CCNP Practice Test 23 — 15 Questions

Question 1

A network engineer is analyzing traffic patterns using Cisco IOS IP Service Level Agreements (IP SLA). The engineer wants to measure the round-trip time (RTT) for HTTP traffic to a web server at 10.1.1.1. Which IP SLA operation type should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

http. The HTTP IP SLA operation is designed to measure the response time of HTTP requests. It sends a request to a web server and measures the time to receive the response. This provides the RTT for HTTP traffic. Other operation types like ICMP echo, TCP connect, or UDP jitter do not measure application-layer HTTP performance. Therefore, the HTTP operation is the correct choice.

Answer

icmp-echo

Answer

tcp-connect

Answer

udp-jitter

Question 2

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN using IPsec. The engineer wants to ensure that the VPN tunnel only carries traffic for the subnet 10.1.1.0/24 to 10.2.2.0/24. Which configuration element is required to define the interesting traffic?

Accepted Answer

crypto ACL (extended access list). The crypto ACL, an extended access list, defines the interesting traffic that should be protected by IPsec. It specifies the source and destination addresses and ports. The crypto map then references this ACL to apply the IPsec policies. Without the crypto ACL, the router would not know which packets to encrypt and send through the tunnel.

Answer

ISAKMP policy

Answer

crypto map

Answer

IPsec transform set

Question 3

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

Accepted Answer

RF interference or poor signal-to-noise ratio on the affected APs.. High client association failures with functional, registered APs most commonly indicate RF-layer problems such as interference, poor SNR, or coverage gaps. Association failures occur when clients cannot complete the 802.11 association handshake, which is heavily dependent on RF signal quality. DNA Center Assurance would flag these as RF health issues rather than configuration or controller problems.

Answer

The APs are not running the recommended firmware version.

Answer

The wireless controller has reached its maximum number of APs.

Answer

The DNA Center Assurance module is not properly configured to monitor wireless events.

Question 4

A network engineer is using Cisco DNA Center to manage a network with multiple sites. The engineer wants to ensure that all devices at a remote site have the same NTP server configuration. The engineer creates a network profile with the NTP settings and assigns it to the site. After provisioning, the engineer checks one of the switches and finds that the NTP configuration is missing. What should the engineer check first?

Accepted Answer

Verify that the device is assigned to the correct site in DNA Center.. In Cisco DNA Center, network profiles with settings like NTP are applied to devices based on site assignment. If a device is not assigned to the correct site, the profile settings will not be provisioned to it. The first thing to verify is that the device is assigned to the intended site, because site assignment is the mechanism that binds network profiles to devices.

Answer

Check if the NTP server is reachable from the device.

Answer

Ensure that the device is running a supported IOS version.

Answer

Recreate the network profile with the correct NTP settings.

Question 5

Drag and drop the steps of OSPF route redistribution into a different autonomous system into the correct order, from first to last.

Accepted Answer

Configure OSPF process on the ASBR. Redistribution requires first configuring the routing process that will receive the routes, then defining the source protocol and metric, optionally setting route tags for loop prevention, applying a route map for filtering, and finally verifying the redistributed routes appear in the OSPF database.

Question 6

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet. The engineer wants to exclude a range of addresses from being assigned dynamically. Which command should be used?

Accepted Answer

ip dhcp excluded-address. The 'ip dhcp excluded-address' command is specifically designed to prevent the DHCP server from assigning certain IP addresses. The other commands serve different purposes: creating a pool, enabling snooping, or configuring relay information. Thus, 'ip dhcp excluded-address' is the correct choice.

Answer

ip dhcp pool

Answer

ip dhcp snooping

Answer

ip dhcp relay information

Question 7

A network engineer uses the Cisco DNA Center API to trigger a provisioning workflow for a new device. The API call returns the following JSON response:

{
  "response": {
    "taskId": "task-12345",
    "url": "/api/v1/task/task-12345"
  },
  "version": "1.0"
}

The engineer then polls the task status using the URL. Which HTTP method should be used to retrieve the task status?

Accepted Answer

GET. To retrieve the status of a task, a GET request should be sent to the provided URL. The task ID is used to query the task API endpoint.

Answer

POST

Answer

PUT

Answer

DELETE

Question 8

A network engineer is implementing a VXLAN overlay over an existing Layer 3 campus network. The requirement is to carry Layer 2 frames across the Layer 3 underlay. Which protocol is used to encapsulate the original Layer 2 frame for transport across the IP network?

Accepted Answer

VXLAN with a UDP header. VXLAN encapsulates the original Layer 2 frame in a MAC-in-UDP format. The outer IP and UDP headers allow the encapsulated frame to be routed across a Layer 3 underlay, which is exactly what the scenario requires. Other encapsulation methods either need a different underlay or do not provide the VXLAN VNI and VTEP behavior.

Answer

802.1Q tagging on the underlay

Answer

MPLS label stack with a Layer 2 VPN

Answer

GRE with a protocol type of 0x6558

Question 9

Drag and drop each OSPF router role on the left to its matching function on the right.

Accepted Answer

DR: Generates Type 2 Network LSA and maintains full adjacencies with all routers on the segment. DR (Designated Router) generates Network LSAs and manages adjacencies on multi-access networks; BDR (Backup DR) takes over if the DR fails; DROTHER routers form full adjacencies only with DR and BDR; ASBR redistributes routes from other protocols; ABR connects multiple areas.

Question 10

A network engineer uses Cisco DNA Center API to retrieve the health of a device. The API call returns:

```json
{
  "response": [
    {
      "deviceId": "1234567890",
      "healthScore": 85,
      "overallHealth": "good",
      "memory": {
        "used": 4096,
        "total": 8192,
        "usage": 50
      },
      "cpu": {
        "usage": 25
      }
    }
  ]
}
```

What does the healthScore of 85 indicate?

Accepted Answer

The device is healthy with a score of 85 out of 100.. In Cisco DNA Center's device health API, healthScore is a normalized 0–100 value where higher is better; 85 corresponds to 'good' overall health. The overallHealth field ('good') confirms the interpretation. Memory usage (50%) and CPU usage (25%) are separate metrics and are not the healthScore.

Answer

The device is critical and needs immediate attention.

Answer

The device has 85% memory usage.

Answer

The device has 85% CPU usage.

Question 11

A network administrator is deploying a new Cisco Catalyst switch and wants to restrict management access to the switch. The requirement is that only hosts on the 10.10.10.0/24 subnet can access the switch via SSH, and all other SSH attempts must be denied. Which configuration achieves this?

Accepted Answer

access-list 10 permit 10.10.10.0 0.0.0.255; line vty 0 4; access-class 10 in. Using a standard ACL that permits the 10.10.10.0/24 subnet and applying it inbound on the VTY lines with access-class restricts SSH and Telnet access to only that subnet. The implicit deny at the end blocks all other sources, satisfying the requirement without affecting other traffic.

Answer

access-list 10 permit 10.10.10.0 0.0.0.255; interface vlan 1; ip access-group 10 in

Answer

access-list 10 deny 10.10.10.0 0.0.0.255; line vty 0 4; access-class 10 in

Answer

access-list 110 permit tcp 10.10.10.0 0.0.0.255 any eq 22; line vty 0 4; access-class 110 in

Question 12

A network engineer is implementing QoS on a Cisco IOS router. The engineer wants to ensure that VoIP traffic is marked with DSCP EF and that the router prioritizes this traffic during congestion. Which mechanism should be used to provide priority queuing for VoIP?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is the QoS mechanism that provides strict priority queuing, ensuring that VoIP traffic marked with DSCP EF is serviced before other traffic during congestion. This minimizes latency and jitter, which are critical for voice quality. LLQ is configured using the 'priority' command within a policy map.

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

Weighted Random Early Detection (WRED)

Answer

Traffic Shaping

Question 13

A network engineer is configuring a new Cisco Catalyst 9300 switch stack. The company requires that the native VLAN for all 802.1Q trunk ports be changed from the default to VLAN 99. The engineer enters the global configuration command vlan dot1q tag native and then configures the trunk ports with switchport trunk native vlan 99. After applying the configuration, the engineer notices that untagged frames received on the trunk are being dropped. What is the most likely cause?

Accepted Answer

The vlan dot1q tag native command causes all native VLAN frames to be tagged, so untagged frames are dropped.. Enabling vlan dot1q tag native globally causes the switch to tag all frames on the native VLAN for 802.1Q trunks. As a result, any untagged frames received on those trunks are dropped because they are not expected. This behavior is by design and explains the observed frame drops.

Answer

The vlan dot1q tag native command must be configured on all switches in the topology, not just the local switch.

Answer

The native VLAN must be the same on both ends of the trunk; otherwise, untagged frames are dropped.

Answer

The switchport trunk native vlan 99 command is only valid if the native VLAN is VLAN 1.

Question 14

Drag and drop each OSPF LSA type on the left to its matching description on the right.

Accepted Answer

Type 1: Describes the router's own directly connected links and neighbors. LSA Type 1 (Router LSA) describes a router's own links; Type 2 (Network LSA) is generated by the DR; Type 3 (Summary LSA) advertises inter-area routes; Type 4 (ASBR Summary LSA) advertises the location of an ASBR; Type 5 (AS External LSA) advertises external routes.

Question 15

A network engineer is designing a model-driven telemetry solution for a large enterprise network with thousands of devices. The engineer wants to minimize the load on the network devices and the collector by sending data only when significant changes occur. The engineer decides to use on-change subscriptions. However, after deployment, the engineer notices that some subscriptions are sending updates too frequently, causing high CPU usage on the devices. What is the most likely reason for this excessive update frequency?

Accepted Answer

The YANG paths include high-frequency changing leafs like interface counters or CPU load. On-change subscriptions in model-driven telemetry (MDT) trigger an update whenever a subscribed YANG leaf changes value. If the subscription path includes volatile leafs such as interface counters, CPU load, or queue statistics that change on every packet or polling cycle, the device will emit updates almost continuously, driving up CPU and collector load. The fix is to subscribe to stable configuration or state leafs, or use periodic subscriptions with a sample-interval for high-churn data.

Answer

The engineer configured a sample-interval in addition to on-change, causing both periodic and on-change updates

Answer

The collector is overwhelmed and sending back-pressure signals causing retransmissions

Answer

The engineer used JSON encoding instead of GPB, causing larger payloads and more CPU usage