CCNP Practice Test 19 — 15 Questions

Question 1

A network engineer runs the following command on Router R3:

R3# show mpls ldp bindings
  lib entry: 10.1.1.1/32, rev 2
        local binding:  label: 16
        remote binding: lsr: 10.1.1.2:0, label: 17
  lib entry: 10.2.2.0/24, rev 4
        local binding:  label: 18
        remote binding: lsr: 10.1.1.2:0, label: 19
  lib entry: 10.3.3.0/24, rev 6
        local binding:  label: 20
        remote binding: lsr: 10.1.1.2:0, label: 21

Based on this output, what is true?

Accepted Answer

For prefix 10.1.1.1/32, the local label is 16 and the remote label from LSR 10.1.1.2 is 17.. The output of 'show mpls ldp bindings' directly shows that for prefix 10.1.1.1/32, the local label assigned by R3 is 16, and the remote label learned from LSR 10.1.1.2 (its LDP peer) is 17. This is a straightforward reading of the command output, confirming the local and remote label bindings for that FEC.

Answer

The router has learned label bindings from two different LDP peers.

Answer

The label for prefix 10.2.2.0/24 is 18 locally and 19 remotely, indicating that the remote LSR will use label 18.

Answer

The LIB entry for 10.3.3.0/24 has a revision number of 6, meaning it was the sixth entry added.

Question 2

An architect is designing an SD-WAN deployment for a multinational enterprise. The design must ensure that control plane traffic remains separate from data plane traffic and that the solution can scale to thousands of sites. Which architectural component is responsible for maintaining the control plane and distributing routing information?

Accepted Answer

vSmart controller. The vSmart controller is the centralized control plane component in Cisco SD-WAN that distributes routing information (OMP routes) and policies to all vEdge/cEdge routers. It maintains the control plane by separating route advertisement and policy enforcement from the data plane, which is handled by the vEdge routers. This separation allows the solution to scale to thousands of sites because vSmart controllers can be clustered and do not process actual data traffic.

Answer

vBond orchestrator

Answer

vManage NMS

Answer

vEdge router

Question 3

An engineer configures VXLAN EVPN on a Nexus 9000 switch. The configuration is shown. The switch does not advertise any EVPN routes for VNI 10100. Which configuration change is required to fix this issue?

Accepted Answer

Configure "evpn" and "vni 10100 l2" under the BGP address-family l2vpn evpn.. For VXLAN EVPN on a Nexus 9000, the BGP address-family l2vpn evpn must explicitly contain the 'evpn' keyword and the 'vni 10100 l2' command to advertise Layer 2 VNI routes. Without this configuration, BGP does not know to inject the VNI's MAC/VTEP information into the EVPN route table, so no EVPN routes are advertised for VNI 10100.

Answer

Remove the mcast-group from the NVE member, because EVPN uses BGP for control plane.

Answer

Change the source-interface to a physical interface.

Answer

Add an IP address to the VLAN 100 interface in the default VRF.

Question 4

A network engineer runs the following command on Router R4:

R4# show mpls interfaces
Interface              IP            Tunnel   BGP Static Operational
GigabitEthernet0/0     Yes           No       No  No     Yes
GigabitEthernet0/1     Yes           No       No  No     Yes
GigabitEthernet0/2     No            No       No  No     No

Based on this output, what can be concluded?

Accepted Answer

MPLS is enabled and operational on GigabitEthernet0/0 and GigabitEthernet0/1.. The 'show mpls interfaces' command displays MPLS status per interface. The 'Operational' column indicates whether MPLS is actively forwarding labels. GigabitEthernet0/0 and GigabitEthernet0/1 both show 'Yes' in the Operational column, confirming MPLS is enabled and operational on those interfaces. GigabitEthernet0/2 shows 'No' in both the IP and Operational columns, meaning MPLS is not enabled or operational there.

Answer

MPLS is enabled on all three interfaces, but only Gi0/0 and Gi0/1 are operational.

Answer

BGP and Static label switching are enabled on Gi0/0 and Gi0/1.

Answer

Tunnel interfaces are configured on Gi0/0 and Gi0/1.

Question 5

A network engineer writes an Ansible playbook to configure a VLAN on a Cisco Nexus switch:

```yaml
---
- name: Configure VLAN
  hosts: nxos_switches
  gather_facts: no
  tasks:
    - name: Create VLAN 100
      cisco.nxos.nxos_vlan:
        vlan_id: 100
        name: test_vlan
        state: present
```

What is a potential issue with this playbook?

Accepted Answer

The playbook is missing the 'connection: network_cli' and 'become: yes' directives to enable privileged mode.. Ansible modules for Cisco NX-OS require `connection: network_cli` (or `ansible_connection: network_cli`) to use the CLI transport, and `become: yes` to elevate privileges to enable mode (similar to `enable` on a switch). Without these, the playbook will fail to authenticate or execute privileged commands, as the `nxos_vlan` module needs to send configuration commands that require enable access.

Answer

The module name is incorrect; it should be 'nxos_vlan_config' instead of 'nxos_vlan'.

Answer

The VLAN ID must be a string, not an integer.

Answer

The 'state: present' is invalid; it should be 'state: create'.

Question 6

A network engineer is analyzing traffic flows using Cisco IOS NetFlow on a router. The engineer notices that the NetFlow cache is filling up rapidly, causing older entries to be exported prematurely before they can be properly aggregated. Which NetFlow configuration parameter should the engineer adjust to control the maximum number of entries in the cache?

Accepted Answer

cache entries. In Cisco IOS NetFlow, the cache has a maximum number of entries defined by the 'cache entries' command. When the cache reaches this limit, the router may prematurely export older flows to free space, leading to incomplete aggregation. Increasing the cache entries allows more flows to be stored, reducing premature exports. Other parameters like timeouts affect flow expiration but not the total capacity. The engineer should adjust 'cache entries' to match the traffic volume and available memory.

Answer

cache timeout active

Answer

ip flow-export destination

Answer

cache timeout inactive

Question 7

Drag and drop each Control plane protection feature on the left to its matching threat on the right.

Accepted Answer

CoPP: CPU overload from excessive control plane traffic. CoPP protects against CPU overload; uRPF against IP spoofing; DHCP snooping against rogue DHCP server; DAI against ARP cache poisoning; IP Source Guard against IP spoofing on access ports.

Question 8

Examine the following VRF configuration:

vrf definition BLUE
 rd 1:1
 route-target export 1:1
 route-target import 2:2
!
interface GigabitEthernet0/5
 vrf forwarding BLUE
 ip address 10.0.0.1 255.255.255.0

What is the effect of having different export and import route targets?

Accepted Answer

The VRF exports routes tagged with RT 1:1 and imports routes tagged with RT 2:2, enabling selective route exchange.. The VRF BLUE configuration uses different route targets for export (1:1) and import (2:2). This enables selective route exchange: routes learned in VRF BLUE are exported with RT 1:1, and only routes tagged with RT 2:2 are imported into VRF BLUE. This is a common design for hub-and-spoke or inter-VRF route leaking scenarios where import and export RTs are intentionally asymmetric.

Answer

The configuration is invalid because export and import RTs must be identical.

Answer

The VRF will only import routes from other VRFs that also have RT 1:1.

Answer

This configuration disables route advertisement for VRF BLUE.

Question 9

Drag and drop each Layer 2 attack on the left to its matching mitigation feature on the right.

Accepted Answer

MAC flooding: Port security. MAC flooding is mitigated by port security; DHCP starvation by DHCP snooping; ARP spoofing by DAI; STP manipulation by BPDU guard; VLAN hopping by disabling DTP.

Question 10

Drag and drop the steps of TrustSec SGT classification and enforcement into the correct order, from first to last.

Accepted Answer

Switch classifies endpoint and assigns SGT. The correct order for TrustSec SGT classification and enforcement begins with the switch classifying the endpoint and assigning an SGT (A). The ingress switch then tags the packet with that SGT (B). The packet is forwarded with the SGT in the header (C). On the egress switch, the SGT is looked up in the SGACL (D), and finally the switch permits or denies the traffic based on the SGACL (E).

Question 11

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

Accepted Answer

Spoke sends NHRP Resolution Request to hub. In DMVPN Phase 2, the spoke sends an NHRP Resolution Request to the hub to learn the destination spoke's NBMA address. The hub forwards the request to the destination spoke, which replies with an NHRP Resolution Reply. The hub relays this reply back to the originating spoke. Finally, the originating spoke installs the NHRP shortcut entry and can initiate a direct tunnel to the destination spoke.

Question 12

Drag and drop the steps of LISP EID-to-RLOC mapping resolution process into the correct order, from first to last.

Accepted Answer

ITR receives packet for destination EID. The process begins when the ingress tunnel router (ITR) receives a packet for a destination EID. The ITR sends a Map-Request to the Map-Server, which looks up the mapping and replies with a Map-Reply containing the RLOC. The ITR then caches the mapping and encapsulates the packet to the egress tunnel router (ETR).

Question 13

What is the default trust state of a Cisco IOS switch port when no 'mls qos trust' command is configured?

Accepted Answer

The port is untrusted and marks all incoming packets with CoS 0.. By default, Cisco IOS switch ports are untrusted for QoS. Without the 'mls qos trust' command, the port does not trust any Layer 2 CoS or Layer 3 DSCP markings. Instead, it applies a default CoS value of 0 to all incoming packets, effectively re-marking them to the lowest priority. This ensures that traffic from untrusted sources (e.g., end hosts) does not retain potentially high-priority markings.

Answer

The port trusts the CoS value of incoming packets.

Answer

The port trusts the DSCP value of incoming packets.

Answer

The port trusts both CoS and DSCP values.

Question 14

A network engineer runs the following command on Switch SW5:

SW5# show spanning-tree vlan 50

VLAN0050
  Spanning tree enabled protocol ieee
  Root ID    Priority    24626
             Address     aabb.cc00.0800
             Cost        4
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32768  (priority 32768 sys-id-ext 50)
             Address     aabb.cc00.0900
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p
Gi0/4               Altn BLK 4         128.4    P2p

Based on this output, how many ports are in the Forwarding state?

Accepted Answer

3. The output shows four interfaces: Gi0/1 (Root FWD), Gi0/2 (Desg FWD), Gi0/3 (Desg FWD), and Gi0/4 (Altn BLK). Three ports (Gi0/1, Gi0/2, Gi0/3) are in the Forwarding state, while Gi0/4 is in the Blocking state. Therefore, the correct answer is 3.

Answer

1

Answer

2

Answer

4

Question 15

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Accepted Answer

Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.. Model-driven telemetry (MDT) using gRPC or gNMI is the correct choice because it provides a push-based, scalable, and real-time streaming mechanism for subscribing to specific YANG data paths, such as interface counters and BGP neighbor state, directly from Cisco Nexus 9000 switches running NX-OS. This approach eliminates the polling overhead of SNMP and supports high-frequency data collection, making it ideal for large-scale enterprise monitoring.

Answer

Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.

Answer

Use SNMP traps to send interface and BGP state changes to the collector.

Answer

Deploy IP SLA responders on the switches to measure performance and send results via syslog.