CCNP Practice Test 24 — 15 Questions

Question 1

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Accepted Answer

IKEv2 packet exceeds MTU on sender. IKEv2 fragmentation occurs when the IKE packet exceeds the MTU. The sender fragments the packet, marks it with a fragment number, and sends all fragments. The receiver reassembles them. DPD keepalives are sent periodically to verify the peer is still reachable; if no response is received, the peer is declared dead.

Question 2

Drag and drop each Ansible variable precedence level on the left to its matching scope on the right.

Accepted Answer

Extra vars: Highest precedence, passed via --extra-vars on command line. Extra-vars override all others, role defaults have lowest precedence, host vars apply per host, group vars apply per group, and play vars apply to the entire play.

Question 3

Which two statements about DMVPN phase 2 are true? (Choose two.)

Accepted Answer

In DMVPN phase 2, spoke routers can establish direct tunnels to each other without traffic passing through the hub.. DMVPN phase 2 allows spoke-to-spoke tunnels after initial hub registration, using NHRP to resolve destination addresses and enabling direct traffic flows.

Answer

DMVPN phase 2 requires mGRE on the hub only; spokes use point-to-point GRE tunnels.

Answer

DMVPN phase 2 supports only IPsec protection and cannot operate without encryption.

Answer

In DMVPN phase 2, spoke routers must be configured with static crypto maps for IPsec.

Question 4

Which two statements about IPsec IKEv2 are true? (Choose two.)

Accepted Answer

IKEv2 uses UDP port 500 for initial negotiation and can switch to UDP 4500 for NAT traversal.. IKEv2 uses UDP port 500 and 4500, supports EAP authentication, and is more robust than IKEv1. It does not use TCP, and it supports multiple simultaneous SAs.

Answer

IKEv2 uses TCP port 500 for control plane messages.

Answer

IKEv2 requires a separate IPsec SA for each direction of traffic.

Answer

IKEv2 is not compatible with certificate-based authentication.

Question 5

Drag and drop the steps of Control Plane Policing (CoPP) rate-limit evaluation into the correct order, from first to last.

Accepted Answer

Define access list to match control plane traffic. CoPP first classifies traffic using an access list, then matches it to a class map, then applies a policy map with a police action (rate-limit), activates the policy on the control plane, and finally the hardware performs policing.

Question 6

Drag and drop the steps of IP Source Guard binding and enforcement into the correct order, from first to last.

Accepted Answer

Switch learns IP-to-port binding from DHCP snooping. IP Source Guard first builds the binding from DHCP snooping, then installs a per-port ACL to permit only the bound IP, applies the ACL to the access port, checks all incoming IP traffic against the ACL, and drops any traffic with a source IP not in the binding.

Question 7

Drag and drop each Control plane protection feature on the left to its matching threat on the right.

Accepted Answer

CoPP: CPU overload from excessive control plane traffic. CoPP protects against CPU overload; uRPF against IP spoofing; DHCP snooping against rogue DHCP server; DAI against ARP cache poisoning; IP Source Guard against IP spoofing on access ports.

Question 8

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Accepted Answer

Disable unused ports: interface range GigabitEthernet0/1-24 ; shutdown. Disable unused ports with 'interface range ... shutdown'; set login banner with 'banner login'; enable SSH with 'ip ssh version 2'; disable CDP with 'no cdp run'; set password encryption with 'service password-encryption'.

Question 9

Drag and drop each Python data structure on the left to its matching network config use on the right.

Accepted Answer

dict: Storing key-value pairs for device configuration parameters. dict stores key-value config pairs like interface settings, list stores ordered config lines, tuple stores immutable device credentials, set stores unique VLAN IDs, and frozenset stores immutable sets of allowed protocols.

Question 10

Drag and drop each HTTP method on the left to its matching REST operation on the right.

Accepted Answer

GET: Retrieve a resource (read data). GET retrieves a resource, POST creates a new resource, PUT updates/replaces a resource, DELETE removes a resource, and PATCH partially modifies a resource.

Question 11

Drag and drop each Netmiko device type on the left to its matching OS on the right.

Accepted Answer

cisco_ios: Cisco IOS. cisco_ios maps to IOS, cisco_nxos to NX-OS, cisco_xr to IOS-XR, and cisco_xe to IOS-XE. The fifth pair cisco_asa maps to ASA.

Question 12

Drag and drop each Ansible component on the left to its matching function on the right.

Accepted Answer

Inventory: Defines the list of managed hosts and groups. Each component has a distinct role: Inventory defines managed nodes, Playbook is the execution blueprint, Role organizes content, Module is the execution unit, and Handler reacts to changes.

Question 13

Which two statements about Ansible modules and idempotency are true? (Choose two.)

Accepted Answer

Idempotency means that running a playbook multiple times will always result in the same final state on the managed node.. Ansible modules are designed to be idempotent, meaning repeated runs produce the same state. The 'command' and 'shell' modules are not idempotent by default. Modules like 'copy' and 'template' check current state before making changes.

Answer

The 'command' module is idempotent by default because it always runs the given command.

Answer

All Ansible modules are inherently idempotent regardless of how they are implemented.

Answer

Idempotency only applies to network modules, not to Linux system modules.

Question 14

Drag and drop the steps of NETCONF edit-config with candidate datastore flow into the correct order, from first to last.

Accepted Answer

Open NETCONF session. The correct order begins with opening a NETCONF session, locking the candidate datastore, sending the edit-config operation, committing the candidate to running, and finally unlocking the candidate datastore.

Question 15

A network engineer runs the following command on Router R7:

R7# show ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
  create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00
  timeout: never, flags: static
--- 192.0.2.11         10.0.0.11          ---                ---
  create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00
  timeout: never, flags: static

Based on this output, what can be concluded?

Accepted Answer

The translations are static and will remain until manually removed.. The output shows two NAT entries with the flag 'static' and a timeout of 'never'. Static NAT translations are manually configured and persist indefinitely in the translation table until explicitly removed by an administrator. This is why option D is correct.

Answer

These translations will expire after a configurable timeout.

Answer

The translations are dynamic and will be removed after idle timeout.

Answer

The router is performing PAT for these addresses.