CCNP Practice Test 31 — 15 Questions

Question 1

A network engineer runs the following command on Switch SW1:

SW1# show vlan id 10

VLAN ID: 10
VLAN Name: Sales
VLAN Type: Ethernet
VLAN State: active
MTU: 1500

Remote SPAN VLAN: No

Primary VLAN ID: 10

Private VLAN Type: Primary

Associated Secondary VLAN IDs: 100, 200

Based on this output, what can be concluded?

Accepted Answer

VLAN 10 is a primary private VLAN.. The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Answer

VLAN 10 is a community VLAN.

Answer

VLAN 10 is an isolated VLAN.

Answer

VLAN 10 is a normal data VLAN with no private VLAN features.

Question 2

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.179
        State: Oper; Msgs sent/rcvd: 100/95; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/0, Src IP: 10.0.0.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.2.2

Peer LDP Ident: 10.0.0.3:0, Local LDP Ident: 10.0.0.1:0
        TCP connection: 10.0.0.3.646 - 10.0.0.1.179
        State: Oper; Msgs sent/rcvd: 200/190; Downstream
        Up time: 00:20:00
        LDP discovery sources:
          GigabitEthernet0/1, Src IP: 10.0.0.3
        Addresses bound to peer LDP Ident:
          10.0.0.3        192.168.3.3

Based on this output, what can be concluded?

Accepted Answer

The router has two LDP peers that are both operational. The output shows two LDP peers (10.0.0.2 and 10.0.0.3) with the State: Oper for both, indicating both Label Distribution Protocol sessions are fully operational. The 'Downstream' label mode confirms unsolicited downstream label advertisement, which is the default behavior. Therefore, option A is correct.

Answer

The router is using LDP in downstream-on-demand mode

Answer

The LDP session with 10.0.0.2 is down

Answer

The router has only one LDP neighbor

Question 3

A network engineer is configuring a Zone-Based Firewall on a Cisco IOS XE router. The design requires that traffic from the inside zone to the outside zone be inspected, that return traffic be permitted, and that traffic from the outside zone to the inside zone be dropped unless it matches an existing session. Which configuration element is required to achieve this behavior?

Accepted Answer

A zone pair with a service policy that applies inspect to inside-to-outside traffic. Zone-Based Firewall policies are applied to zone pairs and are directional. Inspecting traffic from the inside zone to the outside zone creates session state, which allows return traffic from outside to inside automatically. Without the inspect action on that zone pair, the default inter-zone deny would block return traffic, so the inspect policy is the essential element.

Answer

A class map that matches on the outside interface and an ACL that permits established sessions

Answer

A policy map with the pass action applied to the outside-to-inside zone pair

Answer

A zone pair with a service policy that applies drop to the outside-to-inside zone pair

Question 4

A large enterprise has a campus network with a collapsed core design. The core switch connects to two distribution switches, each serving several access switches. The network uses OSPF as the IGP. Recently, after a link failure between the core and distribution switch A, the network experienced a 30-second outage before converging. The engineer wants to improve convergence time to under 5 seconds. The budget is limited, so hardware upgrades are not an option. The engineer is considering the following actions:
A. Enable OSPF Fast Hello on all interfaces.
B. Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.
C. Implement OSPF LSA throttling with a minimum interval of 0 ms.
D. Use OSPF incremental SPF (iSPF).

Which action will provide the most significant improvement in convergence time for this scenario?

Accepted Answer

Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.. Reducing the OSPF dead timer to 1 second and hello timer to 333 milliseconds directly addresses the 30-second outage caused by the link failure. The default dead timer (40 seconds on broadcast networks) is the primary contributor to convergence delay, as OSPF must wait for the dead interval to expire before declaring a neighbor down. By lowering these timers, failure detection drops from 40 seconds to approximately 1 second, which is the most impactful single change for convergence under budget constraints.

Answer

Enable OSPF Fast Hello on all interfaces.

Answer

Implement OSPF LSA throttling with a minimum interval of 0 ms.

Answer

Use OSPF incremental SPF (iSPF).

Question 5

A network security team is hardening a Cisco IOS XE router that terminates IPsec tunnels to remote branch offices. The team wants to use zone-based firewall (ZBFW) to inspect traffic between the inside, outside, and VPN zones. Which two statements correctly describe zone-based firewall behavior on this platform? (Choose two.)

Accepted Answer

Traffic between two interfaces assigned to the same zone is implicitly permitted and not inspected by the zone policy.. ZBFW permits intra-zone traffic without inspection and denies inter-zone traffic by default unless a zone pair with a policy exists. Zone pairs are unidirectional, inspection handles return traffic for established sessions, and unassigned interfaces use classic ACL behavior rather than joining the self zone. These behaviors drive how the branch router's inside, outside, and VPN zones must be paired and inspected.

Answer

Applying an inspect action to a zone pair automatically creates a reverse zone pair for return traffic.

Answer

Interfaces not assigned to any zone are treated as members of the self zone and inspected.

Answer

A zone pair must be configured bidirectionally; a single zone pair covers traffic in both directions automatically.

Question 6

Which two statements about EIGRP stub routing are true? (Choose two.)

Accepted Answer

A stub router advertises only connected and summary routes by default.. Option A is correct because when the 'eigrp stub' command is configured without additional keywords, the router defaults to advertising only connected and summary routes to its EIGRP neighbors, which limits the routing information it propagates. Option D is correct because stub routing confines EIGRP queries to the stub router's local domain, preventing them from being forwarded to the stub, which reduces query scope and speeds up network convergence. Option B is incorrect because a stub router is explicitly not used as a transit router; it does not advertise routes learned from other EIGRP neighbors, so traffic cannot pass through it to reach other networks. Option C is incorrect because the 'eigrp stub' command is configured on the spoke (stub) routers in a hub-and-spoke topology, not on the hub router. Option E is incorrect because the 'receive-only' keyword configures the stub router to advertise no routes at all, not to advertise all its routes.

Answer

A stub router can still be used as a transit router for other EIGRP neighbors.

Answer

The 'eigrp stub' command is configured on the hub router in a hub-and-spoke topology.

Answer

A stub router can be configured with the 'receive-only' keyword to advertise all its routes.

Question 7

A network engineer is configuring MACsec on a point-to-point link between two Cisco Catalyst switches to provide Layer 2 encryption. The engineer wants to use a pre-shared key for authentication and ensure that the key is rotated periodically. Which MACsec component must be configured to specify the pre-shared key and the key rotation timer?

Accepted Answer

A MACsec key chain with a key string and a lifetime configured under the interface.. MACsec on Cisco switches uses a key chain to store the connectivity association key and its lifetime, which controls key rotation. The key chain is referenced under the interface with the mka key-chain command. This configuration provides the preshared key and periodic rotation required by the scenario, unlike IPsec mechanisms such as IKEv2 or crypto maps.

Answer

An IKEv2 profile with a preshared key and a rekey timer applied to the interface.

Answer

A RADIUS server configuration with a shared secret and a session timeout applied to the interface.

Answer

A crypto map with a preshared key and a lifetime applied to the switch port.

Question 8

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive CPU utilization due to malicious traffic. The engineer wants to ensure that BGP, SSH, and SNMP traffic are rate-limited appropriately. After applying the CoPP policy, the engineer notices that BGP sessions are flapping. Which action should the engineer take to resolve the issue while maintaining protection?

Accepted Answer

Increase the rate limit for the class-map that matches BGP traffic.. BGP session flapping after applying CoPP typically occurs because the policer is dropping legitimate BGP control packets. The correct fix is to increase the rate limit for the BGP traffic class so that keepalives and updates are not dropped, while still protecting the control plane from excessive traffic. Other options either do not address the rate limit or suggest inappropriate mechanisms.

Answer

Remove the CoPP policy from the control plane and apply it only to the data plane.

Answer

Configure a separate class-map for BGP and assign it to a higher priority queue in the policy-map.

Answer

Enable BGP graceful restart to prevent session flapping during CoPP drops.

Question 9

Drag and drop the steps of multicast RP discovery using Auto-RP into the correct order, from first to last.

Accepted Answer

Candidate RPs send RP-announce to 224.0.1.39. Auto-RP uses a mapping agent that listens for RP announcements, then advertises the RP mapping via a well-known group; all routers learn the RP and use it for group-to-RP mapping.

Question 10

Drag and drop each PIM mode on the left to its matching traffic distribution method on the right.

Accepted Answer

PIM Sparse Mode: Uses explicit join messages to build a shared tree. PIM Sparse Mode uses explicit join to build a shared tree; Dense Mode floods initially then prunes; Source-Specific Mode uses shortest path trees from source; Bidirectional PIM uses a shared tree with no source-specific state.

Question 11

Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?

Accepted Answer

Add a static route for 192.168.1.0/24 with a lower administrative distance than OSPF.. Adding a static route for 192.168.1.0/24 with a lower administrative distance (e.g., 1) than OSPF (default 110) forces the router to prefer the static route over the OSPF-learned route, even though the OSPF metric is the same. This allows traffic to 192.168.1.0/24 to use a different next-hop (e.g., 10.0.0.1) while traffic to 192.168.2.0/24 continues using the OSPF-learned path via 10.0.0.2, achieving the desired path differentiation without altering OSPF metrics or using complex PBR.

Answer

Configure policy-based routing to match 192.168.1.0/24 and set the next hop to 10.0.0.1.

Answer

Use the 'distance ospf' command to change the OSPF administrative distance for all routes.

Answer

Adjust the OSPF cost on the interface to 10.0.0.2.

Question 12

Which two statements about AAA authorization and accounting are true? (Choose two.)

Accepted Answer

Authorization determines what commands a user is allowed to execute after authentication.. Option A is correct because AAA authorization, which occurs after authentication succeeds, defines the privileges and specific commands a user is permitted to execute on the device, typically enforced via per-user or per-group attributes returned by the AAA server (e.g., TACACS+ or RADIUS attributes). Option D is correct because AAA accounting logs user activity—such as start/stop times, commands issued, and bytes transferred—into accounting records that support auditing, billing, and security monitoring. Option B is not correct because encryption of traffic between client and server is a function of the AAA protocol/transport (e.g., TACACS+ encrypts the entire payload, RADIUS encrypts only the password), not of authorization. Option C is not correct because accounting does not authenticate users; authentication verifies identity, while accounting records activity. Option E is not correct because authorization can be based on many factors, including user identity, group membership, time-of-day, and per-command attributes, not solely the source IP address.

Answer

Authorization ensures that all traffic between the client and server is encrypted.

Answer

Accounting is used to authenticate users based on their previous login history.

Answer

Authorization can only be based on the source IP address of the user.

Question 13

Drag and drop each PIM message type on the left to its matching function on the right.

Accepted Answer

PIM Hello: Discovers PIM neighbors and maintains adjacency. PIM Hello discovers neighbors and maintains adjacency; Join is used to join a multicast tree; Prune is used to leave a tree; Assert resolves duplicate forwarding on a multi-access network; Bootstrap messages are used in PIM SM to distribute RP information.

Question 14

A network engineer is deploying a Cisco SD-WAN solution for a global enterprise with multiple regional hubs. The engineer wants to ensure that traffic from branch offices to the internet is always forwarded directly from the branch, even if the branch has a primary MPLS link and a backup broadband link. The engineer configures the vSmart policy to direct internet-bound traffic to use the local exit at the branch. However, after deployment, the engineer notices that some internet traffic is still being sent to the regional hub before reaching the internet. What is the most likely cause of this behavior?

Accepted Answer

The engineer configured the data policy under VPN 0 instead of the service VPN (e.g., VPN 10).. In Cisco SD-WAN, data policies that control traffic forwarding (such as forcing local internet exit) must be applied to the service VPN (e.g., VPN 10) where the branch’s LAN and internet-bound traffic resides. Configuring the policy under VPN 0 (the transport VPN) only affects overlay tunnel traffic and control-plane packets, not user traffic. Since the engineer applied the policy to VPN 0, the policy did not match internet-bound traffic in the service VPN, causing it to follow the default route toward the regional hub.

Answer

The branch router does not have a default route in its routing table for the service VPN.

Answer

The engineer used a localized data policy instead of a centralized data policy.

Answer

The OMP route redistribution is not enabled on the branch router.

Question 15

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

Accepted Answer

The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.. NAT overload (PAT) uses a single public IP address and tracks sessions via port numbers. With many internal hosts, the router can exhaust its available port numbers (typically 65,535 per public IP), causing new translations to be denied. This leads to intermittent application failures as some sessions cannot be translated.

Answer

The access list 1 is too permissive and includes the public IP address of the router.

Answer

The router is not configured with ip nat inside on the internal interface.

Answer

The overload keyword is misspelled or not supported on this IOS version.