CCNP Practice Test 3 — 30 Questions

Question 1

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Accepted Answer

Phase 1: Hub-and-spoke with NHRP registration. DMVPN has only three phases. Phase 1 uses NHRP for hub registration only; Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel creation via resolution request/reply; Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.

Answer

Phase 4: NHRP with BGP for routing

Answer

Phase 5: NHRP with OSPF for routing

Question 2

A network team is designing an SD-WAN overlay for a multinational enterprise with 500+ branch sites. The design must ensure that control plane traffic (e.g., OMP updates) is encrypted and authenticated between all vSmart controllers and vEdge routers, while allowing data plane traffic to use IPsec tunnels between branch sites directly. Which architectural element is responsible for orchestrating the initial authentication and certificate enrollment of all SD-WAN devices?

Accepted Answer

vBond. C is correct because the vBond orchestrator is the sole component responsible for initial authentication and certificate enrollment in Cisco SD-WAN. It acts as a trusted certificate authority (CA) proxy, validating the serial numbers and certificates of all vSmart controllers and vEdge routers before they join the overlay network. Without vBond, devices cannot establish trust or receive the authorized list of vSmart and vManage IP addresses.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 3

Given the configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache timeout active 60
 cache timeout inactive 15
!

What is the effect of the 'cache timeout active 60' command?

Accepted Answer

Flows that are active for more than 60 seconds are exported immediately and then removed from the cache.. The 'cache timeout active 60' command configures the NetFlow cache to export and remove any flow that has been active for 60 seconds, even if it is still ongoing. This ensures that long-lived flows are reported periodically rather than waiting until the flow ends, which could delay visibility into sustained traffic patterns.

Answer

Flows that are inactive for 60 seconds are exported and removed from the cache.

Answer

The cache will hold a maximum of 60 active flows at any time.

Answer

Flow records are sent to the exporter every 60 seconds.

Question 4

Consider the following BGP configuration:

router bgp 65000
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50

What is the effect of this configuration?

Accepted Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing inbound path selection in AS 65001.. The route-map SET_MED is applied to outbound updates to neighbor 10.1.1.2, setting the MED (Multi-Exit Discriminator) attribute to 50. MED is a metric that influences inbound path selection in the neighboring AS (AS 65001), telling its routers which path to prefer when multiple entry points exist into AS 65000. Therefore, option A correctly describes the effect.

Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing outbound path selection from AS 65000.

Answer

Routes received from 10.1.1.2 will have the MED set to 50.

Answer

The MED value will be set to 50 for all routes in the BGP table.

Question 5

A network engineer is deploying Cisco SD-WAN in a hybrid cloud environment. The company requires secure segmentation between guest, employee, and IoT traffic across all branches. The engineer must ensure that traffic from each segment is isolated and that policies can be applied per segment. Which two components are used to achieve this segmentation? (Choose two.)

Accepted Answer

VPN segments in vManage. In Cisco SD-WAN, segmentation is achieved by creating VPN segments in vManage and mapping them to VRF instances on the WAN Edge devices. The VPN segments define the logical separation, and the VRFs enforce it by maintaining separate routing and forwarding tables. Together, they provide end-to-end isolation and allow policies to be applied per segment. Other options like VLANs or IPsec tunnels do not provide fabric-wide segmentation, and application-aware routing policies are for path selection, not isolation.

Answer

Application-aware routing policies

Answer

IPsec tunnels between branches

Answer

VLANs on the WAN Edge routers

Question 6

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied. The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 7

A network engineer is troubleshooting voice quality issues on a WAN link. The engineer notices that voice packets are being dropped during congestion. The QoS policy uses LLQ for voice traffic, but the priority queue is not providing the expected bandwidth. What is the most likely cause?

Accepted Answer

The priority queue has a built-in policer that drops traffic exceeding the configured bandwidth.. The priority queue in LLQ uses a built-in policer that drops traffic exceeding the configured bandwidth. When congestion occurs, the policer enforces the bandwidth limit by dropping excess packets, which explains why voice packets are being dropped despite the priority queue being active. This is a fundamental behavior of LLQ to prevent the priority queue from starving other queues.

Answer

The priority queue is not configured with a bandwidth statement.

Answer

The class-map is not matching voice traffic correctly.

Answer

The router is using FIFO queuing instead of LLQ.

Question 8

An engineer is troubleshooting an MPLS VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are running OSPF with the CE routers. On PE1, the 'show ip route vrf CUSTOMER' output shows 10.2.2.0/24 as an OSPF route, but the prefix is not present in the global BGP table. What is the most likely cause?

Accepted Answer

Redistribution from OSPF into BGP under the VRF is not configured on PE1.. In an MPLS VPN, the PE router must redistribute OSPF routes learned from the CE into MP-BGP under the VRF to propagate them across the MPLS backbone. Without this redistribution, the prefix 10.2.2.0/24 appears in the VRF routing table as an OSPF route but is never injected into the BGP table, so it cannot be advertised to the remote PE. This explains why CE1 cannot reach CE2 despite the route being present locally on PE1.

Answer

The OSPF adjacency between PE1 and CE1 is down.

Answer

The VRF forwarding table on PE1 is full.

Answer

MPLS LDP is not enabled on the PE1-CE1 link.

Question 9

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 10

Which two statements about Type 1 and Type 2 hypervisors are true? (Choose two.)

Accepted Answer

A Type 1 hypervisor runs directly on the physical hardware without a host operating system.. Option A is correct because a Type 1 (bare-metal) hypervisor, such as VMware ESXi, Microsoft Hyper-V Server, or Citrix XenServer, installs and runs directly on the physical hardware and does not require an underlying host operating system. Option D is correct because VMware Workstation is a Type 2 (hosted) hypervisor that installs as an application on top of an existing host OS like Windows or Linux. Option B is incorrect because it describes a Type 1, not a Type 2, hypervisor — Type 2 hypervisors require a host operating system. Option C is incorrect because VMware ESXi is a Type 1 bare-metal hypervisor, not Type 2. Option E is incorrect because Type 1 hypervisors are typically deployed in data centers and server virtualization scenarios, whereas Type 2 hypervisors are more commonly used for desktop virtualization and testing.

Answer

A Type 2 hypervisor runs directly on the physical hardware without a host operating system.

Answer

VMware ESXi is an example of a Type 2 hypervisor.

Answer

Type 1 hypervisors are typically used for desktop virtualization in enterprise environments.

Question 11

Given the following configuration:

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip access-group 101 in
!
access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 101 deny ip any any

What is the effect of this configuration?

Accepted Answer

Incoming traffic from 192.168.1.0/24 to any destination on port 80 is permitted; all other incoming traffic is denied.. The configuration applies access-list 101 inbound on GigabitEthernet0/0. The first ACE permits TCP traffic from source network 192.168.1.0/24 to any destination on port 80 (HTTP). The second ACE denies all other IP traffic. Since the access list is applied in the inbound direction, it filters traffic entering the router through that interface. Therefore, only incoming traffic matching the permit statement is allowed; everything else is denied.

Answer

Outgoing traffic from the router to 192.168.1.0/24 on port 80 is permitted; all other outgoing traffic is denied.

Answer

Incoming traffic from any source to 192.168.1.0/24 on port 80 is permitted; all other incoming traffic is denied.

Answer

The access-list will permit all TCP traffic from 192.168.1.0/24, regardless of destination port.

Question 12

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Accepted Answer

Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).. In an SD-Access fabric, the underlay network must provide IP connectivity between all fabric devices (edge, control plane, border nodes) using a routed access layer with a link-state routing protocol like IS-IS or OSPF. This ensures fast convergence, loop-free topology, and support for the overlay's VXLAN tunnels. A routed access layer eliminates spanning-tree dependencies and aligns with the fabric's requirement for a simple, scalable IP-based transport.

Answer

Implement PIM-SM for multicast routing in the underlay.

Answer

Preserve existing VLANs across the fabric to minimize changes.

Answer

Deploy VRF-lite on all edge nodes to isolate tenants.

Question 13

What is the purpose of the 'ip nat inside source list' command in Cisco IOS?

Accepted Answer

It identifies the traffic to be translated and the translation method.. The 'ip nat inside source list' command is used to define which traffic (identified by an access list) should be translated and to specify the translation method, such as dynamic NAT, PAT, or static NAT. It links the ACL that matches the source IP addresses to a NAT pool or interface, enabling the router to perform the translation for outbound traffic.

Answer

It defines the inside interface for NAT.

Answer

It filters inbound traffic before NAT is applied.

Answer

It configures the router as a DHCP server.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip route vrf CUSTOMER-A

VRF CUSTOMER-A:
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.100
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.100
B        10.0.2.0/24 [200/0] via 192.168.1.2, 00:12:34

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-A has a BGP-learned route to 10.0.2.0/24. The output shows a BGP-learned route to 10.0.2.0/24 with the code 'B' and the administrative distance [200/0], indicating it is an external BGP route. The route is installed in the VRF CUSTOMER-A routing table, confirming that VRF CUSTOMER-A is using BGP and has learned this prefix via BGP from the next-hop 192.168.1.2.

Answer

VRF CUSTOMER-A is not using BGP for routing

Answer

The default route is learned via BGP

Answer

GigabitEthernet0/0.100 is not associated with VRF CUSTOMER-A

Question 15

Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.

Accepted Answer

Create extended ACL to match traffic. The correct order starts with creating an extended ACL to match the traffic (A), then defining a route-map using the match ip and set vrf commands (B), applying the route-map to the incoming interface (C), after which the router evaluates the policy for each packet (D), and finally matching packets are forwarded into the specified VRF (E). Configuration steps must precede operational steps.

Question 16

Examine the following configuration snippet:
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
 ip ospf dead-interval 40
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF adjacency will form with a neighbor using hello/dead intervals of 10/40 seconds.. The configuration sets the OSPF network type to point-to-point on the interface, which allows OSPF to form an adjacency with a neighbor using the configured hello interval of 10 seconds and dead interval of 40 seconds. These intervals are valid for point-to-point networks, and the network command under router ospf correctly enables OSPF on the interface. Therefore, an adjacency will form as long as the neighbor's intervals match.

Answer

OSPF adjacency will not form because the hello interval is too low for point-to-point.

Answer

The network command under router ospf will be ignored because the interface has an explicit network type.

Answer

OSPF will use the default broadcast network type because the point-to-point keyword is misspelled.

Question 17

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Accepted Answer

Fabric border node. In a centralized policy model for SD-Access, the fabric border node is the correct role to enforce inter-VN traffic policies because it is the only node that can route traffic between different virtual networks (VNs) while applying firewall inspection. The border node connects the fabric to external networks and, when configured with a firewall, can enforce policies such as IP-based ACLs or zone-based firewalls for traffic crossing VNs. This design ensures that all inter-VN traffic is funneled through the border node for inspection, aligning with the centralized policy model where policy enforcement occurs at the network edge.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Fabric WAN router

Question 18

Which component in Cisco SD-WAN is responsible for orchestrating the overlay network, including authentication and NAT traversal?

Accepted Answer

vBond orchestrator. The vBond orchestrator is responsible for the initial authentication of all SD-WAN components (vSmart, vManage, vEdge/cEdge) into the overlay network. It also performs NAT traversal by discovering and distributing the public IP addresses and port numbers of vEdge routers behind NAT, enabling secure DTLS/TLS connections between them. Without vBond, new devices cannot securely join the fabric or establish control-plane connectivity.

Answer

vSmart controller

Answer

vManage NMS

Answer

vEdge router

Question 19

Drag and drop the steps of VNF service chain instantiation into the correct order, from first to last.

Accepted Answer

Define service chain requirements. Service chain instantiation begins with defining the chain, then selecting VNFs, allocating resources, connecting VNFs via virtual links, and finally testing the chain to verify functionality.

Question 20

A network administrator is configuring a new Cisco IOS switch and wants to ensure that the management VLAN is isolated from user traffic. The administrator needs to assign an IP address to VLAN 1 for management access. Which command should be used to enter the interface configuration mode for VLAN 1?

Accepted Answer

interface vlan 1. To assign an IP address to a VLAN for management, you must enter the SVI configuration using 'interface vlan 1'. This creates a logical Layer 3 interface for that VLAN. The other options either configure physical interfaces, create the VLAN without Layer 3, or are incomplete without entering the interface mode first.

Answer

ip address 192.168.1.1 255.255.255.0

Answer

interface fastethernet 0/1

Answer

vlan 1