CCNP Practice Test 39 — 15 Questions

Question 1

Examine the following BGP configuration on a Cisco IOS-XE router:
```
router bgp 65000
 bgp default local-preference 150
 neighbor 10.1.1.1 remote-as 65001
 neighbor 10.1.1.1 password cisco123
 neighbor 10.1.1.1 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50
```
What is the effect of the route-map on outbound updates to 10.1.1.1?

Accepted Answer

The MED value of routes advertised to 10.1.1.1 is set to 50.. The route-map SET-MED is applied to outbound updates to neighbor 10.1.1.1 using the 'route-map SET-MED out' command. The route-map permits all routes (no match statement) and sets the MED (Multi-Exit Discriminator) attribute to 50. This means that when the local router advertises routes to this eBGP neighbor, the MED value in those updates will be 50, influencing the neighbor's inbound path selection.

Answer

The local preference of routes received from 10.1.1.1 is set to 150.

Answer

The route-map filters routes; only those with metric 50 are advertised.

Answer

The password is applied to the BGP session, but the route-map is ignored due to the password.

Question 2

Drag and drop the steps of configuring Dynamic NAT on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Define NAT pool with ip nat pool. Dynamic NAT configuration starts by defining the pool of global IP addresses using 'ip nat pool'. Next, an access list is created to identify the inside local addresses that will be translated. The NAT source list is then configured to associate the ACL with the pool. After that, the inside and outside interfaces are designated with 'ip nat inside' and 'ip nat outside'. Finally, translation is verified with 'show ip nat translations'.

Question 3

Drag and drop the steps of NAT64 IPv6-to-IPv4 translation flow into the correct order, from first to last.

Accepted Answer

IPv6 host sends packet to synthetic IPv6 address. NAT64 translates IPv6 packets to IPv4. The IPv6 host sends a packet to a synthetic IPv6 address, the router extracts the embedded IPv4 destination, creates a NAT64 binding, translates headers, and forwards the IPv4 packet.

Question 4

Drag and drop each Layer 2 attack on the left to its matching mitigation feature on the right.

Accepted Answer

MAC flooding: Port security. MAC flooding is mitigated by port security; DHCP starvation by DHCP snooping; ARP spoofing by DAI; STP manipulation by BPDU guard; VLAN hopping by disabling DTP.

Question 5

Drag and drop each DHCP option on the left to its matching purpose on the right.

Accepted Answer

Option 43: Carries vendor-specific suboptions for device provisioning. Option 43 provides vendor-specific info (e.g., for APs). Option 60 identifies the vendor class. Option 82 is the relay agent information option. Option 150 gives TFTP server address for phones. Option 66 provides a single TFTP server hostname.

Question 6

Drag and drop the steps of DHCP failover configuration between primary and standby into the correct order, from first to last.

Accepted Answer

Configure primary server with failover peer and standby IP. DHCP failover requires both servers to be configured with the same scope and failover parameters. First, configure the primary server with the failover peer name and IP address of the standby. Then, configure the standby server with the same peer name and the primary's IP. Enable the failover on the primary, which starts the negotiation. The standby then enters partner-down state until it synchronizes. Finally, both servers become active and share lease information.

Question 7

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255, which is the default limit for the protocol's route metric. This high hop count allows EIGRP to scale in large enterprise networks without the hop-count restrictions of distance-vector protocols like RIP. The hop count is carried in the EIGRP packet header and is incremented at each router, with routes exceeding 255 being considered unreachable.

Answer

100

Answer

15

Answer

16

Question 8

Drag and drop each AAA service on the left to its matching protocol on the right.

Accepted Answer

Authentication: RADIUS. Authentication uses RADIUS; authorization uses TACACS+; accounting uses RADIUS; command authorization uses TACACS+; dot1x authentication uses RADIUS.

Question 9

Drag and drop each Layer 2 attack on the left to its matching mitigation feature on the right.

Accepted Answer

MAC flooding: Port security. MAC flooding is mitigated by port security, DHCP starvation by DHCP snooping, ARP spoofing by DAI, STP manipulation by BPDU guard, and VLAN hopping by disabling DTP.

Question 10

Drag and drop the steps of Cisco DHCP snooping binding table population into the correct order, from first to last.

Accepted Answer

Enable DHCP snooping globally on the switch. DHCP snooping builds the binding table by first enabling snooping globally, then on specific VLANs, and designating trusted ports. The switch intercepts DHCP messages, extracts client info from ACK packets, and populates the binding table with the lease information.

Question 11

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Accepted Answer

Disable unused ports: shutdown. Disable unused ports with 'shutdown', set a login banner with 'banner login', enable SSH with 'ip ssh version 2', restrict VTY access with 'access-class', and set a minimum password length with 'security passwords min-length'.

Question 12

Consider the following Python script that uses the requests library to delete a VLAN via RESTCONF on a Cisco IOS-XE device:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/vlan=10'
headers = {
    'Accept': 'application/yang-data+json',
    'Content-Type': 'application/yang-data+json'
}
auth = HTTPBasicAuth('admin', 'cisco')

response = requests.delete(url, headers=headers, auth=auth, verify=False)
print(response.status_code)
```

What is the expected outcome if the VLAN 10 exists?

Accepted Answer

It will delete VLAN 10 from the device configuration.. The `requests.delete()` method sends an HTTP DELETE request to the RESTCONF API endpoint for VLAN 10. When the VLAN exists, the device processes the DELETE operation and removes the VLAN configuration from the running config, returning a 204 No Content status code upon success.

Answer

It will retrieve the configuration of VLAN 10.

Answer

It will create VLAN 10 if it does not exist.

Answer

It will return an error because the payload is missing.

Question 13

A network engineer is troubleshooting a Layer 2 loop issue. The network consists of three switches: SW1, SW2, and SW3, all connected in a triangle. The engineer notices that SW1 is the root bridge. After a link failure between SW1 and SW2, the network experiences a temporary loop. The engineer wants to prevent such loops in the future by enabling a feature that provides faster convergence and prevents temporary loops during topology changes. The engineer is using Rapid PVST+. Which feature should the engineer enable?

Accepted Answer

Enable Loop Guard on all switch ports.. When a link fails in a triangle topology with Rapid PVST+, the switch that lost its root port may temporarily transition a blocked alternate port to forwarding before the new root port is fully synchronized, causing a loop. Enabling Loop Guard on all switch ports prevents this by keeping a port in a blocking state if BPDUs are not received, ensuring that a port does not erroneously transition to forwarding during a topology change. This provides faster convergence without temporary loops by enforcing BPDU-based loop prevention.

Answer

Enable BPDU Guard on all switch ports.

Answer

Enable Root Guard on all switch ports.

Answer

Enable UDLD on all fiber links.

Question 14

Which two statements about 802.1X authentication with MAC Authentication Bypass (MAB) are true? (Choose two.)

Accepted Answer

MAB is used as a fallback authentication method for devices that do not support 802.1X.. MAB is used as a fallback for devices that do not support 802.1X supplicant, and it uses the MAC address as the credential. Option A is correct because MAB is typically configured as a fallback method. Option C is correct because the MAC address is used as both username and password. Option B is incorrect because MAB does not use certificates; that is for EAP-TLS. Option D is incorrect because MAB sends the MAC address in the clear, not encrypted. Option E is incorrect because MAB does not use EAPoL; it uses RADIUS with the MAC address.

Answer

MAB requires the supplicant to present a digital certificate for authentication.

Answer

MAB encrypts the MAC address using TLS before sending it to the RADIUS server.

Answer

MAB uses EAPoL to transport the MAC address between the switch and the endpoint.

Question 15

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Accepted Answer

gRPC (Google Remote Procedure Call).. Cisco DNA Center uses gRPC (Google Remote Procedure Call) as the transport protocol for model-driven telemetry from IOS-XE devices like the Catalyst 9000 series. gRPC leverages HTTP/2 and Protocol Buffers to efficiently stream structured YANG-modeled data, providing the real-time visibility required by DNA Center. This is the standard method for streaming telemetry in modern Cisco SD-Access and intent-based networking architectures.

Answer

NetFlow v9.

Answer

SNMPv3.

Answer

Syslog.