CCNP Practice Test 30 — 15 Questions

Question 1

Consider the following partial syslog configuration on a Cisco IOS-XE switch:

logging host 10.10.10.1 transport udp port 514
logging trap 6
logging source-interface Loopback0
logging on

Which statement is true about this configuration?

Accepted Answer

Syslog messages will be sourced from the IP address of Loopback0 interface.. The configuration sends syslog messages to 10.10.10.1 via UDP port 514, with severity level 6 (Informational) and above, sourced from Loopback0, with logging enabled.

Answer

Syslog messages with severity level 7 (Debugging) will be sent to 10.10.10.1.

Answer

The syslog server must be configured to receive messages on TCP port 514.

Answer

Only syslog messages with severity level 6 (Informational) will be sent.

Question 2

What is the default syslog severity level for console logging on a Cisco IOS device?

Accepted Answer

debugging (level 7). The default console logging severity level is 'debugging' (level 7), meaning all messages are displayed on the console by default.

Answer

informational (level 6)

Answer

warnings (level 4)

Answer

errors (level 3)

Question 3

Drag and drop the steps of SNMPv3 secure agent configuration into the correct order, from first to last.

Accepted Answer

Enable SNMP agent with snmp-server command. First, you must enable the SNMP agent with snmp-server. Then define the SNMPv3 group and associate it with a security model. Next, create the user and assign authentication and privacy passwords. Finally, restrict access using an ACL to limit which NMS can poll the agent.

Question 4

A network engineer is troubleshooting intermittent packet loss on a WAN link connecting two data centers. The engineer suspects that certain traffic types are being dropped but needs to confirm this without impacting production. The engineer has access to Cisco IOS-XE routers at both ends. Which approach should the engineer use to identify the specific flows being dropped?

Accepted Answer

Configure Flexible NetFlow on the routers with a flow monitor that includes the 'drop' keyword to capture dropped packets per flow.. NetFlow can be used to monitor traffic flows and identify drops, but traditional NetFlow does not capture drops. The correct answer uses Flexible NetFlow with a flow monitor that includes the 'drop' keyword to capture dropped packets, which is the most direct method. Option B is incorrect because SNMP polling of interface counters shows aggregate drops but not per-flow. Option C is incorrect because EEM alone cannot capture per-flow drop details. Option D is incorrect because IP SLA measures performance but not drop causation per flow.

Answer

Enable SNMP polling of interface counters to identify the total number of dropped packets on the WAN interface.

Answer

Use Embedded Event Manager (EEM) to trigger on interface drops and capture a packet trace.

Answer

Deploy IP SLA probes to measure latency and jitter, and correlate with drop events.

Question 5

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

Accepted Answer

Google Protocol Buffers (GPB) encoding.. For high-volume streaming telemetry, efficient encoding is critical. Option A is correct because GPB (Google Protocol Buffers) is a compact binary format that reduces bandwidth and parsing overhead. Option B is incorrect because JSON is text-based and verbose. Option C is incorrect because XML is even more verbose. Option D is incorrect because CSV is not a standard telemetry encoding and lacks structure.

Answer

JSON encoding.

Answer

XML encoding.

Answer

CSV encoding.

Question 6

A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?

Accepted Answer

No telemetry subscription is configured on the router for the desired data paths.. For gRPC telemetry, the router must have a subscription configured to send data. Option A is correct because without a subscription, no data is streamed. Option B is incorrect because the server is running. Option C is incorrect because the collector is reachable. Option D is incorrect because the encoding format does not prevent data from being sent if the server is up.

Answer

The gRPC server is configured with the wrong port number.

Answer

The collector is not listening on the same IP address as configured on the router.

Answer

The telemetry data is encoded in GPB, but the collector expects JSON.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:34    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:38    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

The local router is the Backup Designated Router (BDR). The output shows OSPF neighbors on a multi-access network. The neighbor with state FULL/DR is the Designated Router, and the neighbor with state 2WAY/DROTHER is a non-DR/BDR router that has formed a two-way adjacency but is not adjacent to the DR. The local router must be either the BDR or a DROTHER, as it is not listed as DR. The correct answer is that the local router is the Backup Designated Router (BDR).

Answer

The local router is the Designated Router (DR)

Answer

The local router is a DROTHER

Answer

The OSPF network type is point-to-point

Question 8

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             Cost        19
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4466
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 19        128.1    P2p
Gi0/2               Altn BLK 19        128.2    P2p

Based on this output, what can be concluded?

Accepted Answer

The local switch is not the root bridge for VLAN 10. The output shows spanning-tree information for VLAN 10. The root bridge has priority 32778 and address 0011.2233.4455. The local switch has a different bridge ID (0011.2233.4466), so it is not the root. Interface Gi0/1 is the root port (Root, FWD), and Gi0/2 is an alternate port (Altn, BLK). The correct answer is that the local switch is not the root bridge for VLAN 10.

Answer

The local switch is the root bridge for VLAN 10

Answer

Interface Gi0/2 is in a forwarding state

Answer

The spanning-tree mode is Rapid PVST+

Question 9

A network engineer runs the following command on Router R1:

R1# show ip pim neighbor

PIM Neighbor Table
Neighbor Address  Interface          Uptime    Expires    Mode
10.0.0.2          GigabitEthernet0/0 00:10:00  00:01:30   Dense
10.0.0.3          GigabitEthernet0/1 00:20:00  00:01:20   Sparse

Based on this output, what can be concluded?

Accepted Answer

The router is configured with mixed PIM modes on different interfaces. The output shows PIM neighbors. One neighbor (10.0.0.2) is in Dense mode, and the other (10.0.0.3) is in Sparse mode. This indicates that the router has interfaces operating in different PIM modes. The correct answer is that the router is configured with mixed PIM modes on different interfaces.

Answer

All PIM neighbors are operating in sparse mode

Answer

The router is using PIM version 2 exclusively

Answer

The neighbor 10.0.0.3 is not a valid PIM neighbor

Question 10

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Accepted Answer

Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.. Model-driven telemetry (MDT) using gRPC or gNMI is the modern approach for streaming structured data from NX-OS devices. Option A is correct because MDT supports both periodic and event-driven subscriptions. Option B is incorrect because NetFlow is for flow data, not interface counters or BGP state. Option C is incorrect because SNMP traps are event-driven but not scalable for high-frequency streaming. Option D is incorrect because IP SLA is for active measurements, not streaming device state.

Answer

Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.

Answer

Use SNMP traps to send interface and BGP state changes to the collector.

Answer

Deploy IP SLA responders on the switches to measure performance and send results via syslog.

Question 11

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

Accepted Answer

Define a flow record that matches the specific application using NBAR or an ACL, and apply a flow monitor with a sampler rate to reduce CPU impact.. Flexible NetFlow allows filtering to reduce CPU impact. Option A is correct because using a flow record with a match on the application (e.g., NBAR or ACL) and a sampler reduces the number of flows processed. Option B is incorrect because capturing all flows would increase CPU load. Option C is incorrect because SNMP polling gives aggregate data, not per-application. Option D is incorrect because mirroring all traffic to a probe would also increase CPU load.

Answer

Enable NetFlow on all interfaces and export all flows to the collector, then filter at the collector.

Answer

Use SNMP to poll interface counters and calculate the bandwidth used by the application.

Answer

Configure port mirroring (SPAN) to send all traffic to an external probe for analysis.

Question 12

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 00:12:34       15
192.168.1.3     4        65003    2048    2040       10    0    0 00:24:56       20

Based on this output, what can be concluded?

Accepted Answer

Both BGP sessions are in the established state. The output shows BGP neighbors and their state. Both neighbors are in established state (PfxRcd shows number of prefixes received). The local AS is 65001, and the neighbors are in different AS numbers (65002 and 65003), indicating eBGP sessions. The correct answer is that both BGP sessions are established and exchanging prefixes.

Answer

The BGP session with 192.168.1.2 is idle

Answer

Router R1 is using iBGP with both neighbors

Answer

The BGP table version is 10, meaning 10 prefixes are in the table

Question 13

A network engineer is configuring NetFlow on a Cisco ISR 4451 router to analyze traffic patterns. The engineer wants to export flow data to a collector every 60 seconds. After applying the configuration, the engineer notices that the export packets are not reaching the collector. The collector is reachable via ICMP. What is the most likely cause?

Accepted Answer

The 'ip flow-export destination' command is missing or specifies an incorrect UDP port number.. NetFlow export uses UDP as the transport protocol, and the collector must be listening on the correct UDP port. Option A is correct because the export destination must specify the correct UDP port. Option B is incorrect because NetFlow does not require TCP. Option C is incorrect because the flow monitor is needed for Flexible NetFlow, but traditional NetFlow uses 'ip flow-export'. Option D is incorrect because the timeout setting affects when flows are exported, not the reachability of export packets.

Answer

The router is using TCP for NetFlow export, but the collector only supports UDP.

Answer

The flow monitor is not applied to any interface, so no flows are being collected.

Answer

The 'ip flow-export timeout rate' is set too high, causing export packets to be delayed.

Question 14

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Accepted Answer

gRPC (Google Remote Procedure Call).. Cisco DNA Center uses model-driven telemetry with gRPC as the preferred transport for streaming data from IOS-XE devices. Option A is correct because gRPC is the standard for MDT. Option B is incorrect because NetFlow is for flow data, not device state. Option C is incorrect because SNMP is not used for streaming telemetry in DNA Center. Option D is incorrect because syslog is for log messages, not structured telemetry.

Answer

NetFlow v9.

Answer

SNMPv3.

Answer

Syslog.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "ospf 1", distance 110, metric 20, type inter area
  Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago
      Route metric is 20, traffic share count is 1

Based on this output, what can be concluded?

Accepted Answer

The route is an OSPF inter-area route. The output shows a specific route in the routing table. The route is learned via OSPF, with a metric of 20, and is an inter-area route (type inter area). The next hop is 10.0.0.2 via GigabitEthernet0/0. The correct answer is that the route is an OSPF inter-area route.

Answer

The route is an OSPF intra-area route

Answer

The route is an OSPF external route

Answer

The route is learned via EIGRP