CCNP Practice Test 2 — 25 Questions

Question 1

Drag and drop each NETCONF operation on the left to its action on the right.

Accepted Answer

get: Retrieve running configuration and state data. Correct pairings: get retrieves running config and state data; get-config retrieves a specific datastore; edit-config modifies configuration; commit confirms a candidate configuration; lock prevents other sessions from modifying a datastore.

Question 2

A network engineer configures IP SLA 20 to monitor the response time of a DNS server at 10.1.1.1 using DNS query for 'example.com'. The operation is used to influence routing decisions. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 50 ms', but the DNS server is actually down and not responding to any queries. What is the most likely reason?

Accepted Answer

The IP SLA DNS probe is using a cached DNS response from the router's DNS resolver, so it does not actually query the server.. IP SLA DNS probes rely on the router's local DNS resolver. If the resolver has a cached response for 'example.com', the probe will return the cached RTT without actually querying the DNS server. This explains why the operation shows 'Active' and a 50 ms RTT even though the DNS server is down.

Answer

The IP SLA DNS probe must be configured with a 'timeout' value lower than 50 ms to detect the failure.

Answer

The DNS server is responding to the probe but not to other queries because the probe uses a different port.

Answer

The IP SLA operation is configured with a 'frequency' that is too low, causing the probe to be sent before the server times out.

Question 3

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

Accepted Answer

The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.. The RADIUS server is receiving authentication requests and sending 'Access-Reject' responses, but the WLC logs show 'RADIUS server not responding'. This indicates the WLC is not receiving the responses. The most likely cause is a source IP mismatch: the RADIUS server sends responses from a different IP address than the one configured on the WLC. The WLC drops these responses because they do not match the expected source IP, making it appear as if the server is not responding.

Answer

The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.

Answer

The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.

Answer

The WLC is not configured with a valid management interface IP address to reach the RADIUS server.

Question 4

An engineer configures IP SLA 100 to monitor the jitter and latency of a VoIP call path between two branch routers. The configuration uses UDP jitter with a target of 192.168.2.2 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' but no jitter or latency statistics are collected. The router is generating the probe packets, but the remote router does not respond. What is the most likely reason?

Accepted Answer

The remote router must have an IP SLA responder configured to process the UDP jitter probes.. For UDP jitter IP SLA operations to collect jitter and latency statistics, the remote router must be configured as an IP SLA responder. The responder processes the probe packets and sends back time-stamped responses, which are essential for calculating jitter and one-way delay. Without the responder, the source router can send probes (showing 'Active' state) but cannot compute meaningful statistics because it never receives the required response packets.

Answer

The IP SLA operation must be configured with a 'request-data-size' value to match the remote router's MTU.

Answer

The source router needs a 'frequency' setting that matches the remote router's response interval.

Answer

The firewall on the remote router is blocking the UDP port 16384, preventing the probe from reaching the target.

Question 5

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Accepted Answer

The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.. RSPAN traffic is carried over an RSPAN VLAN that must be allowed on all trunk links between the source switches and the central switch. If the RSPAN VLAN (999) is not included in the allowed VLAN list on the trunk ports, the mirrored frames will be dropped, and the monitoring station will receive no traffic. This is the most likely missing configuration because the engineer verified the VLAN is active and the destination session is set, but did not check the trunk pruning.

Answer

The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.

Answer

The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.

Answer

The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.

Question 6

Consider the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 2 source interface GigabitEthernet1/0/3 rx
monitor session 2 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.. The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.

Answer

Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.

Answer

The configuration is invalid because the destination interface must be in trunk mode.

Question 7

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Answer

The AS-path contains the local AS number.

Answer

BGP synchronization is enabled.

Answer

The maximum-prefix limit has been exceeded.

Question 8

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Accepted Answer

The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.. If the client and the router's DHCP server interface are on different VLANs (i.e., different subnets), the DHCP discover broadcast will not cross the Layer 3 boundary unless the router interface has an ip helper-address configured. The ip helper-address command enables the router to convert the broadcast DHCP discover into a unicast and forward it to the DHCP server. Without it, the client's broadcast never reaches the server, even if the DHCP pool is correctly defined.

Answer

The router's interface is configured with the no ip forward-protocol udp bootps command.

Answer

The DHCP pool is configured with the wrong default-router option.

Answer

The router's DHCP server is disabled globally with the no service dhcp command.

Question 9

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

Accepted Answer

The interface needs the 'authentication guest-vlan ' command to specify the VLAN for non-802.1X devices.. The 'authentication guest-vlan ' command is missing. This command explicitly defines the VLAN to which the port will assign devices that fail 802.1X authentication or are non-802.1X-capable. Without it, the switch has no configured fallback VLAN, so the port remains in the unauthorized state even with 'authentication port-control auto' and 'authentication host-mode multi-host' configured.

Answer

The switch must have 'aaa authentication dot1x default group radius' configured globally.

Answer

The 'authentication host-mode multi-host' command should be replaced with 'authentication host-mode multi-domain' to support guest VLAN.

Answer

The port must be configured as a trunk port to allow the guest VLAN.

Question 10

interface GigabitEthernet0/2
 spanning-tree link-type point-to-point
 end

What is the effect of this configuration?

Accepted Answer

The port will use RSTP fast transition mechanisms assuming a point-to-point link.. The `spanning-tree link-type point-to-point` command manually overrides the port's link type to point-to-point, forcing the port to use Rapid Spanning Tree Protocol (RSTP) fast transition mechanisms (proposal/agreement handshake) instead of the slower 802.1D listening/learning states. This is correct because RSTP relies on the link type to determine whether it can safely perform a fast transition to the forwarding state; a point-to-point link allows immediate transition without waiting for timers.

Answer

The port will become a designated port immediately.

Answer

The port will disable STP on that link.

Answer

The port will use shared medium behavior.

Question 11

Given the following SNMPv3 configuration on a Cisco IOS-XE router:

snmp-server group ADMIN v3 priv write ADMINVIEW
snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456
snmp-server view ADMINVIEW iso included

What is missing or incorrect in this configuration?

Accepted Answer

The view 'ADMINVIEW' includes the entire ISO tree, which might be too permissive for a restricted write view.. The view 'ADMINVIEW' is configured with 'iso included', which includes the entire ISO OID tree. This grants write access to all MIB objects, which is overly permissive for a restricted write view. In SNMPv3, a write view should be limited to specific OIDs or subtrees to enforce least privilege, and including the entire ISO tree violates that principle. Option D is incorrect because a read view is not required if the group is only intended for write operations. The configuration as shown only specifies a write view, which is sufficient for SNMP set operations. Adding a read view is optional and not a mandatory missing piece.

Answer

The SNMPv3 user 'admin' must also specify an engine ID for the router.

Answer

The privacy password 'cisco456' must be at least 8 characters long.

Answer

The group 'ADMIN' must be configured with a read view to allow SNMP get operations.

Question 12

A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is correct because it combines strict priority queuing with CBWFQ, ensuring that voice traffic (marked with EF or CS5) is dequeued before any other traffic class. This strict priority mechanism guarantees the lowest possible latency for real-time traffic, as packets in the priority queue are always transmitted first, regardless of congestion on the WAN link.

Answer

Weighted Random Early Detection (WRED)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO)

Question 13

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Accepted Answer

The dialer interface does not have an IP address negotiated via IPCP.. In a PPPoE setup, the dialer interface typically obtains its IP address dynamically from the ISP via IPCP (IP Control Protocol) during PPP negotiation. If IPCP fails or is not configured to negotiate an address, the dialer interface remains unnumbered or without a usable IP address. Even though the PPPoE session is established and a default route exists, the router cannot route traffic because it lacks a valid source IP address on the dialer interface to send packets to the ISP's gateway.

Answer

The physical interface is configured with 'no ip address'.

Answer

The default route is pointing to the wrong next-hop IP.

Answer

The ISP's gateway is not responding to ICMP.

Question 14

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not advertising EVPN routes for a specific VNI. The NVE interface is up, and the VNI is configured. Which action should the engineer take to verify that the VNI is properly associated with the EVPN control plane?

Accepted Answer

Check the output of 'show bgp l2vpn evpn' to see if the VNI is advertised in the EVPN address family.. To verify that a VNI is properly associated with the EVPN control plane, the engineer should check the BGP EVPN table using 'show bgp l2vpn evpn'. This command displays EVPN routes, including those for the VNI. If the VNI is not advertised, it indicates a configuration issue in the EVPN address family or BGP. Other commands like 'show nve vni' or 'show interface nve1' do not directly show EVPN route advertisement.

Answer

Check the output of 'show vlan id 10' to see if VLAN 10 is active and mapped to the VNI.

Answer

Check the output of 'show interface nve1' to verify that the NVE interface is operational.

Answer

Check the output of 'show nve vni' to see if the VNI is up and associated with the NVE interface.

Question 15

An engineer is configuring QoS on a Cisco ASR 1000 router to support three traffic classes: voice (EF), video (AF41), and data (default). The link is a 50 Mbps Ethernet circuit. The engineer wants to guarantee 10 Mbps for voice, 20 Mbps for video, and the remaining for data. The current policy uses bandwidth percent statements. During congestion, voice traffic is not receiving its guaranteed bandwidth. What is the most likely cause?

Accepted Answer

The interface bandwidth command is not set to 50000 kbps. The bandwidth percent command allocates a percentage of the interface bandwidth, which by default is derived from the physical interface speed. On a Cisco ASR 1000, if the interface bandwidth is not manually set to 50000 kbps, the router may use a different default value (e.g., 1000000 kbps for Ethernet), causing the bandwidth percent to allocate a much larger absolute amount than intended. This leads to incorrect bandwidth guarantees, such as voice not receiving its required 10 Mbps during congestion.

Answer

The voice class should use priority instead of bandwidth

Answer

The video class should use bandwidth remaining percent

Answer

The policy map is applied in the input direction

Question 16

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

60 seconds. The default quiet-period timer in Cisco IOS 802.1X configuration is 60 seconds. This timer defines the period the switch waits after a failed authentication attempt before re-initiating authentication with the same supplicant. It prevents repeated authentication attempts from overwhelming the switch and the RADIUS server.

Answer

30 seconds

Answer

120 seconds

Answer

10 seconds

Question 17

A network engineer runs the following command on Switch SW1:

SW1# show interfaces gi0/1 switchport

Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Based on this output, what can be concluded?

Accepted Answer

DTP is enabled on this interface.. The output shows 'Negotiation of Trunking: On', which indicates that Dynamic Trunking Protocol (DTP) is enabled on the interface. DTP is a Cisco proprietary protocol used to negotiate trunking between switches. Since the interface is in trunk mode and DTP is on, option B is correct.

Answer

The interface is configured as an access port.

Answer

The native VLAN is tagged with 802.1Q.

Answer

All VLANs except 2-1001 are pruned.

Question 18

A network engineer is deploying QoS on a Cisco Catalyst 4500 switch to support four queues per port. The engineer wants to assign voice traffic to queue 1 (priority), video to queue 2, critical data to queue 3, and best-effort to queue 4. The switch is configured with the default CoS-to-queue mapping. However, video traffic is being placed in queue 1 along with voice. What should the engineer do to separate them?

Accepted Answer

Modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command. The default CoS-to-queue mapping on Cisco Catalyst 4500 switches maps CoS 5 (voice) to queue 1 (priority queue) and CoS 4 (video) also to queue 1. To separate video into queue 2, the engineer must modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command, which reassigns CoS values to specific output queues. This directly overrides the default behavior and places video traffic in the correct queue.

Answer

Change the video traffic marking to DSCP AF41 and rely on DSCP-to-queue mapping

Answer

Apply a service policy that uses a priority queue for voice only

Answer

Increase the number of queues to eight

Question 19

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Accepted Answer

The playbook uses 'direction: outbound' but the module expects 'direction: out'.. The ios_acl_interfaces module in Ansible expects the direction parameter to be specified as 'in' or 'out', not 'outbound'. When 'direction: outbound' is used, the module either ignores the value or defaults to 'in', causing the ACL to be applied inbound instead of outbound. This is a common parameter naming mismatch between the Ansible module and the engineer's expectation.

Answer

The routers have a different IOS version that interprets 'outbound' as 'in'.

Answer

The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.

Answer

The ACL itself is defined with the wrong direction in the playbook.

Question 20

An engineer is troubleshooting multicast performance issues. The network uses PIM sparse mode with a static RP. The engineer notices that the multicast traffic from a source to a group is taking a suboptimal path, causing high latency. The engineer checks the multicast routing table on the last-hop router and sees that the (S,G) entry has an incoming interface that is not the shortest path to the source. What is the most likely reason for this suboptimal path?

Accepted Answer

The last-hop router has not yet switched to the SPT.. In PIM sparse mode, the last-hop router initially receives multicast traffic via the shared tree (RP) and then switches to the shortest path tree (SPT) toward the source once the traffic rate exceeds a threshold (default 0 kbps in Cisco IOS). If the (S,G) entry shows an incoming interface that is not the shortest path to the source, it indicates the router has not yet performed the SPT switchover, so it is still using the RP-based path, which may be suboptimal.

Answer

The RP is not configured as the DR on its segment.

Answer

The multicast source is using a different group address.

Answer

The last-hop router has a higher metric to the source than to the RP.