CCNP Practice Test 42 — 15 Questions

Question 1

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip flow monitor FLOW-MONITOR input
 ip flow monitor FLOW-MONITOR output
!
flow monitor FLOW-MONITOR
 exporter EXPORTER-1
 record netflow ipv4 original-input
!
flow exporter EXPORTER-1
 destination 192.168.1.100
 transport udp 2055
!

What is the effect of this configuration?

Accepted Answer

NetFlow v9 records are sent to the collector at 192.168.1.100 on UDP port 2055.. The configuration uses the 'netflow ipv4 original-input' record, which is a predefined record for NetFlow v9 (the default when no explicit version is specified). The exporter sends data to 192.168.1.100 on UDP port 2055, which is the standard port for NetFlow collectors. This results in NetFlow v9 records being exported to the collector.

Answer

NetFlow v5 records are sent to the collector at 192.168.1.100 on UDP port 2055.

Answer

IPFIX records are sent to the collector at 192.168.1.100 on UDP port 2055.

Answer

The configuration is missing the 'ip flow-export source' command to specify the source interface.

Question 2

Examine the following configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 ip vrf forwarding BLUE
 ip address 192.168.1.1 255.255.255.0
 no shutdown

What is the effect of this configuration?

Accepted Answer

The interface is placed into VRF BLUE, and all traffic sent or received on this interface uses the routing table of VRF BLUE.. The 'ip vrf forwarding BLUE' command associates the interface with VRF BLUE, which creates a separate routing table instance. All traffic entering or exiting this interface is forwarded using the VRF BLUE routing table, not the global routing table. This isolates the interface's traffic from the global routing domain.

Answer

The interface remains in the global routing table but is allowed to communicate with VRF BLUE via route leaking.

Answer

The interface is placed into VRF BLUE, but the IP address is assigned from the global routing table.

Answer

The configuration is invalid because VRF BLUE must be created first using 'vrf definition BLUE'.

Question 3

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

Accepted Answer

The loopback0 is not advertised in the routing protocol.. The spokes can establish the IKEv2 tunnel and ping the hub's tunnel IP, confirming that the tunnel interface is up and the IKEv2 session is functional. However, the loopback0 address (10.0.0.1/32) is not reachable from the spokes because it is not advertised into the routing protocol (e.g., OSPF, EIGRP, or BGP) used over the FlexVPN tunnel. Without a route to the loopback0 prefix, the spokes' traffic to 10.0.0.1 is dropped by the hub's routing table, even though the tunnel is operational.

Answer

The IKEv2 proposal does not match between hub and spoke.

Answer

The certificate authority is not trusted by the hub.

Answer

The tunnel interface is not in an up/up state.

Question 4

A Python script uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device:

from napalm import get_network_driver

driver = get_network_driver('ios')
device = driver('192.168.1.1', 'admin', 'cisco')
device.open()
arp_table = device.get_arp_table()
print(arp_table)
device.close()

What is the issue with this script?

Accepted Answer

The script will fail because the driver name 'ios' is incorrect; it should be 'iosxe' for IOS-XE devices.. The NAPALM driver for Cisco IOS-XE devices is 'iosxe', not 'ios'. The 'ios' driver is designed for classic Cisco IOS, which uses a different data model and CLI structure. Using 'ios' on an IOS-XE device will cause NAPALM to fail when attempting to retrieve data like the ARP table due to incompatible command outputs or missing XML/JSON structures.

Answer

The script will work correctly because 'ios' is the correct driver for all Cisco IOS devices.

Answer

The script will fail because the 'get_arp_table()' method requires an argument.

Answer

The script will work but only if the device is running IOS-XE 16.12 or later.

Question 5

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Accepted Answer

authentication port-control auto. 'authentication port-control auto' is the required interface command to enable 802.1X authentication on a switch port. This command sets the port to initiate the authentication process, placing it in the unauthorized state until the client successfully authenticates via the RADIUS server (Cisco ISE). Without this command, the port will not enforce 802.1X.

Answer

dot1x pae authenticator

Answer

authentication port-control force-authorized

Answer

authentication port-control force-unauthorized

Question 6

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network non-broadcast
 ip ospf priority 1
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0
 neighbor 192.168.1.2

What is the effect of this configuration?

Accepted Answer

OSPF will form an adjacency with 192.168.1.2 and elect a DR/BDR based on priority.. The configuration sets the OSPF network type to non-broadcast on the interface, which requires manual neighbor statements (neighbor 192.168.1.2) to form adjacencies. In non-broadcast mode, OSPF uses unicast instead of multicast, but it still performs DR/BDR election because the network type is considered multi-access (like Frame Relay). The ip ospf priority 1 command influences the election, so the correct answer is that OSPF will form an adjacency with 192.168.1.2 and elect a DR/BDR based on priority.

Answer

OSPF will form an adjacency with 192.168.1.2 without DR/BDR election.

Answer

OSPF will automatically discover neighbors via multicast and form adjacencies.

Answer

OSPF will use a 30-second hello interval and suppress DR/BDR election.

Question 7

A network engineer is migrating a physical server running a critical database to a virtual machine on a VMware vSphere cluster. The database requires high I/O performance and low latency. The engineer decides to use VMFS datastores with multiple extents to improve performance. After migration, the database performance is worse than on the physical server. What is the most likely reason?

Accepted Answer

VMFS datastores with multiple extents can cause I/O to span multiple LUNs, increasing latency.. VMFS datastores with multiple extents distribute data across multiple LUNs, which can cause I/O operations to span physical storage devices. This introduces additional latency due to the need for coordination across LUNs, negating the performance benefit expected from a single, contiguous LUN. For a database requiring high I/O and low latency, this spanning effect degrades performance compared to a physical server with direct-attached storage.

Answer

The VMFS datastore does not support files larger than 2 TB.

Answer

The virtual disk is configured as thin provisioned, causing write amplification.

Answer

The virtual disk is configured as thick eager zeroed, causing slow initial writes.

Question 8

What is the default multicast group range for Source-Specific Multicast (SSM) as defined by IANA and supported by Cisco IOS?

Accepted Answer

232.0.0.0/8. The IANA has reserved the 232.0.0.0/8 address range for Source-Specific Multicast (SSM), and Cisco IOS supports this default allocation. SSM uses (S,G) state, where receivers subscribe to a specific source's traffic for a group in this range, eliminating the need for a shared tree and RP. This is defined in RFC 4607.

Answer

224.0.0.0/4

Answer

239.0.0.0/8

Answer

233.0.0.0/8

Question 9

A network engineer issues the following command on a router:

R1# show tacacs

TACACS+ Server: 10.1.1.10/49
  Socket opens: 5
  Socket closes: 3
  Socket aborts: 0
  Total packets sent: 10
  Total packets received: 9
  Retransmissions: 1
  Timeouts: 1
  Current idle time: 30 seconds

Based on this output, what can be concluded?

Accepted Answer

The TACACS+ server experienced a single timeout.. The output shows 'Timeouts: 1', which indicates that exactly one TACACS+ request did not receive a response within the expected time. This confirms that the TACACS+ server experienced a single timeout, making option C correct. The server is reachable (socket opens/closes show successful connections), and authentication attempts have occurred (total packets sent/received).

Answer

The TACACS+ server is unreachable.

Answer

There have been no authentication attempts.

Answer

All packets were successfully acknowledged.

Question 10

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 route-map FILTER in
!
route-map FILTER deny 10
 match ip address prefix-list BLOCKED
route-map FILTER permit 20
!
ip prefix-list BLOCKED seq 5 permit 10.0.0.0/8
!
What is the effect of this configuration?

Accepted Answer

All routes from neighbor 10.0.0.2 are accepted except those matching 10.0.0.0/8.. The route-map FILTER is applied inbound from neighbor 10.0.0.2. Sequence 10 denies routes that match the prefix-list BLOCKED, which permits 10.0.0.0/8. Sequence 20 is a permit statement with no match, which implicitly permits all other routes. Therefore, only routes matching 10.0.0.0/8 are denied, and all other routes are accepted.

Answer

Only routes matching 10.0.0.0/8 are accepted from the neighbor.

Answer

The configuration is invalid because route-map must have a permit statement first.

Answer

The prefix-list is misconfigured because it should use 'deny' instead of 'permit'.

Question 11

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Accepted Answer

The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.. The DHCP snooping feature on a switch compares the source MAC address in the Ethernet frame with the chaddr (client hardware address) field inside the DHCP packet. When a DHCP client sends a packet with a different MAC in the frame than in the chaddr field, the switch considers it a 'MAC Address Mismatch' and drops the packet. This security mechanism prevents a rogue client from spoofing another device's MAC address to obtain a lease.

Answer

The DHCP server is sending packets with an incorrect server identifier option.

Answer

The DHCP client is sending a request with an incorrect transaction ID.

Answer

The DHCP offer packet is arriving on an untrusted port.

Question 12

A network engineer issues the following command on Router R8:

R8# show ip ospf neighbor detail

Neighbor 1.1.1.1, interface address 192.168.1.1
    In the area 0 via interface GigabitEthernet0/0
    Neighbor priority is 1, State is FULL, 6 state changes
    DR is 192.168.1.2, BDR is 192.168.1.1
    Options is 0x42 (L LSR LSRR L LSR)
    Dead timer due in 00:00:34
    Neighbor is up for 00:12:45
    Index 1/1/1, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0)/0x0(0) Next 0x0(0)/0x0(0)/0x0(0)
    Last retransmission scan length is 0, last retransmission scan time is 0 msec

Based on this output, what can be concluded?

Accepted Answer

Router 1.1.1.1 is the Backup Designated Router.. The output shows 'BDR is 192.168.1.1', which is the interface address of neighbor 1.1.1.1. This directly indicates that router 1.1.1.1 is the Backup Designated Router on this segment. The neighbor state is FULL, confirming adjacency is fully established.

Answer

Router 1.1.1.1 is the Designated Router on this segment.

Answer

The neighbor state is 2WAY.

Answer

The dead timer is 40 seconds.

Question 13

A network engineer runs the following command on Router R3:

R3# show ip nat statistics
Total active translations: 5 (0 static, 5 dynamic; 5 extended)
Outside interfaces: GigabitEthernet0/0
Inside interfaces: GigabitEthernet0/1
Hits: 1234  Misses: 5
CEF Translated packets: 1200, CEF Punted packets: 34
Expired translations: 10
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240
   refcount 5

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT).. The output shows 5 dynamic translations with an 'extended' type, which indicates that the router is using Port Address Translation (PAT) because extended translations include both IP address and port number. Additionally, the NAT pool POOL1 has a range of 203.0.113.1 to 203.0.113.10 (10 addresses), but there are 5 active translations, which would be impossible with basic NAT unless PAT is used to multiplex multiple inside hosts to the same outside IP via unique port numbers.

Answer

The NAT pool has exhausted all available addresses.

Answer

The NAT translations are all static.

Answer

The inside interface is GigabitEthernet0/0.

Question 14

An organization uses Cisco DNA Center to automate network provisioning. A network engineer deploys a new access switch but finds that the switch does not receive the intended configuration template. The switch appears in DNA Center inventory with status 'Managed'. What is the most likely cause?

Accepted Answer

The switch is not assigned to a site. In Cisco DNA Center, configuration templates are applied based on site assignment. A switch that appears as 'Managed' in inventory has been discovered and is under DNA Center's control, but if it is not assigned to a specific site, DNA Center cannot determine which template to push. Site assignment is a prerequisite for template-based provisioning; without it, the intended configuration will not be deployed.

Answer

The switch has not been discovered by DNA Center

Answer

The switch is not in Plug and Play mode

Answer

The switch does not have a valid DNA license

Question 15

A network engineer runs the following command on Router R4:

R4# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy input: SHAPE_POLICY

Class-map: class-default (match-any)
      1000 packets, 100000 bytes
      5 minute offered rate 100000 bps, drop rate 0 bps
      Match: any
      Queueing
      shape (average) cir 500000, bc 5000, be 5000
      target shape rate 500000

Based on this output, what can be concluded?

Accepted Answer

Traffic is being shaped to an average rate of 500 kbps.. The output shows a shape (average) cir 500000 with a target shape rate of 500000, which is 500,000 bps (500 kbps). Shaping buffers excess traffic to enforce an average rate, unlike policing which drops or marks. The 'drop rate 0 bps' confirms no drops are occurring, so traffic is being shaped to 500 kbps.

Answer

Traffic is being policed to 500 kbps.

Answer

The policy is applied to output traffic.

Answer

The offered rate exceeds the shaping rate, causing drops.