CCNP Practice Test 26 — 15 Questions

Question 1

Drag and drop the steps of SD-WAN traffic engineering app-aware routing steps into the correct order, from first to last.

Accepted Answer

Classify traffic using NBAR or DPI. App-aware routing begins with classifying traffic by application, then measuring path performance (loss, latency, jitter), comparing against SLA requirements, selecting the best path, and finally steering traffic over that path.

Question 2

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all)
      50 packets, 2500 bytes
      5 minute offered rate 500 bps
      Match: access-group name BGP-ACL
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 50 packets, 2500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SNMP-CLASS (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: access-group name SNMP-ACL
      police:
          cir 16000 bps, bc 2000 bytes, be 2000 bytes
        conformed 150 packets, 7500 bytes; actions:
          transmit
        exceeded 40 packets, 2000 bytes; actions:
          drop
        violated 10 packets, 500 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: any
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 100 packets, 5000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.. The output shows that for the SNMP-CLASS, 40 packets exceeded and 10 packets violated the policer, resulting in drops, while the BGP-CLASS had 0 exceeded and 0 violated packets, meaning all BGP traffic conformed to its CIR of 64000 bps. This confirms that SNMP traffic is being dropped due to exceeding its policer rate, while BGP traffic is within its rate.

Answer

BGP traffic is being dropped because it exceeds the CIR.

Answer

All traffic to the control plane is being dropped.

Answer

The control-plane policy is applied in the output direction.

Question 3

Which three statements about using Python for interacting with Cisco IOS-XE devices via NETCONF and RESTCONF are true? (Choose three.)

Accepted Answer

The ncclient Python library can be used to establish a NETCONF session with a Cisco IOS-XE device and retrieve YANG-modeled data.. The correct answers are A, B, and C. Option A is true because the ncclient library is specifically designed for NETCONF sessions and can retrieve YANG-modeled data from Cisco IOS-XE devices. Option B is true: RESTCONF uses standard HTTP methods (GET, POST, PUT, DELETE) to access YANG-defined data. Option C is true: YANG models define the structure, constraints, and semantics of data accessible via NETCONF or RESTCONF. Option D is false because RESTCONF supports JSON and XML encoding, not YAML. Option E is false: NETCONF uses XML encoding (not binary) and is not always faster than RESTCONF; performance depends on network conditions, payload size, and device implementation.

Answer

RESTCONF only supports data encoding in YAML format.

Answer

NETCONF is always faster than RESTCONF for retrieving large amounts of data because it uses a binary encoding.

Question 4

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

Accepted Answer

The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.. When a VRF is applied to an interface on a Cisco ASR 1000, the interface's IP address is removed because the VRF changes the routing context. The engineer must reconfigure the IP address under the VRF interface. Without the IP address, the BGP session cannot establish a TCP connection, causing it to go down.

Answer

The BGP neighbor is not configured with the password command.

Answer

The route-target import/export values are incorrect for the customer.

Answer

The engineer forgot to configure the VRF under the BGP router-id.

Question 5

A network team is designing the underlay for an SD-Access fabric. The design must use a routing protocol that supports fast convergence and is commonly recommended for the fabric underlay. Which routing protocol should be used?

Accepted Answer

IS-IS. IS-IS is the correct choice because it is a link-state routing protocol that provides fast convergence, is highly scalable, and is the most commonly recommended routing protocol for the underlay of an SD-Access fabric. Cisco SD-Access designs frequently use IS-IS to support the fabric's control plane and data plane requirements, leveraging its ability to handle large, flat network topologies with minimal overhead.

Answer

RIP

Answer

EIGRP

Answer

BGP

Question 6

A network engineer is configuring a Cisco switch for 802.1X with RADIUS authentication. The switch is also configured with 'aaa authentication dot1x default group radius'. The engineer wants to use a single RADIUS server for both authentication and accounting. The RADIUS server is configured with the same shared secret for both services. The engineer configures 'radius-server host 10.1.1.1 auth-port 1812 acct-port 1813 key cisco123'. However, accounting records are not being sent to the server. The engineer verifies that the RADIUS server is reachable and that accounting is enabled on the server. What is the most likely cause?

Accepted Answer

The switch is missing the 'aaa accounting dot1x default start-stop group radius' command to enable accounting for 802.1X sessions.. The switch is configured for RADIUS authentication but lacks the 'aaa accounting dot1x default start-stop group radius' command, which is required to enable accounting for 802.1X sessions. Without this command, the switch will not send accounting records to the RADIUS server, even if the server is reachable and accounting is enabled on it. The 'aaa authentication dot1x default group radius' command only enables authentication, not accounting.

Answer

The RADIUS server is using a different accounting port than 1813; the switch should use port 1646.

Answer

The switch must have 'aaa new-model' configured before accounting can work.

Answer

The RADIUS server's shared secret for accounting is different from the authentication secret.

Question 7

A network engineer is configuring a zone-based firewall (ZBF) on a Cisco router to allow traffic from the inside zone to the outside zone while blocking traffic from outside to inside. The engineer creates zones, assigns interfaces, and configures a policy-map with a class-map that matches all traffic from inside to outside. The engineer applies the policy to the zone-pair inside-to-outside. However, traffic from inside to outside is being dropped. What is the most likely reason?

Accepted Answer

The policy-map does not include an 'inspect' or 'pass' action for the matched traffic.. In a zone-based firewall (ZBF), a policy-map applied to a zone-pair defines the actions to be taken on traffic flowing between the two zones. By default, traffic between zones is denied unless explicitly permitted. The class-map matches traffic from inside to outside, but without an 'inspect' or 'pass' action in the policy-map, the matched traffic is implicitly dropped. The 'inspect' action enables stateful inspection and allows return traffic, while 'pass' permits traffic without stateful tracking; omitting either results in a deny.

Answer

The zone-pair should be configured as outside-to-inside instead.

Answer

The class-map must also match return traffic for the firewall to allow the session.

Answer

The policy-map is applied to the wrong zone-pair; it should be applied to the inside zone.

Question 8

What is the default OSPF hello interval on an Ethernet broadcast network?

Accepted Answer

10 seconds. On Ethernet broadcast networks, OSPF defaults to a hello interval of 10 seconds, as specified in RFC 2328. This interval is used to maintain neighbor relationships and detect failures quickly on high-speed multi-access links.

Answer

30 seconds

Answer

5 seconds

Answer

20 seconds

Question 9

A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?

Accepted Answer

Enable IP traffic export (NetFlow) on the switch.. The 'IP Input' process handles incoming IP packets that require CPU processing, such as routing protocol updates, management traffic, or packets destined to the switch itself. Enabling IP traffic export (NetFlow) on the switch allows the administrator to analyze traffic flows and identify the specific source/destination IP addresses, ports, and protocols consuming CPU cycles, without overwhelming the CPU further. NetFlow provides granular visibility into the types of packets being processed, making it the correct tool for this scenario.

Answer

Use extended ping from the switch to generate traffic.

Answer

Configure a SPAN session to capture all traffic to the CPU.

Answer

Check CDP neighbors to see if any devices are flooding.

Question 10

Drag and drop the steps of configuring Control Plane Policing (CoPP) on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Create access-list to match control plane traffic. CoPP protects the control plane by filtering traffic. First, define an access-list to match the traffic of interest (e.g., SSH, BGP). Second, create a class-map to reference the access-list. Third, create a policy-map that assigns a police action (rate-limit) to the class. Fourth, apply the policy-map to the control plane in the inbound direction. Finally, verify the policy with show commands to ensure correct operation.

Question 11

A network engineer issues the following command on Router R4:

R4# show ip ospf database

OSPF Router with ID (4.4.4.4) (Process ID 1)

Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         123         0x80000002 0x00A1B2 2
2.2.2.2         2.2.2.2         456         0x80000003 0x00B2C3 3
4.4.4.4         4.4.4.4         789         0x80000001 0x00C3D4 1

Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.1.2     2.2.2.2         234         0x80000001 0x00D4E5

Based on this output, what can be concluded?

Accepted Answer

Router 2.2.2.2 is the Designated Router on the segment 192.168.1.0/24.. The Net Link States entry shows the link ID 192.168.1.2 (the DR's interface IP) and ADV Router 2.2.2.2, which indicates that router 2.2.2.2 is the Designated Router (DR) on the 192.168.1.0/24 segment. In OSPF, only the DR originates the Type 2 (Network LSA) for a broadcast segment, so the advertising router in the Net Link States is always the DR.

Answer

Router 1.1.1.1 has three OSPF-enabled interfaces.

Answer

Router 4.4.4.4 is the BDR on the segment.

Answer

There are multiple broadcast segments in area 0.

Question 12

An engineer is configuring multicast on a Cisco switch running IOS. The switch is acting as the IGMP querier for a VLAN. The engineer notices that multicast traffic is being flooded to all ports in the VLAN, even though only a few receivers have joined the group. The engineer checks the IGMP snooping configuration and sees that IGMP snooping is enabled globally and on the VLAN. What is the most likely cause of the flooding?

Accepted Answer

The IGMP querier is not elected on the VLAN.. When IGMP snooping is enabled but no IGMP querier exists on the VLAN, the switch cannot learn which ports have interested receivers because no general queries are sent. Without querier-generated queries, the snooping database remains empty, causing the switch to flood multicast traffic to all ports in the VLAN as if snooping were disabled.

Answer

The multicast source is connected to a trunk port.

Answer

The switch has PIM enabled on the VLAN interface.

Answer

The receivers are using IGMPv3.

Question 13

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Accepted Answer

HTTP and HTTPS traffic from 192.168.1.0/24. The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Answer

ICMP traffic from any source

Answer

FTP traffic from 192.168.1.0/24

Answer

SSH traffic from 192.168.1.0/24

Question 14

Examine the following CoPP configuration on a Cisco IOS-XE router:
```
class-map match-all CONTROL-PLANE
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class CONTROL-PLANE
 police 1000000 200000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY
```
What is the effect of this configuration?

Accepted Answer

Traffic matching the ACL is rate-limited to 1 Mbps; traffic exceeding the rate is dropped.. The CoPP configuration uses a `police` command with a committed information rate (CIR) of 1,000,000 bits per second (1 Mbps) and a burst size of 200,000 bytes. Traffic that matches the class-map (via the named ACL) is subject to this policer; conforming traffic is transmitted, while exceeding traffic is dropped. This effectively rate-limits the matched control-plane traffic to 1 Mbps.

Answer

All control plane traffic is rate-limited to 1 Mbps.

Answer

Traffic exceeding 1 Mbps is marked down but still transmitted.

Answer

The policy-map is applied to the data plane, not the control plane.

Question 15

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Accepted Answer

Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.. Model-driven telemetry (MDT) using gRPC or gNMI is the correct choice because it provides a push-based, scalable, and real-time streaming mechanism for subscribing to specific YANG data paths, such as interface counters and BGP neighbor state, directly from Cisco Nexus 9000 switches running NX-OS. This approach eliminates the polling overhead of SNMP and supports high-frequency data collection, making it ideal for large-scale enterprise monitoring.

Answer

Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.

Answer

Use SNMP traps to send interface and BGP state changes to the collector.

Answer

Deploy IP SLA responders on the switches to measure performance and send results via syslog.