CCNP Practice Test 17 — 15 Questions

Question 1

Drag and drop each traffic direction on the left to its correct SPAN keyword on the right.

Accepted Answer

Ingress traffic: rx keyword. Ingress traffic is monitored with the 'monitor session source interface x/x rx' keyword; egress with 'tx'; both directions with 'both'.

Question 2

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

Accepted Answer

Configure the port as a trunk port.. A trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Answer

Configure the port as a dynamic desirable port.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port.

Question 3

Drag and drop the steps of RADIUS CoA (Change of Authorization) message flow into the correct order, from first to last.

Accepted Answer

RADIUS server sends CoA-Request to NAS. RADIUS CoA allows a server to dynamically change a session's authorization. The server sends a CoA-Request to the network access server (NAS). The NAS acknowledges with CoA-ACK and applies the new policy. If the session is affected, the NAS may send a disconnect or re-authenticate.

Question 4

Drag and drop each AAA function on the left to its matching description on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device. Authentication verifies identity; Authorization determines permitted actions; Accounting tracks usage for auditing or billing.

Question 5

Drag and drop each protocol number on the left to its matching protocol on the right.

Accepted Answer

1: ICMP. Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 2 is IGMP.

Question 6

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Accepted Answer

Customer edge (CE) routers exchange routing information with provider edge (PE) routers using static routing, RIP, OSPF, EIGRP, or BGP.. MPLS L3VPNs use VRFs for isolation, MP-BGP for route exchange, and MPLS labels for forwarding, with the provider core unaware of customer routes.

Answer

The MPLS core routers (P routers) maintain full VPN routing tables to forward traffic based on customer IP prefixes.

Answer

Route targets (RT) are used to uniquely identify each customer VPN across the provider network.

Question 7

Drag and drop each IPv6 ACL feature on the left to its matching IPv4 ACL equivalent on the right.

Accepted Answer

ipv6 access-list: Equivalent to ip access-list extended in IPv4. IPv6 ACLs use similar logic but with IPv6-specific syntax: deny/ipv6, permit/ipv6, sequence numbers, and implicit deny.

Question 8

Which two statements about DMVPN Phase 2 are true? (Choose two.)

Accepted Answer

Spokes can establish direct tunnels to each other without traversing the hub.. DMVPN Phase 2 allows spoke-to-spoke tunnels after initial hub registration, uses mGRE on spokes, and supports dynamic routing between spokes. NHRP is used for resolution.

Answer

All traffic must pass through the hub router at all times.

Answer

Phase 2 uses only point-to-point GRE tunnels on the hub.

Answer

Phase 2 does not support dynamic routing protocols between spokes.

Question 9

Drag and drop each ACL type on the left to its matching capability on the right.

Accepted Answer

Standard ACL: Filters based on source IP address only. Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow alphanumeric naming; Time-based ACLs restrict based on time of day.

Question 10

Drag and drop each protocol number on the left to its matching protocol on the right.

Accepted Answer

1: Internet Control Message Protocol (ICMP). Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 88 is EIGRP.

Question 11

Which two statements about Control Plane Policing (CoPP) are true? (Choose two.)

Accepted Answer

CoPP uses ACLs to match traffic destined for the control plane.. CoPP uses ACLs to classify traffic destined for the control plane and applies a policy map to rate-limit or drop that traffic. It protects the control plane from excessive or malicious traffic. The service policy is applied to the control plane, not to interfaces. CoPP does not protect the data plane forwarding path; it only filters traffic that is punted to the control plane. CoPP can be applied to both IPv4 and IPv6 traffic.

Answer

CoPP can only be used to rate-limit traffic, not to drop it.

Answer

CoPP is applied to all physical interfaces to protect the data plane.

Answer

CoPP can only filter IPv4 traffic.

Question 12

Which three statements about IPv4 ACLs on Cisco IOS are true? (Choose three.)

Accepted Answer

Standard ACLs can filter traffic based on source IP address only.. Standard ACLs filter only source IP, extended ACLs filter more fields, and the implicit deny is always present. The incorrect options confuse the order of processing or the placement of ACLs.

Answer

ACL entries are processed from bottom to top, with the last match determining the action.

Answer

An ACL applied to an inbound interface filters traffic leaving that interface.

Question 13

Drag and drop the steps of IBNS 2.0 concurrent authentication policy map into the correct order, from first to last.

Accepted Answer

Switch initiates 802.1X authentication. IBNS 2.0 uses a policy map that first triggers 802.1X, then if that fails, concurrently tries MAB and web authentication, evaluates the first successful method, and finally applies the corresponding authorization result.

Question 14

Drag and drop each TrustSec component on the left to its matching function on the right.

Accepted Answer

SGT: 16-bit security tag embedded in Ethernet or IP packets. SGT tags traffic, SGACL enforces policy, SXP propagates SGTs, and MACsec encrypts at Layer 2.

Question 15

Drag and drop each 802.1X component on the left to its matching role on the right.

Accepted Answer

Supplicant: Client device that initiates authentication. Supplicant requests access, Authenticator enforces port state, Authentication Server validates credentials.