CCNP Practice Test 36 — 15 Questions

Question 1

Consider the following partial syslog configuration on a Cisco IOS-XE switch:

logging host 10.10.10.1 transport udp port 514
logging trap 6
logging source-interface Loopback0
logging on

Which statement is true about this configuration?

Accepted Answer

Syslog messages will be sourced from the IP address of Loopback0 interface.. The `logging source-interface Loopback0` command forces all syslog messages to use the IP address of Loopback0 as the source IP in the packet, regardless of the egress interface. This ensures the syslog server sees a consistent source address, which is critical for filtering and logging reliability. The configuration is correct, so option B is true.

Answer

Syslog messages with severity level 7 (Debugging) will be sent to 10.10.10.1.

Answer

The syslog server must be configured to receive messages on TCP port 514.

Answer

Only syslog messages with severity level 6 (Informational) will be sent.

Question 2

Drag and drop the steps of WLC high availability SSO failover steps into the correct order, from first to last.

Accepted Answer

Active WLC experiences a failure. In HA SSO, the active WLC fails, the standby detects the failure via RP link, takes over the active role, reinitializes interfaces, and then clients reassociate to the new active WLC.

Question 3

A network engineer configures SNMPv3 on a Cisco router for secure monitoring. The configuration includes 'snmp-server group ADMIN v3 priv', 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456', and 'snmp-server host 10.1.1.2 version 3 priv admin'. The NMS is configured with the same credentials. However, the NMS cannot poll the router. The engineer verifies that the router's SNMP agent is enabled. What is the most likely cause?

Accepted Answer

The NMS must be configured with the router's SNMP engine ID.. The most likely cause is that the NMS must be configured with the router's SNMP engine ID. In SNMPv3, the engine ID is used to derive authentication and encryption keys. Even if the username and passwords match, if the NMS does not know the router's engine ID, it will compute different keys and fail to authenticate or decrypt responses, preventing polling.

Answer

The SNMPv3 user is not associated with the group correctly.

Answer

The 'priv' keyword in the host command should be 'auth' instead.

Answer

The AES encryption key must be exactly 16 characters.

Question 4

A network engineer runs the following command on Router R6:

R6# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy output: QOS_POLICY

Class-map: VOICE (match-any)
      500 packets, 50000 bytes
      5 minute offered rate 50000 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        strict priority
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 500/50000
      police cir 1000000 bc 15625 be 15625
        conformed 500 packets, 50000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: DATA (match-any)
      1000 packets, 100000 bytes
      5 minute offered rate 100000 bps, drop rate 0 bps
      Match: ip dscp af31 (26)
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 1000/100000
      bandwidth remaining percent 50

Class-map: class-default (match-any)
      2000 packets, 200000 bytes
      5 minute offered rate 200000 bps, drop rate 0 bps
      Match: any
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 2000/200000
      bandwidth remaining percent 50

Based on this output, what can be concluded?

Accepted Answer

Data traffic is being guaranteed 50% of the remaining bandwidth.. The 'bandwidth remaining percent 50' command under the DATA class guarantees that class 50% of any bandwidth left unused by the strict-priority VOICE class. The policy-map is applied in the output direction, and the VOICE class uses a police (not shape) with a CIR of 1 Mbps, so only excess voice packets are dropped, not all traffic shaped. The class-default also gets 50% of the remaining bandwidth, confirming that the DATA class is indeed guaranteed 50% of the leftover bandwidth.

Answer

Voice traffic is being dropped because it exceeds the police rate.

Answer

All traffic is being shaped to a CIR of 1 Mbps.

Answer

The policy-map is applied to input traffic.

Question 5

An engineer is configuring multicast on a Cisco switch running IOS. The switch is acting as the IGMP querier for a VLAN. The engineer notices that multicast traffic is being flooded to all ports in the VLAN, even though only a few receivers have joined the group. The engineer checks the IGMP snooping configuration and sees that IGMP snooping is enabled globally and on the VLAN. What is the most likely cause of the flooding?

Accepted Answer

The IGMP querier is not elected on the VLAN.. When IGMP snooping is enabled but no IGMP querier exists on the VLAN, the switch cannot learn which ports have interested receivers because no general queries are sent. Without querier-generated queries, the snooping database remains empty, causing the switch to flood multicast traffic to all ports in the VLAN as if snooping were disabled.

Answer

The multicast source is connected to a trunk port.

Answer

The switch has PIM enabled on the VLAN interface.

Answer

The receivers are using IGMPv3.

Question 6

Consider the following OSPF configuration on router R2:

interface GigabitEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 ip ospf 1 area 0
 ip ospf hello-interval 5
!
router ospf 1
 router-id 2.2.2.2
 network 192.168.1.0 0.0.0.255 area 0

Which statement is true about this configuration?

Accepted Answer

The OSPF dead interval is automatically set to 20 seconds.. The OSPF dead interval is automatically set to four times the hello interval when the hello interval is manually configured. By default, OSPF uses a hello interval of 10 seconds and a dead interval of 40 seconds on broadcast networks. However, when you explicitly set the hello interval to 5 seconds using the 'ip ospf hello-interval 5' command, the router automatically adjusts the dead interval to 20 seconds (4 × 5 seconds) to maintain the standard ratio, unless the dead interval is also manually configured.

Answer

The OSPF dead interval remains at the default of 40 seconds.

Answer

This configuration will cause OSPF to use MD5 authentication.

Answer

The OSPF network type changes to point-to-point.

Question 7

Drag and drop each IP SLA operation type on the left to its measured metric on the right.

Accepted Answer

ICMP echo: Round-trip time and packet loss. ICMP echo measures round-trip time and packet loss; UDP jitter measures delay, jitter, and packet loss; TCP connect measures connection establishment time; HTTP measures page load time and success; DNS measures DNS resolution time.

Question 8

Drag and drop the steps of DNA Center template deployment to a device into the correct order, from first to last.

Accepted Answer

Create a CLI template in Project. Template deployment starts with creating the template, then associating it with a site, committing the changes, deploying to the target device, and verifying the deployment.

Question 9

Drag and drop each protocol on the left to its matching characteristic on the right.

Accepted Answer

RADIUS: Uses UDP transport. RADIUS uses UDP, encrypts only the password, and combines authentication and authorization. TACACS+ uses TCP, encrypts the entire packet, and separates authentication, authorization, and accounting.

Question 10

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The CoPP policy's conform-action of drop explicitly instructs the switch to discard all packets that match the class-map, regardless of the traffic rate. Even though the traffic rate is only 5 Mbps (below the 10 Mbps police rate), the drop action overrides the policing logic, causing legitimate AF41 traffic to be dropped. This is a common misconfiguration where the engineer sets the action to 'drop' instead of 'transmit' for conforming traffic.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The DSCP value AF41 is not supported on Nexus switches.

Answer

The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.

Question 11

Examine the following RSPAN configuration on a Cisco switch:

vlan 200
 name RSPAN_VLAN
 remote-span

monitor session 3 source interface GigabitEthernet1/0/5 both
monitor session 3 destination remote vlan 200

interface GigabitEthernet1/0/10
 switchport mode trunk
 switchport trunk allowed vlan 200

What is missing for RSPAN to function correctly across multiple switches?

Accepted Answer

The RSPAN VLAN 200 must be created on all switches that will forward the mirrored traffic.. For RSPAN to operate across multiple switches, the RSPAN VLAN (VLAN 200) must be created and configured with the 'remote-span' command on every switch that will forward the mirrored traffic. Without this, intermediate switches will not treat VLAN 200 as a special RSPAN VLAN, causing the mirrored frames to be dropped or mishandled. The configuration shown only creates the RSPAN VLAN on the local switch, but other switches in the path also need the VLAN and the 'remote-span' command to propagate the mirrored traffic correctly.

Answer

The destination remote vlan 200 command should include 'encapsulation replicate'.

Answer

The source interface must be in trunk mode to monitor VLANs.

Answer

The monitor session number must match on all switches.

Question 12

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 00:12:34       15
192.168.1.3     4        65003    2048    2040       10    0    0 00:24:56       20

Based on this output, what can be concluded?

Accepted Answer

Both BGP sessions are in the established state. The 'State/PfxRcd' column shows the number of prefixes received from each neighbor, and the 'Up/Down' column shows the session uptime, both of which indicate that the BGP sessions are fully established. An idle session would show 'Idle' in the State/PfxRcd column, not a prefix count. Therefore, both sessions are in the established state.

Answer

The BGP session with 192.168.1.2 is idle

Answer

Router R1 is using iBGP with both neighbors

Answer

The BGP table version is 10, meaning 10 prefixes are in the table

Question 13

A network engineer is automating the configuration of VLANs on a Cisco Nexus 9000 switch using Python and the NX-API. The engineer sends a Python dictionary with the CLI commands to the API and receives a successful response. However, when checking the switch, the VLANs are not created. The engineer verifies that the credentials and IP address are correct, and the API is enabled. The engineer also notices that the API response contains a 'code' field of '200' and a 'result' field that shows the command output. What is the most likely cause of the issue?

Accepted Answer

The engineer used the 'show' message type in the API request instead of 'cli_conf'.. The NX-API requires the 'message' type to be set to 'cli_conf' for configuration commands. Using 'show' (the default) only executes show commands and returns output, but does not apply any configuration changes to the switch. Even though the API returns a 200 status code and command output, the configuration is not actually committed.

Answer

The API response code of 200 indicates an error, and the engineer should check for a different status code.

Answer

The VLAN commands are incorrect; the engineer should use 'vlan 10' instead of 'vlan 10-20'.

Answer

The switch requires a 'commit' command after configuration changes via NX-API.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
    20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
    30 deny tcp any any eq 22 (2 matches)
    40 permit ip any any (10 matches)

Based on this output, what can be concluded?

Accepted Answer

SSH access from 192.168.1.0/24 would be denied.. The ACL 120 explicitly denies TCP traffic to port 22 (SSH) from any source not matching the earlier permit statements. The source 192.168.1.0/24 is not covered by the permit entries (10.0.0.0/8 or 172.16.0.0/16), so it hits line 30 (deny tcp any any eq 22) and is denied. The 5 matches on line 10 and 3 on line 20 confirm that only traffic from those specific subnets is permitted for SSH.

Answer

SSH access from 10.0.0.0/8 is denied.

Answer

All SSH traffic is permitted.

Answer

The ACL has an implicit deny at the end.

Question 15

Consider the following DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 no ip redirects
 ip nhrp map multicast dynamic
 ip nhrp network-id 100
 tunnel source GigabitEthernet0/0/0
 tunnel mode gre multipoint

What is the effect of the command 'ip nhrp map multicast dynamic'?

Accepted Answer

It enables the hub to dynamically add spoke NBMA addresses to the multicast NHRP map for forwarding multicast traffic to all spokes.. The command 'ip nhrp map multicast dynamic' on a DMVPN hub router instructs the router to dynamically add the NBMA addresses of spoke routers to the multicast NHRP mapping table as they register. This allows the hub to replicate multicast traffic (e.g., routing protocol hellos) to all spokes by using the dynamically learned NBMA addresses, enabling efficient dynamic spoke-to-spoke communication via the hub.

Answer

It statically maps the hub's own NBMA address to the multicast group.

Answer

It configures the hub to send NHRP registration requests to the multicast address 224.0.0.1.

Answer

It disables multicast forwarding over the tunnel interface.