CCNP Practice Test 30 — 15 Questions

Question 1

A network administrator is configuring a Cisco IOS router to terminate a site-to-site IPsec VPN with a remote peer that uses dynamic public IP addressing. The administrator wants the router to accept IKE negotiations from any peer that presents a valid pre-shared key and matches a specific protected subnet. Which configuration element is required to support this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A dynamic crypto map entry referenced by a static crypto map, with the remote peer address set to 0.0.0.0.. To accept IPsec negotiations from a peer whose IP address is not known in advance, the headend uses a dynamic crypto map entry that has no configured peer address. A static crypto map references it, so incoming IKE negotiations can be matched, the peer address learned, and the appropriate transform set and ACL applied to build the tunnel.

Answer

A static crypto map with set peer 0.0.0.0 and a wildcard pre-shared key on the local router.

Answer

An IKEv2 profile with match identity remote address 0.0.0.0 and a certificate map for peer authentication.

Answer

A GRE tunnel with IPsec transport mode protecting the tunnel endpoints and dynamic routing over the tunnel.

Question 2

Drag and drop the steps of NAT64 IPv6-to-IPv4 translation flow into the correct order, from first to last.

Accepted Answer

IPv6 host sends packet to synthetic IPv6 address. NAT64 translates IPv6 packets to IPv4. The IPv6 host sends a packet to a synthetic IPv6 address, the router extracts the embedded IPv4 destination, creates a NAT64 binding, translates headers, and forwards the IPv4 packet.

Question 3

Drag and drop the steps of DHCP failover configuration between primary and standby into the correct order, from first to last.

Accepted Answer

Configure primary server with failover peer and standby IP. DHCP failover requires both servers to be configured with the same scope and failover parameters. First, configure the primary server with the failover peer name and IP address of the standby. Then, configure the standby server with the same peer name and the primary's IP. Enable the failover on the primary, which starts the negotiation. The standby then enters partner-down state until it synchronizes. Finally, both servers become active and share lease information.

Question 4

Drag and drop the steps of Cisco DHCP snooping binding table population into the correct order, from first to last.

Accepted Answer

Enable DHCP snooping globally on the switch. DHCP snooping builds the binding table by first enabling snooping globally, then on specific VLANs, and designating trusted ports. The switch intercepts DHCP messages, extracts client info from ACK packets, and populates the binding table with the lease information.

Question 5

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The engineer wants to ensure that BGP keepalives are not dropped during a control plane overload, while still rate-limiting SSH and SNMP. The engineer creates a class-map matching BGP, SSH, and SNMP traffic, then applies a policy-map with a single policer of 1000 pps to that class. After applying the service-policy to the control plane, BGP sessions flap during high CPU utilization. What is the most likely cause?

Accepted Answer

The policer rate is too low for BGP keepalives, and all matched traffic is treated equally.. CoPP requires granular classification to protect critical protocols. When BGP, SSH, and SNMP are matched in the same class and policed together, BGP keepalives compete with other traffic and may be dropped during high CPU. BGP should be placed in its own class with a higher rate or priority to prevent flapping. The single policer approach lacks the necessary differentiation.

Answer

CoPP cannot be applied to BGP traffic; it only supports management protocols like SSH and SNMP.

Answer

The service-policy must be applied to the data plane instead of the control plane for BGP to be protected.

Answer

The policer should be configured with 'police cir' instead of 'police pps' to properly rate-limit BGP.

Question 6

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an unauthorized device connects to an access port, the port must immediately stop forwarding traffic, generate a syslog message, and increment the violation counter, while allowing the administrator to manually re-enable the port after investigation. Which port security violation mode should be configured?

Accepted Answer

shutdown. Port security shutdown mode is the only violation action that immediately err-disables the interface, halts forwarding, logs a syslog message, increments the violation counter, and requires manual recovery. Protect and restrict leave the port up, and err-disable recovery is a global timer feature rather than a violation mode. The stated need for manual re-enablement after investigation confirms shutdown is correct.

Answer

err-disable recovery

Answer

protect

Answer

restrict

Question 7

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) running AireOS in a branch office. The security policy requires that guest wireless clients be isolated from internal corporate clients and that guest traffic be tunneled back to a DMZ interface on the WLC. Which WLAN configuration element should the administrator use to meet these requirements?

Accepted Answer

Configure a dynamic interface mapped to the guest VLAN and assign it to the guest WLAN.. Guest wireless traffic on an AireOS WLC is isolated and tunneled by mapping the guest WLAN to a dynamic interface whose VLAN resides in a DMZ. The dynamic interface defines the VLAN and IP subnet for that WLAN, and the WLC forwards guest client traffic through that interface rather than the management interface. This design keeps guest clients off corporate VLANs and allows a firewall to enforce policy in the DMZ.

Answer

Configure the guest WLAN with AP group VLAN tagging and enable FlexConnect local switching.

Answer

Configure the guest WLAN to use the management interface with a separate SSID.

Answer

Configure the guest WLAN to use the virtual interface and enable Web Auth.

Question 8

Which two statements about the 'ip access-group' command are true? (Choose two.)

Accepted Answer

The 'ip access-group' command applies an ACL to an interface in a specified direction.. Option A is correct because the 'ip access-group' command binds an existing ACL to an interface and requires a direction keyword (in or out), thereby filtering traffic in that specified direction. Option B is correct because 'ip access-group' can be configured on physical interfaces (e.g., GigabitEthernet0/1) as well as on switched virtual interfaces (SVIs) such as interface Vlan10, since both are Layer 3 interfaces that support ACL application. Option C is incorrect because 'ip access-group' only applies an already-defined ACL; it does not create one, and referencing a nonexistent ACL results in an error or an empty ACL depending on platform. Option D is incorrect because the command supports both the inbound and outbound directions via the 'in' and 'out' keywords. Option E is incorrect because CoPP policies are applied to the control plane using the 'service-policy' command under 'control-plane' configuration, not with 'ip access-group'.

Answer

The 'ip access-group' command creates a new ACL if the named ACL does not exist.

Answer

The 'ip access-group' command can only filter traffic in the inbound direction.

Answer

The 'ip access-group' command is used to apply a CoPP policy to the control plane.

Question 9

A security architect is designing a Cisco TrustSec deployment for a campus network. The architect needs to ensure that security group tags (SGTs) are propagated across a Layer 2 trunk between two Catalyst switches that do not support SGACL enforcement. Which technology should be used to carry SGT information inline within the Ethernet frame?

Accepted Answer

Cisco Meta Data (CMD). Cisco Meta Data (CMD) is the inline tagging mechanism in Cisco TrustSec that inserts the SGT into the Ethernet frame. It enables SGT propagation across switches that may not enforce SGACLs, allowing downstream devices to apply policies. This satisfies the requirement for inline SGT carriage over a Layer 2 trunk.

Answer

MACsec

Answer

SXP

Answer

802.1Q tunneling (QinQ)

Question 10

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive SSH traffic. The engineer wants to classify SSH traffic destined to the router itself and apply a policer to it. Which mechanism is used by CoPP to classify traffic before the policer is applied?

Accepted Answer

Class maps that match on the control-plane interface and access control lists. CoPP is built on the modular QoS CLI, where class maps identify control-plane traffic using the control-plane keyword combined with ACLs or protocol matches. A policy map then applies a policer to those classes, and the policy is attached to the control plane with service-policy. This layered approach lets administrators rate-limit SSH and other punted traffic without affecting transit forwarding.

Answer

Policy maps that match on the ingress data-plane interface

Answer

Route maps that match on the management VRF and next-hop address

Answer

ACLs applied directly to the VTY lines with the access-class command

Question 11

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to define data models for NETCONF and RESTCONF.. Option A is correct because YANG (RFC 7950) is the standard data modeling language used to define the configuration and state data manipulated by NETCONF (RFC 6241) and RESTCONF (RFC 8040) protocols. Option C is correct because YANG organizes data hierarchically using constructs such as containers (for grouping nodes) and lists (for repeated entries keyed by leaf values), enabling tree-structured schemas. Option E is correct because YANG defines built-in types including string, int32, uint32, boolean, enumeration, and others, which can be used directly or restricted via derived types. Option B is not correct because YANG modules are written in a dedicated YANG syntax, not XML; XML is only one of the encodings (alongside JSON) used to represent YANG-modeled data on the wire. Option D is not correct because YANG modules are not compiled into SNMP MIBs; SNMP uses SMIv2 MIBs, and YANG-to-MIB translation is a separate, non-standard mapping, not a compilation step.

Answer

YANG models are written in XML syntax.

Answer

YANG modules are compiled into MIB files for SNMP.

Question 12

Drag and drop each BGP message type on the left to its matching function on the right.

Accepted Answer

OPEN: Establishes BGP peering parameters. OPEN establishes peering; UPDATE advertises/withdraws routes; NOTIFICATION signals errors; KEEPALIVE maintains session; ROUTE-REFRESH requests re-advertisement.

Question 13

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Accepted Answer

Create prefix-list or AS-path ACL. First, you create the prefix-list or AS-path ACL to match routes. Then you define the route-map with match and set clauses. Next, you apply the route-map to a neighbor under the BGP address-family. After that, you clear the BGP session to apply the policy. Finally, you verify the policy effect with show ip bgp.

Question 14

A network engineer is configuring a Cisco switch for 802.1X with RADIUS authentication. The switch is also configured with 'aaa authentication dot1x default group radius'. The engineer wants to use a single RADIUS server for both authentication and accounting. The RADIUS server is configured with the same shared secret for both services. The engineer configures 'radius-server host 10.1.1.1 auth-port 1812 acct-port 1813 key cisco123'. However, accounting records are not being sent to the server. The engineer verifies that the RADIUS server is reachable and that accounting is enabled on the server. What is the most likely cause?

Accepted Answer

The switch is missing the 'aaa accounting dot1x default start-stop group radius' command to enable accounting for 802.1X sessions.. The switch is configured for RADIUS authentication but lacks the 'aaa accounting dot1x default start-stop group radius' command, which is required to enable accounting for 802.1X sessions. Without this command, the switch will not send accounting records to the RADIUS server, even if the server is reachable and accounting is enabled on it. The 'aaa authentication dot1x default group radius' command only enables authentication, not accounting.

Answer

The RADIUS server is using a different accounting port than 1813; the switch should use port 1646.

Answer

The switch must have 'aaa new-model' configured before accounting can work.

Answer

The RADIUS server's shared secret for accounting is different from the authentication secret.

Question 15

Drag and drop the steps of IPFIX template negotiation and export into the correct order, from first to last.

Accepted Answer

Exporter sends template set with field definitions. The exporter first sends a template set to the collector, the collector acknowledges, then the exporter sends data records using that template, and templates may be withdrawn or resent periodically.