CCNP Practice Test 20 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all)
      50 packets, 2500 bytes
      5 minute offered rate 500 bps
      Match: access-group name BGP-ACL
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 50 packets, 2500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SNMP-CLASS (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: access-group name SNMP-ACL
      police:
          cir 16000 bps, bc 2000 bytes, be 2000 bytes
        conformed 150 packets, 7500 bytes; actions:
          transmit
        exceeded 40 packets, 2000 bytes; actions:
          drop
        violated 10 packets, 500 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: any
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 100 packets, 5000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.. The output shows that for the SNMP-CLASS, 40 packets exceeded and 10 packets violated the policer, resulting in drops, while the BGP-CLASS had 0 exceeded and 0 violated packets, meaning all BGP traffic conformed to its CIR of 64000 bps. This confirms that SNMP traffic is being dropped due to exceeding its policer rate, while BGP traffic is within its rate.

Answer

BGP traffic is being dropped because it exceeds the CIR.

Answer

All traffic to the control plane is being dropped.

Answer

The control-plane policy is applied in the output direction.

Question 2

Which three statements about using Python for interacting with Cisco IOS-XE devices via NETCONF and RESTCONF are true? (Choose three.)

Accepted Answer

The ncclient Python library can be used to establish a NETCONF session with a Cisco IOS-XE device and retrieve YANG-modeled data.. The correct answers are A, B, and C. Option A is true because the ncclient library is specifically designed for NETCONF sessions and can retrieve YANG-modeled data from Cisco IOS-XE devices. Option B is true: RESTCONF uses standard HTTP methods (GET, POST, PUT, DELETE) to access YANG-defined data. Option C is true: YANG models define the structure, constraints, and semantics of data accessible via NETCONF or RESTCONF. Option D is false because RESTCONF supports JSON and XML encoding, not YAML. Option E is false: NETCONF uses XML encoding (not binary) and is not always faster than RESTCONF; performance depends on network conditions, payload size, and device implementation.

Answer

RESTCONF only supports data encoding in YAML format.

Answer

NETCONF is always faster than RESTCONF for retrieving large amounts of data because it uses a binary encoding.

Question 3

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

Accepted Answer

The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.. When a VRF is applied to an interface on a Cisco ASR 1000, the interface's IP address is removed because the VRF changes the routing context. The engineer must reconfigure the IP address under the VRF interface. Without the IP address, the BGP session cannot establish a TCP connection, causing it to go down.

Answer

The BGP neighbor is not configured with the password command.

Answer

The route-target import/export values are incorrect for the customer.

Answer

The engineer forgot to configure the VRF under the BGP router-id.

Question 4

Drag and drop the steps of configuring Control Plane Policing (CoPP) on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Create access-list to match control plane traffic. CoPP protects the control plane by filtering traffic. First, define an access-list to match the traffic of interest (e.g., SSH, BGP). Second, create a class-map to reference the access-list. Third, create a policy-map that assigns a police action (rate-limit) to the class. Fourth, apply the policy-map to the control plane in the inbound direction. Finally, verify the policy with show commands to ensure correct operation.

Question 5

A network engineer issues the following command on Router R4:

R4# show ip ospf database

OSPF Router with ID (4.4.4.4) (Process ID 1)

Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         123         0x80000002 0x00A1B2 2
2.2.2.2         2.2.2.2         456         0x80000003 0x00B2C3 3
4.4.4.4         4.4.4.4         789         0x80000001 0x00C3D4 1

Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.1.2     2.2.2.2         234         0x80000001 0x00D4E5

Based on this output, what can be concluded?

Accepted Answer

Router 2.2.2.2 is the Designated Router on the segment 192.168.1.0/24.. The Net Link States entry shows the link ID 192.168.1.2 (the DR's interface IP) and ADV Router 2.2.2.2, which indicates that router 2.2.2.2 is the Designated Router (DR) on the 192.168.1.0/24 segment. In OSPF, only the DR originates the Type 2 (Network LSA) for a broadcast segment, so the advertising router in the Net Link States is always the DR.

Answer

Router 1.1.1.1 has three OSPF-enabled interfaces.

Answer

Router 4.4.4.4 is the BDR on the segment.

Answer

There are multiple broadcast segments in area 0.

Question 6

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Accepted Answer

HTTP and HTTPS traffic from 192.168.1.0/24. The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Answer

ICMP traffic from any source

Answer

FTP traffic from 192.168.1.0/24

Answer

SSH traffic from 192.168.1.0/24

Question 7

Drag and drop the steps of Q-in-Q (802.1ad) double-tagging configuration into the correct order, from first to last.

Accepted Answer

Enable Q-in-Q globally with vlan dot1q tag native. Q-in-Q configuration requires first enabling the feature globally, then configuring the trunk port as a dot1q tunnel port, setting the native VLAN, and finally applying the service instance to encapsulate traffic. Verification ensures proper double-tagging.

Question 8

Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.

Accepted Answer

Create VRF and assign route distinguisher. The correct order first defines the VRF, then configures the NAT inside and outside interfaces under the VRF, defines the NAT pool or ACL for translation, applies the NAT rule referencing the VRF, and finally verifies the translation with show ip nat translations vrf.

Question 9

Drag and drop the steps of DHCP snooping and dynamic ARP inspection flow into the correct order, from first to last.

Accepted Answer

Switch enables DHCP snooping globally and per VLAN. DHCP snooping first builds a binding table by monitoring DHCP messages. The switch validates DHCP server messages on trusted ports and discards rogue offers. For DAI, the switch intercepts ARP packets and checks the sender MAC and IP against the DHCP snooping binding table. If the ARP packet matches, it is forwarded; otherwise, it is dropped.

Question 10

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Accepted Answer

Create community string. First define the community string, then associate it with an ACL, then apply it to views or groups, and finally verify.

Question 11

Drag and drop the steps of WRED configuration for TCP congestion avoidance into the correct order, from first to last.

Accepted Answer

Enable WRED on interface or in policy-map. First, enable WRED under an interface or policy-map. Then set the minimum and maximum thresholds for each IP precedence or DSCP value. Configure the mark probability denominator. Apply the policy-map to the interface. Finally, verify WRED operation using show queueing or show policy-map interface.

Question 12

Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.

Accepted Answer

Identify YANG module for interfaces. YANG traversal starts with identifying the YANG module for interfaces, then navigating to the interfaces container, selecting the specific interface list entry, accessing the statistics container, and finally reading the desired leaf values like in-octets.

Question 13

Drag and drop the steps of Dynamic Trunking Protocol (DTP) negotiation into the correct order, from first to last.

Accepted Answer

Set interface to switchport mode trunk. DTP negotiation begins with the interface defaulting to dynamic desirable or auto mode. If a switchport is set to trunk, DTP sends frames to negotiate. The neighbor responds if in a compatible mode. Once agreed, the link becomes trunking. Finally, both ends forward traffic for multiple VLANs.

Question 14

Drag and drop the steps of Cisco SD-WAN control plane establishment sequence into the correct order, from first to last.

Accepted Answer

vBond orchestrates initial authentication and redirect. The control plane setup begins with vBond orchestrating initial authentication and directing devices to vManage and vSmart. Then each device establishes a DTLS/TLS connection to vManage for management. Next, devices establish DTLS/TLS connections to vSmart for control. After that, OMP peering is set up between edges and vSmart. Finally, BFD sessions are established between edge devices for data plane liveliness detection.

Question 15

Drag and drop each Ansible connection type on the left to its matching protocol on the right.

Accepted Answer

network_cli: SSH-based CLI connection to network devices. network_cli uses SSH for CLI commands, netconf uses SSH for NETCONF XML, httpapi uses HTTP/HTTPS for REST APIs (e.g., NX-API).