CCNP Practice Test 17 — 15 Questions

Question 1

Drag and drop each RADIUS attribute name on the left to its matching attribute number on the right.

Accepted Answer

User-Name: 1. RADIUS attribute numbers are standardized: User-Name=1, NAS-IP-Address=4, Service-Type=6, Framed-IP-Address=8, and Framed-Route=22.

Question 2

Which IPsec protocol provides both encryption and authentication within a single ESP header?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) provides both encryption for data confidentiality and authentication (via an optional Integrity Check Value) within a single ESP header. Unlike AH, ESP can encrypt the payload while also offering integrity and origin authentication, making it the correct choice for combined services in a single header.

Answer

AH (Authentication Header)

Answer

IKE (Internet Key Exchange)

Answer

GRE (Generic Routing Encapsulation)

Question 3

Which type of NAT translates multiple inside addresses to a single outside address using different port numbers?

Accepted Answer

Port Address Translation (PAT). Port Address Translation (PAT) is a form of dynamic NAT that maps multiple private IP addresses to a single public IP address by differentiating traffic based on Layer 4 port numbers. This allows many internal hosts to share one outside address, conserving public IPv4 addresses. PAT is commonly used on home routers and enterprise edge devices to enable internet access for numerous devices with a single public IP.

Answer

Static NAT

Answer

Dynamic NAT

Answer

Policy NAT

Question 4

Drag and drop the steps of RADIUS CoA (Change of Authorization) message flow into the correct order, from first to last.

Accepted Answer

RADIUS server sends CoA-Request to NAS. RADIUS CoA allows a server to dynamically change a session's authorization. The server sends a CoA-Request to the network access server (NAS). The NAS acknowledges with CoA-ACK and applies the new policy. If the session is affected, the NAS may send a disconnect or re-authenticate.

Question 5

An architect is designing a virtualized environment for network functions that require direct access to physical NICs for performance. The hypervisor must support PCI passthrough. Which hypervisor type is best suited for this requirement?

Accepted Answer

Type 1 hypervisor (e.g., VMware ESXi or KVM).. A Type 1 hypervisor (bare-metal) runs directly on the hardware and has direct access to physical resources, including PCIe devices. It supports PCI passthrough (e.g., Intel VT-d or AMD IOMMU), which allows a virtual machine to directly access a physical NIC without hypervisor intervention, maximizing performance for network functions. VMware ESXi and KVM are common Type 1 hypervisors that implement this capability.

Answer

Type 2 hypervisor (e.g., VirtualBox or VMware Workstation).

Answer

Container runtime (e.g., Docker).

Answer

Bare-metal server without virtualization.

Question 6

Drag and drop each protocol number on the left to its matching protocol on the right.

Accepted Answer

1: ICMP. Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 2 is IGMP.

Question 7

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

Accepted Answer

vlan 100. The correct command to create a new VLAN on a Cisco IOS switch is 'vlan 100' entered in global configuration mode. This command creates VLAN 100 and enters VLAN configuration mode, allowing you to assign a name or other parameters. The other options either apply an existing VLAN to an interface, use a deprecated method, or create a switched virtual interface (SVI) for Layer 3 routing, none of which actually create the VLAN itself.

Answer

switchport access vlan 100

Answer

vlan database

Answer

interface vlan 100

Question 8

An enterprise is using OSPF in a multi-area design. Area 1 is a regular area, and Area 2 is a totally stubby area. Which LSA types are present in Area 2?

Accepted Answer

Type 1, Type 2, Type 3 (including default). In a totally stubby area, the ABR blocks Type 4 and Type 5 LSAs and replaces all Type 3 inter-area routes with a single default route (Type 3 LSA with link-state ID 0.0.0.0). Therefore, only Type 1 (router), Type 2 (network), and the default Type 3 LSAs are present. This matches option A.

Answer

Type 1, Type 2, Type 3, Type 5

Answer

Type 1, Type 2, Type 4, Type 5

Answer

Type 1, Type 2, Type 3 (including default), Type 4

Question 9

An engineer is troubleshooting a problem where a host in VLAN 20 cannot communicate with a host in VLAN 30, even though both are connected to the same access switch. The access switch is configured with VLANs 20 and 30, and the uplink to the distribution switch is a trunk that allows both VLANs. The distribution switch has SVIs for both VLANs and IP routing is enabled. The engineer verifies that the trunk is up and both VLANs are allowed. What is the most likely cause of the communication failure?

Accepted Answer

The hosts are not configured with the correct default gateway pointing to the SVI on the distribution switch.. Hosts in different VLANs must communicate through a Layer 3 device. The correct default gateway for each host should be the IP address of the SVI on the distribution switch for its respective VLAN. If the hosts are configured with an incorrect or no default gateway, traffic cannot be routed between VLAN 20 and VLAN 30, even though the trunk and SVIs are properly configured.

Answer

The trunk is not allowing VLAN 20 or VLAN 30.

Answer

Spanning Tree Protocol is blocking the SVI interfaces.

Answer

The native VLAN mismatch on the trunk is causing the issue.

Question 10

Drag and drop the steps of Control Plane Policing (CoPP) rate-limit evaluation into the correct order, from first to last.

Accepted Answer

Define access list to match control plane traffic. CoPP first classifies traffic using an access list, then matches it to a class map, then applies a policy map with a police action (rate-limit), activates the policy on the control plane, and finally the hardware performs policing.

Question 11

Drag and drop the steps of IP Source Guard binding and enforcement into the correct order, from first to last.

Accepted Answer

Switch learns IP-to-port binding from DHCP snooping. IP Source Guard first builds the binding from DHCP snooping, then installs a per-port ACL to permit only the bound IP, applies the ACL to the access port, checks all incoming IP traffic against the ACL, and drops any traffic with a source IP not in the binding.

Question 12

Drag and drop each Netmiko device type on the left to its matching OS on the right.

Accepted Answer

cisco_ios: Cisco IOS. cisco_ios maps to IOS, cisco_nxos to NX-OS, cisco_xr to IOS-XR, and cisco_xe to IOS-XE. The fifth pair cisco_asa maps to ASA.

Question 13

A network engineer runs the following command on Router R8:

R8# show ip pim neighbor vrf CUSTOMER-F

Neighbor          Interface                Uptime/Expires    Ver   DR
10.0.3.2          GigabitEthernet0/0.700   02:00:00/00:01:30 v2    1/ DR
10.0.4.2          GigabitEthernet0/0.800   01:30:00/00:01:45 v2    0/ NDR (BDR)

Based on this output, what can be concluded?

Accepted Answer

PIM is enabled in VRF CUSTOMER-F with a DR and BDR. The output shows two PIM neighbors (10.0.3.2 and 10.0.4.2) with their respective interfaces, uptimes, and DR/BDR roles. The presence of a DR (Designated Router) and BDR (Backup Designated Router) indicates that PIM is enabled and operating in VRF CUSTOMER-F, with the DR being 10.0.3.2 (as shown by '1/ DR') and the BDR being 10.0.4.2 (as shown by '0/ NDR (BDR)'). Therefore, option C is correct.

Answer

PIM is not configured for VRF CUSTOMER-F

Answer

The DR is 10.0.4.2

Answer

Both neighbors are using PIM version 1

Question 14

Drag and drop each Ansible component on the left to its matching function on the right.

Accepted Answer

Inventory: Defines the list of managed hosts and groups. Each component has a distinct role: Inventory defines managed nodes, Playbook is the execution blueprint, Role organizes content, Module is the execution unit, and Handler reacts to changes.

Question 15

Which two statements about Ansible modules and idempotency are true? (Choose two.)

Accepted Answer

Idempotency means that running a playbook multiple times will always result in the same final state on the managed node.. Option A is correct because idempotency in Ansible means that executing the same playbook repeatedly converges the managed node to the same desired final state without making unnecessary changes on subsequent runs. Option C is correct because the copy module compares the checksum (SHA-1 by default) of the source content against the destination file and only transfers the file when they differ, so repeated runs report 'ok' instead of 'changed'. Option B is wrong because the command module is not idempotent by default—it executes the given command every time unless you add guards such as creates, removes, or changed_when. Option D is wrong because idempotency is a property of how each module is implemented, not an automatic guarantee for all modules. Option E is wrong because idempotency applies broadly across module types, including Linux system modules like yum, apt, service, and file.

Answer

The 'command' module is idempotent by default because it always runs the given command.

Answer

All Ansible modules are inherently idempotent regardless of how they are implemented.

Answer

Idempotency only applies to network modules, not to Linux system modules.