CCNP Practice Test 27 — 15 Questions

Question 1

Examine the following configuration:

flow exporter EXPORTER-1
 destination 10.0.0.1
 source Loopback0
 transport udp 2055
 option interface-table
 option application-table
!

What is the purpose of the 'option interface-table' and 'option application-table' commands?

Accepted Answer

They cause the exporter to send interface and application metadata to the collector periodically.. The 'option interface-table' and 'option application-table' commands configure the NetFlow exporter to periodically send metadata (interface names/descriptions and application-to-port mappings) to the collector. This metadata is essential for the collector to interpret flow records correctly, especially when interfaces are renamed or applications are dynamically mapped. The exporter sends these options templates at a default interval (e.g., every 600 seconds) via UDP 2055, independent of regular flow records.

Answer

They filter the flow data to include only traffic from the specified interfaces and applications.

Answer

They enable the exporter to collect interface and application statistics locally.

Answer

They are required only when using IPFIX, not NetFlow v9.

Question 2

A network engineer is troubleshooting a VMware vSphere cluster where a VM with a large memory footprint (256 GB) is experiencing poor performance. The host has two NUMA nodes, each with 128 GB of memory. The VM is configured with 256 GB of memory and 4 vCPUs. Performance monitoring shows high memory latency and CPU ready time. What is the most likely cause?

Accepted Answer

The VM's memory size forces it to span multiple NUMA nodes, increasing memory access latency.. The VM is configured with 256 GB of memory, but each NUMA node on the host has only 128 GB. Since a single NUMA node cannot satisfy the VM's memory allocation, the hypervisor must split the VM across both NUMA nodes. This forces memory accesses to cross the NUMA interconnect (e.g., QPI or UPI), which introduces significantly higher latency compared to local memory access, directly causing the observed high memory latency and increased CPU ready time.

Answer

The VM has too few vCPUs for the memory size.

Answer

The host is using memory ballooning to reclaim memory from other VMs.

Answer

The host's memory is overcommitted.

Question 3

Drag and drop the steps of Q-in-Q (802.1ad) double-tagging configuration into the correct order, from first to last.

Accepted Answer

Enable Q-in-Q globally with vlan dot1q tag native. Q-in-Q configuration requires first enabling the feature globally, then configuring the trunk port as a dot1q tunnel port, setting the native VLAN, and finally applying the service instance to encapsulate traffic. Verification ensures proper double-tagging.

Question 4

Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.

Accepted Answer

Create VRF and assign route distinguisher. The correct order first defines the VRF, then configures the NAT inside and outside interfaces under the VRF, defines the NAT pool or ACL for translation, applies the NAT rule referencing the VRF, and finally verifies the translation with show ip nat translations vrf.

Question 5

Drag and drop the steps of DHCP snooping and dynamic ARP inspection flow into the correct order, from first to last.

Accepted Answer

Switch enables DHCP snooping globally and per VLAN. DHCP snooping first builds a binding table by monitoring DHCP messages. The switch validates DHCP server messages on trusted ports and discards rogue offers. For DAI, the switch intercepts ARP packets and checks the sender MAC and IP against the DHCP snooping binding table. If the ARP packet matches, it is forwarded; otherwise, it is dropped.

Question 6

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

Accepted Answer

Create community string. First define the community string, then associate it with an ACL, then apply it to views or groups, and finally verify.

Question 7

Drag and drop the steps of WRED configuration for TCP congestion avoidance into the correct order, from first to last.

Accepted Answer

Enable WRED on interface or in policy-map. First, enable WRED under an interface or policy-map. Then set the minimum and maximum thresholds for each IP precedence or DSCP value. Configure the mark probability denominator. Apply the policy-map to the interface. Finally, verify WRED operation using show queueing or show policy-map interface.

Question 8

Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.

Accepted Answer

Identify YANG module for interfaces. YANG traversal starts with identifying the YANG module for interfaces, then navigating to the interfaces container, selecting the specific interface list entry, accessing the statistics container, and finally reading the desired leaf values like in-octets.

Question 9

Drag and drop the steps of Dynamic Trunking Protocol (DTP) negotiation into the correct order, from first to last.

Accepted Answer

Set interface to switchport mode trunk. DTP negotiation begins with the interface defaulting to dynamic desirable or auto mode. If a switchport is set to trunk, DTP sends frames to negotiate. The neighbor responds if in a compatible mode. Once agreed, the link becomes trunking. Finally, both ends forward traffic for multiple VLANs.

Question 10

Drag and drop the steps of Cisco SD-WAN control plane establishment sequence into the correct order, from first to last.

Accepted Answer

vBond orchestrates initial authentication and redirect. The control plane setup begins with vBond orchestrating initial authentication and directing devices to vManage and vSmart. Then each device establishes a DTLS/TLS connection to vManage for management. Next, devices establish DTLS/TLS connections to vSmart for control. After that, OMP peering is set up between edges and vSmart. Finally, BFD sessions are established between edge devices for data plane liveliness detection.

Question 11

Drag and drop each Ansible connection type on the left to its matching protocol on the right.

Accepted Answer

network_cli: SSH-based CLI connection to network devices. network_cli uses SSH for CLI commands, netconf uses SSH for NETCONF XML, httpapi uses HTTP/HTTPS for REST APIs (e.g., NX-API).

Question 12

Drag and drop each Ansible variable precedence level on the left to its matching scope on the right.

Accepted Answer

extra-vars: Variables passed via --extra-vars, highest precedence. extra-vars have highest precedence; role defaults have lowest; host vars apply to a specific host; group vars apply to all hosts in a group; play vars are set at the play level.

Question 13

A network engineer configures SNMPv3 on a Cisco router for secure monitoring. The configuration includes 'snmp-server group ADMIN v3 priv', 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456', and 'snmp-server host 10.1.1.2 version 3 priv admin'. The NMS is configured with the same credentials. However, the NMS cannot poll the router. The engineer verifies that the router's SNMP agent is enabled. What is the most likely cause?

Accepted Answer

The NMS must be configured with the router's SNMP engine ID.. The most likely cause is that the NMS must be configured with the router's SNMP engine ID. In SNMPv3, the engine ID is used to derive authentication and encryption keys. Even if the username and passwords match, if the NMS does not know the router's engine ID, it will compute different keys and fail to authenticate or decrypt responses, preventing polling.

Answer

The SNMPv3 user is not associated with the group correctly.

Answer

The 'priv' keyword in the host command should be 'auth' instead.

Answer

The AES encryption key must be exactly 16 characters.

Question 14

Drag and drop the steps of Cisco DHCP snooping binding table population into the correct order, from first to last.

Accepted Answer

Switch receives DHCPACK from trusted server port. DHCP snooping first validates DHCP server messages on trusted ports, then creates a binding entry from the DHCPACK, stores the entry with MAC/IP/port/VLAN, updates the table on lease renewal, and finally removes the entry on lease expiry or DHCPRELEASE.

Question 15

Drag and drop each ACL action on the left to its matching result on the right.

Accepted Answer

permit: Packet is allowed to pass through the ACL. Permit allows the packet; Deny discards the packet; Remark adds a comment; Log generates a log message for matched packets; Sequence-number assigns a line number for editing.