CCNP Practice Test 45 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list
  Inbound  access list is not set
  Outbound access list is 140

R1# show access-lists 140
Extended IP access list 140
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    20 deny tcp any any eq 443 (10 matches)
    30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.. The ACL 140 is applied outbound on GigabitEthernet0/1. It permits TCP port 443 (HTTPS) traffic only from source 192.168.1.0/24, then denies all other HTTPS traffic, and finally permits all other IP traffic. Since the deny statement (line 20) blocks HTTPS from any source not matching the permit (line 10), traffic from outside 192.168.1.0/24 is denied when exiting the interface, making option A correct.

Answer

All HTTPS traffic is permitted outbound.

Answer

The ACL is applied inbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 2

Drag and drop the steps for the DHCP DORA process in the correct order.

Accepted Answer

Discover, then Offer, then Request, then Acknowledge. DHCP uses Discover, Offer, Request, Acknowledge (DORA) for dynamic address assignment.

Answer

Discover, then Request, then Offer, then Acknowledge

Answer

Offer, then Discover, then Request, then Acknowledge

Answer

Discover, then Offer, then Acknowledge, then Request

Question 3

A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics:

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1
Accept: application/yang-data+json

Response:

{
  "ietf-interfaces:interface": [
    {
      "name": "GigabitEthernet1",
      "type": "iana-if-type:ethernetCsmacd",
      "enabled": true,
      "ietf-ip:ipv4": {
        "address": [
          {
            "ip": "192.168.1.1",
            "netmask": "255.255.255.0"
          }
        ]
      }
    }
  ]
}

What does the response indicate about the interface?

Accepted Answer

The interface GigabitEthernet1 is enabled and has an IPv4 address of 192.168.1.1/24.. The response includes an 'enabled' field set to 'true' and an IPv4 address of '192.168.1.1' with a netmask of '255.255.255.0', which corresponds to a /24 prefix. The RESTCONF GET request successfully retrieves the interface configuration from the ietf-interfaces YANG data model, confirming the interface is administratively up and has an IPv4 address configured.

Answer

The interface is disabled because the 'enabled' field is missing.

Answer

The response indicates an error because the interface type is incorrect.

Answer

The response shows that the interface has no IP address configured.

Question 4

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Accepted Answer

BGP sessions may flap due to dropped keepalives.. The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.

Answer

Data plane traffic will be dropped.

Answer

Only SSH sessions will be rate-limited.

Answer

SNMP and SSH will be unaffected because they are explicitly permitted.

Question 5

A network engineer issues the following command on Router R9:

R9# show ip pim bsr-router
PIMv2 Bootstrap Router (BSR) information
This system is the Bootstrap Router (BSR)
BSR address: 10.0.0.11
Uptime: 1w2d, BSR priority: 0, Hash mask length: 30
Next bootstrap message in 00:00:45

Based on this output, what can be concluded?

Accepted Answer

This router is the elected BSR.. The output explicitly states 'This system is the Bootstrap Router (BSR)', which means the router on which the command was issued is the elected BSR for the PIM domain. The BSR address of 10.0.0.11 confirms this is the router's own IP address, and the uptime of 1 week 2 days indicates it has been functioning as the BSR for an extended period, further solidifying its elected status.

Answer

This router is a candidate BSR but not elected.

Answer

The BSR priority is 192.

Answer

The hash mask length is 32.

Question 6

A network engineer runs the following command on Switch SW3:

SW3# show monitor session 3
Session 3
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 100
Destination Ports      : Gi1/0/15
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.. The output shows a Remote Destination Session, meaning this switch (SW3) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 100 and forwards it out of the destination port Gi1/0/15, typically to a monitoring device. The 'Ingress: Disabled' confirms that traffic entering Gi1/0/15 is not being injected back into the switch.

Answer

This is a local SPAN session with source VLAN 100.

Answer

The RSPAN VLAN 100 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.

Question 7

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 route-map SET_COMMUNITY in
!
route-map SET_COMMUNITY permit 10
 set community 100:200
!
What is the effect of this configuration?

Accepted Answer

Routes received from 10.0.0.2 are tagged with community 100:200, but the community is not sent to other BGP peers unless send-community is configured.. The route-map SET_COMMUNITY is applied to inbound updates from neighbor 10.0.0.2, so routes received from that neighbor are tagged with community 100:200. However, BGP does not propagate communities to other peers unless the neighbor is explicitly configured with the send-community command. Without send-community, the community attribute is stripped from outbound updates, so the community is not sent to other BGP peers.

Answer

Routes received from 10.0.0.2 are tagged with community 100:200 and automatically sent to all neighbors.

Answer

The route-map is applied to outbound updates to 10.0.0.2, setting community on routes sent to that neighbor.

Answer

The configuration is invalid because the community must be a string, not a numeric value.

Question 8

A network engineer runs the following command on Router R4:

R4# show interfaces tunnel 0
Tunnel0 is up, line protocol is up
  Hardware is Tunnel
  Internet address is 10.0.0.4/30
  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation TUNNEL, loopback not set
  Keepalive not set
  Tunnel source 192.168.1.4, destination 192.168.2.4
  Tunnel protocol/transport GRE/IP
    Key disabled, sequencing disabled
    Checksumming of packets disabled
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

Based on this output, what is true about this tunnel?

Accepted Answer

The tunnel is a GRE tunnel that is up and operational.. The output shows 'Tunnel protocol/transport GRE/IP', confirming this is a GRE tunnel. The interface status is 'up, line protocol is up', and the counters show zero errors, indicating the tunnel is fully operational. The lack of packet traffic does not indicate a failure; GRE tunnels can be up without active data flow.

Answer

The tunnel is using IPsec encryption.

Answer

The tunnel is using MPLS over GRE.

Answer

The tunnel is down because there are no packets.

Question 9

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 ebgp-multihop 2
 neighbor 10.0.0.2 update-source Loopback0
!
What is the purpose of the ebgp-multihop 2 command?

Accepted Answer

It allows the eBGP session to be established with a neighbor that is not directly connected, with a maximum of 2 hops.. The ebgp-multihop 2 command allows an eBGP session to be established between peers that are not directly connected at Layer 3. By setting the TTL to 2, it permits the BGP packets to traverse one intermediate router (hop) to reach the neighbor, which is necessary when using loopback interfaces for eBGP peering.

Answer

It sets the maximum number of prefixes that can be received from the neighbor to 2.

Answer

It limits the number of paths BGP can install for load balancing to 2.

Answer

It enables BGP multipath for eBGP with a hop count of 2.

Question 10

A network engineer runs the following command on Switch SW8:

SW8# show etherchannel 2 detail | include "Port state|Port: Gi|Partner"
Port: Gi0/0
Port state    = Up, In-Bundle
Port: Gi0/1
Port state    = Up, In-Bundle
Port: Gi0/2
Port state    = Down, Not-In-Bundle
Partner information:
Gi0/0: Partner state = bndl
Gi0/1: Partner state = bndl
Gi0/2: Partner state = down

Based on this output, what can be concluded?

Accepted Answer

Gi0/2 is not bundled because the partner is in 'down' state, indicating a physical layer issue.. The output shows that Gi0/2 is in 'Down, Not-In-Bundle' state and its partner state is 'down', which indicates a physical layer issue such as a bad cable, disabled port, or misconfiguration on the remote side. Since the port is down, it cannot participate in the EtherChannel bundle, confirming that only Gi0/0 and Gi0/1 are active and forwarding traffic.

Answer

All three ports are bundled and forwarding traffic.

Answer

The EtherChannel is using PAgP because the partner state shows 'bndl'.

Answer

Gi0/2 is in standby mode waiting to become active.

Question 11

Which SNMP version introduced the use of a username and authentication/password framework, without encryption?

Accepted Answer

SNMPv3. SNMPv3 introduced a security model that provides both authentication and privacy (encryption), but the question specifically asks for the version that introduced a username and authentication/password framework without encryption. SNMPv3's User-based Security Model (USM) allows for authentication-only mode (authNoPriv), which uses a username and password (or key) for authentication but does not encrypt the payload. This distinguishes it from earlier versions that relied on community strings (SNMPv1 and SNMPv2c) or offered no standardized security framework.

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv2u

Question 12

Review this IP SLA configuration on Router R1:

ip sla 6
 icmp-echo 10.6.6.6
 frequency 10
ip sla schedule 6 life forever start-time now
ip sla reaction-configuration 6 react timeout threshold-type immediate action-type triggerOnly

Which statement is true about the 'threshold-type immediate' parameter?

Accepted Answer

It triggers an event immediately when a timeout occurs.. The 'threshold-type immediate' parameter in an IP SLA reaction configuration causes the router to trigger the specified action (in this case, 'triggerOnly') as soon as a single probe timeout occurs, without waiting for any additional probes or a delay. This is correct because the configuration explicitly sets the threshold type to immediate, meaning the reaction is instantaneous upon detecting the timeout event.

Answer

It triggers an event after a delay of 10 seconds.

Answer

It triggers an event only if the timeout persists for 5 consecutive probes.

Answer

It triggers an event only if the timeout occurs within the first 10 seconds.

Question 13

Which BGP attribute is preferred with the lowest value?

Accepted Answer

MED. MED (Multi-Exit Discriminator) is a BGP attribute that is preferred with the lowest value. It is used to influence inbound traffic to an AS when multiple entry points exist, and a lower MED value is more preferred over a higher one.

Answer

Local Preference

Answer

Weight

Answer

Origin

Question 14

Drag and drop each STP protection feature on the left to its matching purpose on the right.

Accepted Answer

PortFast: Immediately transitions a port to forwarding state. PortFast moves a port to forwarding immediately; BPDU Guard err-disables a port upon BPDU reception; Root Guard prevents a port from becoming root; Loop Guard prevents alternate/backup ports from transitioning to forwarding.

Question 15

spanning-tree vlan 10 priority 4096

What is the effect of this global configuration command?

Accepted Answer

The switch will have a bridge priority of 4096 for VLAN 10, increasing its chance to become root bridge.. The command `spanning-tree vlan 10 priority 4096` sets the bridge priority for VLAN 10 to 4096. A lower bridge priority value increases the likelihood that this switch will be elected as the root bridge for that VLAN, because the spanning-tree algorithm selects the switch with the lowest bridge priority as the root. However, it does not guarantee immediate root status, as other switches with an even lower priority could still win the election.

Answer

The switch will have a bridge priority of 4096 for all VLANs.

Answer

The switch will become the root bridge for VLAN 10 immediately.

Answer

The switch will have a bridge priority of 4096 for VLAN 10 and all other VLANs will use 32768.