CCNP Practice Test 46 — 15 Questions

Question 1

Drag and drop each IP SLA tracking object on the left to its application on the right.

Accepted Answer

tracked static route: Install or remove a static route. Static route uses tracking to install or remove a route; HSRP uses tracking to adjust priority; PBR uses tracking to change policy routing; VRRP uses tracking for priority; GLBP uses tracking for weighting.

Question 2

Drag and drop the steps of DNA Center template deployment to a device into the correct order, from first to last.

Accepted Answer

Create a CLI template in Project. Template deployment starts with creating the template, then associating it with a site, committing the changes, deploying to the target device, and verifying the deployment.

Question 3

Drag and drop each DNA Center ISE integration component on the left to its matching role on the right.

Accepted Answer

pxGrid: Enables real-time context sharing between DNA Center and ISE. ISE integration: pxGrid shares context data; TrustSec enforces segmentation; RADIUS provides authentication; SGT carries security group tags.

Question 4

Which three statements about VRF path isolation in a service provider network are true? (Choose three.)

Accepted Answer

VRFs allow multiple customers to share the same physical infrastructure while keeping their traffic isolated.. Correct: VRFs isolate customer traffic; MPLS VPN uses VRFs with route targets; VRF-aware features like NAT and QoS can be applied per VRF. Incorrect: VRFs do not replace VLANs; VRF-lite does not use labels.

Answer

VRF can be used to replace VLANs for Layer 2 isolation.

Answer

In VRF-lite, path isolation is achieved using MPLS labels.

Question 5

An engineer is deploying QoS on a WAN link between two sites using a Cisco ISR 4451 router. The link is a 10 Mbps MPLS circuit. The engineer wants to ensure that voice traffic (EF) is never dropped, even during congestion. The current policy uses a single class map for voice with a policer that drops excess traffic. During peak hours, users report choppy voice calls. What change should the engineer make?

Accepted Answer

Change the policer to a shaper and apply it to the voice class. A policer drops traffic that exceeds the configured rate, which causes choppy voice calls during congestion. Changing the policer to a shaper allows the router to buffer excess voice traffic (EF) instead of dropping it, ensuring that voice packets are never dropped and are instead queued and transmitted when bandwidth becomes available. This aligns with the requirement that voice traffic (EF) is never dropped, even during congestion, as a shaper provides a smoothing effect without discarding packets.

Answer

Increase the policer rate to 20 Mbps to accommodate voice bursts

Answer

Remove the policer and rely on FIFO queuing

Answer

Apply the policy in the output direction only

Question 6

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream OSPF neighbor state changes. The engineer uses the YANG model 'Cisco-IOS-XE-ospf-oper' and creates an on-change subscription. After testing, the engineer notices that the telemetry data is being sent, but the collector is receiving duplicate updates for the same OSPF neighbor state change. What is the most likely cause of these duplicate updates?

Accepted Answer

The YANG path includes multiple leafs that change together, each triggering a separate update. That the YANG path includes multiple leafs that change simultaneously, causing multiple updates for the same event. For example, when an OSPF neighbor goes from FULL to DOWN, multiple leafs (state, last-up-time, etc.) change, and each change triggers an on-change update. The other options are incorrect because the sample-interval is not used in on-change subscriptions; the collector is not causing duplicates; and the encoding does not cause duplicates.

Answer

The subscription is configured with both on-change and periodic updates

Answer

The collector is sending acknowledgments that cause the router to resend data

Answer

The engineer used JSON encoding which causes larger payloads and fragmentation

Question 7

Drag and drop each protocol on the left to its matching characteristic on the right.

Accepted Answer

RADIUS: Uses UDP transport. RADIUS uses UDP, encrypts only the password, and combines authentication and authorization. TACACS+ uses TCP, encrypts the entire packet, and separates authentication, authorization, and accounting.

Question 8

Drag and drop the steps of DMVPN Phase 1 spoke-to-hub tunnel setup into the correct order, from first to last.

Accepted Answer

Configure mGRE tunnel interface on spoke. In DMVPN Phase 1, the spoke first establishes an mGRE tunnel to the hub using NHRP registration, then the hub learns the spoke's NBMA address, and finally the spoke can route traffic through the hub. The correct order is: configure mGRE tunnel interface on spoke, configure NHRP with hub as NHS, spoke registers its NBMA address via NHRP, hub adds spoke to its NHRP database, and spoke sends traffic through hub.

Question 9

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Accepted Answer

Load YANG model into DevKit environment. Validation begins with loading the YANG model, then using the tool to check path syntax, verifying existence, and confirming with device capabilities.

Question 10

Drag and drop each AAA function on the left to its correct description on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device. Authentication verifies identity, authorization determines allowed actions, and accounting tracks usage for auditing or billing.

Question 11

Which three statements about RADIUS and TACACS+ are true? (Choose three.)

Accepted Answer

RADIUS combines authentication and authorization in a single packet.. RADIUS and TACACS+ are both AAA protocols but differ in transport, encryption, and authorization granularity. RADIUS uses UDP and encrypts only the password; TACACS+ uses TCP and encrypts the entire packet. TACACS+ supports per-command authorization, while RADIUS does not. Both can be used for device administration, but RADIUS is more common for network access.

Answer

RADIUS encrypts the entire packet payload for all attributes.

Answer

RADIUS supports per-command authorization for shell sessions.

Question 12

Which two statements about YANG data models and their role in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG is a data modeling language used to define the structure of configuration and operational state data.. YANG models define the structure and constraints of data that can be streamed via telemetry. Native models are vendor-specific, while OpenConfig models are vendor-neutral. IETF models are standards-based but not necessarily vendor-neutral. YANG is a data modeling language, not a transport protocol. Telemetry subscriptions reference YANG paths to specify which data to stream.

Answer

OpenConfig YANG models are vendor-specific and only supported on Cisco devices.

Answer

IETF YANG models are the only models that can be used for model-driven telemetry subscriptions.

Answer

YANG is a transport protocol used to stream telemetry data from network devices to collectors.

Question 13

Which three statements about configuring AAA on Cisco IOS devices are true? (Choose three.)

Accepted Answer

The aaa new-model command enables AAA services on the device.. The correct answers cover common AAA configuration steps. Option A is correct because the aaa new-model command enables AAA on a Cisco IOS device. Option C is correct because the radius-server host command specifies the RADIUS server IP and shared secret. Option E is correct because the aaa authentication login command defines a method list for login authentication. Option B is wrong because the aaa new-model command does not disable local authentication; it enables AAA. Option D is wrong because the tacacs-server host command is used for TACACS+, not RADIUS.

Answer

The aaa new-model command disables local authentication and forces the use of an external server.

Answer

The tacacs-server host command is used to specify the IP address and shared secret for a RADIUS server.

Question 14

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream BGP route updates to a collector using gRPC dial-out. The engineer wants to ensure that the telemetry data is encrypted in transit. Which additional configuration is required to secure the gRPC telemetry stream?

Accepted Answer

Enable TLS on the gRPC connection by configuring a trustpoint and using the 'transport grpc tls' command. To configure TLS on the gRPC connection. gRPC supports TLS for encryption, and on IOS-XE, this requires configuring a trustpoint and enabling TLS under the telemetry receiver. The other options are incorrect because IPsec is not directly integrated with gRPC telemetry; SSH is used for NETCONF, not gRPC; and DTLS is used for UDP-based telemetry, not gRPC.

Answer

Configure IPsec between the router and the collector

Answer

Use SSH tunneling for the gRPC connection

Answer

Configure DTLS on the telemetry receiver

Question 15

Which three statements about the classification and marking tools in Cisco IOS are true? (Choose three.)

Accepted Answer

The trust boundary can be configured using the 'mls qos trust' command on a switch port to trust the CoS or DSCP value received from an attached device.. Classification identifies traffic based on various fields, while marking sets the QoS value. Trust boundaries determine where marking is honored. NBAR can perform deep packet inspection for classification. CoS is a Layer 2 marking in 802.1Q frames, while DSCP is Layer 3. MPLS uses EXP bits.

Answer

The 'set dscp' command in a policy map can be used to mark packets with a DSCP value, but only on egress interfaces.

Answer

MPLS EXP bits are a 3-bit field used for QoS in MPLS networks and are always directly mapped from the IP DSCP value without any configuration.