CCNP Practice Test 32 — 15 Questions

Question 1

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Accepted Answer

Define capture buffer with size and type. EPC requires defining a capture buffer, then a capture point, associating them, starting the capture, and finally exporting or viewing.

Question 2

Drag and drop each hypervisor type on the left to its matching characteristic on the right.

Accepted Answer

Type 1 hypervisor: Runs directly on physical hardware without a host OS. Type 1 hypervisors run directly on hardware and are common in data centers; Type 2 run on a host OS and are used for desktop virtualization.

Question 3

A service provider is deploying NFV to offer managed SD-WAN services to enterprise customers. The architect must place virtual network functions (VNFs) such as vEdge routers and firewalls in the provider's data center. Which VNF placement model allows the provider to chain these functions efficiently and scale per customer?

Accepted Answer

Use a centralized service chain with a service graph that defines the order of VNFs, and deploy VNFs on separate hosts for redundancy.. A centralized service chain with a service graph allows the provider to define the ordered sequence of VNFs (e.g., vEdge router then firewall) and deploy them on separate hosts for redundancy. This model aligns with NFV MANO (Management and Orchestration) principles, enabling efficient scaling per customer by instantiating VNFs as needed while maintaining the service chain across hypervisors.

Answer

Place all VNFs for a customer on a single hypervisor host and use internal virtual switches to chain them.

Answer

Deploy each VNF as a separate virtual machine on a dedicated physical server to maximize performance.

Answer

Use a single VNF that combines routing and firewall functions to avoid chaining complexity.

Question 4

An enterprise network uses OSPF as its IGP. The network engineer notices that a particular route learned via OSPF is not being installed in the routing table, even though the neighbor adjacency is up and the route appears in the OSPF database. The route is an external route redistributed from EIGRP. What is the most likely cause?

Accepted Answer

The forwarding address in the type 5 LSA is not reachable via an OSPF internal route.. OSPF requires the forwarding address (FA) in a Type 5 LSA to be reachable via an OSPF internal route (intra-area or inter-area) for the external route to be installed in the routing table. If the FA is not reachable, the router will ignore the LSA and not install the route, even though the LSA exists in the OSPF database and the neighbor adjacency is up.

Answer

The OSPF process ID is different on the routers.

Answer

The external route has a higher administrative distance than the internal route.

Answer

The OSPF metric for the external route is too high.

Question 5

Given the following Ansible playbook snippet:
---
- name: Configure interface
  hosts: routers
  gather_facts: no
  tasks:
    - name: Set IP address
      ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
          - no shutdown
        parents: interface GigabitEthernet0/1
What is the effect of this playbook?

Accepted Answer

It configures IP address 192.168.1.1/24 on interface GigabitEthernet0/1 and enables it.. The `ios_config` module uses the `parents` parameter to navigate into interface configuration mode before applying the `lines` commands. The `ip address 192.168.1.1 255.255.255.0` command configures the IP address with a /24 subnet mask, and `no shutdown` administratively enables the interface. This is the standard Cisco IOS behavior for interface configuration.

Answer

It configures the IP address globally, not under the interface.

Answer

It only configures the IP address; no shutdown is ignored because it is not a valid command.

Answer

It fails because 'parents' cannot be used with 'lines' in ios_config.

Question 6

An engineer is using Ansible to automate the configuration of NTP on a group of Cisco IOS-XE switches. The playbook uses the ios_ntp module. The engineer wants to ensure that the NTP configuration is applied only to switches that are in the 'core' group, not the 'access' group. The inventory file defines these groups. Which Ansible feature should the engineer use to restrict the playbook to the 'core' group?

Accepted Answer

Set the 'hosts' field in the play to 'core' instead of 'all'.. Setting the 'hosts' field in the play to 'core' directly targets only the switches in the 'core' group from the inventory. This is the standard Ansible method for restricting a playbook to a specific inventory group, ensuring that the ios_ntp module configures NTP only on those devices.

Answer

Use the 'when' clause to check if the switch is in the 'core' group using the 'group_names' variable.

Answer

Use the 'limit' option when running the ansible-playbook command to specify the 'core' group.

Answer

Define a variable in the 'core' group and use 'vars_prompt' to ask the engineer which group to run on.

Question 7

A network engineer is troubleshooting multicast video distribution across an enterprise campus. The multicast source is connected to a switch that is the PIM Designated Router (DR) on a multi-access segment. Receivers in a different VLAN report that they are not receiving the multicast stream, although the DR shows the correct (S,G) entry. The engineer checks the RPF neighbor for the source and notices that the unicast route to the source points to a different interface than the one where the multicast stream is received. What is the most likely cause of the issue?

Accepted Answer

The multicast stream is arriving on an interface that is not the RPF interface for the source.. PIM uses the unicast routing table to determine the Reverse Path Forwarding (RPF) interface for a multicast source. If the multicast stream arrives on an interface that is not the RPF interface (the interface the unicast route uses to reach the source), the router will perform an RPF check and fail, dropping the multicast traffic. This is the most likely cause of the issue, as the DR has the (S,G) entry but the stream is not being forwarded due to the RPF mismatch.

Answer

The DR is not configured as the RP (Rendezvous Point).

Answer

The switchport connected to the source is not configured as a trunk.

Answer

IGMP snooping is disabled on the receiver VLAN.

Question 8

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Accepted Answer

DMVPN: mGRE with NHRP. DMVPN uses mGRE and NHRP; FlexVPN uses IKEv2; GET VPN uses GDOI; AnyConnect uses TLS/DTLS; Site-to-Site IPsec VPN uses IKEv1 or IKEv2 with ESP.

Question 9

A network engineer is deploying a new wireless LAN controller (WLC) in a campus network. The WLC must manage 200 access points across three buildings. The engineer configures the WLC with a management IP address and enables CAPWAP. However, the access points fail to join the WLC. The APs are in the same VLAN as the WLC and can ping the WLC's management IP. What is the most likely cause of the APs not joining?

Accepted Answer

The APs are not configured with DHCP option 43 to point to the WLC.. The APs are in the same VLAN and can ping the WLC, but they still fail to join. Since the APs use DHCP by default, they rely on DHCP option 43 to obtain the WLC's IP address for CAPWAP discovery. Without this option, the APs do not know which WLC to join, even though they have IP connectivity. Option A is incorrect because the management interface is the default CAPWAP source; a separate source interface is not required for APs in the same VLAN.

Answer

The WLC does not have a CAPWAP source interface configured.

Answer

The APs are running an incompatible IOS version that does not support CAPWAP.

Answer

The APs must be assigned a static IP address to join the WLC.

Question 10

An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?

Accepted Answer

The DHCP server is in a different VRF, and the switch does not have a route from the GUEST VRF to the CORP VRF for the DHCP server.. The DHCP server resides in VRF CORP, but the DHCP relay agent on the guest SVI forwards the discover packet within VRF GUEST. Without a route from VRF GUEST to the DHCP server's subnet in VRF CORP, the relayed packet cannot reach the server. Inter-VRF routing (e.g., a route leak or VRF-aware service) is required for the relay to forward the packet across VRFs.

Answer

The DHCP relay agent is not configured to use the VRF GUEST; the ip helper-address command must be applied under the VRF interface, but the DHCP server is in a different VRF, requiring inter-VRF routing or the use of the ip dhcp relay information option.

Answer

The DHCP server is not configured with a scope for the guest subnet.

Answer

The guest VRF is missing the ip dhcp relay command globally.

Question 11

An enterprise network is experiencing high CPU utilization on the distribution layer switches. The design uses VLANs with SVIs for inter-VLAN routing, and HSRP for first-hop redundancy. The engineer notices that the standby switch is also experiencing high CPU. What is the most likely cause?

Accepted Answer

The standby switch is processing HSRP hellos for all VLANs, causing CPU spikes.. In an HSRP setup, both the active and standby routers process incoming Hello messages for every VLAN on which HSRP is configured. Even though the standby switch does not forward inter-VLAN traffic, it must still receive and process periodic HSRP hellos (default every 3 seconds) to maintain its role and detect active failures. With a large number of VLANs, the cumulative CPU overhead from processing these hellos can cause high utilization on both switches.

Answer

The standby switch is forwarding all broadcast traffic due to a misconfigured STP root.

Answer

The standby switch is performing routing for all VLANs because the active switch failed.

Answer

The standby switch is processing VTP updates from the distribution layer.

Question 12

A network engineer is troubleshooting an STP issue in a switched network. The network has two distribution switches connected via a trunk, and each distribution switch connects to the same access switch. The engineer notices that the root bridge is not the intended distribution switch. Upon checking, the engineer sees that the access switch has a higher priority than the distribution switches. The engineer needs to ensure that the intended distribution switch becomes the root bridge without causing a temporary loop. What should the engineer do?

Accepted Answer

Configure the 'spanning-tree vlan vlan-id root primary' command on the intended distribution switch.. The 'spanning-tree vlan vlan-id root primary' command dynamically sets the switch's bridge priority to 24576 (or 4096 if the current root has a priority lower than 24576) and ensures the switch becomes the root bridge without manual priority miscalculation. This command also adjusts the priority of neighboring switches if needed, preventing temporary loops by avoiding the need to disable or reset STP. It is the safest and most efficient method to force a specific switch to become the root bridge in a live network.

Answer

Set the priority of the access switch to 0 using the 'spanning-tree vlan vlan-id priority 0' command.

Answer

Increase the priority of the distribution switch to 61440 using the 'spanning-tree vlan vlan-id priority 61440' command.

Answer

Disable STP on the distribution switch and manually configure it as the root bridge.

Question 13

A network engineer is configuring BGP on a Cisco router that is part of an enterprise network with multiple BGP peers. The router receives routes from two different ISPs. The engineer wants to ensure that only specific prefixes from ISP-A are installed in the routing table, while all other routes from ISP-A are ignored. Additionally, the engineer wants to accept all routes from ISP-B. Which BGP feature should be used on the router for the peering with ISP-A?

Accepted Answer

Apply a distribute list under the BGP neighbor configuration for ISP-A.. A distribute list applied under the BGP neighbor configuration for ISP-A allows the engineer to filter specific prefixes using an access list or prefix list, ensuring only the desired prefixes are installed in the routing table while all others from ISP-A are ignored. This is the correct tool for inbound route filtering on a per-neighbor basis, as it directly controls which routes are accepted into the BGP table and subsequently the routing table.

Answer

Configure a network statement under BGP for the desired prefixes.

Answer

Use the default-information originate command under BGP.

Answer

Apply a route map to the neighbor using the route-map command in the inbound direction.

Question 14

Refer to the exhibit. Which OSPF route type is the default route?

Accepted Answer

External type 2 (E2). The exhibit shows a default route (0.0.0.0/0) being redistributed into OSPF from another routing protocol or static route. By default, OSPF redistributes routes as External Type 2 (E2), meaning the metric does not include the internal cost to the ASBR. The route is not an NSSA type because the area is not configured as a not-so-stubby area, and it is not an inter-area route because it originates outside the OSPF domain.

Answer

Inter-area (IA)

Answer

NSSA external type 2 (N2)

Answer

External type 1 (E1)

Question 15

Given the following SD-WAN configuration on a Cisco IOS-XE router:

router ospf 1
 redistribute bgp 65000 subnets
 network 192.168.1.0 0.0.0.255 area 0
!
interface GigabitEthernet0/0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
!

Which statement is true?

Accepted Answer

The OSPF network type is point-to-point, so the hello interval defaults to 10 seconds on this interface.. On a Cisco IOS-XE router, when the OSPF network type is set to point-to-point, the default hello interval is 10 seconds (not 30 seconds as on broadcast networks). The dead interval defaults to 40 seconds (four times the hello interval), not 120 seconds. This configuration is valid and does not require a manually configured router-id, as OSPF can dynamically select one. The redistribution of BGP into OSPF only injects routes that are in the BGP table; it does not automatically include all SD-WAN overlay routes unless they are present in BGP.

Answer

The OSPF network type is point-to-point, so the dead interval defaults to 120 seconds.

Answer

The redistribution of BGP into OSPF will cause OSPF to advertise all BGP routes, including those learned via SD-WAN overlay.

Answer

The configuration is incomplete because OSPF requires a router-id to be manually configured.