivity.

Question 2

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Accepted Answer

Fabric border node. In a centralized policy model for SD-Access, the fabric border node is the correct role to enforce inter-VN traffic policies because it is the only node that can route traffic between different virtual networks (VNs) while applying firewall inspection. The border node connects the fabric to external networks and, when configured with a firewall, can enforce policies such as IP-based ACLs or zone-based firewalls for traffic crossing VNs. This design ensures that all inter-VN traffic is funneled through the border node for inspection, aligning with the centralized policy model where policy enforcement occurs at the network edge.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Fabric WAN router

Question 3

What is the maximum number of WLANs that can be configured on a single AP in a Cisco 9800 WLC deployment?

Accepted Answer

16. In a Cisco 9800 WLC deployment, each AP supports up to 16 WLANs (SSIDs). This is a hard limit enforced by the controller, regardless of the AP model. The 9800 WLC maps WLANs to APs via policy profiles, and the AP can serve a maximum of 16 unique SSIDs simultaneously.

Answer

8

Answer

32

Answer

64

Question 4

Which two statements about PIM sparse mode are true? (Choose two.)

Accepted Answer

PIM sparse mode uses an explicit join model to receive multicast traffic.. PIM sparse mode uses an explicit join model where routers send PIM Join messages toward the RP to join a multicast group. It builds a shared tree (RP-tree) initially, and optionally switches to a source tree (SPT) when traffic exceeds a threshold. PIM dense mode uses flood-and-prune, not sparse mode. PIM-BSR is one method for RP distribution, but not a requirement for sparse mode operation.

Answer

PIM sparse mode routers always use the shortest path tree (SPT) immediately after the first packet is received.

Answer

PIM sparse mode uses a flood-and-prune mechanism to distribute multicast traffic.

Answer

PIM sparse mode requires the use of a bootstrap router (BSR) to operate.

Question 5

Drag and drop the steps of OSPF neighbor adjacency formation into the correct order, from first to last.

Accepted Answer

Router sends Hello packets on interface. OSPF neighbors transition through Down, Init, 2-Way, ExStart, Exchange, Loading, and Full states. The correct order begins with the router sending Hello packets (Down to Init), then receiving a Hello reply (Init to 2-Way), electing DR/BDR if needed (2-Way to ExStart), exchanging database description packets (ExStart to Exchange), and finally synchronizing databases (Loading to Full).

Question 6

A network administrator is configuring a new VLAN 100 on a switch and wants to ensure that the VLAN is created and active. Which command is required to create a VLAN in the VLAN database?

Accepted Answer

vlan 100. The 'vlan 100' command is executed in global configuration mode to create a VLAN in the VLAN database on a Cisco IOS switch. This command creates the VLAN and places the switch into VLAN configuration mode, where optional parameters like name can be set. The VLAN is active immediately upon creation, provided the switch is in VTP server or transparent mode.

Answer

interface vlan 100

Answer

name VLAN100

Answer

switchport access vlan 100

Question 7

Given the following SNMPv3 configuration on a Cisco IOS-XE router:

snmp-server group ADMIN v3 priv write ADMINVIEW
snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456
snmp-server view ADMINVIEW iso included

What is missing or incorrect in this configuration?

Accepted Answer

The view 'ADMINVIEW' includes the entire ISO tree, which might be too permissive for a restricted write view.. The view 'ADMINVIEW' is configured with 'iso included', which includes the entire ISO OID tree. This grants write access to all MIB objects, which is overly permissive for a restricted write view. In SNMPv3, a write view should be limited to specific OIDs or subtrees to enforce least privilege, and including the entire ISO tree violates that principle. Option D is incorrect because a read view is not required if the group is only intended for write operations. The configuration as shown only specifies a write view, which is sufficient for SNMP set operations. Adding a read view is optional and not a mandatory missing piece.

Answer

The SNMPv3 user 'admin' must also specify an engine ID for the router.

Answer

The privacy password 'cisco456' must be at least 8 characters long.

Answer

The group 'ADMIN' must be configured with a read view to allow SNMP get operations.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied. The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 9

A network engineer runs the following command on a Cisco WLC:

WLC# show wlan summary

WLAN ID   SSID               Status   Security   Interface
1         Guest              Enabled  Open       guest-vlan
2         Corporate          Enabled  WPA2       corp-vlan
3         IoT                Disabled WPA2       iot-vlan
4         Management         Enabled  WPA2       mgmt-vlan

Based on this output, what can be concluded?

Accepted Answer

WLAN 3 is not operational because it is disabled.. The 'show wlan summary' output clearly shows that WLAN 3 (IoT) has a Status of 'Disabled', meaning it is not operational and cannot serve clients. Only enabled WLANs can transmit beacons and accept client associations. Therefore, option B is correct because a disabled WLAN is effectively non-functional.

Answer

All WLANs are currently active and serving clients.

Answer

The Guest WLAN uses WPA2 security.

Answer

The Management WLAN is on the guest-vlan interface.

Question 10

Review the following IP SLA configuration on Router R1:

ip sla 3
 icmp-echo 10.3.3.3
 frequency 30
ip sla schedule 3 life forever start-time now
ip sla reaction-configuration 3 react rtt threshold-type xof 5 threshold-value 100 action-type triggerAndReset

What is the purpose of the 'threshold-type xof 5' parameter?

Accepted Answer

It triggers an event if 5 consecutive RTT measurements exceed 100 ms.. The 'threshold-type xof 5' parameter in IP SLA triggers an action when 5 consecutive RTT measurements exceed the specified threshold of 100 ms. This is a 'consecutive violations' threshold, meaning the event fires only after a sustained pattern of failures, not based on a sliding window or time duration. The 'xof' keyword specifically indicates the number of consecutive probe results that must exceed the threshold before the reaction is triggered.

Answer

It triggers an event if 5 out of the last 10 RTT measurements exceed 100 ms.

Answer

It triggers an event if the RTT exceeds 100 ms for 5 seconds.

Answer

It triggers an event if the RTT exceeds 100 ms and then repeats 5 times.

Question 11

In OSPF, which LSA type is used to describe routes to networks within the same area and is generated by the router that owns the network?

Accepted Answer

Type 1 (Router LSA). Type 1 (Router LSA) is correct because each OSPF router generates a Type 1 LSA to describe its directly connected links and networks within the same area. This LSA is flooded only within the originating area and is the fundamental building block for intra-area route calculation using the SPF algorithm.

Answer

Type 2 (Network LSA)

Answer

Type 3 (Summary LSA)

Answer

Type 5 (External LSA)

Question 12

A network engineer is configuring 802.1X on a Cisco switch for a guest network. The engineer wants to allow guests to access the internet after authentication but restrict access to internal resources. The engineer configures the switch with 'authentication port-control auto' and a downloadable ACL (dACL) from the RADIUS server. After a guest authenticates, the engineer tests connectivity and finds that the guest can access internal servers. What is the most likely cause?

Accepted Answer

The RADIUS server is not sending the dACL attributes in the Access-Accept message.. The most likely cause is that the RADIUS server is not sending the dACL attributes in the Access-Accept message. For a downloadable ACL to be applied, the RADIUS server must include specific attributes (e.g., Cisco-AVPair with 'ip:inacl#<seq>=permit/deny...' or using IETF attributes like Filter-ID referencing a dACL name) in the Access-Accept. Without these attributes, the switch cannot apply the dACL, and the guest retains default access, which may include internal resources if no other ACL is in place.

Answer

The switchport is configured as 'switchport mode trunk', which does not support dACLs.

Answer

The guest is not being authenticated; the switch is using MAB instead.

Answer

The switch is not configured with 'ip access-group' to apply the dACL.

Question 13

Drag and drop the steps of TrustSec SGT assignment and propagation via SXP into the correct order, from first to last.

Accepted Answer

ISE assigns SGT based on endpoint identity. SXP propagates SGTs from a classification device to enforcement devices; first the SGT is assigned (e.g., via IP-to-SGT mapping), then SXP sends the binding to an SXP speaker, which forwards it to a listener, who adds it to the local SGT mapping table, enabling enforcement.

Question 14

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Accepted Answer

start-time: Defines when the operation begins. Start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration of the operation.

Question 15

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    24586
             Address     aabb.cc00.0100
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    24586  (priority 24576 sys-id-ext 10)
             Address     aabb.cc00.0100
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

The root bridge priority for VLAN 10 is 24576 without the system ID extension.. The output shows the root bridge priority as 24586, which includes the VLAN 10 system ID extension. The configured bridge priority (without the system ID) is 24576, as indicated by 'priority 24576 sys-id-ext 10' in the Bridge ID line. Therefore, option D correctly states that the root bridge priority for VLAN 10 is 24576 without the system ID extension. Option A is incorrect because, while SW1 is the root bridge, the question asks for a conclusion based on the output; the key detail is the priority value. Options B and C are false based on the output.

Answer

SW1 is the root bridge for VLAN 10, and all its interfaces are in the Designated role.

Answer

SW1 is not the root bridge; the root bridge has MAC address aabb.cc00.0100 but is a different switch.

Answer

SW1 has a port in the Blocking state, preventing loops.