CCNP Practice Test 47 — 15 Questions

Question 1

Which three statements about path isolation using VRF are true? (Choose three.)

Accepted Answer

VRFs allow overlapping IP addresses between different virtual networks on the same router.. Path isolation with VRF ensures that traffic from different tenants or departments does not interfere. The correct answers highlight that VRFs provide separate forwarding tables, that overlapping IP addresses are possible, and that VRF-lite can be used without MPLS. The incorrect options claim that VRFs guarantee end-to-end encryption (they do not) or that VRF-lite requires a full mesh of trunks (it does not).

Answer

VRF-based path isolation ensures encryption of all data between VRFs.

Answer

VRF-lite requires a full mesh of trunk links between all routers in the network.

Question 2

A network engineer issues the following command on Router R2:

R2# show ip mroute 239.1.1.1
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
       L - Local, P - Pruned, R - RP-bit set, F - Register flag,
       T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet,
       X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
       U - URD, I - Received Source Specific Host Report,
       Z - Multicast Tunnel, z - MDT-data group session,
       Y - Joined MDT-data group, y - Sending to MDT-data group
Outgoing interface flags: H - Hardware switched, A - Assert winner
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 239.1.1.1), 00:03:45/00:02:15, RP 10.0.0.1, flags: S
  Incoming interface: GigabitEthernet0/0, RPF nbr 10.0.0.1
  Outgoing interface list:
    GigabitEthernet0/1, Forward/Sparse, 00:03:45/00:02:15

Based on this output, what can be concluded?

Accepted Answer

The RP for this group is 10.0.0.1.. The output shows a (*, G) entry for 239.1.1.1 with the flags field containing 'S', which indicates Sparse Mode. The line 'RP 10.0.0.1' explicitly identifies the Rendezvous Point for this group. Therefore, option B is correct because the RP is indeed 10.0.0.1.

Answer

The group is using PIM dense mode.

Answer

The multicast traffic is being hardware switched.

Answer

The group is a Bidir group.

Question 3

Drag and drop the steps of TACACS+ command authorization flow into the correct order, from first to last.

Accepted Answer

User enters command on device. TACACS+ command authorization starts with the user entering a command, which is sent to the TACACS+ server. The server checks the command against the user's authorization profile and responds with permit or deny. The device executes or blocks the command accordingly, and finally logs the result.

Question 4

An engineer retrieves telemetry data from a Cisco IOS-XE device using RESTCONF and receives the following response:

```json
{
  "ietf-interfaces:interfaces": {
    "interface": [
      {
        "name": "GigabitEthernet1",
        "type": "iana-if-type:ethernetCsmacd",
        "enabled": true,
        "ipv4": {
          "address": [
            {
              "ip": "192.168.1.1",
              "netmask": "255.255.255.0"
            }
          ]
        }
      }
    ]
  }
}
```

What is the correct way to access the IP address of the interface using Python?

Accepted Answer

data['ietf-interfaces:interfaces']['interface'][0]['ipv4']['address'][0]['ip']. The JSON response is nested. To access the IP address, you need to navigate through the dictionary: data['ietf-interfaces:interfaces']['interface'][0]['ipv4']['address'][0]['ip']. This returns '192.168.1.1'.

Answer

data['interface'][0]['ipv4']['address']['ip']

Answer

data['interfaces']['interface']['ipv4']['address']['ip']

Answer

data['ietf-interfaces:interfaces']['interface']['ipv4']['address'][0]['ip']

Question 5

Drag and drop each AAA method list type on the left to its correct fallback order (from first to last) on the right.

Accepted Answer

Default login authentication: local, line. The default method list for login authentication tries local first, then fallback to line password. The default for enable authentication uses enable password, then none. The default for PPP authentication uses local, then none. The default for command authorization uses local, then if-authenticated. The default for exec authorization uses local, then none.

Question 6

Drag and drop the steps of ISE RADIUS policy evaluation order into the correct order, from first to last.

Accepted Answer

ISE receives RADIUS Access-Request. Cisco ISE evaluates RADIUS policies in a specific order: first it checks authentication policies, then authorization policies (including exception policies), and finally applies the matched authorization profile. If no match, the default deny policy applies.

Question 7

Drag and drop each telemetry protocol on the left to its matching transport on the right.

Accepted Answer

gRPC: HTTP/2. gRPC uses HTTP/2, gNMI uses gRPC, NETCONF uses SSH, RESTCONF uses HTTPS, and HTTP is not a standard telemetry transport.

Question 8

An engineer creates an Ansible playbook to configure model-driven telemetry on a Cisco IOS-XE device:

```yaml
---
- name: Configure MDT subscription
  hosts: ios_xe
  gather_facts: no
  tasks:
    - name: Configure telemetry receiver
      cisco.ios.ios_config:
        lines:
          - telemetry ietf subscription 101
          - receiver ip address 10.10.10.10 port 57500 protocol grpc-tcp
          - encoding encode-kvgpb
          - filter xpath /interfaces/interface/state/counters
          - update-policy periodic 5000
```

What is the problem with this playbook?

Accepted Answer

The playbook is missing the 'source-address' command under the receiver.. The telemetry subscription configuration is missing the 'source-address' command under the receiver. Without specifying a source IP, the device may not send telemetry data if the management interface is not the correct source. Additionally, the 'update-policy' command should be 'update-policy periodic 5000' but the correct syntax is 'update-policy periodic 5000' under the subscription, not under the receiver. However, the most critical issue is that the 'telemetry ietf subscription' configuration requires a 'source-address' to specify the source IP for the telemetry stream.

Answer

The 'encoding encode-kvgpb' should be 'encoding encode-json'.

Answer

The 'update-policy periodic 5000' should be 'update-policy periodic 5000 milliseconds'.

Answer

The 'filter xpath' path is invalid for IOS-XE.

Question 9

Drag and drop the steps of 4G/LTE WAN failover with IP SLA tracking into the correct order, from first to last.

Accepted Answer

Configure IP SLA probe to monitor primary WAN. For 4G/LTE WAN failover using IP SLA, first an IP SLA probe is configured to monitor the primary WAN link, then the probe is associated with a tracking object, a backup static route with a higher metric is configured for the LTE interface, the primary route is removed when the tracking object goes down, and finally traffic is rerouted through the LTE interface. The correct order is: configure IP SLA probe to monitor primary WAN, associate probe with tracking object, configure backup static route with higher metric for LTE, remove primary route when tracking object goes down, reroute traffic through LTE interface.

Question 10

Drag and drop each WAN technology on the left to its matching OSI layer on the right.

Accepted Answer

MPLS: Layer 2.5. MPLS operates at Layer 2.5 (between Layer 2 and Layer 3). Metro Ethernet is a Layer 2 technology. SD-WAN is a Layer 3 overlay technology. DMVPN is a Layer 3 VPN technology.

Question 11

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream CPU and memory statistics to a collector. The engineer wants to use the YANG model 'Cisco-IOS-XE-process-cpu-oper' and 'Cisco-IOS-XE-memory-oper'. After configuring the telemetry subscription, the engineer notices that no data is being received at the collector. The collector is reachable and the gRPC dial-out is configured correctly. What is the most likely cause of the issue?

Accepted Answer

The telemetry subscription is missing the 'source-interface' configuration. That the YANG models are operational data models and require the 'source-address' to be specified under the telemetry receiver, or the subscription must be for operational data. Actually, the most likely cause is that the engineer did not include the 'source-interface' configuration under the telemetry subscription, which is required for dial-out telemetry to ensure the router uses the correct IP address. The other options are incorrect because the collector is reachable, so firewall is not the issue; YANG models are correct; and gRPC is supported.

Answer

The YANG models specified are not supported on IOS-XE

Answer

The collector is blocking UDP traffic from the router

Answer

The engineer must enable 'ip http secure-server' for telemetry to work

Question 12

Drag and drop each TACACS+ packet type on the left to its correct function on the right.

Accepted Answer

START: Initiates an authentication session from the client to the server. TACACS+ uses START to initiate authentication, REPLY to respond with prompts or success/failure, CONTINUE to send user responses, and also has special types for authorization and accounting.

Question 13

A network engineer is implementing model-driven telemetry on a Cisco Nexus 9000 switch to monitor VLAN and STP changes. The engineer wants to use the native telemetry protocol with UDP as the transport. After configuring the telemetry subscription with the 'destination-group' and 'sensor-group', the engineer notices that the collector is not receiving any data. The collector is reachable and the UDP port is open. What is the most likely missing configuration?

Accepted Answer

The engineer did not create a 'policy' that binds the sensor-group and destination-group. That the engineer must configure a 'policy' that associates the sensor-group with the destination-group and commits the configuration. On Nexus switches, model-driven telemetry requires a policy to bind the sensor and destination groups. The other options are incorrect because the source-interface is optional; the YANG models are correct; and the encoding is not the issue.

Answer

The engineer forgot to configure a 'source-interface' under the destination-group

Answer

The YANG models for VLAN and STP are not supported in the native telemetry protocol

Answer

The engineer used GPB encoding instead of JSON, and the collector only accepts JSON

Question 14

Which two statements about local AAA and fallback methods are true? (Choose two.)

Accepted Answer

Local AAA authentication uses the username and password configured in the running configuration.. Local AAA uses the device's local database for authentication. Fallback methods define the order of servers to try. If all servers are unreachable, the local database can be used as a backup. The 'aaa authentication login default local' command uses the local database only. The 'aaa new-model' command enables AAA globally.

Answer

The 'aaa authentication login default local' command configures the device to use a RADIUS server first, then fall back to local.

Answer

The 'aaa new-model' command is required only when using TACACS+ servers.

Answer

Fallback to local authentication occurs only if all remote servers explicitly reject the authentication request.

Question 15

A large enterprise is redesigning its campus network to support 5000 users across three buildings. The design must provide high availability and fast convergence in case of a link failure. The network engineer is considering using Spanning Tree Protocol (STP) in the access layer. What is the primary design concern with using STP in this scenario?

Accepted Answer

STP will cause slow convergence and inefficient use of redundant links.. STP (802.1D) converges slowly, typically taking 30-50 seconds (listening + learning states) after a topology change. In a large campus network with 5000 users, this delay causes unacceptable downtime. Additionally, STP blocks redundant links to prevent loops, wasting bandwidth that could be used for load balancing. Modern alternatives like Rapid PVST+ (802.1w) or MST (802.1s) offer sub-second convergence, making classic STP a poor choice for high-availability designs.

Answer

STP requires all switches to be in the same VLAN to function correctly.

Answer

STP cannot be used with 5000 users due to MAC address table limitations.

Answer

STP will cause broadcast storms in a three-building design.