CCNP Practice Test 44 — 15 Questions

Question 1

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED. BGP uses multiple attributes to determine the best path. The WEIGHT attribute is Cisco-specific and is preferred when it has the highest value, not lowest. The LOCAL_PREF attribute is preferred with the highest value. The MED (Multi-Exit Discriminator) attribute is preferred with the lowest value. The ORIGIN attribute prefers IGP over EGP and incomplete.

Answer

WEIGHT

Answer

LOCAL_PREF

Answer

ORIGIN

Question 2

Which two statements about Cisco DNA Center automation workflows are true? (Choose two.)

Accepted Answer

Cisco DNA Center supports Plug and Play (PnP) for zero-touch deployment of new switches and routers.. Cisco DNA Center uses intent-based networking to automate network changes. The correct answers highlight key automation capabilities: PnP for zero-touch provisioning and the ability to push configuration templates via CLI or REST API. The wrong answers misstate the role of APIC-EM (a predecessor), the GUI-only limitation, and the integration with ISE for policy rather than device discovery.

Answer

Cisco DNA Center requires an external APIC-EM controller to manage device discovery and inventory.

Answer

Cisco DNA Center automation is limited to GUI-based workflows and does not support any programmatic interfaces.

Answer

Cisco DNA Center uses Cisco ISE as the primary source for device discovery and network topology mapping.

Question 3

Which three statements about hypervisor security and isolation are true? (Choose three.)

Accepted Answer

A VM escape attack occurs when an attacker breaks out of a virtual machine to access the hypervisor or other VMs.. Hypervisor security is critical to prevent VM escape and ensure isolation. Option A is correct because VM escape is a serious vulnerability where code in a VM breaks out to the hypervisor. Option C is correct because the hypervisor should enforce strict isolation between VMs to prevent data leakage. Option D is correct because keeping the hypervisor patched and minimizing its attack surface are key security practices. Option B is incorrect because VMs are not inherently isolated from each other; isolation depends on hypervisor design. Option E is incorrect because VMs do not have direct access to physical hardware; the hypervisor mediates access.

Answer

Virtual machines are inherently isolated from each other and do not require any additional security measures.

Answer

Virtual machines have direct access to physical hardware resources such as CPU and memory.

Question 4

Drag and drop the steps of Cisco DNA Center assurance data collection workflow into the correct order, from first to last.

Accepted Answer

Devices stream telemetry to DNA Center. Assurance begins with network devices streaming telemetry data (e.g., NetFlow, SNMP, syslog) to DNA Center. DNA Center processes and correlates the data to build a baseline of normal behavior. It then applies machine learning models to detect anomalies. Alerts and insights are generated for potential issues. Finally, the dashboard displays health scores and recommended actions for the administrator.

Question 5

Which two statements about Cisco Aironet 2800/3800 series APs are true? (Choose two.)

Accepted Answer

These APs support 802.11ac Wave 2 with MU-MIMO technology.. The 2800/3800 series APs are 802.11ac Wave 2 devices that support MU-MIMO and have integrated antennas; they do not support 802.11ax (Wi-Fi 6) and are not modular with field-replaceable radios.

Answer

These APs are Wi-Fi 6 (802.11ax) capable.

Answer

These APs support modular field-replaceable radios for future upgrades.

Answer

These APs can operate in both local and FlexConnect modes.

Question 6

Drag and drop the steps of network audit and gap analysis steps into the correct order, from first to last.

Accepted Answer

Inventory all network devices and software versions. The audit starts with inventory collection, then performance baselining. Security and configuration compliance are checked, gaps are identified, and finally a remediation plan is created.

Question 7

Drag and drop the steps of IP SLA with threshold and reaction configuration into the correct order, from first to last.

Accepted Answer

Define IP SLA operation type and target. First, the IP SLA operation is defined. Then thresholds for rising and falling are configured. The reaction is set to trigger when thresholds are crossed. The operation is scheduled. Finally, the reaction is enabled to take action.

Question 8

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

Accepted Answer

Configure 'monitor session 1 source interface Port-channel 1 both' and 'monitor session 1 destination interface Gi1/0/24'.. SPAN on a Cisco Catalyst 9300 switch can directly source an EtherChannel interface (Port-channel 1) to monitor all member link traffic as a single logical stream. The 'both' keyword captures ingress and egress traffic, and the destination interface Gi1/0/24 receives the mirrored frames. This is the proper method to monitor an EtherChannel without needing to configure individual member ports.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' (where Gi1/0/1 is a member of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' (the VLAN of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source interface Port-channel 1' and 'monitor session 1 destination remote vlan 999'.

Question 9

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

Accepted Answer

RF interference or poor signal-to-noise ratio on the affected APs.. Cisco DNA Center Assurance can correlate client association failures with RF interference, authentication issues, or configuration mismatches. Since the APs are registered and functional, the issue is likely related to RF interference or signal quality. DNA Center's Assurance can analyze client association events and highlight RF issues as a common cause.

Answer

The APs are not running the recommended firmware version.

Answer

The wireless controller has reached its maximum number of APs.

Answer

The DNA Center Assurance module is not properly configured to monitor wireless events.

Question 10

A network engineer is using Cisco DNA Center to manage a network with multiple sites. The engineer wants to ensure that all devices at a remote site have the same NTP server configuration. The engineer creates a network profile with the NTP settings and assigns it to the site. After provisioning, the engineer checks one of the switches and finds that the NTP configuration is missing. What should the engineer check first?

Accepted Answer

Verify that the device is assigned to the correct site in DNA Center.. In Cisco DNA Center, network profiles are applied to sites, but devices must be assigned to the correct site hierarchy. If a device is not assigned to the site where the profile is applied, it will not receive the configuration. The engineer should verify that the device is in the correct site within DNA Center's hierarchy.

Answer

Check if the NTP server is reachable from the device.

Answer

Ensure that the device is running a supported IOS version.

Answer

Recreate the network profile with the correct NTP settings.

Question 11

Which two statements about the Cisco FlexConnect architecture are true? (Choose two.)

Accepted Answer

FlexConnect APs can locally switch client data traffic when the CAPWAP tunnel to the WLC is down.. FlexConnect allows local switching and backup connectivity when the WLC is unreachable. Central switching requires the CAPWAP tunnel to the WLC. FlexConnect groups are used to apply common policies, not to assign APs to different VLANs. Native VLAN tagging is supported on the uplink port.

Answer

FlexConnect APs must always tunnel all client traffic back to the WLC for central switching.

Answer

FlexConnect APs require a direct Layer 2 connection to the WLC at all times.

Answer

FlexConnect APs cannot support native VLAN tagging on the uplink interface.

Question 12

Drag and drop each VM network mode on the left to its matching behavior description on the right.

Accepted Answer

Bridged: VM appears as a separate device on the physical network. Bridged mode connects the VM to the physical network as if it were a separate host. NAT mode allows the VM to share the host’s IP address for outbound access. Host-only mode creates an isolated network between the host and VMs. Internal mode isolates VMs from the host. Custom mode allows the user to select a specific virtual switch.

Question 13

Drag and drop the steps of 802.11r Fast BSS Transition (FT) roaming steps into the correct order, from first to last.

Accepted Answer

Client discovers target AP via active/passive scan. 802.11r FT roaming uses a key hierarchy to reduce latency. The client first discovers the target AP via scanning. The client sends an FT Authentication request containing a Mobility Domain Identifier (MDIE) and R0KH-ID. The target AP responds with an FT Authentication response with key data. The client then sends an FT Association request, and the AP completes the process with an FT Association response.

Question 14

Drag and drop the steps of IP SLA DNS lookup operation setup into the correct order, from first to last.

Accepted Answer

Define IP SLA operation type dns. First, define the IP SLA operation with type dns. Then specify the target DNS server and the domain name to resolve. Optionally set the DNS source interface or timeout. Next, schedule the operation. Finally, verify the DNS resolution success and response time.

Question 15

Drag and drop the steps of KVM VM provisioning via virsh CLI into the correct order, from first to last.

Accepted Answer

Define VM XML configuration file. KVM provisioning via virsh begins with defining the VM XML configuration. Then, the VM is started using virsh start. Next, the VM's console is accessed to complete OS installation. After that, the VM is shut down gracefully. Finally, the VM is restarted for production use.