CCNP Practice Test 41 — 15 Questions

Question 1

Which two statements about 802.1X port-based authentication on a Cisco switch are true? (Choose two.)

Accepted Answer

The switch acts as the authenticator in the 802.1X framework.. 802.1X uses EAP over LAN (EAPoL) to authenticate devices at the port level. The switch acts as an authenticator and can use a RADIUS server for authentication. Option A is correct because the switch is the authenticator. Option D is correct because EAPoL is the protocol used between the supplicant and the authenticator. Option B is incorrect because the RADIUS server is the authentication server, not the authenticator. Option C is incorrect because 802.1X can be configured on Layer 2 switch ports, not just routers. Option E is incorrect because 802.1X is not limited to wireless; it is commonly used on wired switch ports.

Answer

The RADIUS server acts as the authenticator in the 802.1X framework.

Answer

802.1X can only be configured on router interfaces, not on switch ports.

Answer

802.1X authentication is only applicable to wireless networks.

Question 2

Which two statements about MPLS label operations are true? (Choose two.)

Accepted Answer

The ingress LSR imposes a label onto the packet.. In MPLS, the ingress LSR imposes (pushes) a label onto the packet. At each intermediate LSR, the label is swapped (the incoming label is replaced with an outgoing label). The egress LSR removes (pops) the label before forwarding the IP packet. Penultimate Hop Popping (PHP) is a feature where the penultimate router pops the label, so the egress router receives only an IP packet. Option C is incorrect because the egress LSR always pops the label, not pushes. Option D is incorrect because label imposition occurs only at the ingress, not at every LSR. Option E is incorrect because label swapping is the action at transit LSRs, not label imposition.

Answer

The egress LSR pushes a new label onto the packet.

Answer

Each LSR in the LSP performs label imposition.

Answer

Transit LSRs perform label imposition.

Question 3

Drag and drop each MPLS label operation on the left to its matching action on the right.

Accepted Answer

Push: Adds a new label to the top of the label stack. Push adds a new label to the stack, pop removes the top label, swap replaces the top label with a new one, PHP pops the label before the egress LER, and TTL propagation copies the IP TTL into the label TTL field.

Question 4

Which three statements about MPLS VPN (Layer 3 VPN) are true? (Choose three.)

Accepted Answer

PE routers maintain separate VRF instances for each customer.. In MPLS Layer 3 VPNs, the PE routers maintain separate VRF instances for each customer. Route distinguishers (RDs) make overlapping customer prefixes unique, while route targets (RTs) control the import/export of routes between VRFs. The P (provider) routers do not need to know about customer routes; they only switch based on MPLS labels. Option D is incorrect because P routers do not maintain customer routes. Option E is incorrect because MPLS VPNs use two labels: the inner label identifies the egress PE, and the outer label is used for transport through the core.

Answer

P routers must maintain customer VPN routing information.

Answer

MPLS VPNs use a single label to forward packets across the service provider core.

Question 5

Drag and drop each MPLS VPN type on the left to its matching layer on the right.

Accepted Answer

L3VPN: Operates at Layer 3 using IP routing and VRF. L3VPN uses IP routing (Layer 3) and VRF, L2VPN emulates Layer 2 services like Ethernet, VPLS is a multipoint L2VPN, VPWS is a point-to-point L2VPN, and EVPN is a modern L2VPN control plane.

Question 6

Drag and drop each MPLS VPN type on the left to its matching layer on the right.

Accepted Answer

L3VPN: Layer 3 IP-based VPN using MP-BGP. L3VPN operates at Layer 3 (IP), L2VPN at Layer 2 (Ethernet/Frame Relay), VPLS is a specific L2VPN, VPWS is point-to-point L2VPN, and MVPN is multicast L3VPN.

Question 7

Which two statements about Cisco SD-Access fabric wireless integration are true? (Choose two.)

Accepted Answer

Wireless clients are assigned to the same virtual network (VN) as wired clients for consistent policy.. In Cisco SD-Access fabric wireless integration, wireless clients are assigned to the same virtual network (VN) as wired clients, ensuring consistent policy enforcement. Option A is correct because VN membership is shared across wired and wireless. Option E is correct because when the WLC is fabric-enabled, the access point (AP) encapsulates wireless client traffic directly into VXLAN and forwards it to the fabric edge, bypassing the need for a separate wireless overlay. The WLC can be deployed as a fabric edge or border, not a dedicated role, so option B is false. CAPWAP is used only for control between the AP and WLC, not for data traffic to the fabric edge (option C is false). The fabric does not use a separate wireless overlay; it reuses the same VXLAN data plane (option D is false).

Answer

The wireless LAN controller in SD-Access must be a dedicated fabric role separate from the fabric edge.

Answer

CAPWAP tunnels are used between the access point and the fabric edge for data traffic.

Answer

The fabric uses a separate wireless overlay network for wireless traffic.

Question 8

Drag and drop the steps of SD-WAN edge device (vEdge/cEdge) bring-up sequence into the correct order, from first to last.

Accepted Answer

Obtain IP address via DHCP. The correct order follows the Cisco SD-WAN device bootstrapping process: first the device obtains an IP address via DHCP, then it discovers the vManage using DNS or a redirect server, establishes a DTLS/TLS control connection to vManage, downloads its configuration, and finally establishes OMP sessions with vSmart controllers.

Question 9

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Accepted Answer

start-time: Defines when the operation begins. start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration; ageout removes the operation after inactivity; recurring repeats the schedule daily.

Question 10

An engineer is using the Cisco SD-WAN vManage REST API to retrieve the list of WAN edge devices. The engineer sends a GET request to 'https://vmanage/dataservice/device' and receives a 401 Unauthorized error. The engineer has already obtained a JSESSIONID cookie by authenticating with the API. What is the most likely cause of the error?

Accepted Answer

The JSESSIONID cookie must be included in the request headers for authentication.. A 401 error indicates that authentication is required or has failed. Even with a JSESSIONID cookie, the engineer must include it in the request headers. Additionally, vManage APIs often require a CSRF token for state-changing operations, but for GET requests, the JSESSIONID should suffice. The most likely cause is that the cookie is not being sent with the request, or the session has expired.

Answer

The engineer must use a different authentication method, such as OAuth2, instead of cookies.

Answer

The URI is incorrect; the correct URI should be 'https://vmanage/dataservice/device/wanedge'.

Answer

The engineer must include a CSRF token in the request header for GET requests.

Question 11

Drag and drop the steps of the QoS trust boundary configuration process into the correct order, from first to last.

Accepted Answer

Enable trust on the interface (e.g., trust cos). The trust boundary process starts by enabling trust on the interface, then optionally setting a default CoS/DSCP for untrusted traffic, and finally applying a service policy to enforce policing or marking. Verification ensures the trust boundary is correctly applied.

Question 12

Drag and drop the steps of VNF life cycle management into the correct order, from first to last.

Accepted Answer

Onboard VNF package into NFVI. The correct order follows the ETSI NFV lifecycle: first onboard the VNF package, then instantiate the VNF, configure the VNF, scale the VNF as needed, and finally terminate the VNF when no longer required.

Question 13

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Accepted Answer

Define prefix-list for more-specific routes. The correct order for BGP route aggregation with suppress-map is: first, define a prefix-list to match the more-specific routes you want to suppress. Second, create a route-map with a suppress clause that references the prefix-list. Third, configure the aggregate-address in BGP under the address-family. Fourth, apply the suppress-map to the aggregate-address command (typically as part of the aggregate-address command itself). Finally, verify the summary route and the suppressed routes.

Question 14

Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.

Accepted Answer

Create VRF and assign route distinguisher. First, you create the VRF and assign an RD. Then, you configure the NAT inside and outside interfaces under the VRF. Next, you define the NAT pool and access list for translation. After that, you apply the NAT rules with 'ip nat inside source' referencing the VRF. Finally, you verify NAT translations using 'show ip nat translations vrf'.

Question 15

Drag and drop the steps of traffic shaping vs policing configuration steps into the correct order, from first to last.

Accepted Answer

Define class map to match traffic. The correct order for configuring traffic shaping or policing is: first, define a class map to match the desired traffic (A); second, create a policy map that specifies the shape or police action (B); third, apply the service policy to the interface (C); fourth, verify the policy using the show policy-map interface command (D); and finally, adjust the shaping rate or policing burst as needed based on verification results (E). This sequence ensures that traffic classification and policy definition are completed before applying the policy, and verification is done before making adjustments.