CCNP Practice Test 47 — 15 Questions

Question 1

A network architect is designing QoS for a Cisco SD-WAN deployment that uses a mix of MPLS and broadband Internet transports. The design must ensure that interactive video traffic is not delayed by large file transfers, even when the Internet link experiences congestion. Which SD-WAN policy type should the architect use to enforce this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a localized QoS policy on the WAN edge routers that matches video traffic and applies a priority queue.. A localized QoS policy on the WAN edge router can classify interactive video traffic and place it into a priority queue, ensuring low-latency treatment even when the Internet link is congested. This policy operates locally on the router, directly controlling queuing and scheduling behavior on the specific interface, which is essential for protecting real-time traffic from bulk file transfers.

Answer

Use a centralized data policy to steer video traffic to the MPLS link only.

Answer

Implement a centralized application-aware routing policy to prefer the MPLS link for video.

Answer

Configure a VPN membership policy to isolate video traffic in a separate VPN.

Question 2

Which three statements about Multiple Spanning Tree Protocol (MSTP) are true? (Choose three.)

Accepted Answer

MSTP allows multiple VLANs to be grouped into a single spanning-tree instance, reducing CPU and memory usage.. MSTP (IEEE 802.1s) allows multiple VLANs to be mapped to a single spanning-tree instance (MST instance), reducing the number of STP instances needed. It uses an Internal Spanning Tree (IST) instance (instance 0) that always runs and carries BPDUs for the region. Switches in the same MST region must have identical VLAN-to-instance mappings, revision number, and region name. MSTP interoperates with Rapid PVST+ at region boundaries by using PVST simulation mode. MSTP does not require a separate root bridge for each VLAN; instead, each MST instance has its own root bridge.

Answer

MSTP automatically load-balances traffic across all available uplinks without any configuration.

Answer

MSTP requires a separate root bridge to be elected for each VLAN in the network.

Question 3

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/0(P)    Gi0/1(P)    Gi0/2(s)    Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

Interface Gi0/2 is suspended due to a configuration mismatch.. The output shows Gi0/2 with an '(s)' flag, which means 'suspended'. In LACP EtherChannel, a port is suspended when there is a configuration mismatch (e.g., different speed, duplex, VLAN settings, or trunk allowed VLANs) that prevents it from being bundled. The '(D)' flag on Gi0/3 indicates the port is down, not suspended.

Answer

Port-channel 1 is operating as a Layer 3 interface.

Answer

Interface Gi0/3 is in standby mode waiting to join the bundle.

Answer

All four interfaces are actively forwarding traffic in the EtherChannel.

Question 4

Which three statements about queuing and congestion avoidance in a QoS architecture are true? (Choose three.)

Accepted Answer

Class-Based Weighted Fair Queuing (CBWFQ) assigns a weight to each class and guarantees a minimum bandwidth during congestion.. Queuing manages packets when output is congested, using algorithms like CBWFQ and LLQ. Congestion avoidance techniques like WRED proactively drop packets to prevent tail drops. LLQ provides strict priority queuing for delay-sensitive traffic. WRED can be configured per class in a policy map.

Answer

Weighted Random Early Detection (WRED) can be used only with TCP traffic and drops packets randomly based on the average queue depth.

Answer

Tail drop is a congestion avoidance mechanism that drops packets from the front of the queue when it is full.

Question 5

A network engineer is configuring a zone-based firewall (ZBF) on a Cisco router to allow traffic from the inside zone to the outside zone while blocking traffic from outside to inside. The engineer creates zones, assigns interfaces, and configures a policy-map with a class-map that matches all traffic from inside to outside. The engineer applies the policy to the zone-pair inside-to-outside. However, traffic from inside to outside is being dropped. What is the most likely reason?

Accepted Answer

The policy-map does not include an 'inspect' or 'pass' action for the matched traffic.. In a zone-based firewall (ZBF), a policy-map applied to a zone-pair defines the actions to be taken on traffic flowing between the two zones. By default, traffic between zones is denied unless explicitly permitted. The class-map matches traffic from inside to outside, but without an 'inspect' or 'pass' action in the policy-map, the matched traffic is implicitly dropped. The 'inspect' action enables stateful inspection and allows return traffic, while 'pass' permits traffic without stateful tracking; omitting either results in a deny.

Answer

The zone-pair should be configured as outside-to-inside instead.

Answer

The class-map must also match return traffic for the firewall to allow the session.

Answer

The policy-map is applied to the wrong zone-pair; it should be applied to the inside zone.

Question 6

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 mpls ip
 mpls label protocol tdp
!
router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
!
router ldp
 interface GigabitEthernet0/1
!
Which statement about this configuration is true?

Accepted Answer

The interface will use TDP for label distribution, ignoring the LDP configuration under router ldp.. The interface-level command `mpls label protocol tdp` explicitly sets TDP (Tag Distribution Protocol) for that interface. When both an interface-specific `mpls label protocol` command and a global `router ldp` configuration exist, the interface-level command takes precedence. Therefore, GigabitEthernet0/1 will use TDP for label distribution, and the LDP configuration under `router ldp` is effectively ignored for that interface.

Answer

The router will use LDP because the global configuration overrides the interface command.

Answer

Both TDP and LDP will be used simultaneously on the interface.

Answer

The configuration will fail because TDP is not supported on this platform.

Question 7

A network administrator runs the following command on a switch:

Switch# show aaa method-list

Method List Name: default
  Type: authentication
  Group: radius
  Group: local
Method List Name: console
  Type: authentication
  Group: local
Method List Name: default
  Type: authorization
  Group: tacacs+
  Group: local

Based on this output, what can be concluded?

Accepted Answer

RADIUS is the primary authentication method for default login.. The output shows that the default method list for authentication uses RADIUS as the first method and local as the fallback. Since 'default' applies to all lines and services that do not have a named list, RADIUS is the primary authentication method for default login. Option C correctly identifies this primary role of RADIUS.

Answer

Authorization for all users uses RADIUS.

Answer

Console authentication uses RADIUS as fallback.

Answer

TACACS+ is used for authentication.

Question 8

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.252
 ip ospf network point-to-multipoint
 ip ospf hello-interval 30
!
router ospf 1
 network 10.0.0.0 0.0.0.3 area 0

What is the effect of this configuration?

Accepted Answer

OSPF will use a 30-second hello interval and form adjacencies with all neighbors without DR/BDR election.. The configuration sets the OSPF network type to point-to-multipoint, which by default uses a 30-second hello interval and does not perform DR/BDR election. The explicit 'ip ospf hello-interval 30' command confirms this interval, overriding any default. Therefore, OSPF will form adjacencies with all neighbors without electing a DR/BDR.

Answer

OSPF will use a 10-second hello interval and elect a DR/BDR.

Answer

OSPF will use a 30-second hello interval and elect a DR/BDR.

Answer

OSPF will use a 10-second hello interval and form adjacencies with all neighbors without DR/BDR.

Question 9

Drag and drop the steps of EtherChannel troubleshooting and verification into the correct order, from first to last.

Accepted Answer

Check physical link status and errors. Troubleshooting begins with checking physical layer, then verifying protocol negotiation, inspecting bundle state, checking load balancing, and finally reviewing logs.

Question 10

A network engineer runs the following command on Router R7:

R7# show vrf brief
  Name                             Default RD            Protocols   Interfaces
  Mgmt-intf                        <not set>             ipv4,ipv6    GigabitEthernet0/0
  CUSTOMER-A                       65001:100             ipv4         GigabitEthernet0/1.10
  CUSTOMER-B                       65001:200             ipv4         GigabitEthernet0/1.20

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-B is associated with subinterface GigabitEthernet0/1.20.. The 'show vrf brief' output explicitly lists GigabitEthernet0/1.20 under the Interfaces column for VRF CUSTOMER-B, confirming that this subinterface is associated with that VRF. VRFs use subinterfaces to segment traffic for different customers or tenants on the same physical link, and the output directly shows this mapping.

Answer

VRF CUSTOMER-A is using IPv6.

Answer

VRF Mgmt-intf has a route distinguisher set.

Answer

All VRFs are using the same route distinguisher.

Question 11

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor vrf CUSTOMER-C

Peer LDP Ident: 10.0.0.5:0; Local LDP Ident 10.0.0.4:0
	TCP connection: 10.0.0.5.646 - 10.0.0.4.646
	State: Oper; Msgs sent/rcvd: 500/500; Downstream
	Up time: 02:30:00
	LDP discovery sources:
	  GigabitEthernet0/0.300, Src IP addr: 10.0.1.2
	        hello sent/rcvd: 1000/1000
	Addresses bound to peer LDP Ident:
	  10.0.1.2        10.0.2.2

Based on this output, what can be concluded?

Accepted Answer

The LDP session is operational with peer 10.0.0.5. The output shows 'State: Oper' and 'Up time: 02:30:00', which confirms the LDP session is fully operational. The peer LDP Ident is 10.0.0.5:0 and the local LDP Ident is 10.0.0.4:0, with a TCP connection established on port 646. This directly indicates that the LDP session with peer 10.0.0.5 is up and running.

Answer

LDP is not configured for VRF CUSTOMER-C

Answer

The LDP session is using TCP port 179

Answer

The peer is discovered via OSPF

Question 12

A network engineer checks AAA accounting on a router:

R1# show aaa accounting

Accounting method list 'default':
  Type: exec
  Start-stop: group radius
  Accounting records:
    Total started: 10
    Total stopped: 8
    Total failed: 2
    Last record: user 'admin', start time 00:01:00 UTC Mar 1 2023

Based on this output, what can be concluded?

Accepted Answer

Accounting is configured for EXEC sessions using RADIUS.. The output shows an accounting method list named 'default' for type 'exec' using 'group radius' with start-stop accounting. This confirms that accounting is configured for EXEC sessions (user logins) and that RADIUS is the protocol used to send accounting records. The 'Total started: 10' and 'Total stopped: 8' indicate some records were not successfully stopped, but the configuration itself is correctly identified.

Answer

All accounting records were successfully sent.

Answer

Accounting is performed using TACACS+.

Answer

No users have logged in since accounting was enabled.

Question 13

Examine the following AAA configuration snippet:

aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line con 0
 login authentication CONSOLE
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

Console login uses local authentication; VTY login uses local authentication; exec accounting is sent to TACACS+.. The configuration defines two AAA authentication login lists: 'default' and 'CONSOLE'. Both lists use the 'local' method, meaning they authenticate against the local user database. The 'aaa authorization exec default local' command enables local authorization for exec sessions, and 'aaa accounting exec default start-stop group tacacs+' sends accounting records for exec sessions to the TACACS+ server. The 'line con 0' applies the 'CONSOLE' list, and 'line vty 0 4' applies the 'default' list, so both use local authentication. Therefore, option A is correct.

Answer

Console login uses TACACS+ authentication; VTY login uses local authentication; exec accounting is disabled.

Answer

Both console and VTY login use TACACS+ authentication; exec accounting is sent to TACACS+.

Answer

Console login uses local authentication; VTY login uses TACACS+ authentication; accounting is not configured.

Question 14

Router R6 has the following OSPF configuration:

router ospf 1
 router-id 6.6.6.6
 network 192.168.0.0 0.0.255.255 area 0
 passive-interface default
 no passive-interface GigabitEthernet0/0
!
interface GigabitEthernet0/0
 ip address 192.168.1.6 255.255.255.0
 ip ospf 1 area 0

What is the effect of the 'passive-interface default' command?

Accepted Answer

Only GigabitEthernet0/0 is active; all other OSPF interfaces are passive.. The 'passive-interface default' command sets all OSPF interfaces to passive by default, meaning they will not send or receive OSPF hello packets and thus cannot form adjacencies. The subsequent 'no passive-interface GigabitEthernet0/0' overrides this for that specific interface, making it the only active OSPF interface. This matches option B.

Answer

All OSPF interfaces become passive, including GigabitEthernet0/0.

Answer

OSPF adjacencies are formed on all interfaces.

Answer

The 'passive-interface default' command is ignored because the 'network' command is used.

Question 15

Drag and drop each VRF component on the left to its matching function on the right.

Accepted Answer

Route Distinguisher (RD): Uniquely identifies a VRF to allow overlapping IPv4 prefixes. Route Distinguisher (RD) makes IPv4 prefixes unique across VRFs; Route Target (RT) controls import/export of routes; the VRF RIB stores routes learned within that VRF; the global RIB holds routes for the global routing table; the FIB is used for forwarding decisions.