CCNP Practice Test 42 — 15 Questions

Question 1

Drag and drop the steps of Cisco NSO service provisioning workflow into the correct order, from first to last.

Accepted Answer

Operator sends service request to NSO. Cisco NSO service provisioning begins with the operator or OSS sending a service request to NSO via NETCONF/RESTCONF. NSO then processes the service model and creates a service instance. NSO uses device templates and YANG models to generate device configurations. NSO pushes the configuration to the network devices using NETCONF. Finally, NSO verifies the service is operational and updates the service state.

Question 2

Which three statements about IGMP snooping are true? (Choose three.)

Accepted Answer

IGMP snooping reduces multicast flooding on a VLAN by forwarding traffic only to ports that have joined the group.. IGMP snooping optimizes multicast forwarding at Layer 2 by monitoring IGMP messages. It builds a snooping table, forwards reports only to the querier, and can be configured with static entries. It does not suppress queries or require PIM.

Answer

IGMP snooping suppresses all IGMP general queries from the multicast router.

Answer

IGMP snooping requires PIM to be enabled on the switch.

Question 3

Which three statements about Dynamic Trunking Protocol (DTP) are true? (Choose three.)

Accepted Answer

DTP is a Cisco proprietary protocol.. Correct: A is true because DTP is Cisco proprietary and not supported on non-Cisco switches. B is true because DTP uses VLAN 1 (the native VLAN) for its frames; if the native VLAN is mismatched, DTP may fail. C is true because the 'switchport mode dynamic desirable' interface configuration command actively sends DTP frames to negotiate trunking. D is incorrect because DTP operates at Layer 2, not Layer 3. E is incorrect because DTP is not used on routed ports; it only applies to switch ports in access or trunk mode.

Answer

DTP operates at Layer 3 of the OSI model.

Answer

DTP is used to negotiate trunking on routed ports.

Question 4

A network engineer is implementing MACsec on a Cisco switch-to-switch link to provide encryption. Both switches support MACsec and are configured with the same pre-shared key (PSK). The engineer configures 'mka' and 'macsec' on the interfaces. After configuration, the link does not come up, and the engineer sees 'MKA not operational' in the show macsec status. What is the most likely cause?

Accepted Answer

The pre-shared key (PSK) configured on both switches does not match.. The 'MKA not operational' error indicates that the MACsec Key Agreement (MKA) protocol cannot establish a secure session. Since both switches are configured with a pre-shared key (PSK), the most likely cause is that the PSK values do not match, preventing MKA from completing the mutual authentication and key derivation process. MKA relies on the Connectivity Association Key (CAK) derived from the PSK; mismatched PSKs result in different CAKs, causing the MKA exchange to fail.

Answer

MACsec requires a RADIUS server for key distribution, which is not configured.

Answer

The interfaces are configured with different VLANs, causing MACsec to fail.

Answer

The interfaces must be configured as trunk ports for MACsec to work.

Question 5

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Accepted Answer

DMVPN: mGRE with NHRP. DMVPN uses mGRE and NHRP; FlexVPN uses IKEv2; GET VPN uses GDOI; AnyConnect uses TLS/DTLS; Site-to-Site IPsec VPN uses IKEv1 or IKEv2 with ESP.

Question 6

Which three statements about FlexVPN are true? (Choose three.)

Accepted Answer

FlexVPN uses IKEv2 as its underlying key exchange protocol.. FlexVPN is a Cisco implementation based on IKEv2, supporting hub-and-spoke, spoke-to-spoke, and remote access VPNs with centralized key management.

Answer

FlexVPN requires a dedicated AAA server for all authentication functions.

Answer

FlexVPN uses NHRP to dynamically discover spoke routers and establish direct tunnels.

Question 7

Which three statements about SSL VPNs are true? (Choose three.)

Accepted Answer

SSL VPNs use the TLS protocol to encrypt traffic between client and server.. SSL VPNs use TLS for encryption, can provide clientless access via web browser, and support port forwarding for legacy applications. They do not require IPsec and can use any port (typically 443).

Answer

SSL VPNs require a pre-shared key for authentication.

Answer

SSL VPNs can only operate over TCP port 443.

Question 8

A network engineer runs the following command on Router R4:

R4# show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.1.10:1024  10.0.0.10:1024     203.0.113.5:80     203.0.113.5:80
tcp 192.168.1.10:1024  10.0.0.10:1024     203.0.113.5:80     203.0.113.5:80
--- 192.168.1.11:2048  10.0.0.11:2048     198.51.100.2:443   198.51.100.2:443

Based on this output, what can be concluded?

Accepted Answer

The translation for 10.0.0.10 is a static NAT entry.. The first translation entry for 10.0.0.10 shows both a protocol-less line (---) and a TCP line, which is characteristic of a static NAT entry. In static NAT, the router pre-populates the translation table with a permanent mapping, and the protocol-less entry indicates the static binding before any traffic is seen. The second entry for 10.0.0.11 lacks this protocol-less line, confirming it is a dynamic entry.

Answer

Both translations are dynamic NAT entries.

Answer

The router is performing PAT for both translations.

Answer

The outside global address is the same as the outside local address for both entries.

Question 9

Drag and drop each EIGRP metric component on the left to its matching variable on the right.

Accepted Answer

K1: Bandwidth. K1 corresponds to bandwidth, K2 to load, K3 to delay, and K4 to reliability. K5 is not directly assigned to a single metric component; it is a multiplier used with reliability in the metric formula. MTU is not a K variable; it is only used in the feasibility condition.

Answer

K5: MTU

Question 10

Examine the following VRF configuration:

vrf definition BLUE
 rd 1:1
 route-target export 1:1
 route-target import 2:2
!
interface GigabitEthernet0/5
 vrf forwarding BLUE
 ip address 10.0.0.1 255.255.255.0

What is the effect of having different export and import route targets?

Accepted Answer

The VRF exports routes tagged with RT 1:1 and imports routes tagged with RT 2:2, enabling selective route exchange.. The VRF BLUE configuration uses different route targets for export (1:1) and import (2:2). This enables selective route exchange: routes learned in VRF BLUE are exported with RT 1:1, and only routes tagged with RT 2:2 are imported into VRF BLUE. This is a common design for hub-and-spoke or inter-VRF route leaking scenarios where import and export RTs are intentionally asymmetric.

Answer

The configuration is invalid because export and import RTs must be identical.

Answer

The VRF will only import routes from other VRFs that also have RT 1:1.

Answer

This configuration disables route advertisement for VRF BLUE.

Question 11

A network engineer is automating the configuration of VLANs on a Cisco Nexus 9000 switch using Python and the NX-API. The engineer sends a Python dictionary with the CLI commands to the API and receives a successful response. However, when checking the switch, the VLANs are not created. The engineer verifies that the credentials and IP address are correct, and the API is enabled. The engineer also notices that the API response contains a 'code' field of '200' and a 'result' field that shows the command output. What is the most likely cause of the issue?

Accepted Answer

The engineer used the 'show' message type in the API request instead of 'cli_conf'.. The NX-API requires the 'message' type to be set to 'cli_conf' for configuration commands. Using 'show' (the default) only executes show commands and returns output, but does not apply any configuration changes to the switch. Even though the API returns a 200 status code and command output, the configuration is not actually committed.

Answer

The API response code of 200 indicates an error, and the engineer should check for a different status code.

Answer

The VLAN commands are incorrect; the engineer should use 'vlan 10' instead of 'vlan 10-20'.

Answer

The switch requires a 'commit' command after configuration changes via NX-API.

Question 12

A network engineer configures SNMPv3 on a Cisco router with the following: 'snmp-server group GRP v3 priv', 'snmp-server user usr GRP v3 auth sha pass1 priv aes 128 pass2'. The NMS is configured with the same credentials. However, the NMS cannot perform SNMP walks. The engineer notices that the router's SNMP agent is responding to queries from other devices. What is the most likely cause?

Accepted Answer

The group 'GRP' is not associated with a view that allows read access to the MIB tree.. The 'snmp-server group GRP v3 priv' command creates an SNMPv3 group with privacy (encryption) but does not associate it with any view. By default, SNMPv3 groups have no read, write, or notify access unless a view is explicitly configured. Without a view that permits read access to the MIB tree, the NMS cannot perform SNMP walks, even though the router responds to other queries (e.g., from different groups or versions).

Answer

The user's authentication key is too short.

Answer

The NMS is using SNMPv2c community strings instead of SNMPv3.

Answer

The router's SNMP engine ID has changed since the user was created.

Question 13

Which three statements about syslog message severity levels are correct? (Choose three.)

Accepted Answer

Severity level 0 (emergencies) indicates the system is unusable.. Syslog severity levels range from 0 (emergency) to 7 (debugging). The logging console default is usually level 7 (debugging) but can be changed. Level 3 (errors) includes error conditions that still allow the system to function. Level 5 (notifications) is for normal but significant conditions. Level 6 (informational) is for informational messages. Level 0 is the highest severity (most critical).

Answer

Severity level 6 (informational) is used for debugging messages that are only useful during troubleshooting.

Answer

The default logging console severity level on Cisco IOS is 3 (errors).

Question 14

Which three statements about SNMP trap and inform operations are true? (Choose three.)

Accepted Answer

Traps are unacknowledged notifications sent from the SNMP agent to the manager.. SNMP traps are unacknowledged messages sent from agent to manager. Informs are acknowledged (confirmed) notifications. Informs require a response from the manager and can be retransmitted if no response is received. Traps are sent via UDP port 162 by default. Informs also use UDP port 162. Informs consume more memory and processing because they maintain state for acknowledgment. Traps are less reliable because they are not acknowledged.

Answer

Traps are more reliable than informs because they are sent with a higher priority.

Answer

Informs consume less memory and processing than traps because they do not require state tracking.

Question 15

Which two statements about SNMPv3 security models are true? (Choose two.)

Accepted Answer

The authNoPriv security model provides authentication but no encryption.. SNMPv3 provides three security models: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication but no encryption), and authPriv (authentication and encryption). The authPriv model uses HMAC-MD5 or HMAC-SHA for authentication and CBC-DES or CFB128-AES for encryption. The engine ID is a unique identifier for each SNMP entity and is used to generate the localized key.

Answer

The noAuthNoPriv security model uses both a username and a password for authentication.

Answer

SNMPv3 requires the use of a separate engine ID for each SNMP manager and agent.

Answer

The authPriv model supports only AES-256 for encryption.