CCNP Practice Test 45 — 15 Questions

Question 1

Drag and drop the steps of Layer 3 EtherChannel (routed port-channel) setup into the correct order, from first to last.

Accepted Answer

Create port-channel interface with 'interface port-channel'. The correct order for Layer 3 EtherChannel (routed port-channel) setup is: first, create the port-channel interface using 'interface port-channel'. Next, configure the member ports as Layer 3 interfaces with 'no switchport' and assign them to the port-channel using 'channel-group'. Then, assign an IP address to the port-channel interface. After that, enable the port-channel interface with 'no shutdown'. Finally, verify routing using 'show ip route' and ping.

Question 2

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

Accepted Answer

Spoke1 sends IKEv2 request to hub for Spoke2. In FlexVPN, the spoke-to-spoke dynamic tunnel creation process uses IKEv2, not IKEv1. The correct sequence: Spoke1 sends an IKEv2 request to the hub for information about Spoke2. The hub responds with a redirect notification containing Spoke2's address. Spoke1 then initiates a direct IKEv2 SA with Spoke2. Authentication is performed directly between spokes (typically using certificates or pre-shared keys), not via the hub. After authentication, they establish an IPsec SA for secure data transfer.

Question 3

Drag and drop the steps of gRPC dial-in telemetry session from collector into the correct order, from first to last.

Accepted Answer

Collector initiates TCP connection to device port 57400. The collector initiates the connection, authenticates, subscribes to specific YANG paths, receives streaming updates, and then processes the data.

Question 4

Drag and drop the steps of VLAN pruning on trunks using VTP into the correct order, from first to last.

Accepted Answer

Enable VTP pruning globally. VTP pruning must be enabled globally before configuring the pruning-eligible list on a specific trunk interface. The global VTP pruning command enables the feature, then per-interface configuration restricts which VLANs can be pruned.

Question 5

Drag and drop each MPLS VPN role on the left to its matching description on the right.

Accepted Answer

CE (Customer Edge): Connects directly to the provider edge and advertises customer routes. The CE device connects directly to the PE and advertises customer routes; the PE device attaches labels and maintains VRFs; the P device is a core router that switches MPLS labels without holding VPN routes; the RR (Route Reflector) distributes VPNv4 routes within the MPLS VPN core; the ASBR connects different MPLS VPN domains.

Question 6

Drag and drop the steps of MPLS VPN (L3VPN) service provisioning into the correct order, from first to last.

Accepted Answer

Configure IGP and LDP on core interfaces. First, the provider edge (PE) router must have IGP and LDP running in the core. Then the VRF is defined with route distinguisher and import/export RTs. The customer edge (CE) interface is placed into the VRF. MP-BGP is configured between PEs to exchange VPNv4 routes. Finally, the CE routes are redistributed into the VRF and advertised via MP-BGP.

Question 7

Drag and drop the steps of gNMI Subscribe RPC using Python gRPC library into the correct order, from first to last.

Accepted Answer

Compile gnmi.proto to generate Python stubs. The correct order starts with generating gNMI protobuf stubs, then creating a gRPC channel and stub. Next, a SubscribeRequest is built with paths and mode, the Subscribe RPC is called, and finally responses are iterated from the stream.

Question 8

Drag and drop the steps of DMVPN Phase 3 NHRP registration and spoke-to-spoke tunnel establishment into the correct order, from first to last.

Accepted Answer

Spoke registers with hub via NHRP. In DMVPN Phase 3, the spoke first registers its NHRP mapping with the hub, then the hub propagates the mapping. When a spoke needs to reach another spoke, it sends an NHRP resolution request to the hub, the hub replies with the mapping, and then the spoke initiates a direct IPsec tunnel to the target spoke.

Question 9

Drag and drop the steps of Hierarchical QoS (H-QoS) parent/child policy steps into the correct order, from first to last.

Accepted Answer

Define child policy-map with class actions. H-QoS uses a child policy for per-class actions and a parent policy to shape aggregate traffic. The order ensures child policy is defined first, then parent references it, and finally applied to the interface.

Question 10

Drag and drop each NAT terminology on the left to its matching definition on the right.

Accepted Answer

Inside local: The IP address of a host as seen from the internal network. Inside global is the translated public IP address of an internal host. Inside local is the private IP address of a host as seen from the internal network. Outside local is the IP address of a remote host as seen from the inside network. Outside global is the actual public IP address of a remote host. Inside host is the device behind the NAT that initiates traffic.

Question 11

A network engineer runs the following command on Switch SW2:

SW2# show spanning-tree vlan 20

VLAN0020
  Spanning tree enabled protocol ieee
  Root ID    Priority    24596
             Address     aabb.cc00.0200
             Cost        4
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 20)
             Address     aabb.cc00.0300
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Altn BLK 4         128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

GigabitEthernet0/3 is in the Blocking state to prevent a loop.. The output shows that SW2's Gi0/3 is in the Alternate (Altn) role and Blocking (BLK) state. In Rapid PVST+ (IEEE 802.1w), an alternate port provides a backup path to the root bridge and is placed in a blocking state to prevent Layer 2 loops. This confirms that Gi0/3 is blocking to maintain a loop-free topology.

Answer

SW2 is the root bridge for VLAN 20.

Answer

The root port cost is 8.

Answer

SW2's bridge priority is 32768.

Question 12

A network engineer uses the Cisco DNA Center REST API to retrieve the list of devices. The API returns the following JSON:

```json
{
  "response": [
    {
      "id": "12345678-1234-1234-1234-123456789abc",
      "managementIpAddress": "192.168.1.1",
      "hostname": "Router1",
      "platformId": "ISR4331",
      "role": "ACCESS",
      "series": "ISR4300 Series"
    }
  ],
  "version": "1.0"
}
```

The engineer writes the following Python code to extract the hostname of the first device:

```python
import requests

url = 'https://dna-center.local/dna/intent/api/v1/network-device'
headers = {'X-Auth-Token': 'valid_token', 'Accept': 'application/json'}
response = requests.get(url, headers=headers, verify=False)
data = response.json()
hostname = data['response'][0]['hostname']
print(hostname)
```

What is a potential issue with this code?

Accepted Answer

The code does not check if the HTTP response status is 200 before parsing JSON, which could lead to errors if the token is invalid.. The code assumes the API call succeeds and the 'response' list is non-empty. If the token is expired or the API returns an error, response.json() may not have the expected structure, causing a KeyError or IndexError. The code lacks error handling for HTTP status codes and empty responses.

Answer

The URL is missing the '/v1' version segment.

Answer

The 'Accept' header should be 'application/yang-data+json' for DNA Center.

Answer

The 'X-Auth-Token' header is not the correct authentication method; DNA Center uses Basic Auth.

Question 13

Drag and drop the steps of configuring a site-to-site IPsec VPN on Cisco IOS into the correct order, from first to last.

Accepted Answer

Define IKE policy. The correct order for configuring a site-to-site IPsec VPN is: first define the IKE policy (Phase 1 parameters), then define the IPsec transform set (Phase 2 parameters), then create the crypto ACL to match interesting traffic, then configure the crypto map to bind all parameters, and finally apply the crypto map to the outgoing interface.

Question 14

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Accepted Answer

GM initiates ISAKMP SA with KS. In GET VPN, a group member (GM) first registers with the key server (KS) using ISAKMP. The KS authenticates the GM and then pushes the current policy and encryption keys (TEK and KEK) to the GM. The KS periodically sends a rekey message to all GMs to update the keys before they expire.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/0 | include access list
  Inbound  access list is 101
  Outbound access list is not set

R1# show access-lists 101
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 80 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from sources outside 192.168.1.0/24 is denied.. The ACL 101 is applied inbound on GigabitEthernet0/0. The first line permits TCP traffic from source 192.168.1.0/24 to any destination on port 80 (HTTP). The second line denies TCP traffic from any source to any destination on port 80, which catches HTTP traffic from sources outside 192.168.1.0/24. Since ACLs process in order, traffic from outside the permitted subnet is denied, making option A correct.

Answer

All HTTP traffic is permitted.

Answer

The ACL is applied outbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.