CCNP Practice Test 45 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip access-lists 101

Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 23 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet traffic from any source is denied.. The ACL 101 has three entries. The first permits HTTP traffic from 192.168.1.0/24 to any destination. The second denies Telnet traffic from any source. The third permits all other IP traffic. The match counters show hits. Since Telnet is denied, any Telnet attempt will be blocked unless it matches a preceding permit (which it doesn't).

Answer

Telnet traffic from 192.168.1.0/24 is permitted.

Answer

HTTP traffic from any source is permitted.

Answer

All traffic is permitted because of the last entry.

Question 2

A network engineer runs the following command on Router R1:

R1# show vrf brief

Name                             Default RD            Protocols   Interfaces
  CUSTOMER_A                       65000:100              ipv4        Gi0/0.100
  CUSTOMER_B                       65000:200              ipv4        Gi0/0.200
  MANAGEMENT                       65000:999              ipv4        Gi0/1

Based on this output, what can be concluded?

Accepted Answer

CUSTOMER_A and CUSTOMER_B are on the same physical interface but different subinterfaces.. The output shows three VRFs: CUSTOMER_A, CUSTOMER_B, and MANAGEMENT. Each has a route distinguisher and is associated with specific interfaces. The CUSTOMER_A and CUSTOMER_B VRFs are on subinterfaces of GigabitEthernet0/0, while MANAGEMENT is on a separate physical interface.

Answer

All VRFs are using the same route distinguisher.

Answer

The MANAGEMENT VRF is used for customer traffic.

Answer

The router is running MPLS L3VPN.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.10       192.168.1.10       ---                ---
--- 203.0.113.11       192.168.1.11       ---                ---
tcp 203.0.113.10:1024 192.168.1.10:1024  198.51.100.5:80    198.51.100.5:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing static NAT for two internal hosts.. The output shows NAT translations. The first two lines are static NAT entries (no protocol, no outside address). The third line is a dynamic translation for a TCP session. The inside local addresses are private (192.168.1.x), and inside global addresses are public (203.0.113.x). The outside addresses are public. This is typical for PAT or dynamic NAT.

Answer

The router is performing dynamic NAT for all translations.

Answer

The router is performing Port Address Translation (PAT) for all translations.

Answer

The router is translating outside global addresses to inside local addresses.

Question 4

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reset: 10

Session Id: 5
  Unique Id: 5
  User Name: admin
  IP Address: 192.168.1.100
  Idle Time: 0:00:05
  Timeout: 0:10:00
  Type: SSH
  Method: local

Session Id: 6
  Unique Id: 6
  User Name: neteng
  IP Address: 10.0.0.2
  Idle Time: 0:02:30
  Timeout: 0:10:00
  Type: SSH
  Method: tacacs+

Based on this output, what can be concluded?

Accepted Answer

Session 5 is authenticated locally.. The output shows two active AAA sessions. Session 5 is authenticated locally (Method: local), while session 6 uses TACACS+. Both are SSH sessions. The idle time for session 6 is 2 minutes 30 seconds, which is approaching the timeout of 10 minutes.

Answer

Both sessions are authenticated using TACACS+.

Answer

Session 6 will be disconnected due to idle timeout.

Answer

Both sessions are using RADIUS for authentication.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 02:30:15       5
192.168.1.3     4        65003     500     498       10    0    0 00:15:20       3
10.0.0.2        4        65004       0       0        0    0    0 never    Active

Based on this output, what can be concluded?

Accepted Answer

The BGP session to 10.0.0.2 is down due to a TCP connection issue.. The output shows BGP neighbors. The first two neighbors are established (up/down time and prefixes received). The third neighbor (10.0.0.2) is in Active state, meaning it is trying to establish a TCP connection but failing. This could be due to a missing route, ACL blocking, or incorrect configuration.

Answer

All BGP neighbors are fully established.

Answer

The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.

Answer

The router is receiving prefixes from all neighbors.

Question 6

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
	TCP connection: 10.0.0.2.646 - 10.0.0.1.49231
	State: Oper; Msgs sent/rcvd: 100/95; Downstream
	Up time: 01:23:45
	LDP discovery sources:
	  GigabitEthernet0/0, Src IP addr: 192.168.1.2
        	Addresses bound to peer LDP Ident:
        	  10.0.0.2        192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The LDP session is using TCP port 646.. The output shows an LDP neighbor with peer LDP identifier 10.0.0.2:0. The state is Operational, meaning the LDP session is established. The discovery source is GigabitEthernet0/0 with source IP 192.168.1.2. The peer's addresses include the LDP router ID and the interface IP.

Answer

The LDP session is not yet established.

Answer

The LDP neighbor is using a different router ID than 10.0.0.2.

Answer

The LDP session has been up for 1 hour 23 minutes.

Question 7

Examine the following CoPP configuration on a Cisco IOS-XE router:
```
class-map match-all CONTROL-PLANE
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class CONTROL-PLANE
 police 1000000 200000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY
```
What is the effect of this configuration?

Accepted Answer

Traffic matching the ACL is rate-limited to 1 Mbps; traffic exceeding the rate is dropped.. This applies a policy-map to the control plane that polices traffic matching the class-map. The police command limits traffic to 1 Mbps (1000000 bps) with a normal burst of 200000 bytes; conforming traffic is transmitted, exceeding traffic is dropped.

Answer

All control plane traffic is rate-limited to 1 Mbps.

Answer

Traffic exceeding 1 Mbps is marked down but still transmitted.

Answer

The policy-map is applied to the data plane, not the control plane.

Question 8

What is the default OSPF hello interval on an Ethernet link in a Cisco router?

Accepted Answer

10 seconds. By default, OSPF sends hello packets every 10 seconds on broadcast and point-to-point links (e.g., Ethernet).

Answer

30 seconds

Answer

5 seconds

Answer

40 seconds

Question 9

Drag and drop the steps of configuring Control Plane Policing (CoPP) on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Create access-list to match control plane traffic. CoPP protects the control plane by filtering traffic. First, define an access-list to match the traffic of interest (e.g., SSH, BGP). Second, create a class-map to reference the access-list. Third, create a policy-map that assigns a police action (rate-limit) to the class. Fourth, apply the policy-map to the control plane in the inbound direction. Finally, verify the policy with show commands to ensure correct operation.

Question 10

Examine the following interface configuration on a Cisco IOS-XE switch:
```
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
```
What is the effect of this configuration?

Accepted Answer

The port will dynamically learn MAC addresses, allow up to 2 addresses, and if a third MAC is seen, it will drop the traffic but keep the port up.. This configuration enables port security with sticky MAC learning, allowing up to 2 MAC addresses, and sets the violation mode to restrict (drops offending traffic but does not shut down the port).

Answer

The port will learn up to 2 MAC addresses and then shut down if a third is seen.

Answer

The port will allow only 2 MAC addresses and will generate a syslog message but continue forwarding traffic from the third MAC.

Answer

The port will learn MAC addresses dynamically and convert them to secure MAC addresses, but the maximum is 1 by default.

Question 11

Consider the following configuration on a Cisco IOS-XE router:
```
ip access-list extended BLOCK_SSH
 deny tcp any any eq 22
 permit ip any any
!
line vty 0 4
 access-class BLOCK_SSH in
```
Which statement is true about this configuration?

Accepted Answer

The ACL blocks all SSH traffic to the router, but permits other IP traffic.. The access-class applied to the VTY lines filters incoming Telnet/SSH sessions. The ACL denies TCP port 22 (SSH) and permits all other IP traffic. This blocks SSH access to the router.

Answer

The ACL blocks all traffic to the router because the deny statement is first.

Answer

The ACL only filters traffic going through the router, not destined to it.

Answer

The ACL permits SSH traffic because the permit statement overrides the deny.

Question 12

Consider the following IPv6 access-list on a Cisco IOS-XE router:
```
ipv6 access-list PERMIT_ICMP
 permit icmp any any echo-request
 permit icmp any any echo-reply
 deny ipv6 any any
!
interface GigabitEthernet0/0
 ipv6 traffic-filter PERMIT_ICMP in
```
What is the effect of this configuration?

Accepted Answer

Only IPv6 ping (echo-request and echo-reply) is allowed inbound on Gi0/0; all other IPv6 traffic is dropped.. The IPv6 ACL permits only ICMP echo-request and echo-reply (ping) and denies all other IPv6 traffic. It is applied inbound on Gi0/0.

Answer

All ICMPv6 traffic is permitted inbound on Gi0/0.

Answer

The ACL is applied outbound, so it filters traffic leaving Gi0/0.

Answer

The ACL permits all IPv6 traffic because the deny statement is at the end.

Question 13

Consider the following DHCP snooping configuration on a Cisco IOS-XE switch:
```
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
!
interface GigabitEthernet0/2
 ip dhcp snooping limit rate 10
```
Which statement is true?

Accepted Answer

Gi0/1 is trusted for DHCP snooping, and Gi0/2 will drop DHCP packets exceeding 10 per second.. DHCP snooping is enabled globally and for VLAN 10. Gi0/1 is trusted (typically uplink to DHCP server). Gi0/2 is untrusted and has a rate limit of 10 packets per second to prevent DHCP starvation.

Answer

Gi0/2 is trusted and will forward all DHCP packets without rate limiting.

Answer

The switch will only snoop DHCP on VLAN 10, but rate limiting applies to all VLANs.

Answer

Gi0/1 will rate-limit DHCP packets to 10 per second.

Question 14

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

Accepted Answer

Local preference. BGP uses the local preference attribute as the second tie-breaker (after weight). Higher local preference is preferred.

Answer

AS path length

Answer

MED

Answer

Origin code

Question 15

Examine the following BGP configuration on a Cisco IOS-XE router:
```
router bgp 65000
 bgp default local-preference 150
 neighbor 10.1.1.1 remote-as 65001
 neighbor 10.1.1.1 password cisco123
 neighbor 10.1.1.1 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50
```
What is the effect of the route-map on outbound updates to 10.1.1.1?

Accepted Answer

The MED value of routes advertised to 10.1.1.1 is set to 50.. The route-map SET-MED is applied outbound to neighbor 10.1.1.1. It sets the MED (multi-exit discriminator) to 50 for all routes advertised to that neighbor.

Answer

The local preference of routes received from 10.1.1.1 is set to 150.

Answer

The route-map filters routes; only those with metric 50 are advertised.

Answer

The password is applied to the BGP session, but the route-map is ignored due to the password.