CCNP Practice Test 3 — 10 Questions

Question 1

A network administrator is deploying Cisco Application Centric Infrastructure (ACI) and needs to allow two endpoint groups (EPGs) in different bridge domains to communicate while applying a contract that permits only TCP port 443. Which ACI construct provides the policy enforcement point where the contract is applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy enforcement point on the leaf where the EPGs reside. ACI applies contracts at the leaf switch, which acts as the policy enforcement point for the attached EPGs. The APIC distributes the compiled policy, but the leaf hardware renders and enforces the permit for TCP port 443 between the two EPGs in their respective bridge domains.

Answer

The VXLAN tunnel interface on the spine

Answer

The bridge domain subnet SVI on the border leaf

Answer

The APIC controller cluster policy compiler

Question 2

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Accepted Answer

Define ERSPAN source interface(s) and direction. ERSPAN configuration requires first defining the source and destination, then enabling the session. The order ensures the session references exist before activation.

Question 3

A network engineer is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The engineer wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which configuration step is required to maintain isolation between VRFs?

Accepted Answer

Place the guest network interfaces into the guest VRF and do not configure any route leaking.. VRFs provide logical separation of routing tables. When you assign interfaces to a VRF, those interfaces use that VRF's routing table. By default, there is no communication between VRFs unless you explicitly configure route leaking, such as static routes with next-hop VRF or BGP route targets. Therefore, placing the guest interfaces in the guest VRF and not configuring any route leaking ensures isolation. Other options either do not enforce isolation or are unnecessary.

Answer

Assign the guest VRF to a separate VLAN and configure inter-VLAN routing.

Answer

Configure a route target export and import policy to control route leaking.

Answer

Enable VRF-aware routing and ensure no static routes point between VRFs.

Question 4

Examine the following IPsec configuration snippet:

crypto ikev2 proposal IKEV2_PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy IKEV2_POL
 proposal IKEV2_PROP
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto ipsec profile IPSEC_PROF
 set transform-set TSET
 set ikev2-profile IKEV2_POL

Which statement about this configuration is true?

Accepted Answer

The transform set uses ESP with AES-256 encryption and SHA-256 HMAC for authentication.. The transform set explicitly uses 'esp-aes 256' for encryption and 'esp-sha256-hmac' for authentication, which matches the description of ESP with AES-256 encryption and SHA-256 HMAC. The IKEv2 proposal and profile are correctly configured, and the 'mode tunnel' command ensures the transform set operates in tunnel mode, which is appropriate for site-to-site VPNs.

Answer

The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the IPsec profile will not apply because the ikev2-profile command is missing the 'set' keyword.

Answer

The transform set is configured in transport mode, which is incorrect for site-to-site VPN.

Answer

The IPsec profile is incomplete because it does not include a PFS (Perfect Forward Secrecy) setting.

Question 5

An organization uses Ansible to manage network device configurations. They have a playbook that uses the ios_command module to execute 'show ip route' on multiple routers and then uses the 'debug' module to print the output. Recently, the playbook started failing with 'Timeout (12s) waiting for privilege escalation prompt'. The routers are reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The 'ansible_connection' is set to 'network_cli' but the 'ansible_become_method' is not set to 'enable'.. The error 'Timeout (12s) waiting for privilege escalation prompt' indicates that Ansible successfully connected to the routers via SSH but failed to escalate privileges to enable mode. For network devices like Cisco IOS routers, when using the 'network_cli' connection type, the 'ansible_become_method' must be explicitly set to 'enable' to send the 'enable' command and handle the privilege escalation prompt. Without this setting, Ansible does not attempt to enter enable mode, causing the timeout when the module requires higher privileges to execute commands like 'show ip route'.

Answer

The routers are configured with a different enable secret that does not match the one in the Ansible vault.

Answer

The SSH key exchange is taking longer than the default 12-second timeout.

Answer

The ios_command module requires a different privilege level to execute 'show ip route'.

Question 6

Drag and drop each NETCONF operation on the left to its action on the right.

Accepted Answer

get: Retrieve running configuration and state data. Correct pairings: get retrieves running config and state data; get-config retrieves a specific datastore; edit-config modifies configuration; commit confirms a candidate configuration; lock prevents other sessions from modifying a datastore.

Question 7

A network engineer configures IP SLA 20 to monitor the response time of a DNS server at 10.1.1.1 using DNS query for 'example.com'. The operation is used to influence routing decisions. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 50 ms', but the DNS server is actually down and not responding to any queries. What is the most likely reason?

Accepted Answer

The IP SLA DNS probe is using a cached DNS response from the router's DNS resolver, so it does not actually query the server.. IP SLA DNS probes rely on the router's local DNS resolver. If the resolver has a cached response for 'example.com', the probe will return the cached RTT without actually querying the DNS server. This explains why the operation shows 'Active' and a 50 ms RTT even though the DNS server is down.

Answer

The IP SLA DNS probe must be configured with a 'timeout' value lower than 50 ms to detect the failure.

Answer

The DNS server is responding to the probe but not to other queries because the probe uses a different port.

Answer

The IP SLA operation is configured with a 'frequency' that is too low, causing the probe to be sent before the server times out.

Question 8

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

Accepted Answer

The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.. The RADIUS server is receiving authentication requests and sending 'Access-Reject' responses, but the WLC logs show 'RADIUS server not responding'. This indicates the WLC is not receiving the responses. The most likely cause is a source IP mismatch: the RADIUS server sends responses from a different IP address than the one configured on the WLC. The WLC drops these responses because they do not match the expected source IP, making it appear as if the server is not responding.

Answer

The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.

Answer

The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.

Answer

The WLC is not configured with a valid management interface IP address to reach the RADIUS server.

Question 9

An engineer configures IP SLA 100 to monitor the jitter and latency of a VoIP call path between two branch routers. The configuration uses UDP jitter with a target of 192.168.2.2 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' but no jitter or latency statistics are collected. The router is generating the probe packets, but the remote router does not respond. What is the most likely reason?

Accepted Answer

The remote router must have an IP SLA responder configured to process the UDP jitter probes.. For UDP jitter IP SLA operations to collect jitter and latency statistics, the remote router must be configured as an IP SLA responder. The responder processes the probe packets and sends back time-stamped responses, which are essential for calculating jitter and one-way delay. Without the responder, the source router can send probes (showing 'Active' state) but cannot compute meaningful statistics because it never receives the required response packets.

Answer

The IP SLA operation must be configured with a 'request-data-size' value to match the remote router's MTU.

Answer

The source router needs a 'frequency' setting that matches the remote router's response interval.

Answer

The firewall on the remote router is blocking the UDP port 16384, preventing the probe from reaching the target.

Question 10

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Accepted Answer

The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.. RSPAN traffic is carried over an RSPAN VLAN that must be allowed on all trunk links between the source switches and the central switch. If the RSPAN VLAN (999) is not included in the allowed VLAN list on the trunk ports, the mirrored frames will be dropped, and the monitoring station will receive no traffic. This is the most likely missing configuration because the engineer verified the VLAN is active and the destination session is set, but did not check the trunk pruning.

Answer

The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.

Answer

The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.

Answer

The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.