CCNP Practice Test 41 — 15 Questions

Question 1

A network engineer runs the following command on switch SW5:

SW5# show cts sxp connections

SXP Connections:

Peer IP         Source IP        Conn Status     Duration
10.1.1.1        10.1.1.2        Up              2d3h
10.1.1.3        10.1.1.2        Down            0d0h

Based on this output, what can be concluded?

Accepted Answer

The SXP connection to 10.1.1.1 has been up for 2 days and 3 hours.. The output shows SXP connections. One connection to 10.1.1.1 is up for 2 days and 3 hours, while another to 10.1.1.3 is down. This indicates that SGT mapping exchange is active with 10.1.1.1 but not with 10.1.1.3.

Answer

Both SXP connections are operational.

Answer

The switch is using 802.1X for authentication.

Answer

The SXP connection to 10.1.1.3 is up.

Question 2

A network engineer runs the following command on switch SW9:

SW9# show cts role-based policy

Role-based policy:

Source Group   Dest Group   Action
10             20           PERMIT
10             30           DENY
20             30           PERMIT

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 20 to SGT 30 is permitted.. The output shows the role-based policy table. It lists the source and destination SGTs and the action (PERMIT or DENY). This is the policy that the switch enforces for traffic between SGTs.

Answer

Traffic from SGT 10 to SGT 20 is denied.

Answer

Traffic from SGT 30 to SGT 10 is denied.

Answer

The policy is configured on an ISE server.

Question 3

A network engineer runs the following command on switch SW2:

SW2# show cts role-based sgt-map

Active IPv4-SGT Mapping Table:
IP Address       SGT
192.168.1.10     10
192.168.1.20     20
192.168.1.30     30

Total number of entries: 3

Based on this output, what can be concluded?

Accepted Answer

The switch maintains a mapping table that associates IP addresses with SGTs for TrustSec policy enforcement.. The command shows the mapping of IP addresses to Security Group Tags (SGTs) in a TrustSec environment. Each IP is associated with a specific SGT value, which is used for role-based access control.

Answer

The switch is using 802.1X to assign SGTs to endpoints.

Answer

The switch has a static mapping of IP addresses to SGTs.

Answer

The switch is using MAB to assign SGTs to endpoints.

Question 4

A network engineer runs the following command on switch SW4:

SW4# show cts environment-data

CTS Environment Data:

Device ID: SW4.cisco.com
Device Name: SW4
CTS Capabilities: SGT, SXP, CTSD, CTSA
SGT: 100
SXP Node: Enabled
SXP Connection: 10.1.1.1:64999

Based on this output, what can be concluded?

Accepted Answer

The switch has an SXP connection to a peer at 10.1.1.1.. The output shows the switch's CTS environment data, including its own SGT (100) and that SXP (SGT Exchange Protocol) is enabled with a connection to 10.1.1.1 on port 64999. This indicates the switch is participating in SXP to propagate SGT mappings.

Answer

The switch is using 802.1X for authentication.

Answer

The switch's SGT is 10.

Answer

The switch is not capable of SGT assignment.

Question 5

A network engineer runs the following command on switch SW8:

SW8# show cts role-based sgt-map 192.168.1.10

IP Address: 192.168.1.10
SGT: 10
Source: SXP

Based on this output, what can be concluded?

Accepted Answer

The SGT mapping was learned via SXP from a peer.. The output shows the SGT for IP 192.168.1.10 is 10, and the source is SXP, meaning the mapping was learned via the SGT Exchange Protocol from an SXP peer. This is dynamic, not static.

Answer

The SGT mapping was configured manually.

Answer

The IP address 192.168.1.10 is not mapped to any SGT.

Answer

The SGT mapping is from local authentication.

Question 6

A network engineer runs the following command on switch SW6:

SW6# show cts role-based counters

Role-based counters:

Source Group   Dest Group   Packets Sent   Bytes Sent   Packets Denied   Bytes Denied
10             20           1500           120000       0                0
10             30           0              0            500              40000

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 10 to SGT 20 is being permitted, and traffic from SGT 10 to SGT 30 is being denied.. The output shows packet and byte counters for role-based policies. For source 10 to dest 20, 1500 packets were sent and none denied, indicating a permit policy. For source 10 to dest 30, 0 packets sent and 500 denied, indicating a deny policy. This matches the permissions seen in a previous question.

Answer

Traffic from SGT 10 to SGT 20 is being denied.

Answer

Traffic from SGT 10 to SGT 30 is being permitted.

Answer

No traffic has been sent between any SGTs.

Question 7

A network engineer is configuring a GETVPN solution for a large enterprise with many remote sites. The engineer wants to ensure that all traffic between sites is encrypted using a common group key. The key server (KS) is a Cisco ASR 1000. After configuration, the group members (GMs) can register with the KS, but traffic between GMs is not encrypted. The engineer checks the KS configuration and sees that the crypto gdoi group has been defined with a transform set and a security association. What is the most likely missing configuration?

Accepted Answer

The KS is missing an access list to define the traffic to encrypt.. In GETVPN, the KS must define a traffic selector (access list) that specifies which traffic to encrypt. Without a proper access list, the KS will not send the policy to the GMs, and traffic will pass in the clear. Option A is correct because the access list is missing. Option B is incorrect because the group name is not the issue. Option C is incorrect because the KS does not need an IPsec profile. Option D is incorrect because GMs can be in different subnets.

Answer

The group name on the GMs does not match the KS.

Answer

The KS is not configured with an IPsec profile.

Answer

The GMs are in different IP subnets than the KS.

Question 8

Consider the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 5
 spanning-tree portfast

What is the effect of this configuration?

Accepted Answer

The switch will act as an 802.1X authenticator and the port will be unauthorized until a successful authentication.. This configuration enables 802.1X authentication on the interface with the authenticator role, sets the transmit period to 5 seconds, and enables PortFast to avoid STP delays. The 'authentication port-control auto' command puts the port in unauthorized state until authentication succeeds.

Answer

The port will immediately transition to forwarding state and then wait for authentication.

Answer

The port will be placed in a VLAN assigned by the RADIUS server after authentication.

Answer

The switch will act as a supplicant and respond to EAP requests from an upstream authenticator.

Question 9

Consider this configuration for TrustSec on a Cisco switch:

cts role-based enforcement
interface GigabitEthernet1/0/5
 cts manual
 sap pmk AABBCCDDEEFF00112233445566778899 mode-list both
 propagate sgt

What is the purpose of the 'propagate sgt' command under the interface?

Accepted Answer

It enables the switch to insert SGT tags into packets forwarded out of this interface.. The 'propagate sgt' command enables the switch to insert SGT information into packets received on this interface, allowing SGT propagation to downstream devices.

Answer

It allows the switch to receive SGT information from the connected device.

Answer

It enables the switch to enforce role-based access control on this interface.

Answer

It configures the interface to use SXP for SGT propagation.

Question 10

What is the default tx-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

30 seconds. The tx-period timer defines the number of seconds the switch waits for a response to an EAP-Request/Identity packet before retransmitting. The default value is 30 seconds.

Answer

3 seconds

Answer

10 seconds

Answer

60 seconds

Question 11

Drag and drop the steps of TrustSec SGT classification and enforcement into the correct order, from first to last.

Accepted Answer

Switch classifies endpoint and assigns SGT. TrustSec first classifies traffic by assigning an SGT based on user/device identity, then the switch tags packets with the SGT. The packet is forwarded with the SGT intact, and the destination switch enforces policy by checking the SGT against an SGACL. Finally, the destination switch permits or denies traffic based on the SGACL.

Question 12

Examine the following configuration snippet:

interface GigabitEthernet1/0/2
 switchport mode access
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10

Which statement about this configuration is true?

Accepted Answer

802.1X will be attempted first; if the client does not respond, MAB will be used as a fallback.. This configuration enables both 802.1X and MAB (MAC Authentication Bypass) on the interface. MAB is used as a fallback if the connected device does not support 802.1X. The switch acts as an authenticator.

Answer

MAB will be attempted first, and if it fails, 802.1X will be used.

Answer

The port will be placed in a guest VLAN if both 802.1X and MAB fail.

Answer

The switch will act as a supplicant for MAB and an authenticator for 802.1X.

Question 13

Examine the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/6
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 3
 dot1x max-req 3
 dot1x timeout supp-timeout 10

What is the total time the switch will wait for a supplicant to respond before failing authentication?

Accepted Answer

9 seconds. The switch sends up to 'max-req' (3) EAP-Request/Identity packets, each with a 'tx-period' of 3 seconds. The total time is max-req * tx-period = 3 * 3 = 9 seconds. The 'supp-timeout' is for EAP packets after identity, but the initial identity timeout is governed by tx-period.

Answer

30 seconds

Answer

10 seconds

Answer

13 seconds

Question 14

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Accepted Answer

Switch sends EAP-Request/Identity. The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject. The switch then opens or blocks the port accordingly.

Question 15

Consider the following TrustSec configuration on a Cisco switch:

cts role-based enforcement
interface GigabitEthernet1/0/3
 cts manual
 sap pmk 0123456789ABCDEF mode-list both

What is the purpose of this configuration?

Accepted Answer

It enables CTS inline tagging with a pre-shared key for SGT exchange between peers.. This enables CTS role-based enforcement globally and configures the interface for manual CTS with a pre-shared key (PMK) for SGT exchange. The 'mode-list both' allows both source and destination SGT enforcement.

Answer

It enables 802.1X authentication with a pre-shared key.

Answer

It configures the interface to use SGT (Security Group Tag) propagation via SXP.

Answer

It enables dynamic VLAN assignment based on user authentication.