CCNP Practice Test 32 — 15 Questions

Question 1

A network engineer is implementing Cisco TrustSec (CTS) with Security Group Tags (SGTs) using SXP (SGT Exchange Protocol). The engineer configures the switch as an SXP speaker and the Cisco ISE as an SXP listener. The engineer verifies that SXP peers are established. However, when the engineer checks 'show cts role-based sgt map', the SGT mappings for users are not present. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch is not configured to assign SGTs to users via 802.1X or static mapping.. The SXP protocol only propagates SGT-to-IP mappings that already exist on the speaker device. If the switch is not configured to assign SGTs to users via 802.1X or static mapping, no SGT mappings will be generated to send to ISE. The 'show cts role-based sgt map' command displays the local SGT mapping table, which remains empty because the switch has no mechanism to associate users with SGTs.

Answer

The SXP version mismatch between the switch and ISE.

Answer

The ISE is configured as an SXP speaker instead of a listener.

Answer

The SXP connection is using the wrong TCP port.

Question 2

A network engineer runs the following command on Switch SW1:

SW1# show dtp interface gi0/1

DTP information on GigabitEthernet0/1:
  DTP:                      Enabled
  DTP mode:                 Desirable
  DTP negotiate:            TRUE
  DTP status:               Trunk
  DTP trunk status:         Trunking
  DTP timer:                30
  DTP max-age:              2
  DTP encapsulation:        802.1q
  DTP refresh rate:         Both
  DTP requests:             10
  DTP errors:               0

Based on this output, what can be concluded?

Accepted Answer

The interface will not form a trunk unless the neighbor is set to trunk or desirable.. The output shows DTP is enabled, mode is 'Desirable', and the interface is already trunking with 802.1q encapsulation. Option A is incorrect because the interface is trunking, not in access mode. Option B is incorrect because dynamic desirable can form a trunk with dynamic auto as well as trunk or desirable modes; the statement that it 'will not form a trunk unless the neighbor is set to trunk or desirable' is false. Option C is incorrect because encapsulation is 802.1q, not ISL. Option D is incorrect because DTP is enabled. Since all provided options are incorrect, no correct conclusion can be selected from the given choices.

Answer

The interface is in access mode.

Answer

The interface is using ISL encapsulation.

Answer

DTP is disabled on this interface.

Question 3

A network engineer runs the following command on switch SW3:

SW3# show cts role-based permissions

IPv4 Role-based permissions:

Source Group   Dest Group   Action
10             20           PERMIT
10             30           DENY
20             30           PERMIT

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 20 to SGT 30 is permitted.. The output from 'show cts role-based permissions' displays a policy table where each row defines a rule for traffic from a specific Source Group (SGT) to a specific Dest Group (SGT). The third row shows Source Group 20, Dest Group 30, and Action PERMIT, meaning traffic from SGT 20 to SGT 30 is explicitly permitted. This is a Cisco TrustSec role-based access control (RBAC) policy enforced at the switch level.

Answer

Traffic from SGT 10 to SGT 20 is denied.

Answer

Traffic from SGT 10 to SGT 30 is permitted.

Answer

Traffic from SGT 30 to SGT 10 is denied.

Question 4

A company is deploying a virtualized router (CSR1000v) on VMware vSphere. The VNF must support high throughput and low latency. Which vSphere configuration option should the architect select to optimize network performance?

Accepted Answer

Enable SR-IOV on the physical NIC and assign virtual functions to the VM.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch. This reduces latency and CPU overhead, making it ideal for high-throughput, low-latency VNFs like the CSR1000v. Option B is correct because SR-IOV provides near-native performance by allowing the VM to directly access the NIC hardware.

Answer

Use the default e1000 NIC driver.

Answer

Use VMXNET3 paravirtualized NIC.

Answer

Configure the VM with multiple vCPUs and large memory.

Question 5

A network engineer issues the following command on Router R7:

R7# show ip pim tunnel
Tunnel1:
  Type: PIM Encap
  Source: 10.0.0.7, Destination: 10.0.0.8
  Status: up

Based on this output, what can be concluded?

Accepted Answer

This tunnel is used for PIM register encapsulation to the RP.. The 'show ip pim tunnel' output displays a PIM Encap tunnel, which is automatically created by Cisco IOS to encapsulate multicast packets from a source that is outside the Rendezvous Point (RP) tree. The tunnel sends these encapsulated packets to the RP (10.0.0.8) using unicast PIM register messages, making option A correct.

Answer

This tunnel is used for MDT data group forwarding.

Answer

This tunnel is used for BSR messages.

Answer

This tunnel is used for Auto-RP announcements.

Question 6

Examine the following EIGRP configuration for route summarization:

interface GigabitEthernet0/0
 ip summary-address eigrp 100 192.168.0.0 255.255.252.0

What is the effect of this command?

Accepted Answer

EIGRP will advertise the 192.168.0.0/22 summary route out of GigabitEthernet0/0 and create a discard route.. The `ip summary-address eigrp` command creates a summary route (192.168.0.0/22) that EIGRP advertises out of the specified interface, and it automatically installs a discard (null0) route to prevent routing loops when the summary is advertised but some component routes may not be present in the routing table.

Answer

EIGRP will only accept routes within the 192.168.0.0/22 range on this interface.

Answer

The summary route will have a metric equal to the best metric among the component routes.

Answer

This command will cause EIGRP to automatically summarize routes to their classful boundaries.

Question 7

Drag and drop the steps of MAB (MAC Authentication Bypass) fallback flow into the correct order, from first to last.

Accepted Answer

Switch detects link up and no EAP response. MAB is used as a fallback when 802.1X fails; the switch detects the MAC, sends a RADIUS Access-Request, ISE checks the MAC database, returns an Access-Accept with a downloadable ACL, and the switch applies the ACL.

Question 8

Consider the following configuration on a Cisco IOS-XE router:
```
ip access-list extended BLOCK_SSH
 deny tcp any any eq 22
 permit ip any any
!
line vty 0 4
 access-class BLOCK_SSH in
```
Which statement is true about this configuration?

Accepted Answer

The ACL blocks all SSH traffic to the router, but permits other IP traffic.. The `access-class` command applied to the VTY lines filters inbound Telnet/SSH traffic destined to the router itself. The ACL `BLOCK_SSH` explicitly denies TCP traffic to port 22 (SSH) and permits all other IP traffic. Therefore, SSH connections to the router are blocked, while other IP traffic (e.g., HTTP, SNMP) is allowed. Option A correctly describes this behavior.

Answer

The ACL blocks all traffic to the router because the deny statement is first.

Answer

The ACL only filters traffic going through the router, not destined to it.

Answer

The ACL permits SSH traffic because the permit statement overrides the deny.

Question 9

In a Cisco QoS policy, what is the difference between 'bandwidth' and 'bandwidth remaining' commands?

Accepted Answer

'bandwidth' allocates from the total bandwidth, while 'bandwidth remaining' allocates from the bandwidth left after priority queues.. The 'bandwidth' command allocates a guaranteed minimum bandwidth from the total interface bandwidth during congestion, while 'bandwidth remaining' allocates bandwidth only from the leftover bandwidth after the priority queue (LLQ) has taken its share. This distinction is critical in Cisco QoS policies where priority queues can consume a large portion of the link, and remaining bandwidth must be distributed among other classes using a ratio or percentage.

Answer

There is no difference; both commands allocate bandwidth based on the total interface bandwidth.

Answer

'bandwidth' is used for output policies, while 'bandwidth remaining' is used for input policies.

Answer

'bandwidth' guarantees a minimum rate, while 'bandwidth remaining' sets a maximum rate.

Question 10

An engineer is configuring MPLS L3VPN with OSPF as the PE-CE protocol. The customer wants to ensure that routes from the MPLS backbone are not redistributed back into the customer's OSPF domain. What configuration should the engineer apply on the PE router?

Accepted Answer

Configure the 'domain-id' under the OSPF process in the VRF.. Configuring the 'domain-id' under the OSPF process in the VRF prevents routes learned from the MPLS backbone (via MP-BGP) from being redistributed back into the customer's OSPF domain. By default, OSPF uses the domain ID to determine if a route originated from the same OSPF domain; when the domain ID matches, the PE router treats the redistributed BGP route as an OSPF inter-area route and may re-advertise it. Setting a unique domain ID on the PE-CE OSPF process ensures that BGP routes are not considered part of the customer's OSPF domain, thus blocking the redistribution loop.

Answer

Configure a sham-link between the PE routers.

Answer

Use the 'capability vrf-lite' command under OSPF.

Answer

Apply a route-map to filter routes redistributed into OSPF.

Question 11

Drag and drop each EAP method on the left to its matching authentication type on the right.

Accepted Answer

EAP-TLS: Mutual certificate-based authentication. EAP-TLS uses certificates, PEAP uses server certificate with inner MSCHAPv2, EAP-FAST uses a PAC, and EAP-MD5 uses simple password hash.

Question 12

A network engineer issues the following command on Router R6:

R6# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.1.100      10.0.0.10          ---                ---
--- 192.168.1.101      10.0.0.11          ---                ---
udp 192.168.1.100:1234 10.0.0.10:1234     203.0.113.5:53     203.0.113.5:53
tcp 192.168.1.101:80   10.0.0.11:80       198.51.100.2:443   198.51.100.2:443

Based on this output, what is true about the NAT translations?

Accepted Answer

The translation for 10.0.0.10 to 192.168.1.100 is a dynamic NAT without PAT.. The output shows two static-like entries (the first two lines with no protocol or port) and two dynamic entries with PAT (the UDP and TCP lines). The first translation for 10.0.0.10 to 192.168.1.100 has no protocol or port information, indicating it is a dynamic NAT entry without PAT (port address translation), because PAT would show specific ports. Option B correctly identifies this translation as dynamic NAT without PAT.

Answer

All translations are static NAT entries.

Answer

The router is performing only PAT (overload).

Answer

The outside global address is the same for all translations.

Question 13

Drag and drop the steps for configuring STP root guard and loop guard and the resulting port behavior into the correct order, from first to last.

Accepted Answer

Enter interface configuration mode. The correct order for activating STP root guard and loop guard begins with entering interface configuration mode (A), then configuring root guard with 'spanning-tree guard root' (B), followed by loop guard with 'spanning-tree guard loop' (C). After configuration, verification of port role and protection status (D) ensures the guards are active. Step E (port moves to root-inconsistent state if superior BPDU received) is not an activation step but a reactive event that occurs when root guard triggers; it is placed last as the expected outcome.

Question 14

Drag and drop each EtherChannel port state on the left to its matching description on the right.

Accepted Answer

bundled: Port is actively forwarding traffic in the EtherChannel. In EtherChannel, ports can be in one of three states: bundled, stand-alone, or suspended. A bundled port actively forwards traffic in the channel. A stand-alone port is active but not part of any EtherChannel. A suspended port is administratively down or error-disabled. The remaining options are distractors that do not match any of these states.

Answer

bundled: Port is a member of the channel and forwarding

Answer

stand-alone: Port operates as a regular switch port

Question 15

Which three statements about SD-WAN segmentation and multi-tenancy are true? (Choose three.)

Accepted Answer

Each VPN in SD-WAN corresponds to a separate VRF on the edge device, providing Layer 3 isolation.. VPN segmentation in SD-WAN uses VRFs (VPN IDs) to isolate traffic. Service-side routing uses VRFs, and transport-side uses TLOCs. OMP carries VPN membership information. Extranet allows controlled sharing between VPNs. VPN 0 is for transport, not service. Multiple VRFs can be used to support multi-tenancy.

Answer

VPN 0 is used for service-side connectivity, such as connecting to a corporate LAN or data center.

Answer

Multi-tenancy in SD-WAN requires separate physical edge devices for each tenant to ensure isolation.