CCNP Practice Test 21 — 15 Questions

Question 1

A network engineer is configuring a Switched Port Analyzer (SPAN) session on a Cisco Catalyst switch to capture traffic from a specific VLAN. Which configuration command is required to monitor all traffic on VLAN 10 and send it to a destination port?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

monitor session 1 source vlan 10. To monitor all traffic on VLAN 10, the correct command is 'monitor session 1 source vlan 10'. This sets the source VLAN for the SPAN session. The destination port is then configured separately. Other options either use incorrect syntax or confuse source and destination roles.

Answer

monitor session 1 source interface vlan 10

Answer

monitor session 1 destination vlan 10

Answer

monitor session 1 filter vlan 10

Question 2

A network engineer is deploying Cisco ACI in a data center. The engineer needs to configure a bridge domain that provides Layer 2 connectivity between endpoints in the same tenant. Which two statements about Cisco ACI bridge domains are true? (Choose two.)

Accepted Answer

A bridge domain can contain multiple subnets.. In Cisco ACI, a bridge domain is a Layer 2 construct that can contain multiple subnets and must be associated with a VRF to enable Layer 3 routing. The VRF provides the routing context, and multiple subnets allow flexible IP addressing within the same bridge domain. VLAN pools are used for VLAN allocation but are not a direct requirement for the bridge domain itself.

Answer

A bridge domain requires a VLAN pool to be defined in the fabric access policies.

Answer

A bridge domain can only contain a single subnet.

Answer

A bridge domain provides Layer 3 routing between subnets by default.

Question 3

Consider the following Python script using the requests library to interact with a Cisco IOS-XE device via RESTCONF:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=1/0/1'
headers = {
    'Accept': 'application/yang-data+json',
    'Content-Type': 'application/yang-data+json'
}
auth = HTTPBasicAuth('admin', 'cisco')

response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the script attempting to do?

Accepted Answer

It retrieves the configuration of GigabitEthernet1/0/1 in JSON format.. The script uses an HTTP GET request to the RESTCONF API endpoint for GigabitEthernet1/0/1. The GET method is specifically used to retrieve data, and the 'Accept: application/yang-data+json' header tells the server to return the configuration in JSON format. This matches option B exactly.

Answer

It updates the IP address of GigabitEthernet1/0/1.

Answer

It deletes the interface configuration.

Answer

It creates a new interface.

Question 4

A network architect is designing a Cisco ACI fabric for a multi-tenant data center. Tenants must be isolated at Layer 3, but some tenants require shared services such as a firewall and load balancer. Which Cisco ACI construct should the architect use to allow selective communication between tenants while maintaining isolation?

Accepted Answer

A contract between the tenant EPG and a shared services EPG in the common tenant. Cisco ACI enables selective inter-tenant communication by placing shared services in the common tenant and using contracts that are exported and consumed by tenant EPGs. This preserves Layer 3 isolation between tenants while permitting only the traffic defined by the contract. The shared services EPG can be a firewall or load balancer, and the contract enforces the allowed protocols and ports.

Answer

A VRF leak between the tenant VRFs using route targets

Answer

A bridge domain shared between tenants with a common subnet

Answer

A shared L3Out with a common EPG for all tenants

Question 5

Drag and drop each WAN transport type on the left to its matching SD-WAN characteristic on the right.

Accepted Answer

MPLS: Provides guaranteed SLA, low jitter, and private connectivity. MPLS offers predictable performance; broadband Internet provides low-cost but variable quality; LTE offers mobility; 5G adds low latency and high bandwidth.

Question 6

Drag and drop the steps of using a REST API to retrieve interface statistics from a Cisco device into the correct order, from first to last.

Accepted Answer

Authenticate with the REST API. The process starts with authenticating to the device's REST API, then constructing the GET request for the interface statistics endpoint. The device processes the request, retrieves the data, and sends a JSON response. The client then parses the JSON to extract the statistics.

Question 7

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that the health score for a particular building has dropped significantly. Which feature of Cisco DNA Center Assurance should the administrator use to identify the root cause of the issue by analyzing network events and device performance metrics over time?

Accepted Answer

AI Network Analytics. AI Network Analytics leverages machine learning to process large volumes of historical data, including device performance metrics and network events, to identify the root cause of health score degradation. Unlike dashboards or path trace tools that provide current state or connectivity views, AI Network Analytics correlates past and present data to uncover underlying issues, making it the correct choice for deep root cause analysis.

Answer

Assurance Issues

Answer

Network Health Dashboard

Answer

Path Trace

Question 8

Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.

Accepted Answer

Client sends Access-Request to RADIUS server. RADIUS uses UDP and encrypts only the password in the Access-Request. The server checks credentials and responds with Access-Accept or Access-Reject. Accounting-Start is sent after authentication succeeds.

Question 9

A network architect is designing a data center fabric that uses VXLAN with an EVPN control plane on Cisco Nexus 9000 switches. The architect must justify why EVPN is preferred over a flood-and-learn VXLAN data plane. Which two statements correctly describe advantages of using an EVPN control plane in this design? (Choose two.)

Accepted Answer

It distributes MAC address reachability through BGP so VTEPs do not need to flood frames to learn remote host locations. An EVPN control plane advertises MAC and IP reachability via BGP, avoiding data-plane flooding for host learning, and it supports standards-based all-active multihoming through Ethernet Segment identifiers and DF election. It does not remove the underlay routing requirement, convert VXLAN to MPLS, or eliminate the VTEP loopback, so those statements are incorrect for this design.

Answer

It converts VXLAN tunnels into MPLS LSPs to improve forwarding performance between leaf switches

Answer

It eliminates the need for any underlay routing protocol because BGP carries all traffic between leaf switches

Answer

It removes the requirement for a loopback interface on each VTEP by using physical interface addresses

Question 10

Drag and drop the steps of gNMI Subscribe RPC using Python gRPC library into the correct order, from first to last.

Accepted Answer

Import gnmi_pb2, gnmi_pb2_grpc, and grpc. The correct order starts with importing the gNMI protobuf modules and gRPC, creating a secure channel with credentials, instantiating the gNMI stub, building a SubscribeRequest with paths and mode, and finally calling the Subscribe RPC and iterating over responses.

Question 11

Drag and drop the steps of SD-Access fabric endpoint registration into the correct order, from first to last.

Accepted Answer

Endpoint sends ARP or DHCP request. The correct order begins with the endpoint sending an ARP or DHCP request, the edge node detecting the new endpoint, registering it with the control plane (LISP), the control plane updating the map server, and finally the edge node installing the necessary forwarding entries. This sequence ensures the endpoint is properly discovered and integrated into the fabric.

Question 12

Which three statements about IP SLA probe types and their characteristics are true? (Choose three.)

Accepted Answer

The UDP jitter operation measures one-way delay, jitter, and packet loss in both directions.. Option A is correct because the UDP jitter operation sends a stream of UDP packets and, with an IP SLA responder on the far end, reports one-way delay (both directions), positive and negative jitter (inter-packet delay variation), and packet loss in each direction. Option B is correct because the ICMP echo operation measures round-trip time by sending ICMP Echo Requests, and the resulting per-probe RTT samples can be used to derive jitter statistics. Option C is correct because the TCP connect operation times how long it takes to complete the TCP three-way handshake (SYN, SYN-ACK, ACK) with a target host and port, which is useful for verifying application reachability. Option D is not correct because DNS resolution timing is provided by the DNS operation, not the HTTP operation, which measures transaction time such as connect, request, and response. Option E is not correct because ICMP echo works without an IP SLA responder on the target; the responder is required for operations like UDP jitter that need timestamping and packet generation support.

Answer

The HTTP operation measures the time to resolve the DNS name of the target web server.

Answer

The ICMP echo operation requires the IP SLA responder to be enabled on the target device.

Question 13

A network architect is designing a Cisco SD-Access fabric for a large enterprise. The fabric will use VXLAN encapsulation and a Layer 3 underlay. The architect must ensure that the fabric supports the separation of policy from topology and allows endpoints to be assigned to virtual networks. Which Cisco SD-Access component is responsible for maintaining the mapping between endpoint IP addresses and their fabric locators, and for providing the control plane that enables fabric edge nodes to resolve endpoint locations?

Accepted Answer

Control plane node. In Cisco SD-Access, the control plane node hosts the LISP map-server and map-resolver functions, maintaining the endpoint-to-locator mapping database. Fabric edge nodes query this node to resolve endpoint locations. This design separates policy from topology and supports virtual network assignment. The other components either connect endpoints, handle external traffic, or forward underlay packets, but none maintain the mapping database.

Answer

Fabric border node

Answer

Fabric intermediate node

Answer

Fabric edge node

Question 14

A network administrator needs to validate that the path taken by packets from a branch router to a remote server matches the expected primary path. The administrator wants to collect per-hop latency and packet loss statistics along that path. Which tool should be used?

Accepted Answer

IP SLA with a path-echo operation. IP SLA path-echo is designed to trace the path to a destination and collect per-hop latency and packet loss. Unlike simple ICMP echo, it provides hop-by-hop details, which are necessary to validate that traffic follows the expected primary path. The other options either lack hop-by-hop granularity or are not performance-monitoring tools.

Answer

Cisco IOS Embedded Event Manager (EEM) with a Tcl script

Answer

IOS IP SLA with an ICMP echo operation

Answer

Cisco Discovery Protocol (CDP) neighbor details

Question 15

A network engineer is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The engineer wants to view detailed hop-by-hop performance metrics for the path between the user's endpoint and the voice gateway over the last 24 hours. Which Assurance feature should the engineer use?

Accepted Answer

Path Trace. Cisco DNA Center Assurance Path Trace is designed to provide detailed hop-by-hop performance metrics for a specific path between two endpoints. It collects and displays latency, jitter, and packet loss per hop, which is essential for diagnosing voice quality issues. The other features offer summary or client-centric views but not the granular path data required.

Answer

Application Experience

Answer

Client 360

Answer

Network Health Dashboard