CCNP Practice Test 2 — 25 Questions

Question 1

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Accepted Answer

Configure underlay network with IS-IS or OSPF. SD-Access deployment begins with underlay configuration for physical connectivity, then overlay setup with LISP/VXLAN, followed by policy definition and integration with DNA Center for automation and assurance.

Question 2

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Accepted Answer

The control policy is not attached to the appropriate site list or VPN list.. In Cisco SD-WAN, centralized control policies must be explicitly attached to a site list or VPN list to define which devices or traffic the policy applies to. If the policy is not attached to the appropriate list, the vSmart controller will not push the policy to the targeted vEdge routers, causing them to continue using the default OMP best-path selection (based on administrative distance and cost). The fact that the vEdge routers are connected to the vSmart confirms the issue is with policy application, not reachability.

Answer

The vEdge routers have not been rebooted after the policy change.

Answer

The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.

Answer

The BFD sessions between vEdge and vSmart are flapping.

Question 3

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Accepted Answer

View current ACL with 'show access-list'. Sequence numbers allow editing named ACLs without re-entering all entries. The correct order is: view current entries, insert a new entry at a specific sequence, then verify the updated ACL.

Question 4

Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.

Accepted Answer

Ingress switch classifies endpoint and assigns SGT. Inline tagging embeds SGT in the Ethernet frame header; the ingress switch classifies the endpoint, adds the SGT tag, forwards the frame across the fabric, and the egress switch enforces policy based on the tag.

Question 5

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Accepted Answer

Create job template with playbook and inventory. In Ansible Tower/AWX, a job template execution starts with creating the template, launching it, which triggers inventory and credential resolution, then the playbook runs, and finally the job output is displayed for review.

Question 6

Drag and drop the steps of LACP active/passive mode negotiation into the correct order, from first to last.

Accepted Answer

Active mode ports transmit LACPDUs. LACP negotiation starts with active ports sending LACPDUs, passive ports listening, then exchanging system/port priorities, selecting aggregator, and finally forming the bundle.

Question 7

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Accepted Answer

Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status. VTP requires setting mode and domain before trunking works; verification confirms operation.

Answer

Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Answer

Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status

Answer

Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Question 8

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Accepted Answer

Define prefix-list or AS-path ACL. Policy application starts with defining match criteria (prefix-list or AS-path ACL), then creating a route-map with permit/deny and set actions, applying it to a neighbor, and finally verifying the policy effect.

Question 9

A network engineer runs the following command on Switch SW1:

SW1# show vlan id 10

VLAN ID: 10
VLAN Name: Sales
VLAN Type: Ethernet
VLAN State: active
MTU: 1500

Remote SPAN VLAN: No

Primary VLAN ID: 10

Private VLAN Type: Primary

Associated Secondary VLAN IDs: 100, 200

Based on this output, what can be concluded?

Accepted Answer

VLAN 10 is a primary private VLAN.. The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Answer

VLAN 10 is a community VLAN.

Answer

VLAN 10 is an isolated VLAN.

Answer

VLAN 10 is a normal data VLAN with no private VLAN features.

Question 10

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel has two active member links.. The output shows that Gi0/1 and Gi0/2 have a flag of 'P' (bundled in port-channel), while Gi0/3 has a flag of 'D' (down). Therefore, only two ports are actively bundled, making option D correct. The 'SU' flags on Po1 indicate the port-channel is Layer 2 (S) and in use (U), not Layer 3.

Answer

The EtherChannel is using PAgP.

Answer

Port Gi0/3 is bundled in the channel.

Answer

The port-channel is a Layer 3 interface.

Question 11

What is the default native VLAN on a Cisco switch trunk port?

Accepted Answer

VLAN 1. The default native VLAN on a Cisco switch trunk port is VLAN 1. The native VLAN is the VLAN that carries untagged traffic over a trunk link, and by default, all switch ports (including trunk ports) belong to VLAN 1. This is defined in the IEEE 802.1Q standard, which specifies that frames on the native VLAN are not tagged with a VLAN ID.

Answer

VLAN 0

Answer

VLAN 1002

Answer

VLAN 4095

Question 12

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 13

Drag and drop the steps of Multicast RP discovery using Auto-RP into the correct order, from first to last.

Accepted Answer

Candidate-RPs send RP-Announce to 224.0.1.39. Auto-RP uses a mapping agent to discover RPs. Candidate RPs announce their services to a well-known group (224.0.1.39). The mapping agent collects these announcements and sends RP-to-group mappings to another group (224.0.1.40). Routers then learn the RP for each group.

Question 14

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Accepted Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.. It uses the 'monitor session 1 source interface Gi1/0/1 both' command to capture all traffic (both ingress and egress) from the trunk port, and then applies the 'monitor session 1 filter vlan 20' command to restrict the SPAN session to only VLAN 20 traffic. This is the proper method to filter traffic from a trunk port to a specific VLAN on a Cisco Catalyst 3850 switch, as the filter command is applied after the source is defined.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.

Question 15

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

Accepted Answer

Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.. Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.

Answer

Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.

Answer

Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.

Answer

Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.

Question 16

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

Accepted Answer

Classifier identifies traffic and maps to service chain. SFC path setup begins with classifying traffic to determine which service chain to apply. Next, the classifier encapsulates packets with an NSH header. Then the SFC path is computed by the controller using the service function path identifier. After path computation, the controller installs forwarding entries in each service function forwarder. Finally, traffic traverses the chain as SFFs forward packets between VNFs.

Question 17

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Accepted Answer

Restarting router sends OPEN with graceful restart capability. Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

Question 18

Drag and drop the steps of VLAN pruning on trunks using VTP into the correct order, from first to last.

Accepted Answer

Enable VTP pruning globally on the VTP server. To configure VTP pruning on trunks, first set the VTP domain name and version (C). Then enable VTP pruning globally on the VTP server (A). Next, configure the trunk interface with switchport mode trunk (B). Then allow VTP pruning on the trunk with the switchport trunk pruning vlan command (D). Finally, verify pruning with show vtp status and show interfaces trunk (E).

Question 19

Drag and drop the steps of SVI configuration for inter-VLAN routing into the correct order, from first to last.

Accepted Answer

Create VLAN and SVI interface. First create the SVI interface, assign an IP address, enable it, and then configure routing or ACLs as needed.

Question 20

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Accepted Answer

Client sends SAE Commit to AP. WPA3 uses Simultaneous Authentication of Equals (SAE) handshake. The client first sends an SAE commit to the AP, the AP responds with its own SAE commit, then both compute a shared key. Next, the client sends an SAE confirm message, and finally the AP sends its SAE confirm to complete authentication.