CCNP Practice Test 39 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
    20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
    30 deny tcp any any eq 22 (2 matches)
    40 permit ip any any (10 matches)

Based on this output, what can be concluded?

Accepted Answer

SSH access from 192.168.1.0/24 would be denied.. ACL 120 permits SSH (port 22) from 10.0.0.0/8 and 172.16.0.0/16, denies SSH from all other sources, and permits all other IP traffic. The match counts show 5 SSH packets from 10.x.x.x, 3 from 172.16.x.x, 2 denied SSH packets from other sources, and 10 other packets permitted. The correct answer is that SSH access from 192.168.1.0/24 would be denied.

Answer

SSH access from 10.0.0.0/8 is denied.

Answer

All SSH traffic is permitted.

Answer

The ACL has an implicit deny at the end.

Question 2

A network engineer runs the following command on Router R1:

R1# show access-lists 130
Extended IP access list 130
    10 permit icmp host 10.1.1.1 any echo (8 matches)
    20 permit icmp host 10.1.1.1 any echo-reply (5 matches)
    30 deny icmp any any (3 matches)
    40 permit ip any any (12 matches)

Based on this output, what can be concluded?

Accepted Answer

ICMP packets from sources other than 10.1.1.1 are denied.. ACL 130 permits ICMP echo and echo-reply only from host 10.1.1.1, denies all other ICMP, and permits all other IP traffic. The match counts show 8 echo packets from 10.1.1.1, 5 echo-reply packets from 10.1.1.1, 3 denied ICMP packets from other sources, and 12 other packets permitted. The correct answer is that ICMP packets from sources other than 10.1.1.1 are denied.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all traffic from 10.1.1.1.

Answer

The ACL is applied inbound on an interface.

Question 3

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all)
      50 packets, 2500 bytes
      5 minute offered rate 500 bps
      Match: access-group name BGP-ACL
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 50 packets, 2500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SNMP-CLASS (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: access-group name SNMP-ACL
      police:
          cir 16000 bps, bc 2000 bytes, be 2000 bytes
        conformed 150 packets, 7500 bytes; actions:
          transmit
        exceeded 40 packets, 2000 bytes; actions:
          drop
        violated 10 packets, 500 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: any
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 100 packets, 5000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.. The BGP class has a CIR of 64 kbps and all 50 packets conformed. The SNMP class has a CIR of 16 kbps, but 50 out of 200 packets exceeded or violated, meaning 50 packets were dropped. The class-default has a CIR of 32 kbps and all 100 packets conformed. The correct answer is that SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.

Answer

BGP traffic is being dropped because it exceeds the CIR.

Answer

All traffic to the control plane is being dropped.

Answer

The control-plane policy is applied in the output direction.

Question 4

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: MGMT-CLASS (match-all)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: access-group name MGMT-ACL
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 80 packets, 4000 bytes; actions:
          transmit
        exceeded 15 packets, 750 bytes; actions:
          drop
        violated 5 packets, 250 bytes; actions:
          drop

Class-map: class-default (match-any)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 200 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

Management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.. The MGMT class has a CIR of 32 kbps. Out of 100 packets, 80 conformed and were transmitted, while 20 exceeded or violated and were dropped. This indicates that the traffic rate exceeded the policer's CIR, causing drops. The correct answer is that management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.

Answer

All management traffic is being transmitted without drops.

Answer

The policer is configured in the output direction.

Answer

The class-default is dropping packets.

Question 5

Given the following CoPP configuration:

class-map match-all COPP_ICMP
 match access-group name ICMP_ACL
!
policy-map COPP_POLICY
 class COPP_ICMP
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY

What is the effect?

Accepted Answer

All ICMP traffic to the control plane is rate-limited to 8000 bps.. This CoPP policy polices traffic matching class COPP_ICMP to 8000 bps; conforming traffic is transmitted, exceeding traffic is dropped.

Answer

ICMP traffic is permitted unconditionally.

Answer

The policy is applied to all interfaces, not just the control plane.

Answer

The class-map is missing a match-all statement.

Question 6

What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?

Accepted Answer

10 seconds. OSPF defaults to a 10-second hello interval on broadcast and point-to-point networks.

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 7

Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. Standard ACLs are configured by first entering global config, defining the ACL with permit/deny statements, then applying it to an interface in the correct direction. Verification confirms the ACL is active.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list
  Inbound  access list is not set
  Outbound access list is 140

R1# show access-lists 140
Extended IP access list 140
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    20 deny tcp any any eq 443 (10 matches)
    30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.. ACL 140 is applied outbound on GigabitEthernet0/1. It permits HTTPS (port 443) from subnet 192.168.1.0/24 to any destination, denies all other HTTPS, and permits all other IP traffic. The match counts show 25 HTTPS packets from the subnet, 10 denied HTTPS packets from other sources, and 50 other packets permitted. The correct answer is that HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.

Answer

All HTTPS traffic is permitted outbound.

Answer

The ACL is applied inbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. ACL 150 permits Telnet (port 23) from 10.0.0.0/8, denies Telnet from all other sources, permits SSH (port 22) from 172.16.0.0/16, denies SSH from all other sources, and permits all other IP traffic. The match counts show 2 Telnet packets from 10.x.x.x, 8 denied Telnet packets from other sources, 4 SSH packets from 172.16.x.x, 1 denied SSH packet from another source, and 15 other packets. The correct answer is that Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied because it does not match the SSH permit entry.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 10

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip access-group FILTER_IN in
!
ip access-list extended FILTER_IN
 deny   icmp any any echo
 permit ip any any

What is the effect of this configuration?

Accepted Answer

It blocks inbound ICMP Echo requests on GigabitEthernet0/1.. The ACL denies ICMP Echo (ping) inbound on GigabitEthernet0/1 while permitting all other IP traffic.

Answer

It blocks all ICMP traffic inbound on GigabitEthernet0/1.

Answer

It blocks all inbound traffic on GigabitEthernet0/1.

Answer

It blocks outbound ICMP Echo requests on GigabitEthernet0/1.

Question 11

Examine the CoPP configuration:

class-map match-any COPP_SSH
 match access-group name SSH_ACL
!
policy-map COPP_POLICY
 class COPP_SSH
  police 10000 conform-action transmit exceed-action drop
 class class-default
  police 5000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY

Which statement is true?

Accepted Answer

SSH traffic is limited to 10 kbps; all other control plane traffic is limited to 5 kbps.. The policy applies two police rates: 10 kbps for SSH traffic and 5 kbps for all other control plane traffic.

Answer

All control plane traffic is limited to 10 kbps.

Answer

The class-default police rate is ignored because it is not explicitly matched.

Answer

The policy-map should be applied to an interface, not the control plane.

Question 12

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255, but the default is 100.

Answer

100

Answer

15

Answer

Unlimited

Question 13

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

Accepted Answer

Match against class-map with highest priority. CoPP evaluates packets against class maps in sequential order. The first match determines the action. The default class is processed last if no match occurs.

Question 14

A network engineer is configuring 802.1X on a Cisco Catalyst 9300 switch for a wired network. The engineer wants to allow devices that do not support 802.1X (e.g., printers) to still access the network using MAB (MAC Authentication Bypass). The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'mab'. However, after connecting a printer, the switch logs show 'MAB failed' repeatedly. The printer's MAC address is in the RADIUS server database. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured to accept MAC addresses in the format sent by the switch (e.g., with dots or colons).. MAB requires the switch to send a MAC address as the username and password. If the RADIUS server does not accept the format, authentication fails. Option A is correct because the RADIUS server must be configured to accept MAC addresses in the format sent by the switch (e.g., 'aaaa.bbbb.cccc'). Option B is incorrect because MAB does not require EAP. Option C is incorrect because the switchport mode does not affect MAB. Option D is incorrect because the printer does not support 802.1X, so it cannot respond to EAP.

Answer

The switch is not configured with 'dot1x timeout tx-period' to initiate MAB.

Answer

The interface is configured as 'switchport mode trunk', which does not support MAB.

Answer

The printer is not responding to EAP-Request/Identity packets.

Question 15

A network engineer is implementing Cisco TrustSec (CTS) with Security Group Tags (SGTs) using SXP (SGT Exchange Protocol). The engineer configures the switch as an SXP speaker and the Cisco ISE as an SXP listener. The engineer verifies that SXP peers are established. However, when the engineer checks 'show cts role-based sgt map', the SGT mappings for users are not present. What is the most likely cause?

Accepted Answer

The switch is not configured to assign SGTs to users via 802.1X or static mapping.. SXP propagates SGTs from a speaker to a listener. If the switch is the speaker, it must have SGT mappings from authentication. If the switch does not have the mappings, it cannot propagate them. Option B is correct because the switch must first learn SGTs via 802.1X or manual configuration. Option A is incorrect because SXP does not require a specific version. Option C is incorrect because the listener is ISE, which is correct. Option D is incorrect because the peers are established.

Answer

The SXP version mismatch between the switch and ISE.

Answer

The ISE is configured as an SXP speaker instead of a listener.

Answer

The SXP connection is using the wrong TCP port.