CCNP Practice Test 16 — 15 Questions

Question 1

An enterprise network uses TACACS+ for device administration and RADIUS for network access (VPN and wireless). The TACACS+ server is configured to authorize commands. A network engineer notices that after a recent upgrade of the TACACS+ server software, some commands that were previously authorized are now being denied. The engineer checks the router configuration and sees 'aaa authorization commands 15 default group tacacs+'. The TACACS+ server logs show that the authorization requests are being sent and responded to. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The TACACS+ server upgrade changed the default authorization behavior from permissive to restrictive, requiring explicit 'permit' statements for each command, and the existing rules may not cover all commands.. TACACS+ uses an authorization model where the server explicitly permits or denies each command. After an upgrade, the default behavior may have changed from a permissive mode (allowing commands not explicitly denied) to a restrictive mode (denying commands not explicitly permitted). Since the router is configured to use TACACS+ for command authorization (aaa authorization commands 15 default group tacacs+), and the server logs show requests and responses, the issue is that the server is now denying commands that were previously allowed due to missing explicit permit statements.

Answer

The router's 'aaa authorization commands 15 default group tacacs+' command is missing the 'local' keyword, so if TACACS+ denies, there is no fallback.

Answer

The router's privilege level 15 is not correctly assigned to the user.

Answer

The TACACS+ server is not reachable due to a firewall change, causing the router to deny all commands.

Question 2

Drag and drop the steps of 802.11r Fast BSS Transition (FT) roaming steps into the correct order, from first to last.

Accepted Answer

Client discovers target AP via active/passive scan. 802.11r FT roaming uses a key hierarchy to reduce latency. The client first discovers the target AP via scanning. The client sends an FT Authentication request containing a Mobility Domain Identifier (MDIE) and R0KH-ID. The target AP responds with an FT Authentication response with key data. The client then sends an FT Association request, and the AP completes the process with an FT Association response.

Question 3

Drag and drop each MPLS label field on the left to its matching bit size on the right.

Accepted Answer

Label: 20 bits. The MPLS label has 4 fields: Label (20 bits), TC (3 bits), S (1 bit), and TTL (8 bits).

Question 4

Drag and drop the steps of DMVPN Phase 1 spoke-to-hub tunnel setup into the correct order, from first to last.

Accepted Answer

Spoke configures mGRE tunnel interface to hub. In DMVPN Phase 1, the spoke first establishes an mGRE tunnel to the hub using a multipoint interface. The hub then registers the spoke's NHRP mapping. After registration, the spoke can dynamically learn routes from the hub via the tunnel. Finally, the spoke sends traffic through the hub, which routes it to the destination.

Question 5

Drag and drop the steps of EIGRP named mode configuration steps into the correct order, from first to last.

Accepted Answer

Enter global config and type router eigrp . Named mode starts with the router eigrp command, then enters address-family configuration, configures the network, and optionally adjusts timers or other parameters. Finally, the configuration is verified.

Question 6

A network engineer runs the following command on Switch SW3:

SW3# show spanning-tree vlan 30

VLAN0030
  Spanning tree enabled protocol ieee
  Root ID    Priority    24606
             Address     aabb.cc00.0400
             Cost        12
             Port        2 (GigabitEthernet0/2)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32798  (priority 32768 sys-id-ext 30)
             Address     aabb.cc00.0500
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Root FWD 12        128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p

Based on this output, what is the root path cost from SW3 to the root bridge for VLAN 30?

Accepted Answer

12. The root path cost is the cumulative cost from the local switch to the root bridge. In the output, the Root ID section shows a cost of 12, and the Gi0/2 interface is the root port with a cost of 12. This cost represents the total path cost from SW3 to the root bridge for VLAN 30, making option B correct.

Answer

4

Answer

16

Answer

20

Question 7

Drag and drop the steps of stateless DHCPv6 address assignment steps into the correct order, from first to last.

Accepted Answer

Host sends Router Solicitation (RS) message. Stateless DHCPv6 uses SLAAC for addressing and DHCPv6 for additional parameters. The host sends an RS, receives an RA with the O flag, then sends an Information-Request and receives a Reply with options like DNS.

Question 8

Examine this DHCP configuration:
```
ip dhcp pool POOL1
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 8.8.8.8
 lease 0 12
!
ip dhcp excluded-address 10.10.10.1 10.10.10.10
```
Which statement is true?

Accepted Answer

DHCP clients will receive a lease for 12 hours.. The `lease 0 12` command explicitly sets the DHCP lease duration to 12 hours (0 days, 12 hours). The router will assign addresses from 10.10.10.11 to 10.10.10.254, as the excluded-address range (10.10.10.1–10.10.10.10) removes the first ten addresses from the pool, and the network statement defines the 10.10.10.0/24 subnet.

Answer

The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.

Answer

The default lease is used because the lease command is incomplete.

Answer

The DNS server is set to 8.8.8.8, but clients will ignore it.

Question 9

A network engineer is configuring uRPF (unicast Reverse Path Forwarding) on a Cisco router to prevent spoofed IP traffic. The engineer enables uRPF in strict mode on the ingress interface connected to the internal network. After enabling uRPF, legitimate traffic from internal hosts is being dropped. The engineer checks the routing table and sees that the routes for the internal subnets are present. What is the most likely cause?

Accepted Answer

The return route for the source IP points to a different interface than the one where the packet arrived.. In strict uRPF mode, the router checks that the source IP address of an incoming packet is reachable via the same interface on which the packet arrived. Even if the route for the source subnet exists in the routing table, if the best return route points to a different interface (e.g., a backup link or a different path), the packet will be dropped. This is the most common cause of legitimate traffic being dropped after enabling strict uRPF.

Answer

uRPF is checking the destination IP address, which is not reachable.

Answer

The router does not have a default route, so uRPF drops all traffic.

Answer

uRPF cannot be used with static routes; it requires a dynamic routing protocol.

Question 10

What is the default OSPF hello interval on an Ethernet broadcast network?

Accepted Answer

10 seconds. On Ethernet broadcast networks, OSPF defaults to a hello interval of 10 seconds, as specified in RFC 2328. This interval is used to maintain neighbor relationships and detect failures quickly on high-speed multi-access links.

Answer

30 seconds

Answer

5 seconds

Answer

20 seconds

Question 11

Drag and drop each queuing mechanism on the left to its matching feature on the right.

Accepted Answer

FIFO: No classification, single queue, packets served in order of arrival. FIFO is the simplest queuing with no classification; WFQ provides fair bandwidth distribution; CBWFQ allows user-defined classes; LLQ adds a strict priority queue; PQ always services the highest-priority queue first.

Question 12

Drag and drop the steps of SNMP bulk walk operation process into the correct order, from first to last.

Accepted Answer

Send GetBulkRequest with non-repeaters. The manager initiates a GetBulkRequest, the agent responds with multiple variables, and the process repeats until all OIDs are retrieved.

Question 13

A network administrator runs the following debug on a router:

R1# debug aaa authorization

*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Processing author request for user 'jdoe'
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Method=TACACS+
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): TACACS+ server 10.1.1.10:49, timeout 5
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Sent author request
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Received PASS response
*Mar  1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Pass

Based on this output, what can be concluded?

Accepted Answer

The TACACS+ server authorized the user successfully.. The debug output shows a 'Received PASS response' from the TACACS+ server at 10.1.1.10:49, followed by 'Pass'. This indicates that the TACACS+ authorization request for user 'jdoe' was successful. TACACS+ encrypts the entire packet and separates authentication, authorization, and accounting (AAA), allowing granular authorization control.

Answer

The user jdoe failed authorization.

Answer

Authorization was performed using RADIUS.

Answer

The user was authenticated but not authorized.

Question 14

Drag and drop each SNMP operation on the left to its matching direction on the right.

Accepted Answer

GET: Manager requests a specific variable from agent. GET, GETNEXT, GETBULK, and SET are initiated by the manager; TRAP and INFORM are initiated by the agent.

Question 15

Drag and drop each flow record field on the left to its matching category (key or non-key) on the right.

Accepted Answer

Source IPv4 address: Key field. Key fields define a unique flow (e.g., source IP, destination IP, protocol). Non-key fields provide additional data (e.g., byte count, packet count, timestamps).