CCNP Practice Test 2 — 30 Questions

Question 1

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Accepted Answer

HTTP and HTTPS traffic from 192.168.1.0/24. The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Answer

ICMP traffic from any source

Answer

FTP traffic from 192.168.1.0/24

Answer

SSH traffic from 192.168.1.0/24

Question 2

Which TWO STP features are used to improve convergence time after a topology change?

Accepted Answer

UplinkFast. UplinkFast is correct because it enables a switch to immediately use an alternate root port when its current root port fails, bypassing the usual 30-second listening and learning delay. This is achieved by artificially lowering the bridge priority of the switch to trigger a topology change notification, allowing the backup port to transition directly to forwarding. BackboneFast is correct because it reduces convergence time by detecting indirect link failures in the backbone and allowing a switch to expire its Max Age timer (default 20 seconds) immediately, rather than waiting for the full timer to expire, thus speeding up the transition to a new root port.

Answer

Root Guard

Answer

BPDU Guard

Answer

PortFast

Question 3

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Accepted Answer

switchport port-security maximum 2
switchport port-security violation shutdown. Option B is correct because the 'shutdown' violation mode places the interface into an err-disabled state when a port security violation occurs, which matches the requirement to disable the interface. The 'maximum 2' command limits the number of allowed MAC addresses to two, and the first two learned MAC addresses are dynamically secured. This combination ensures that any additional MAC address triggers a violation and disables the port.

Answer

switchport port-security maximum 2
switchport port-security violation err-disable

Answer

switchport port-security maximum 2
switchport port-security violation protect

Answer

switchport port-security maximum 2
switchport port-security violation restrict

Question 4

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Option B is correct because disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.

Question 5

A campus network uses a collapsed core design with two distribution switches and multiple access switches. The engineer wants to ensure that if one distribution switch fails, the access switches can still reach the core. The access switches are connected to both distribution switches. What additional configuration is required on the access switches?

Accepted Answer

Configure the access switches with VPC (Virtual Port Channel) to the distribution switches.. Option A is correct because VPC allows the access switches to form a single logical link to the pair of distribution switches, enabling active-active forwarding and seamless failover. If one distribution switch fails, the access switch continues to reach the core through the surviving distribution switch without requiring STP convergence or routing protocol changes.

Answer

Enable STP on the access switches and set the root bridge priority to 0.

Answer

Configure the access switches with HSRP to the distribution switches.

Answer

Use static routing with equal-cost paths from the access switches to the distribution switches.

Question 6

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

Accepted Answer

Tenant. In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.

Answer

VRF

Answer

Bridge Domain

Answer

Contract

Question 7

A service provider is deploying NFV to host virtual network functions (VNFs) such as firewalls, routers, and WAN optimizers on a single server. The design must support service chaining, where traffic flows through multiple VNFs in a specific order, and must allow dynamic insertion of new VNFs without re-cabling. Which technology should be used to implement the service chain?

Accepted Answer

VXLAN overlay with policy-based forwarding to direct traffic through VNFs. VXLAN overlay with policy-based forwarding (PBF) is the correct choice because it enables service chaining by encapsulating traffic and steering it through a sequence of VNFs based on policies, without requiring physical re-cabling. This allows dynamic insertion of new VNFs by simply updating the forwarding policies in the overlay, which is essential for NFV environments where VNFs are hosted on the same server and must be chained flexibly.

Answer

VLAN trunking between VNFs on the same hypervisor

Answer

Static routing between VNFs using dedicated interfaces

Answer

MPLS L3VPN between VNFs

Question 8

Given the following configuration:
router eigrp TEST
 network 10.0.0.0 0.255.255.255
 network 192.168.1.0
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip summary-address eigrp TEST 10.0.0.0 255.0.0.0 5

What is the effect of the ip summary-address command?

Accepted Answer

It creates a summary route 10.0.0.0/8 with a metric of 5, advertised out GigabitEthernet0/0.. The `ip summary-address eigrp TEST 10.0.0.0 255.0.0.0 5` command creates a summary route of 10.0.0.0/8 with an administrative distance of 5, which is advertised out of GigabitEthernet0/0. The EIGRP process name TEST matches the router eigrp configuration, and the summary is generated regardless of the network statements, as long as the router has a more specific route within the summarized range.

Answer

It creates a summary route 10.0.0.0/8 with a metric of 5, but only for the EIGRP process named TEST.

Answer

It creates a summary route 10.0.0.0/8 with a hop count of 5.

Answer

The command is invalid because the summary address must match the network statement exactly.

Question 9

Drag and drop the steps of the PPDIOO network lifecycle into the correct order, from first to last.

Accepted Answer

Prepare: Define network requirements and strategy. The PPDIOO lifecycle defines six phases: Prepare, Plan, Design, Implement, Operate, and Optimize. This order ensures a structured approach from initial requirements gathering through ongoing improvement.

Question 10

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Accepted Answer

Design access layer with VLANs and port security. The hierarchical design process starts with access layer connectivity, then moves to distribution layer aggregation, core layer transport, and finally WAN edge integration. This layered approach optimizes scalability and performance.

Question 11

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Accepted Answer

Configure underlay network with IS-IS or OSPF. SD-Access deployment begins with underlay configuration for physical connectivity, then overlay setup with LISP/VXLAN, followed by policy definition and integration with DNA Center for automation and assurance.

Question 12

Examine the following configuration snippet:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 100
 spanning-tree portfast
 spanning-tree bpduguard enable

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.. The configuration enables PortFast and BPDU Guard on an access port. PortFast immediately transitions the port to forwarding state, bypassing the usual STP listening and learning phases. BPDU Guard monitors for incoming BPDUs; if any are received, it error-disables the port to prevent a potential bridging loop from an unauthorized switch connection.

Answer

The port will remain in blocking state until a BPDU is received from the root bridge.

Answer

The port will only forward BPDUs and will not forward data traffic.

Answer

The port will participate in RSTP and will not be affected by BPDU reception.

Question 13

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

Accepted Answer

Each VDC can have its own admin account and separate management interface.. Option C is correct because each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

Answer

VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

Answer

VDCs provide Layer 3 routing isolation by default across all VDCs.

Answer

VDCs are supported on all Cisco IOS-XE switches.

Question 14

Drag and drop the steps of SD-Access fabric node onboarding into DNA Center into the correct order, from first to last.

Accepted Answer

Physically connect the node to the network and power it on. The correct order begins with physical connectivity and discovery, followed by adding the device to inventory, assigning it to a site, configuring the network profile and fabric role, and finally provisioning the node. This sequence ensures the device is discovered, recognized, and properly configured within the SD-Access fabric.

Question 15

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Accepted Answer

authentication port-control auto. Option B is correct because 'authentication port-control auto' is the required interface command to enable 802.1X authentication on a switch port. This command sets the port to initiate the authentication process, placing it in the unauthorized state until the client successfully authenticates via the RADIUS server (Cisco ISE). Without this command, the port will not enforce 802.1X.

Answer

dot1x pae authenticator

Answer

authentication port-control force-authorized

Answer

authentication port-control force-unauthorized

Question 16

Which TWO of the following are benefits of implementing a spine-leaf architecture in a data center?

Accepted Answer

Provides predictable latency for east-west traffic.. In a spine-leaf architecture, every leaf switch connects to every spine switch, creating a full mesh topology. This design ensures that any east-west traffic (server-to-server) traverses exactly one spine hop, providing consistent and predictable latency regardless of which leaf switches the source and destination are connected to.

Answer

Eliminates the need for spanning-tree protocol.

Answer

Reduces the amount of cabling required.

Answer

Eliminates the need for firewall appliances.

Question 17

Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.

Accepted Answer

Define the external network and VLAN mapping. The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.

Question 18

Drag and drop the steps of SD-Access fabric endpoint registration into the correct order, from first to last.

Accepted Answer

Endpoint sends ARP or DHCP request. The correct order begins with the endpoint sending an ARP or DHCP request, the edge node detecting the new endpoint, registering it with the control plane (LISP), the control plane updating the map server, and finally the edge node installing the necessary forwarding entries. This sequence ensures the endpoint is properly discovered and integrated into the fabric.

Question 19

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

Accepted Answer

The next-hop IP addresses are in the global routing table, not in the VRF.. When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.

Answer

LISP is not configured to map the virtual network.

Answer

OSPF is not redistributing the routes into the VRF.

Answer

The physical interface is not configured as a trunk.

Question 20

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.. The issue is that the remote PE router does not have the correct route target import/export configuration for VRF CUSTOMER_C. In MPLS L3VPN, VRFs on different PEs must have matching route target values to import and export VPNv4 routes into the correct VRF. Even if the local PE is correctly configured, the remote PE must also import the routes from the local PE using the same route target. Without this, the remote PE will not install the VPNv4 prefixes into its VRF, causing the customer to be unable to reach sites connected to that remote PE.

Answer

Increase the MTU on the link between the PE routers.

Answer

Reconfigure LDP on the PE routers to establish a targeted session.

Answer

Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.

CCNP Practice Test 2 — 30 Questions

Exhibit

CCNP Practice Test 2 — 30 Questions

Exhibit