CCNP Practice Test 24 — 15 Questions

Question 1

A network engineer is configuring a switch to support 802.1X authentication for wired clients. The requirement is to authenticate users against a centralized RADIUS server and assign dynamic VLANs based on the user's role. Which command must be configured on the switch to enable 802.1X authentication globally?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dot1x system-auth-control. To enable 802.1X authentication globally on a Cisco switch, the 'dot1x system-auth-control' command must be configured. This command activates the 802.1X process and allows the switch to act as an authenticator. Other commands, such as those for RADIUS or interface-level settings, are necessary but do not globally enable 802.1X.

Answer

aaa authentication dot1x default group radius

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Question 2

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Accepted Answer

Enables Layer 2 extension across Layer 3 boundaries.. VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Answer

Eliminates the need for STP by using a centralized controller.

Answer

Uses only multicast for control plane learning.

Answer

Provides native encryption for data in transit.

Question 3

Given the following configuration:

ip access-list extended FILTER
 permit tcp any host 10.1.1.1 eq 22
 permit icmp any any echo-reply
!
interface GigabitEthernet0/4
 ip access-group FILTER in

What traffic is permitted?

Accepted Answer

SSH to 10.1.1.1 and ICMP Echo Reply are permitted.. The access list FILTER permits TCP traffic to destination host 10.1.1.1 on port 22 (SSH) and ICMP packets of type Echo Reply. Since the list is applied inbound on GigabitEthernet0/4, only these two types of traffic are allowed into the interface. Option B correctly identifies both permitted traffic types.

Answer

Only SSH traffic to 10.1.1.1 is permitted.

Answer

All ICMP traffic is permitted.

Answer

Only traffic from host 10.1.1.1 is permitted.

Question 4

Given this telemetry configuration on a Cisco IOS-XE device:

telemetry ietf subscription 400
 encoding encode-kvgpb
 filter xpath /interfaces/interface/state
 stream yang-push
 update-policy periodic 1000
 receiver ip address 10.1.1.1 50000 protocol grpc
 source-interface Loopback0

What is the effect of the source-interface Loopback0 command?

Accepted Answer

It uses the IP address of Loopback0 as the source for telemetry packets to the receiver.. The source-interface command ensures that all telemetry packets sent to the receiver use the IP address of Loopback0 as the source.

Answer

It forces the telemetry receiver to listen on Loopback0.

Answer

It restricts the telemetry data to only Loopback0 interface counters.

Answer

It changes the update policy to on-change for Loopback0.

Question 5

A network engineer is using the Cisco DNA Center API to initiate a network discovery. The API endpoint '/dna/intent/api/v1/discovery' is called with a POST request containing the following JSON payload:

```json
{
  "discoveryType": "Range",
  "ipAddressList": "10.10.20.1-10.10.20.254",
  "protocolOrder": "SSH",
  "timeout": 5,
  "retryCount": 3
}
```

The API returns a 202 Accepted status code. What does this indicate?

Accepted Answer

The discovery has been accepted and is being processed asynchronously.. A 202 Accepted status code indicates that the request has been accepted for processing, but the processing is not complete. In the context of Cisco DNA Center discovery, it means the discovery job has been initiated and will run asynchronously.

Answer

The discovery was completed successfully and devices are added.

Answer

The request is invalid and the payload needs correction.

Answer

The server is busy and the request is queued.

Question 6

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) for a new wireless network. The engineer wants to ensure that client traffic is tunneled back to the WLC and that the WLC is the single point of management for the access points. Which mode should the access points be configured in?

Accepted Answer

Local mode. Local mode is the standard mode for access points in a centralized wireless deployment. It creates a CAPWAP tunnel to the WLC, carrying both management and client data traffic. This ensures that the WLC is the single point of management and that all client traffic is tunneled back to the WLC, meeting the engineer's requirements. Other modes either do not serve clients or switch traffic locally.

Answer

Sniffer mode

Answer

FlexConnect mode

Answer

Monitor mode

Question 7

A network engineer runs the following command on Router R7:

R7# show ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
  create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00
  timeout: never, flags: static
--- 192.0.2.11         10.0.0.11          ---                ---
  create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00
  timeout: never, flags: static

Based on this output, what can be concluded?

Accepted Answer

The translations are static and will remain until manually removed.. The output shows two NAT entries with the flag 'static' and a timeout of 'never'. Static NAT translations are manually configured and persist indefinitely in the translation table until explicitly removed by an administrator. This is why option D is correct.

Answer

These translations will expire after a configurable timeout.

Answer

The translations are dynamic and will be removed after idle timeout.

Answer

The router is performing PAT for these addresses.

Question 8

A network engineer is designing a new data center network using Cisco ACI. The engineer needs to ensure that traffic between two endpoints in different EPGs is allowed only if a contract permits it. Which ACI construct is used to define the rules that permit or deny traffic between EPGs?

Accepted Answer

Contract. In Cisco ACI, contracts are the constructs that define the rules for permitting or denying traffic between EPGs. A contract contains subjects and filters that specify the allowed protocols and ports. EPGs can be providers or consumers of contracts, and traffic is only allowed if a contract is in place. This policy-based approach ensures that communication between endpoints is explicitly permitted, aligning with a zero-trust security model.

Answer

Tenant

Answer

Application Profile

Answer

Bridge Domain

Question 9

A network administrator is deploying a Cisco Catalyst switch with DHCP snooping. The switch is configured with DHCP snooping globally and on VLAN 10. A DHCP server is connected to GigabitEthernet1/0/5, and client devices are connected to GigabitEthernet1/0/6 through 1/0/20. The administrator notices that DHCP offers from the server are being dropped. What is the most likely cause?

Accepted Answer

The DHCP server port is not configured as trusted.. DHCP snooping treats all ports as untrusted by default and drops DHCP server messages received on untrusted ports. To allow legitimate DHCP server responses, the port connected to the DHCP server must be configured with 'ip dhcp snooping trust'. In this scenario, the server port GigabitEthernet1/0/5 is untrusted, so offers are dropped. Trusting the server port resolves the issue while maintaining protection against rogue DHCP servers on client ports.

Answer

The DHCP snooping database agent is not configured.

Answer

The client ports are configured as trusted.

Answer

DHCP snooping is not enabled on the VLAN of the client ports.

Question 10

Examine this SNMP configuration snippet from a Cisco IOS-XE router:

snmp-server community MyComm RO 10
access-list 10 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

SNMP read requests from any host in the 192.168.1.0/24 network using community 'MyComm' will be accepted.. The `snmp-server community MyComm RO 10` command creates an SNMPv2c community string named 'MyComm' with read-only (RO) access, and the trailing '10' references access-list 10. Access-list 10 permits only the 192.168.1.0/24 subnet. The combined effect is that SNMP GET (read) requests from any host in that subnet using the community string 'MyComm' are accepted, while all other SNMP requests are implicitly denied.

Answer

SNMP read and write requests from 192.168.1.0/24 using community 'MyComm' will be accepted.

Answer

Only SNMP requests from the 192.168.1.0/24 network are allowed, regardless of community string.

Answer

The access-list 10 is incomplete; it needs a deny statement to block other traffic.

Question 11

A network engineer is configuring a Cisco IOS switch to use 802.1X authentication for endpoints connected to interface GigabitEthernet1/0/1. The engineer wants to ensure that if the RADIUS server is unreachable, the port will be placed in a restricted VLAN. Which command should be used?

Accepted Answer

authentication event server dead action authorize vlan 10. The command 'authentication event server dead action authorize vlan 10' is specifically designed to handle the case where the RADIUS server is unreachable, placing the port into VLAN 10 as a fallback. This ensures that endpoints can still access limited network resources according to policy when the authentication server is down.

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 10

Answer

authentication event no-response action authorize vlan 10

Question 12

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The design requires that the virtual IP address be the same as one of the physical interface addresses, and that the standby group use a virtual MAC address of 0000.0c07.acXX. Which protocol meets these requirements?

Accepted Answer

HSRP. HSRP is a Cisco-proprietary first-hop redundancy protocol that uses the virtual MAC address 0000.0c07.acXX and permits the virtual IP to be the same as a physical interface IP. VRRP and GLBP use different MAC address formats. Therefore, HSRP uniquely satisfies both conditions in the scenario.

Answer

VRRP

Answer

SLB

Answer

GLBP

Question 13

A network engineer is configuring OSPF on a multiaccess segment. The design requires that the DR/BDR election be deterministic, with Router A always becoming the DR and Router B always becoming the BDR. Both routers are Cisco IOS devices. Which configuration on Router A ensures it wins the DR election?

Accepted Answer

Set the OSPF priority to 255 on Router A's interface.. To ensure a router becomes DR, its OSPF interface priority must be higher than all other routers on the segment. Priority 255 is the maximum and guarantees victory unless another router also has 255 and a higher Router ID. Setting priority to 0 makes a router ineligible, a higher Router ID on another router would favor that router, and point-to-point network type removes DR/BDR election altogether.

Answer

Set the OSPF priority to 0 on Router A's interface.

Answer

Configure a higher Router ID on Router B.

Answer

Set the OSPF network type to point-to-point on Router A's interface.

Question 14

A network engineer is configuring a Cisco IOS switch and needs to assign a specific port to VLAN 20 as an access port. The port is currently in VLAN 1 and is administratively up. Which sequence of interface configuration commands correctly places the port into VLAN 20 as an access port?

Accepted Answer

switchport mode access followed by switchport access vlan 20. To place an interface into a specific VLAN as an access port on a Cisco IOS switch, the engineer enters interface configuration mode, sets the port to access mode with switchport mode access, and assigns the VLAN with switchport access vlan 20. This ensures the port carries untagged traffic for VLAN 20 only.

Answer

vlan 20 followed by switchport mode access

Answer

switchport mode dynamic auto followed by switchport access vlan 20

Answer

switchport access vlan 20 followed by switchport mode trunk

Question 15

An engineer is configuring a Cisco Catalyst switch with VXLAN to extend Layer 2 connectivity between two data centers. The switch will act as a VXLAN Tunnel Endpoint (VTEP) and must encapsulate traffic from VLAN 10 into VXLAN VNI 10010. Which command is required to map the VLAN to the VNI?

Accepted Answer

vlan configuration 10: vn-segment 10010. To map a VLAN to a VXLAN VNI on a Cisco Catalyst switch, the engineer must enter VLAN configuration mode for the specific VLAN and use the 'vn-segment' command. This creates the association that allows the VTEP to encapsulate traffic from that VLAN into VXLAN packets with the specified VNI. Other command forms are invalid or apply to different platforms.

Answer

vxlan vlan 10 vni 10010

Answer

interface vlan 10: vxlan vni 10010

Answer

vxlan vni 10010 vlan 10