CCNP Practice Test 31 — 15 Questions

Question 1

Drag and drop each OSPF router role on the left to its matching function on the right.

Accepted Answer

DR: Generates Type 2 Network LSA and maintains full adjacencies with all routers on the segment. DR (Designated Router) generates Network LSAs and manages adjacencies on multi-access networks; BDR (Backup DR) takes over if the DR fails; DROTHER routers form full adjacencies only with DR and BDR; ASBR redistributes routes from other protocols; ABR connects multiple areas.

Question 2

In Cisco SD-WAN, what is the default OMP hello interval (in seconds) between a vEdge router and a vSmart controller?

Accepted Answer

10 seconds. The default OMP hello interval between a vEdge router and a vSmart controller in Cisco SD-WAN is 10 seconds. OMP (Overlay Management Protocol) uses these periodic hello messages to maintain adjacency and detect failures, with a default dead interval of 60 seconds (6 times the hello interval).

Answer

30 seconds

Answer

60 seconds

Answer

5 seconds

Question 3

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The device's SSH server is not fully initialized. The error 'ValueError: SSH session not active' indicates that Netmiko attempted to establish an SSH connection but the session was not fully active. The most likely cause is that the device's SSH server is not fully initialized, which can happen if the device is still booting or the SSH process has not completed startup. This is distinct from reachability or credential issues, as the device responds to pings but the SSH daemon is not ready to accept connections.

Answer

The connection timeout is set too low

Answer

The device has reached the maximum number of SSH sessions

Answer

The device requires an enable password but none was provided

Question 4

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

Accepted Answer

Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.. The CoPP policy is dropping SNMP packets from the NMS because the class-map matching SNMP traffic (UDP port 161) is applied without an exception for the specific management station. By modifying the ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement, the router will match and allow those packets before they hit the drop action, preserving control plane protection while permitting the NMS polls.

Answer

Increase the police rate for the CoPP class that matches SNMP traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Answer

Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.

Question 5

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Accepted Answer

The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.. The missing 'aaa authentication enable default group tacacs+ local' command means the device does not require TACACS+ authentication to enter enable mode. Since the user is already at privilege level 15 after login (due to the 'aaa authorization exec' command or local user configuration), they are not prompted for a password and are granted full privileges immediately. Additionally, command authorization is only configured for privilege level 15 ('aaa authorization commands 15'), so once the user is at level 15, no further authorization checks are performed for commands like 'debug', bypassing the intended per-role enforcement.

Answer

The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.

Answer

Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.

Answer

The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.

Question 6

A multinational organization has a BGP-based MPLS VPN network. The CE router at a branch office is connected to two PE routers (PE1 and PE2) in the service provider network. The branch uses eBGP to exchange routes with the PEs. The network administrator notices that the branch can reach some destinations but not others. The BGP table on the CE shows routes with next-hop set to the PE loopback addresses, but those loopbacks are not reachable. The CE has a default route pointing to the PEs. What is the most likely cause of the issue?

Accepted Answer

The next-hop addresses of the BGP routes are not reachable.. The CE router learns BGP routes from the PE routers with next-hop addresses set to the PE loopback interfaces. For these routes to be installed in the routing table, the CE must have a route to the next-hop IP address. Since the CE only has a default route pointing to the PEs and the PE loopbacks are not directly connected or reachable via any specific route, the BGP routes remain hidden (not installed) because the next-hop is unreachable. This is the most likely cause of partial reachability.

Answer

The default route on the CE is overriding the BGP routes.

Answer

The routes have an AS path that is too long.

Answer

The CE is not advertising its routes to the PEs.

Question 7

A network engineer runs the following command on Router R4:

R4# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy input: SHAPE_POLICY

Class-map: class-default (match-any)
      1000 packets, 100000 bytes
      5 minute offered rate 100000 bps, drop rate 0 bps
      Match: any
      Queueing
      shape (average) cir 500000, bc 5000, be 5000
      target shape rate 500000

Based on this output, what can be concluded?

Accepted Answer

Traffic is being shaped to an average rate of 500 kbps.. The output shows a shape (average) cir 500000 with a target shape rate of 500000, which is 500,000 bps (500 kbps). Shaping buffers excess traffic to enforce an average rate, unlike policing which drops or marks. The 'drop rate 0 bps' confirms no drops are occurring, so traffic is being shaped to 500 kbps.

Answer

Traffic is being policed to 500 kbps.

Answer

The policy is applied to output traffic.

Answer

The offered rate exceeds the shaping rate, causing drops.

Question 8

Examine the following IPsec configuration snippet:

crypto ikev2 proposal IKEV2_PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy IKEV2_POL
 proposal IKEV2_PROP
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto ipsec profile IPSEC_PROF
 set transform-set TSET
 set ikev2-profile IKEV2_POL

Which statement about this configuration is true?

Accepted Answer

The transform set uses ESP with AES-256 encryption and SHA-256 HMAC for authentication.. The transform set explicitly uses 'esp-aes 256' for encryption and 'esp-sha256-hmac' for authentication, which matches the description of ESP with AES-256 encryption and SHA-256 HMAC. The IKEv2 proposal and profile are correctly configured, and the 'mode tunnel' command ensures the transform set operates in tunnel mode, which is appropriate for site-to-site VPNs.

Answer

The IKEv2 proposal uses AES-256, SHA-256, and DH group 14, but the IPsec profile will not apply because the ikev2-profile command is missing the 'set' keyword.

Answer

The transform set is configured in transport mode, which is incorrect for site-to-site VPN.

Answer

The IPsec profile is incomplete because it does not include a PFS (Perfect Forward Secrecy) setting.

Question 9

A large enterprise has a campus network with a collapsed core design. The core switch connects to two distribution switches, each serving several access switches. The network uses OSPF as the IGP. Recently, after a link failure between the core and distribution switch A, the network experienced a 30-second outage before converging. The engineer wants to improve convergence time to under 5 seconds. The budget is limited, so hardware upgrades are not an option. The engineer is considering the following actions:
A. Enable OSPF Fast Hello on all interfaces.
B. Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.
C. Implement OSPF LSA throttling with a minimum interval of 0 ms.
D. Use OSPF incremental SPF (iSPF).

Which action will provide the most significant improvement in convergence time for this scenario?

Accepted Answer

Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.. Reducing the OSPF dead timer to 1 second and hello timer to 333 milliseconds directly addresses the 30-second outage caused by the link failure. The default dead timer (40 seconds on broadcast networks) is the primary contributor to convergence delay, as OSPF must wait for the dead interval to expire before declaring a neighbor down. By lowering these timers, failure detection drops from 40 seconds to approximately 1 second, which is the most impactful single change for convergence under budget constraints.

Answer

Enable OSPF Fast Hello on all interfaces.

Answer

Implement OSPF LSA throttling with a minimum interval of 0 ms.

Answer

Use OSPF incremental SPF (iSPF).

Question 10

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The CoPP policy's conform-action of drop explicitly instructs the switch to discard all packets that match the class-map, regardless of the traffic rate. Even though the traffic rate is only 5 Mbps (below the 10 Mbps police rate), the drop action overrides the policing logic, causing legitimate AF41 traffic to be dropped. This is a common misconfiguration where the engineer sets the action to 'drop' instead of 'transmit' for conforming traffic.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The DSCP value AF41 is not supported on Nexus switches.

Answer

The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.

Question 11

Which two statements about NAT configuration on Cisco IOS-XE are true? (Choose two.)

Accepted Answer

NAT overload (PAT) allows multiple internal hosts to share a single public IP address by using unique source port numbers.. NAT overload (PAT) translates multiple inside local addresses to a single inside global address using port numbers. The ip nat inside source list command with the overload keyword enables this. The ip nat inside source static command creates a one-to-one mapping, not many-to-one. Dynamic NAT without overload uses a pool of global addresses one-to-one. The ip nat outside command is applied to the external interface, not inside. NAT can translate source addresses for traffic leaving the inside network.

Answer

The ip nat inside source list 1 pool POOL overload command enables dynamic NAT without port translation.

Answer

The ip nat outside command is applied to the internal interface to mark it as the source of NAT translations.

Answer

Dynamic NAT without overload translates multiple inside addresses to a single outside address using port numbers.

Question 12

A network engineer configures model-driven telemetry on a Cisco IOS-XE device using gRPC dial-out. The subscription configuration snippet is:

```
telemetry ietf subscription 100
 encoding encode-kvgpb
 filter xpath /interfaces/interface/statistics
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.1.1.1 50001 protocol grpc-tcp
```

What is the primary issue with this configuration?

Accepted Answer

The 'encoding' should be 'encode-json' or 'encode-gpb' instead of 'encode-kvgpb' for gRPC.. GRPC dial-out on Cisco IOS-XE requires the encoding to be 'encode-gpb' (GPB) or 'encode-json' (JSON), not 'encode-kvgpb'. The 'encode-kvgpb' encoding is used for gRPC dial-in (subscriptions initiated by the collector), not dial-out. Using the wrong encoding will cause the telemetry data to be malformed or rejected by the receiver.

Answer

The 'stream' should be 'yang-notif' instead of 'yang-push'.

Answer

The 'update-policy periodic' value must be between 100 and 1000 milliseconds.

Answer

The 'receiver' command should specify 'protocol grpc' instead of 'grpc-tcp'.

Question 13

A network engineer is configuring a DMVPN Phase 3 deployment with EIGRP as the routing protocol. The hub router has multiple spoke routers behind a single physical interface. The engineer notices that spoke-to-spoke traffic is being forwarded through the hub instead of directly. The spoke routers have the correct NHRP and mGRE configuration. What is the most likely cause of this issue?

Accepted Answer

The hub router is configured with 'ip next-hop-self eigrp' under the tunnel interface.. In DMVPN Phase 3, spoke-to-spoke direct communication relies on the hub sending an NHRP Redirect to inform the source spoke of a better path. However, if the hub has 'ip next-hop-self eigrp' configured under the tunnel interface, EIGRP updates sent from the hub will set the next-hop to the hub's own tunnel IP address. This causes the spoke routers to install routes with the hub as the next-hop, preventing them from triggering an NHRP resolution for a direct spoke-to-spoke tunnel. The correct behavior for Phase 3 is to use 'no ip next-hop-self eigrp' so that the original spoke's next-hop is preserved, allowing spokes to resolve the destination via NHRP.

Answer

The hub router is configured with 'no ip next-hop-self eigrp' under the tunnel interface.

Answer

The spoke routers have 'ip nhrp shortcut' configured but the hub does not have 'ip nhrp redirect'.

Answer

The spoke routers are using static NHRP mappings to the hub only, without dynamic NHRP registration.

Question 14

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

Accepted Answer

Predictable latency between any two devices. A is correct because spine-leaf architecture ensures that every leaf switch is connected to every spine switch, creating a full-mesh topology. This design guarantees that traffic between any two leaf switches traverses at most one spine hop, resulting in predictable, consistent latency regardless of which devices are communicating.

Answer

Increased number of single points of failure

Answer

Increased broadcast domain size

Answer

Reduced need for VLANs

Question 15

Drag and drop each OSPF LSA type on the left to its matching description on the right.

Accepted Answer

Type 1: Describes the router's own directly connected links and neighbors. LSA Type 1 (Router LSA) describes a router's own links; Type 2 (Network LSA) is generated by the DR; Type 3 (Summary LSA) advertises inter-area routes; Type 4 (ASBR Summary LSA) advertises the location of an ASBR; Type 5 (AS External LSA) advertises external routes.