CCNP Practice Test 29 — 15 Questions

Question 1

A network administrator must secure management access to a Cisco IOS XE router so that only SSH version 2 is accepted and Telnet is disabled on all VTY lines. Which configuration accomplishes this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure transport input ssh on the VTY lines and set the SSH version to 2 globally.. Restricting management to SSH requires the transport input ssh command applied to the VTY lines, which removes Telnet as an accepted transport. Enforcing SSH version 2 with ip ssh version 2 ensures the stronger protocol is used. Together they block Telnet and guarantee only SSHv2 sessions are accepted on the router.

Answer

Configure line vty 0 4 with the exec-timeout command and set the SSH version to 2.

Answer

Configure transport input telnet ssh on the VTY lines and set the SSH version to 2.

Answer

Configure transport output ssh on the VTY lines and set the SSH version to 2.

Question 2

A network engineer is implementing MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two campus distribution switches. Which two statements accurately describe MACsec operation on Cisco platforms? (Choose two.)

Accepted Answer

MACsec uses the MACsec Key Agreement (MKA) protocol to negotiate and distribute session keys between peers.. MACsec is a Layer 2 hop-by-hop security standard that encrypts Ethernet frames and validates integrity between directly connected devices. The MKA protocol handles key negotiation and distribution, electing a key server and refreshing keys. It does not provide end-to-end protection across Layer 3 hops and does not rely on IKEv2, which belongs to the IPsec suite.

Answer

MACsec can secure traffic end-to-end between two hosts separated by multiple Layer 3 hops.

Answer

MACsec requires the use of IKEv2 to establish the security association between switches.

Answer

MACsec encrypts the entire IP packet including the original source and destination IP addresses.

Question 3

Which QoS mechanism is used to prevent congestion by dropping packets before a queue becomes full?

Accepted Answer

Weighted Random Early Detection (WRED). Weighted Random Early Detection (WRED) is a congestion avoidance mechanism that proactively drops packets before a queue becomes full. By monitoring the average queue depth and dropping packets with a probability that increases as the queue depth grows, WRED signals TCP senders to reduce their transmission rate, thereby preventing tail drop and global synchronization. This differs from congestion management mechanisms like PQ or CBWFQ, which only act on packets after the queue is full.

Answer

Priority Queuing (PQ)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

Tail Drop

Question 4

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The administrator wants to protect the route processor from excessive control-plane traffic while still allowing legitimate routing protocol and management traffic. The administrator creates a class map that matches BGP, OSPF, and SSH traffic and applies a police action with a committed information rate. Which additional configuration element is required to complete the CoPP implementation?

Accepted Answer

Apply the policy map to the control plane using the service-policy input command under control-plane configuration mode.. CoPP is implemented by defining class maps to identify control-plane traffic, a policy map to apply actions such as police, and then attaching the policy map to the control plane with service-policy input under control-plane configuration mode. Without that attachment, the policy is never applied to control-plane traffic, so the route processor remains vulnerable to excessive protocol or management packets.

Answer

Configure a route map that matches the control-plane protocols and reference it in the policy map.

Answer

Apply the policy map to all physical interfaces using the service-policy input command under interface configuration mode.

Answer

Enable NetFlow on the router to export control-plane traffic statistics to a collector.

Question 5

Drag and drop the steps of CoPP class-map match criteria and rate-limit application into the correct order, from first to last.

Accepted Answer

Create class-map with match criteria. CoPP configuration requires defining class-maps first, then policy-map with police statements, then applying to control-plane. The order ensures proper traffic classification and rate-limiting.

Question 6

Drag and drop each OSPF area type on the left to its matching characteristic on the right.

Accepted Answer

Backbone area: Must connect all other areas; area 0. Backbone area (0) connects all other areas; Stub area blocks Type 5 LSAs but allows Type 3; Totally stubby area blocks both Type 5 and Type 3 (default route only); NSSA allows Type 7 LSAs for external routes but blocks Type 5; NSSA totally stubby blocks Type 5 and Type 3 but allows Type 7.

Question 7

Which three statements about HTTP response status codes in REST APIs are true? (Choose three.)

Accepted Answer

200 OK is used to indicate a successful GET request.. Option A is correct because 200 OK is the standard success status code returned when a GET request successfully retrieves a representation of the requested resource. Option B is correct because 201 Created is returned after a POST request successfully creates a new resource, typically accompanied by a Location header pointing to the new resource's URI. Option D is correct because 400 Bad Request is a 4xx client error status indicating the server cannot process the request due to malformed syntax, invalid framing, or deceptive request routing. Option C is incorrect because 404 Not Found is a 4xx client error meaning the origin server did not find a current representation for the target resource, not a server-side error. Option E is incorrect because 500 Internal Server Error is a 5xx server error indicating the server encountered an unexpected condition that prevented it from fulfilling the request, not a client error.

Answer

404 Not Found indicates a server-side error.

Answer

500 Internal Server Error is a client error.

Question 8

Examine the following OSPF configuration on a Cisco IOS-XE router:

router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.255.255.255 area 0
 network 192.168.1.0 0.0.0.255 area 1
 default-information originate always metric 10 metric-type 1

What is the effect of the 'default-information originate always' command?

Accepted Answer

A default route is unconditionally advertised into OSPF with metric 10 and type E1.. The 'default-information originate always' command unconditionally injects a default route (0.0.0.0/0) into OSPF, regardless of whether the router itself has a default route. The metric 10 and metric-type 1 set the cost and external type to E1, meaning the cost is the sum of external and internal costs.

Answer

A default route is advertised into OSPF only if the router has a default route in its routing table.

Answer

The router will redistribute static default routes into OSPF.

Answer

The router will generate a default route only for area 1.

Question 9

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against control plane overload. The router has management traffic (SSH, SNMP) and routing protocol traffic (OSPF, BGP). After applying the CoPP policy, the engineer notices that OSPF adjacencies are flapping. Which action should the engineer take to resolve this issue while maintaining control plane protection?

Accepted Answer

Increase the rate limit for the OSPF class in the CoPP policy.. OSPF adjacency flapping after CoPP deployment indicates that OSPF hello packets are being dropped by the policer. The CoPP policy likely has a rate limit for OSPF that is too low for the network's requirements. Increasing the rate limit for the OSPF class allows OSPF traffic to pass while still enforcing a policer to protect against excess traffic. This maintains control plane protection and resolves the flapping.

Answer

Configure OSPF to use a different DSCP value so it matches a higher-priority class in the CoPP policy.

Answer

Remove the CoPP policy from the control plane and reapply it after OSPF stabilizes.

Answer

Apply the CoPP policy only to the management plane interface instead of the control plane.

Question 10

A network administrator is implementing Control Plane Policing on a Cisco IOS-XE router to protect the route processor from excessive BGP, SSH, and SNMP traffic. After applying the policy, legitimate BGP keepalives are being dropped, causing peer resets. Which action should the administrator take to resolve this while still protecting the control plane?

Accepted Answer

Raise the conform-action rate for the BGP class and verify BGP is classified before the default class. CoPP classifies control-plane traffic and applies policers per class. BGP keepalives are small and periodic; if the BGP class rate is too low or BGP is not matched before the default class, keepalives get dropped and peers reset. Increasing the conform rate for the BGP class and ensuring correct classification order restores keepalive delivery while continuing to protect the route processor from abusive traffic in other classes.

Answer

Remove the BGP class from the policy map so BGP is not policed at all

Answer

Apply the policy to the data plane interfaces instead of the control plane

Answer

Change the policy map to use priority queuing instead of policing for the BGP class

Question 11

What is the purpose of the 'ip sla schedule' command in IP SLA configuration?

Accepted Answer

It starts the IP SLA operation and sets its lifetime and start time.. The 'ip sla schedule' command is used to start an IP SLA operation and configure its lifetime and start time. Without this command, the IP SLA operation is configured but remains inactive. This command controls when the operation begins and how long it runs, which is essential for scheduled monitoring.

Answer

It defines the type of IP SLA operation.

Answer

It sets the frequency of the IP SLA operation.

Answer

It configures threshold monitoring for the IP SLA operation.

Question 12

Drag and drop the steps of DMVPN Phase 3 spoke-to-spoke shortcut creation into the correct order, from first to last.

Accepted Answer

Spoke sends traffic to hub for remote spoke. In DMVPN Phase 3, when a spoke needs to reach another spoke, it first sends traffic to the hub. The hub forwards the packet with an NHRP redirect. The source spoke then sends an NHRP resolution request to the hub to get the destination spoke's NBMA address. The hub replies with the mapping, and the source spoke dynamically builds a direct mGRE tunnel to the destination spoke.

Question 13

Drag and drop each BGP attribute on the left to its preferred value (highest or lowest) on the right.

Accepted Answer

WEIGHT: Highest. Higher WEIGHT and LOCAL_PREF are preferred; lower MED, AS_PATH length, and IGP metric to next-hop are preferred.

Question 14

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The engineer applies a CoPP policy-map to the control plane with a class that matches BGP traffic and sets police rate 8000 conform-action transmit exceed-action drop. After applying the policy, BGP sessions intermittently flap during route convergence. Which action should the engineer take to resolve the issue while maintaining control plane protection?

Accepted Answer

Increase the police rate for the BGP class or change the exceed-action to transmit, after verifying the offered rate.. BGP session flapping immediately after applying a policer that drops exceeded traffic points to legitimate BGP control packets being dropped because the configured rate is too low for convergence bursts. The correct remediation is to right-size the policer for the BGP class, either by raising the rate or by permitting excess traffic, after confirming the actual offered rate from the control plane.

Answer

Apply the CoPP policy to all router interfaces as an input service policy instead of to the control plane.

Answer

Remove the CoPP policy from the control plane interface and rely on interface ACLs instead.

Answer

Change the CoPP policy to use priority queuing instead of policing for the BGP class.

Question 15

Drag and drop the steps of configuring Dynamic NAT on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Define NAT pool with ip nat pool. Dynamic NAT configuration starts by defining the pool of global IP addresses using 'ip nat pool'. Next, an access list is created to identify the inside local addresses that will be translated. The NAT source list is then configured to associate the ACL with the pool. After that, the inside and outside interfaces are designated with 'ip nat inside' and 'ip nat outside'. Finally, translation is verified with 'show ip nat translations'.