CCNP Practice Test 23 — 15 Questions

Question 1

Drag and drop each AAA function on the left to its matching description on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device. Authentication verifies identity; Authorization determines permitted actions; Accounting tracks usage for auditing or billing.

Question 2

An architect is designing a virtualized environment for network functions that require direct access to physical NICs for performance. The hypervisor must support PCI passthrough. Which hypervisor type is best suited for this requirement?

Accepted Answer

Type 1 hypervisor (e.g., VMware ESXi or KVM).. A Type 1 hypervisor (bare-metal) runs directly on the hardware and has direct access to physical resources, including PCIe devices. It supports PCI passthrough (e.g., Intel VT-d or AMD IOMMU), which allows a virtual machine to directly access a physical NIC without hypervisor intervention, maximizing performance for network functions. VMware ESXi and KVM are common Type 1 hypervisors that implement this capability.

Answer

Type 2 hypervisor (e.g., VirtualBox or VMware Workstation).

Answer

Container runtime (e.g., Docker).

Answer

Bare-metal server without virtualization.

Question 3

Drag and drop each protocol number on the left to its matching protocol on the right.

Accepted Answer

1: ICMP. Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 2 is IGMP.

Question 4

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Accepted Answer

Customer edge (CE) routers exchange routing information with provider edge (PE) routers using static routing, RIP, OSPF, EIGRP, or BGP.. MPLS L3VPNs use VRFs for isolation, MP-BGP for route exchange, and MPLS labels for forwarding, with the provider core unaware of customer routes.

Answer

The MPLS core routers (P routers) maintain full VPN routing tables to forward traffic based on customer IP prefixes.

Answer

Route targets (RT) are used to uniquely identify each customer VPN across the provider network.

Question 5

Drag and drop each IPv6 ACL feature on the left to its matching IPv4 ACL equivalent on the right.

Accepted Answer

ipv6 access-list: Equivalent to ip access-list extended in IPv4. IPv6 ACLs use similar logic but with IPv6-specific syntax: deny/ipv6, permit/ipv6, sequence numbers, and implicit deny.

Question 6

Which two statements about DMVPN Phase 2 are true? (Choose two.)

Accepted Answer

Spokes can establish direct tunnels to each other without traversing the hub.. DMVPN Phase 2 allows spoke-to-spoke tunnels after initial hub registration, uses mGRE on spokes, and supports dynamic routing between spokes. NHRP is used for resolution.

Answer

All traffic must pass through the hub router at all times.

Answer

Phase 2 uses only point-to-point GRE tunnels on the hub.

Answer

Phase 2 does not support dynamic routing protocols between spokes.

Question 7

Drag and drop each ACL type on the left to its matching capability on the right.

Accepted Answer

Standard ACL: Filters based on source IP address only. Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow alphanumeric naming; Time-based ACLs restrict based on time of day.

Question 8

Drag and drop each protocol number on the left to its matching protocol on the right.

Accepted Answer

1: Internet Control Message Protocol (ICMP). Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 88 is EIGRP.

Question 9

Which two statements about Control Plane Policing (CoPP) are true? (Choose two.)

Accepted Answer

CoPP uses ACLs to match traffic destined for the control plane.. CoPP uses ACLs to classify traffic destined for the control plane and applies a policy map to rate-limit or drop that traffic. It protects the control plane from excessive or malicious traffic. The service policy is applied to the control plane, not to interfaces. CoPP does not protect the data plane forwarding path; it only filters traffic that is punted to the control plane. CoPP can be applied to both IPv4 and IPv6 traffic.

Answer

CoPP can only be used to rate-limit traffic, not to drop it.

Answer

CoPP is applied to all physical interfaces to protect the data plane.

Answer

CoPP can only filter IPv4 traffic.

Question 10

An enterprise uses VRF-lite to isolate guest Wi-Fi traffic from corporate traffic on a Cisco Catalyst 9300 switch. The guest VRF (GUEST) is configured on VLAN 100, and the corporate VRF (CORP) on VLAN 200. Both VRFs use the same default gateway router connected via a trunk. The engineer notices that guest devices can reach the internet but cannot access the guest captive portal hosted on a server in VLAN 100. The server's IP is reachable from the switch itself. What is the issue?

Accepted Answer

The guest server is in a different VLAN than the guest wireless subnet, and inter-VLAN routing is not configured within the GUEST VRF.. The issue is that the guest captive portal server resides in VLAN 100, but the guest wireless subnet is likely in a different VLAN or subnet within the GUEST VRF. Since VRF-lite provides separate routing tables, inter-VLAN routing within the same VRF must be explicitly configured (e.g., using SVIs with 'ip routing' and proper VRF forwarding). The switch can reach the server because it is directly connected, but guest devices cannot because their traffic is not routed between the wireless subnet and the server's VLAN within the GUEST VRF.

Answer

The trunk between the switch and the router is not allowing VLAN 100.

Answer

The guest VRF is missing the route-target export command.

Answer

The captive portal server is configured with a default gateway that points to the corporate VRF.

Question 11

Which three statements about IPv4 ACLs on Cisco IOS are true? (Choose three.)

Accepted Answer

Standard ACLs can filter traffic based on source IP address only.. Standard ACLs filter only source IP, extended ACLs filter more fields, and the implicit deny is always present. The incorrect options confuse the order of processing or the placement of ACLs.

Answer

ACL entries are processed from bottom to top, with the last match determining the action.

Answer

An ACL applied to an inbound interface filters traffic leaving that interface.

Question 12

Drag and drop the steps of IBNS 2.0 concurrent authentication policy map into the correct order, from first to last.

Accepted Answer

Switch initiates 802.1X authentication. IBNS 2.0 uses a policy map that first triggers 802.1X, then if that fails, concurrently tries MAB and web authentication, evaluates the first successful method, and finally applies the corresponding authorization result.

Question 13

Drag and drop each TrustSec component on the left to its matching function on the right.

Accepted Answer

SGT: 16-bit security tag embedded in Ethernet or IP packets. SGT tags traffic, SGACL enforces policy, SXP propagates SGTs, and MACsec encrypts at Layer 2.

Question 14

Drag and drop each 802.1X component on the left to its matching role on the right.

Accepted Answer

Supplicant: Client device that initiates authentication. Supplicant requests access, Authenticator enforces port state, Authentication Server validates credentials.

Question 15

Which two statements about 802.1X authentication process are true? (Choose two.)

Accepted Answer

The supplicant sends an EAPOL-Start frame to begin the authentication process.. In 802.1X, the supplicant (client) initiates the session by sending an EAPOL-Start, or the authenticator (switch) can send an EAP-Request/Identity to prompt the client. The RADIUS server is the authentication server that validates credentials and sends an EAP-Success or EAP-Failure. The authenticator does not perform the actual authentication; it only relays EAP frames.

Answer

The authenticator (switch) performs the actual authentication of the supplicant credentials.

Answer

EAPOL frames are used only between the authentication server and the authenticator.

Answer

The authenticator places the port in the unauthorized state before authentication completes.