CCNP Practice Test 29 — 15 Questions

Question 1

Drag and drop each VNF category on the left to its matching example on the right.

Accepted Answer

Virtual Router: Cisco CSR 1000v. Virtual routers, firewalls, and load balancers are common VNF categories.

Question 2

Which three statements about NFV use cases and deployment models are true? (Choose three.)

Accepted Answer

Virtual CPE (vCPE) is a common NFV use case that replaces physical routers and firewalls at customer sites with software-based functions.. NFV is used to virtualize various network functions. Virtual CPE (vCPE) replaces physical customer premises equipment with software running on standard hardware. Virtual Evolved Packet Core (vEPC) is a key use case in mobile networks. NFV can be deployed on-premises or in the cloud. Option A is correct because vCPE is a common NFV use case. Option B is correct because vEPC virtualizes mobile core functions. Option C is correct because NFV supports both on-prem and cloud deployment. Option D is incorrect because NFV does not require dedicated hardware; it uses standard servers. Option E is incorrect because NFV can scale dynamically, not just statically.

Answer

NFV requires dedicated hardware appliances for each virtualized network function.

Answer

NFV deployments are limited to static, non-scalable configurations.

Question 3

Which three statements about RSPAN configuration and behavior are true? (Choose three.)

Accepted Answer

The RSPAN VLAN must be created on all switches that participate in the RSPAN session.. RSPAN requires a dedicated VLAN that is not used for user traffic. The RSPAN VLAN must be created on all switches in the path, and the destination switch must have a destination port configured. The RSPAN VLAN should not be pruned from trunks. The source switch sends mirrored frames into the RSPAN VLAN, and the destination switch extracts them.

Answer

The RSPAN destination port must be configured in access mode and assigned to the RSPAN VLAN.

Answer

RSPAN can only monitor source ports on the same switch as the destination port.

Question 4

Drag and drop the steps of Cisco NSO service provisioning workflow into the correct order, from first to last.

Accepted Answer

Operator sends service request to NSO. Cisco NSO service provisioning begins with the operator or OSS sending a service request to NSO via NETCONF/RESTCONF. NSO then processes the service model and creates a service instance. NSO uses device templates and YANG models to generate device configurations. NSO pushes the configuration to the network devices using NETCONF. Finally, NSO verifies the service is operational and updates the service state.

Question 5

Which three statements about IGMP snooping are true? (Choose three.)

Accepted Answer

IGMP snooping reduces multicast flooding on a VLAN by forwarding traffic only to ports that have joined the group.. IGMP snooping optimizes multicast forwarding at Layer 2 by monitoring IGMP messages. It builds a snooping table, forwards reports only to the querier, and can be configured with static entries. It does not suppress queries or require PIM.

Answer

IGMP snooping suppresses all IGMP general queries from the multicast router.

Answer

IGMP snooping requires PIM to be enabled on the switch.

Question 6

Which three statements about Dynamic Trunking Protocol (DTP) are true? (Choose three.)

Accepted Answer

DTP is a Cisco proprietary protocol.. Correct: A is true because DTP is Cisco proprietary and not supported on non-Cisco switches. B is true because DTP uses VLAN 1 (the native VLAN) for its frames; if the native VLAN is mismatched, DTP may fail. C is true because the 'switchport mode dynamic desirable' interface configuration command actively sends DTP frames to negotiate trunking. D is incorrect because DTP operates at Layer 2, not Layer 3. E is incorrect because DTP is not used on routed ports; it only applies to switch ports in access or trunk mode.

Answer

DTP operates at Layer 3 of the OSI model.

Answer

DTP is used to negotiate trunking on routed ports.

Question 7

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Accepted Answer

DMVPN: mGRE with NHRP. DMVPN uses mGRE and NHRP; FlexVPN uses IKEv2; GET VPN uses GDOI; AnyConnect uses TLS/DTLS; Site-to-Site IPsec VPN uses IKEv1 or IKEv2 with ESP.

Question 8

Which three statements about FlexVPN are true? (Choose three.)

Accepted Answer

FlexVPN uses IKEv2 as its underlying key exchange protocol.. FlexVPN is a Cisco implementation based on IKEv2, supporting hub-and-spoke, spoke-to-spoke, and remote access VPNs with centralized key management.

Answer

FlexVPN requires a dedicated AAA server for all authentication functions.

Answer

FlexVPN uses NHRP to dynamically discover spoke routers and establish direct tunnels.

Question 9

Which three statements about SSL VPNs are true? (Choose three.)

Accepted Answer

SSL VPNs use the TLS protocol to encrypt traffic between client and server.. SSL VPNs use TLS for encryption, can provide clientless access via web browser, and support port forwarding for legacy applications. They do not require IPsec and can use any port (typically 443).

Answer

SSL VPNs require a pre-shared key for authentication.

Answer

SSL VPNs can only operate over TCP port 443.

Question 10

Drag and drop each EIGRP metric component on the left to its matching variable on the right.

Accepted Answer

K1: Bandwidth. K1 corresponds to bandwidth, K2 to load, K3 to delay, and K4 to reliability. K5 is not directly assigned to a single metric component; it is a multiplier used with reliability in the metric formula. MTU is not a K variable; it is only used in the feasibility condition.

Answer

K5: MTU

Question 11

A network engineer configures SNMPv3 on a Cisco router with the following: 'snmp-server group GRP v3 priv', 'snmp-server user usr GRP v3 auth sha pass1 priv aes 128 pass2'. The NMS is configured with the same credentials. However, the NMS cannot perform SNMP walks. The engineer notices that the router's SNMP agent is responding to queries from other devices. What is the most likely cause?

Accepted Answer

The group 'GRP' is not associated with a view that allows read access to the MIB tree.. The 'snmp-server group GRP v3 priv' command creates an SNMPv3 group with privacy (encryption) but does not associate it with any view. By default, SNMPv3 groups have no read, write, or notify access unless a view is explicitly configured. Without a view that permits read access to the MIB tree, the NMS cannot perform SNMP walks, even though the router responds to other queries (e.g., from different groups or versions).

Answer

The user's authentication key is too short.

Answer

The NMS is using SNMPv2c community strings instead of SNMPv3.

Answer

The router's SNMP engine ID has changed since the user was created.

Question 12

Which three statements about syslog message severity levels are correct? (Choose three.)

Accepted Answer

Severity level 0 (emergencies) indicates the system is unusable.. Syslog severity levels range from 0 (emergency) to 7 (debugging). The logging console default is usually level 7 (debugging) but can be changed. Level 3 (errors) includes error conditions that still allow the system to function. Level 5 (notifications) is for normal but significant conditions. Level 6 (informational) is for informational messages. Level 0 is the highest severity (most critical).

Answer

Severity level 6 (informational) is used for debugging messages that are only useful during troubleshooting.

Answer

The default logging console severity level on Cisco IOS is 3 (errors).

Question 13

Which three statements about SNMP trap and inform operations are true? (Choose three.)

Accepted Answer

Traps are unacknowledged notifications sent from the SNMP agent to the manager.. SNMP traps are unacknowledged messages sent from agent to manager. Informs are acknowledged (confirmed) notifications. Informs require a response from the manager and can be retransmitted if no response is received. Traps are sent via UDP port 162 by default. Informs also use UDP port 162. Informs consume more memory and processing because they maintain state for acknowledgment. Traps are less reliable because they are not acknowledged.

Answer

Traps are more reliable than informs because they are sent with a higher priority.

Answer

Informs consume less memory and processing than traps because they do not require state tracking.

Question 14

Which two statements about SNMPv3 security models are true? (Choose two.)

Accepted Answer

The authNoPriv security model provides authentication but no encryption.. SNMPv3 provides three security models: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication but no encryption), and authPriv (authentication and encryption). The authPriv model uses HMAC-MD5 or HMAC-SHA for authentication and CBC-DES or CFB128-AES for encryption. The engine ID is a unique identifier for each SNMP entity and is used to generate the localized key.

Answer

The noAuthNoPriv security model uses both a username and a password for authentication.

Answer

SNMPv3 requires the use of a separate engine ID for each SNMP manager and agent.

Answer

The authPriv model supports only AES-256 for encryption.

Question 15

Which three statements about EIGRP stub routing are true? (Choose three.)

Accepted Answer

A stub router does not send Query packets to its neighbors.. EIGRP stub routing is used to limit the query scope and improve convergence. A stub router is typically a spoke in a hub-and-spoke topology. It advertises its directly connected and summary routes to the hub, but does not query its neighbors. The hub router does not send queries to the stub router. The stub router can be configured with different options: connected, static, summary, receive-only, or redistributed. The 'eigrp stub' command enables this feature.

Answer

A hub router will send queries to a stub router when a route is lost.

Answer

Stub routing is used to reduce the size of the routing table on the hub router.