CCNP Practice Test 26 — 15 Questions

Question 1

Drag and drop the steps of Docker container networking with bridge mode into the correct order, from first to last.

Accepted Answer

Create Docker bridge network. Bridge networking starts with creating a Docker bridge network. Then, a container is run attached to that bridge. Next, the container gets an IP from the bridge subnet. After that, port mapping is configured for external access. Finally, the container communicates with others via the bridge.

Question 2

A network architect is designing a new branch office that must support a single physical link carrying traffic for multiple tenants while keeping each tenant's routing and forwarding isolated. The design requires that the branch device maintain separate routing tables and forwarding instances per tenant, all on the same physical interface using 802.1Q encapsulation. Which architecture component should be implemented on the branch router to meet these requirements?

Accepted Answer

Virtual Routing and Forwarding (VRF) with 802.1Q subinterfaces. VRF is the Cisco IOS XE feature that creates separate routing and forwarding tables on one device. When paired with 802.1Q subinterfaces, each tenant's VLAN tag maps to a specific VRF, allowing a single physical link to carry isolated tenant traffic. This directly fulfills the requirement for per-tenant routing isolation on a shared branch link.

Answer

Multiprotocol Label Switching (MPLS) L3VPN on the branch router

Answer

Policy-Based Routing (PBR) with route maps

Answer

Generic Routing Encapsulation (GRE) tunnels per tenant

Question 3

A network architect is designing a new branch office that must support wired and wireless users on the same Layer 2 segment while enforcing consistent security policy regardless of where a user connects. The design must minimize the number of VLANs and IP subnets that must be provisioned as users move between floors. Which Cisco architecture feature should be used to meet these requirements?

Accepted Answer

Cisco SD-Access fabric with VXLAN overlay and policy-based segmentation. The requirement is location-independent identity with consistent policy and minimal VLAN/subnet provisioning across wired and wireless. SD-Access uses a VXLAN overlay with a LISP control plane and Cisco TrustSec group tags, allowing users to retain the same subnet and policy anywhere in the fabric. StackWise Virtual, standalone TrustSec, and VLAN trunking to a WLC all remain tied to physical VLAN boundaries and cannot deliver the same outcome.

Answer

Cisco StackWise Virtual on the distribution switches

Answer

Cisco Software-Defined Access with traditional VLAN trunking to the WLC

Answer

Cisco TrustSec with static SGACL enforcement on access ports

Question 4

A network architect is evaluating Cisco SD-Access for a large campus. The architect must ensure the fabric supports policy enforcement based on user identity and group membership, and that the fabric can scale to thousands of endpoints without flooding the underlay. Which two statements are correct about how SD-Access achieves these goals? (Choose two.)

Accepted Answer

The LISP control plane in SD-Access registers endpoint EID-to-RLOC mappings so fabric edge nodes can resolve destinations without flooding the underlay.. SD-Access scales by moving endpoint reachability into the LISP control plane, where EID-to-RLOC mappings are registered and resolved, avoiding underlay flooding. Policy is enforced with Cisco TrustSec group tags carried in the VXLAN Group Policy Option header, enabling group-based ACLs at fabric edge nodes. The underlay is a routed IS-IS fabric that does not carry endpoint host routes or rely on VXLAN flooding, and the overlay does not require a single stretched bridge domain.

Answer

The fabric uses a single shared bridge domain across all edge nodes to avoid VLAN proliferation.

Answer

The underlay uses VXLAN flooding to propagate endpoint reachability to all fabric edge nodes.

Answer

Fabric edge nodes use OSPF to advertise endpoint host routes into the underlay for reachability.

Question 5

A network administrator is designing a campus network that must support a single management IP address for a pair of Catalyst 9000 switches acting as a collapsed core. The design requires that both switches actively forward traffic, that the control plane operate as one logical device, and that a single configuration file be maintained. Which technology meets these requirements?

Accepted Answer

Cisco StackWise Virtual. StackWise Virtual merges two Catalyst 9000 switches into a single logical switch using a virtual switch link. It provides one management IP, one configuration file, and active-active forwarding, which is precisely what the collapsed core design requires. Classic StackWise is intended for different topologies, while vPC with HSRP and HSRP/GLBP keep separate control planes and configurations, so they do not meet the single logical device requirement.

Answer

Cisco IOS-XE with HSRP and GLBP

Answer

Cisco StackWise with a StackWise cable

Answer

Virtual Port Channel with HSRP

Question 6

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Accepted Answer

Define community string. The correct order is: first enable SNMP agent globally (E), then define the community string (A), then configure an access-list for the manager (B), then create an SNMP view (C), and finally apply the view to the community (D). Enabling the agent globally must occur first to activate SNMP on the device, followed by defining community strings and associating them with ACLs and views for access control.

Question 7

A network architect is evaluating Cisco StackWise Virtual technology for a pair of Cisco Catalyst 9000 switches that will act as a single logical entity at the distribution layer. Which two statements accurately describe Cisco StackWise Virtual? (Choose two.)

Accepted Answer

It supports Multichassis EtherChannel (MEC) so that access switches can dual-home to both stack members.. Cisco StackWise Virtual combines two Catalyst 9000 switches into one logical switch via a StackWise Virtual Link, presenting a single control plane and management IP. It enables Multichassis EtherChannel so downstream devices can dual-home with active-active forwarding. The SVL requires high-speed ports, both switches must run the same IOS XE version, and the pair shares one control plane rather than maintaining independent ones.

Answer

Each switch in the StackWise Virtual pair maintains an independent control plane and separate management IP address.

Answer

It requires that both switches run different IOS XE versions to provide software redundancy.

Answer

The StackWise Virtual Link can be formed using any two 1 Gigabit Ethernet ports on the switches.

Question 8

A network engineer is designing a QoS policy for a WAN edge router. Voice traffic must be serviced with strict priority and guaranteed low latency, while a policer must limit voice to 30 percent of the interface bandwidth to prevent starvation of other queues. Which queuing mechanism should the engineer configure?

Accepted Answer

Low Latency Queuing (LLQ) with a priority policer. Low Latency Queuing is the correct choice because it creates a strict priority queue for voice while applying a policer that caps the priority class at a configured rate, such as 30 percent of interface bandwidth. This gives voice minimal delay and jitter while preventing it from consuming all bandwidth. CBWFQ lacks strict priority, WRED is a drop mechanism, and FIFO offers no prioritization or policing.

Answer

First-In, First-Out (FIFO) queuing on the WAN interface

Answer

Class-Based Weighted Fair Queuing (CBWFQ) with a bandwidth guarantee

Answer

Weighted Random Early Detection (WRED) on the voice class

Question 9

A network architect is designing a Cisco SD-WAN solution with multiple data centers and a mix of MPLS and Internet transports. The company requires that business-critical traffic (e.g., ERP) always use the MPLS transport, while guest traffic uses the Internet. Which Cisco SD-WAN feature should be used to enforce this policy?

Accepted Answer

Centralized data policy. Centralized data policy in Cisco SD-WAN is used to define traffic steering rules. By creating a policy that matches ERP traffic and sets the preferred transport to MPLS, and another that matches guest traffic and sets the transport to Internet, the architect can enforce the requirement. Other features like AAR or VPN segmentation do not provide this static transport enforcement.

Answer

Direct Internet Access (DIA)

Answer

Application-aware routing

Answer

VPN segmentation

Question 10

A network engineer is designing a network that uses Cisco SD-Access with a fabric that includes a border node and control plane node. The engineer must ensure that traffic from external networks can reach endpoints within the fabric. Which function does the border node provide in this architecture?

Accepted Answer

It provides connectivity between the fabric and external networks, such as WAN or data center.. The border node in Cisco SD-Access provides connectivity between the fabric and external networks, handling traffic entering and leaving the fabric. It performs VXLAN-to-VLAN translation and routing, enabling external users to reach fabric endpoints. This is distinct from the control plane node's mapping function and the edge node's policy enforcement.

Answer

It maintains the mapping of endpoint IP addresses to fabric edge nodes.

Answer

It enforces security policies between endpoints within the same virtual network.

Answer

It acts as the default gateway for all endpoints in the fabric.

Question 11

A network architect is designing a Cisco SD-Access fabric for a hospital campus. The hospital requires that guest wireless users be allowed access only to the internet, while clinical staff devices must reach internal EHR servers. The fabric uses Cisco DNA Center and Cisco Identity Services Engine for policy. Which fabric component enforces the group-based policy between these user groups?

Accepted Answer

The fabric edge node applying Cisco TrustSec group-based access control lists. Group-based policy in a Cisco SD-Access fabric is enforced at the fabric edge node using Cisco TrustSec security group tags and scalable group ACLs, with group membership and policy defined in Cisco Identity Services Engine. This lets the hospital block guest-to-EHR flows while permitting clinical staff access, without redesigning VLANs or subnets for each user category.

Answer

The Cisco DNA Center Intent API translating business intent into device configuration

Answer

The fabric control plane node running LISP map-server functions

Answer

The fabric intermediate node forwarding VXLAN-encapsulated traffic between edge nodes

Question 12

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) and access points in a branch office. The administrator wants to ensure that all management traffic between the WLC and APs is encrypted and that APs can discover the WLC across a Layer 3 network. Which protocol should be used for AP-to-WLC communication?

Accepted Answer

CAPWAP with DTLS encryption enabled on the management interface.. CAPWAP is the current protocol for AP-to-WLC communication, and it supports DTLS encryption for control and data traffic. It also enables Layer 3 discovery through options like DHCP option 43 or DNS. LWAPP is deprecated, Mobility Express is for controller-less setups, and SNMPv3 is for management polling, not AP tunneling. Therefore, CAPWAP with DTLS is the correct choice.

Answer

SNMPv3 with AES encryption for AP management and discovery.

Answer

LWAPP with IPsec encryption between AP and WLC.

Answer

Mobility Express with HTTPS management and no CAPWAP tunnel.

Question 13

A network administrator is deploying a new Cisco SD-WAN solution. The administrator needs to ensure that the control plane is separated from the data plane and that the solution can dynamically select the best path for application traffic based on policies. Which component of Cisco SD-WAN is responsible for centralized control plane functions and distributing routing information to the WAN Edge devices?

Accepted Answer

vSmart. vSmart is the centralized control plane in Cisco SD-WAN, using OMP to distribute routing and policies to WAN Edge devices. It enables dynamic path selection and separates control from data plane. vManage is management, vBond is orchestration, and WAN Edge is data plane.

Answer

WAN Edge

Answer

vManage

Answer

vBond

Question 14

A network engineer is designing a high-availability solution for a data center using Cisco Application Centric Infrastructure (ACI). The engineer wants to ensure that the fabric can continue to operate if a spine switch fails, and that traffic is load-balanced across all available paths. Which statement accurately describes the ACI fabric architecture?

Accepted Answer

ACI uses a spine-leaf topology where every leaf connects to every spine, and a failed spine switch reduces capacity but does not cause an outage.. ACI uses a spine-leaf topology where all leaf switches connect to all spine switches, providing active-active forwarding. A failed spine reduces overall capacity but does not cause an outage because other spines continue to forward traffic. This design ensures high availability and load balancing.

Answer

ACI uses a single spine switch for all traffic, and redundancy is achieved through a standby spine that takes over on failure.

Answer

ACI uses a traditional Spanning Tree Protocol (STP) to prevent loops, and a failed spine switch causes a full fabric outage.

Answer

ACI uses a ring topology for the fabric, and a failed spine switch breaks the ring, causing a partial outage.

Question 15

A network architect is designing a QoS policy for a Cisco Catalyst switch that must prioritize voice traffic over all other traffic, while ensuring that bulk data transfers do not starve other applications. The design requires strict priority for voice and a guaranteed minimum bandwidth for business-critical applications. Which two mechanisms should be used together to meet these requirements?

Accepted Answer

Low Latency Queuing (LLQ) and Class-Based Weighted Fair Queuing (CBWFQ). LLQ and CBWFQ are used together to provide strict priority for voice traffic while guaranteeing bandwidth for other classes. LLQ places voice in a priority queue with a policed rate to prevent starvation, and CBWFQ allocates minimum bandwidth to business-critical applications, ensuring they are not starved by bulk data.

Answer

Priority Queuing (PQ) and Custom Queuing (CQ)

Answer

Class-Based Marking and Policing

Answer

Weighted Random Early Detection (WRED) and First-In First-Out (FIFO) queuing