CCNP Practice Test 31 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.1.10:1024  10.0.0.10:1024     203.0.113.5:80     203.0.113.5:80
tcp 192.168.1.10:1025  10.0.0.10:1025     203.0.113.5:80     203.0.113.5:80
--- 192.168.1.11:2048  10.0.0.11:2048     198.51.100.2:443   198.51.100.2:443

Based on this output, what can be concluded?

Accepted Answer

The router is performing NAT overload (PAT). The output shows NAT translations. Inside global addresses are the public IPs seen on the outside, and inside local are the private IPs. The first entry has no protocol (---) indicating a static NAT or a translation that has timed out. The second and third entries are TCP translations. The correct answer is that the router is performing NAT overload (PAT) because multiple inside local addresses are mapped to the same inside global address (192.168.1.10).

Answer

The router is performing static NAT

Answer

The router is performing dynamic NAT without overload

Answer

The router is performing destination NAT

Question 2

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Accepted Answer

Define a custom flow record that includes the 'match ipv4 vlan' or 'match ipv4 vrf' field to identify each customer's traffic, and apply a single flow monitor on the shared interface.. Flexible NetFlow allows customization of flow records. Option A is correct by using a flow record with a 'match ipv4 vlan' or 'match ipv4 vrf' field to tag flows per customer. Option B is incorrect because separate flow monitors for each interface would still mix flows if multiple customers share an interface. Option C is incorrect because NetFlow v9 export format does not inherently separate customers. Option D is incorrect because SNMP is not suitable for per-customer flow identification.

Answer

Configure a separate flow monitor for each customer interface and export to different collectors.

Answer

Use NetFlow v9 export with the 'match ipv4 source address' field only, and rely on the collector to separate by source IP.

Answer

Enable SNMP interface polling to track per-customer traffic statistics.

Question 3

A network engineer is configuring NetFlow on a Cisco Nexus 7000 switch to monitor traffic between two data centers. The engineer wants to ensure that flow records are exported even if the export destination is temporarily unreachable. Which feature should the engineer enable?

Accepted Answer

Increase the NetFlow export buffer size and configure the export retry interval.. NetFlow export uses UDP, which is unreliable. Option A is correct because NetFlow export buffer and retry mechanisms (like 'ip flow-export buffer-size' and 'ip flow-export retry') can store and retransmit records. Option B is incorrect because TCP is not supported for NetFlow export. Option C is incorrect because SNMP traps are not for flow data. Option D is incorrect because IP SLA does not buffer NetFlow records.

Answer

Change the export protocol to TCP to ensure reliable delivery.

Answer

Enable SNMP traps to notify the collector of flow data.

Answer

Configure IP SLA to monitor the collector and buffer flows locally.

Question 4

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6, Gi0/7
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

VLANs 10 and 20 are configured and have ports assigned. The output shows VLANs configured on the switch. VLANs 1, 10, and 20 are active and have ports assigned. VLANs 1002-1005 are default VLANs that are not supported on this platform (act/unsup). The correct answer is that VLANs 10 and 20 are configured and have ports assigned.

Answer

All VLANs are in the active state and supported

Answer

VLAN 1 is the only VLAN with ports assigned

Answer

The switch is running VTP transparent mode

Question 5

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.179
        State: Oper; Msgs sent/rcvd: 100/95; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/0, Src IP: 10.0.0.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.2.2

Peer LDP Ident: 10.0.0.3:0, Local LDP Ident: 10.0.0.1:0
        TCP connection: 10.0.0.3.646 - 10.0.0.1.179
        State: Oper; Msgs sent/rcvd: 200/190; Downstream
        Up time: 00:20:00
        LDP discovery sources:
          GigabitEthernet0/1, Src IP: 10.0.0.3
        Addresses bound to peer LDP Ident:
          10.0.0.3        192.168.3.3

Based on this output, what can be concluded?

Accepted Answer

The router has two LDP peers that are both operational. The output shows LDP neighbors. Both neighbors are in Oper (operational) state. The local LDP identifier is 10.0.0.1:0. The peers are discovered via different interfaces (GigabitEthernet0/0 and GigabitEthernet0/1). The correct answer is that the router has two LDP peers that are both operational.

Answer

The router is using LDP in downstream-on-demand mode

Answer

The LDP session with 10.0.0.2 is down

Answer

The router has only one LDP neighbor

Question 6

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel is operational with two active links. The output shows an EtherChannel summary. Port-channel 1 is in use (U) and Layer2 (S). The protocol is LACP. Two ports (Gi0/1 and Gi0/2) are bundled (P), but Gi0/3 is down (D). The correct answer is that the EtherChannel is operational with two active links.

Answer

The EtherChannel is fully operational with three active links

Answer

The EtherChannel is using PAgP protocol

Answer

The EtherChannel is a Layer 3 port-channel

Question 7

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip flow monitor FLOW-MONITOR input
 ip flow monitor FLOW-MONITOR output
!
flow monitor FLOW-MONITOR
 exporter EXPORTER-1
 record netflow ipv4 original-input
!
flow exporter EXPORTER-1
 destination 192.168.1.100
 transport udp 2055
!

What is the effect of this configuration?

Accepted Answer

NetFlow v9 records are sent to the collector at 192.168.1.100 on UDP port 2055.. This configuration enables NetFlow on an interface using a flow monitor that references a flow exporter. The record type 'netflow ipv4 original-input' is valid for collecting IPv4 flow data. The exporter sends UDP packets to the collector at 192.168.1.100 on port 2055.

Answer

NetFlow v5 records are sent to the collector at 192.168.1.100 on UDP port 2055.

Answer

IPFIX records are sent to the collector at 192.168.1.100 on UDP port 2055.

Answer

The configuration is missing the 'ip flow-export source' command to specify the source interface.

Question 8

Consider the following configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache entries 16000
!

Which statement about this configuration is correct?

Accepted Answer

The flow cache can hold up to 16,000 flow entries simultaneously.. The 'cache entries' command sets the maximum number of flow entries that the cache can hold. When the cache is full, the router may need to age out flows prematurely or drop new flows.

Answer

The flow cache will export flows every 16,000 seconds.

Answer

The flow cache will store only 16,000 bytes of flow data.

Answer

The flow cache will automatically increase to 32,000 entries if needed.

Question 9

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a hop count metric as one of the factors in its composite metric. The maximum hop count is 255, beyond which a route is considered unreachable.

Answer

15

Answer

224

Answer

Unlimited

Question 10

Drag and drop the steps of configuring model-driven telemetry with gRPC on a Cisco IOS-XE device into the correct order, from first to last.

Accepted Answer

Enable telemetry feature globally. First, enable telemetry and define the destination. Then, create a subscription with a sensor path. Next, set the update policy. Finally, verify the telemetry data is being sent.

Question 11

Consider the following configuration:

flow exporter EXPORTER-1
 destination 10.0.0.1
 source Loopback0
 transport udp 9996
 template data timeout 60
!

Which statement about this configuration is true?

Accepted Answer

Template data records are sent every 60 seconds to the collector.. The 'template data timeout' command sets the interval (in seconds) at which the exporter sends NetFlow template data records to the collector. A shorter timeout ensures the collector has up-to-date templates but increases overhead.

Answer

The exporter uses UDP port 9996 to send flow data and templates.

Answer

The source interface Loopback0 is used only for flow data, not for templates.

Answer

The exporter will send template data only when a new flow is detected.

Question 12

Examine the following configuration:

flow exporter EXPORTER-1
 destination 10.0.0.1
 source Loopback0
 transport udp 2055
 option interface-table
 option application-table
!

What is the purpose of the 'option interface-table' and 'option application-table' commands?

Accepted Answer

They cause the exporter to send interface and application metadata to the collector periodically.. These commands enable the exporter to send option data records to the collector. Option data provides metadata about the router's interfaces and applications, helping the collector interpret the flow data correctly.

Answer

They filter the flow data to include only traffic from the specified interfaces and applications.

Answer

They enable the exporter to collect interface and application statistics locally.

Answer

They are required only when using IPFIX, not NetFlow v9.

Question 13

A network engineer is using a Cisco Catalyst 3850 switch to monitor traffic from a server connected to port Gi1/0/1. The monitoring station is on port Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. The monitoring station receives traffic, but the engineer notices that the switch CPU utilization is high. What is the most likely cause of the high CPU?

Accepted Answer

The destination port is still a member of a VLAN, and the switch is processing the copied frames as normal traffic, leading to high CPU.. SPAN can cause high CPU if the destination port is not configured with 'ingress' or if the switch is overloaded. However, a common cause is that the destination port is configured to also forward traffic normally (i.e., it is not a dedicated SPAN destination). But the question says the monitoring station receives traffic, so the destination port is working. High CPU can occur if the SPAN session is configured to capture from a large number of sources or if the switch is processing many packets. The most likely cause here is that the destination port is not configured with 'switchport nonegotiate' or is in a VLAN that causes the switch to process the copied frames as normal traffic, leading to high CPU. But the best answer: The destination port should be configured as a SPAN destination only, and if it is also a member of a VLAN, the switch may try to switch the copied frames, causing high CPU. The correct answer is that the destination port is not configured as a SPAN destination-only port; it is still a member of a VLAN, causing the switch to process the copied frames as normal traffic.

Answer

The SPAN session is capturing both directions, which doubles the number of packets and increases CPU usage.

Answer

The destination port is not configured with 'switchport nonegotiate' and is still participating in DTP, causing CPU overhead.

Answer

The source interface is a trunk port, and SPAN is capturing all VLANs, causing high CPU.

Question 14

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

Accepted Answer

Configure 'monitor session 1 source interface Port-channel 1 both' and 'monitor session 1 destination interface Gi1/0/24'.. SPAN can source from an EtherChannel interface. The correct answer is to use the port-channel interface as the source. Option B is incorrect because individual member ports cannot be used as SPAN sources if they are part of an EtherChannel; the SPAN session must reference the port-channel. Option C is incorrect because VLAN-based SPAN would capture all traffic on that VLAN, not just the EtherChannel. Option D is incorrect because RSPAN is not needed.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' (where Gi1/0/1 is a member of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' (the VLAN of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source interface Port-channel 1' and 'monitor session 1 destination remote vlan 999'.

Question 15

Given the configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache timeout active 60
 cache timeout inactive 15
!

What is the effect of the 'cache timeout active 60' command?

Accepted Answer

Flows that are active for more than 60 seconds are exported immediately and then removed from the cache.. The 'cache timeout active' command sets the maximum lifetime (in seconds) for an active flow in the cache. After 60 seconds, the flow is exported even if it is still ongoing. This prevents long-lived flows from being delayed indefinitely.

Answer

Flows that are inactive for 60 seconds are exported and removed from the cache.

Answer

The cache will hold a maximum of 60 active flows at any time.

Answer

Flow records are sent to the exporter every 60 seconds.