CCNP Practice Test 25 — 15 Questions

Question 1

Drag and drop each EAP method on the left to its matching authentication type on the right.

Accepted Answer

EAP-TLS: Mutual certificate-based authentication. EAP-TLS uses certificates, PEAP uses server certificate with inner MSCHAPv2, EAP-FAST uses a PAC, and EAP-MD5 uses simple password hash.

Question 2

Drag and drop the steps for configuring STP root guard and loop guard and the resulting port behavior into the correct order, from first to last.

Accepted Answer

Enter interface configuration mode. The correct order for activating STP root guard and loop guard begins with entering interface configuration mode (A), then configuring root guard with 'spanning-tree guard root' (B), followed by loop guard with 'spanning-tree guard loop' (C). After configuration, verification of port role and protection status (D) ensures the guards are active. Step E (port moves to root-inconsistent state if superior BPDU received) is not an activation step but a reactive event that occurs when root guard triggers; it is placed last as the expected outcome.

Question 3

Drag and drop each EtherChannel port state on the left to its matching description on the right.

Accepted Answer

bundled: Port is actively forwarding traffic in the EtherChannel. In EtherChannel, ports can be in one of three states: bundled, stand-alone, or suspended. A bundled port actively forwards traffic in the channel. A stand-alone port is active but not part of any EtherChannel. A suspended port is administratively down or error-disabled. The remaining options are distractors that do not match any of these states.

Answer

bundled: Port is a member of the channel and forwarding

Answer

stand-alone: Port operates as a regular switch port

Question 4

Which three statements about SD-WAN segmentation and multi-tenancy are true? (Choose three.)

Accepted Answer

Each VPN in SD-WAN corresponds to a separate VRF on the edge device, providing Layer 3 isolation.. VPN segmentation in SD-WAN uses VRFs (VPN IDs) to isolate traffic. Service-side routing uses VRFs, and transport-side uses TLOCs. OMP carries VPN membership information. Extranet allows controlled sharing between VPNs. VPN 0 is for transport, not service. Multiple VRFs can be used to support multi-tenancy.

Answer

VPN 0 is used for service-side connectivity, such as connecting to a corporate LAN or data center.

Answer

Multi-tenancy in SD-WAN requires separate physical edge devices for each tenant to ensure isolation.

Question 5

Drag and drop the steps of NFVI resource allocation and VNF instantiation into the correct order, from first to last.

Accepted Answer

NFVO receives VNF instantiation request. The NFVI resource allocation and VNF instantiation process begins with the NFVO receiving a VNF instantiation request, then the NFVO requests the VIM to allocate compute, storage, and network resources. The VIM allocates the resources and provides the resource IDs. The NFVO then instructs the VNFM to instantiate the VNF. Finally, the VNFM instantiates the VNF on the allocated resources.

Question 6

Drag and drop the steps of LLQ configuration for voice traffic into the correct order, from first to last.

Accepted Answer

Create class-map matching voice (DSCP EF). First, classify voice traffic using a class-map matching DSCP EF. Then create a policy-map and assign the class to priority (LLQ). Optionally configure a bandwidth guarantee for other classes. Apply the service-policy on the WAN interface. Finally, verify the LLQ operation using show policy-map interface.

Question 7

Given this telemetry configuration on a Cisco IOS-XE device:

telemetry ietf subscription 400
 encoding encode-kvgpb
 filter xpath /interfaces/interface/state
 stream yang-push
 update-policy periodic 1000
 receiver ip address 10.1.1.1 50000 protocol grpc
 source-interface Loopback0

What is the effect of the source-interface Loopback0 command?

Accepted Answer

It uses the IP address of Loopback0 as the source for telemetry packets to the receiver.. The source-interface command ensures that all telemetry packets sent to the receiver use the IP address of Loopback0 as the source.

Answer

It forces the telemetry receiver to listen on Loopback0.

Answer

It restricts the telemetry data to only Loopback0 interface counters.

Answer

It changes the update policy to on-change for Loopback0.

Question 8

A network engineer is using the Cisco Meraki REST API to update the SSID settings for a wireless network. The engineer sends a PUT request to 'https://api.meraki.com/api/v1/networks/{networkId}/wireless/ssids/{ssidNumber}' with a JSON payload containing the new settings. The API returns a 429 Too Many Requests error. What should the engineer do to resolve this issue?

Accepted Answer

Implement exponential backoff and retry the request after a delay.. A 429 error indicates rate limiting; the API has received too many requests from the client within a given time frame. The engineer should implement exponential backoff and retry logic, or reduce the request rate.

Answer

Change the HTTP method to POST because PUT is not supported for this endpoint.

Answer

Add an 'X-Cisco-Meraki-API-Key' header with a higher rate limit key.

Answer

Use a different API endpoint, such as 'https://api.meraki.com/api/v1/organizations/{orgId}/ssids'.

Question 9

Match each Cisco switch security feature to its function.

Accepted Answer

Port Security: Limits the number of MAC addresses allowed on a switch port.. Port Security limits MAC addresses per port to prevent MAC flooding. DHCP Snooping filters DHCP messages to block rogue servers. Dynamic ARP Inspection validates ARP packets using DHCP snooping entries to prevent spoofing. IP Source Guard filters IP traffic based on the binding table to prevent IP spoofing. Common confusions include swapping these functions, e.g., assigning ARP spoofing prevention to Port Security or MAC flooding prevention to DHCP Snooping.

Answer

Port Security: Prevents ARP spoofing attacks.

Answer

DHCP Snooping: Prevents MAC flooding attacks.

Question 10

A network engineer is configuring PIM sparse mode in a network that uses a Bootstrap Router (BSR) for RP discovery. The engineer has configured a candidate BSR and candidate RPs. However, some routers in the network are not learning the RP set. The engineer checks the BSR and sees that it is receiving candidate RP advertisements, but the BSR messages are not being forwarded to all routers. What is the most likely cause?

Accepted Answer

PIM is not enabled on all interfaces between the BSR and the other routers.. BSR messages are flooded hop-by-hop using PIM. If PIM is not enabled on all interfaces between the BSR and the other routers, the BSR messages will not be forwarded, preventing RP discovery.

Answer

The candidate BSR priority is set too low.

Answer

The candidate RPs are not in the same OSPF area as the BSR.

Answer

The BSR is not configured as a candidate RP.

Question 11

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Accepted Answer

Display ACL with show access-lists. Named ACLs can be modified by inserting or deleting entries by sequence number. The correct order is: view current entries, delete the old entry, insert the new entry with a sequence number, verify, then save.

Question 12

Drag and drop the steps of CoPP class-map match criteria and rate-limit application into the correct order, from first to last.

Accepted Answer

Create class-map with match criteria. CoPP configuration requires defining class-maps first, then policy-map with police statements, then applying to control-plane. The order ensures proper traffic classification and rate-limiting.

Question 13

Drag and drop the steps of uRPF (Unicast Reverse Path Forwarding) verification into the correct order, from first to last.

Accepted Answer

Check uRPF status with show ip interface. uRPF verification involves checking if it is enabled, verifying the routing table, testing with ping, checking counters, and interpreting results. The order follows a logical troubleshooting sequence.

Question 14

Drag and drop each OSPF area type on the left to its matching characteristic on the right.

Accepted Answer

Backbone area: Must connect all other areas; area 0. Backbone area (0) connects all other areas; Stub area blocks Type 5 LSAs but allows Type 3; Totally stubby area blocks both Type 5 and Type 3 (default route only); NSSA allows Type 7 LSAs for external routes but blocks Type 5; NSSA totally stubby blocks Type 5 and Type 3 but allows Type 7.

Question 15

Drag and drop each OSPF area type on the left to its matching characteristic on the right.

Accepted Answer

Backbone (Area 0): Must connect all other areas and cannot be a stub. The backbone area (Area 0) connects all other areas. A stub area blocks Type 5 LSAs and uses a default route. A totally stubby area blocks both Type 3 and Type 5 LSAs, using only a default route. An NSSA (Not-So-Stubby Area) allows Type 7 LSAs for external routes and converts them to Type 5 at the ABR.