CCNP Practice Test 48 — 15 Questions

Question 1

Drag and drop each VRF component on the left to its matching function on the right.

Accepted Answer

Route Distinguisher (RD): Makes an IPv4 prefix globally unique across the MPLS VPN network. The Route Distinguisher (RD) makes a customer prefix globally unique; the Route Target (RT) controls import/export of routes between VRFs; the RIB stores routing information for the VRF; the VRF table holds the IP routing table for the VRF; the VRF label is used for MPLS forwarding.

Question 2

Examine the following Python script snippet that uses netmiko to configure a Cisco IOS-XE device:

```python
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
}

connection = ConnectHandler(**device)
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()
```

What is the primary purpose of this script?

Accepted Answer

It retrieves and prints the output of 'show ip interface brief'.. The script uses netmiko's `send_command()` method, which sends a show command to the device and returns the output. It does not include any configuration commands or file transfer operations. Therefore, its primary purpose is to retrieve and print the output of 'show ip interface brief'.

Answer

It configures an IP address on an interface.

Answer

It saves the running configuration to startup configuration.

Answer

It backs up the configuration to a TFTP server.

Question 3

Drag and drop the steps of NFV MANO (VNFM/NFVO/VIM) interaction flow into the correct order, from first to last.

Accepted Answer

NFVO receives service request from OSS/BSS. The MANO interaction flow starts with the NFVO receiving a service request from OSS/BSS. The NFVO then requests the VNFM to instantiate a VNF. The VNFM requests the VIM to allocate resources. The VIM allocates resources and returns resource information to the VNFM. Finally, the VNFM instantiates the VNF and reports status to the NFVO.

Question 4

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

Accepted Answer

The interface needs the 'authentication guest-vlan ' command to specify the VLAN for non-802.1X devices.. The 'authentication guest-vlan ' command is missing. This command explicitly defines the VLAN to which the port will assign devices that fail 802.1X authentication or are non-802.1X-capable. Without it, the switch has no configured fallback VLAN, so the port remains in the unauthorized state even with 'authentication port-control auto' and 'authentication host-mode multi-host' configured.

Answer

The switch must have 'aaa authentication dot1x default group radius' configured globally.

Answer

The 'authentication host-mode multi-host' command should be replaced with 'authentication host-mode multi-domain' to support guest VLAN.

Answer

The port must be configured as a trunk port to allow the guest VLAN.

Question 5

Drag and drop the steps of adding a new VLAN to a trunk link into the correct order, from first to last.

Accepted Answer

Create VLAN 100 in global configuration. First, create the VLAN globally on the switch. Then, verify the VLAN exists. Next, ensure the trunk allows that VLAN. After that, check the trunk's allowed VLAN list. Finally, test connectivity for hosts in the new VLAN.

Question 6

Drag and drop the steps for the EIGRP neighbor discovery process in the correct order.

Accepted Answer

Step 1: Send Hello packets. Step 2: Discover neighbors. Step 3: Exchange routing updates. Step 4: Maintain neighbor state.. EIGRP uses Hello packets to discover neighbors, then exchanges routes and maintains state.

Answer

Step 1: Exchange routing updates. Step 2: Send Hello packets. Step 3: Discover neighbors. Step 4: Maintain neighbor state.

Answer

Step 1: Discover neighbors. Step 2: Send Hello packets. Step 3: Exchange routing updates. Step 4: Maintain neighbor state.

Answer

Step 1: Send Hello packets. Step 2: Exchange routing updates. Step 3: Discover neighbors. Step 4: Maintain neighbor state.

Question 7

Drag and drop each DSCP PHB on the left to its matching queue treatment on the right.

Accepted Answer

EF: Expedited forwarding, strict priority queuing, low delay and jitter. EF PHB (DSCP 46) is for low-loss, low-latency traffic; AF PHBs (AF1x-AF4x) provide assured forwarding with four classes and three drop precedences; CS PHBs (CS1-CS7) are backward-compatible with IP precedence; BE (DSCP 0) is best-effort; DF (DSCP 0) is the default PHB.

Question 8

What is the default EIGRP hello interval on a point-to-point serial link?

Accepted Answer

5 seconds. The default EIGRP hello interval on a point-to-point serial link is 5 seconds. EIGRP uses different hello intervals depending on the media type: for high-speed broadcast links (e.g., Ethernet) and point-to-point links, the default is 5 seconds; for multipoint non-broadcast links (e.g., Frame Relay), the default is 60 seconds.

Answer

10 seconds

Answer

30 seconds

Answer

60 seconds

Question 9

Drag and drop each MQC command on the left to its matching configuration level on the right.

Accepted Answer

class-map: Defines a traffic class using match criteria. class-map defines traffic classes; policy-map associates actions with classes; service-policy applies the policy to an interface or globally.

Question 10

An engineer is writing an Ansible playbook to configure OSPF on a fleet of Cisco Nexus 9000 switches. The playbook uses the nxos_ospf module. When executed, the playbook reports 'changed' for every switch, even on subsequent runs when no configuration changes are made. The engineer wants to achieve idempotent behavior. What is the most likely cause of the non-idempotent results?

Accepted Answer

The playbook does not specify all OSPF parameters, such as 'router-id', causing the module to detect a difference with the running configuration.. The nxos_ospf module requires all mandatory OSPF parameters to be explicitly defined in the playbook to achieve idempotency. If parameters such as 'router-id' are omitted, the module compares the current running configuration (which may have a default or previously configured router-id) against the playbook's parameters. Since the playbook does not specify the router-id, the module interprets this as a missing parameter and attempts to reconfigure OSPF, resulting in a 'changed' status on every run. Specifying all OSPF parameters ensures the module can accurately detect that the desired state matches the current state.

Answer

The Ansible control node is using an outdated version of the nxos_ospf module that does not support idempotency.

Answer

The switches have different NX-OS versions, causing the module to behave inconsistently.

Answer

The engineer forgot to use the '--check' flag to verify idempotency.

Question 11

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reset: 10

Session Id: 5
  Unique Id: 5
  User Name: admin
  IP Address: 192.168.1.100
  Idle Time: 0:00:05
  Timeout: 0:10:00
  Type: SSH
  Method: local

Session Id: 6
  Unique Id: 6
  User Name: neteng
  IP Address: 10.0.0.2
  Idle Time: 0:02:30
  Timeout: 0:10:00
  Type: SSH
  Method: tacacs+

Based on this output, what can be concluded?

Accepted Answer

Session 5 is authenticated locally.. The output shows that Session 5 has 'Method: local', which means the user 'admin' was authenticated using the local database on the router, not an external AAA server. Session 6 uses 'Method: tacacs+', confirming TACACS+ authentication for that session. Therefore, only Session 5 is authenticated locally, making option B correct.

Answer

Both sessions are authenticated using TACACS+.

Answer

Session 6 will be disconnected due to idle timeout.

Answer

Both sessions are using RADIUS for authentication.

Question 12

Which component in Cisco SD-WAN is responsible for orchestrating the overlay network, including authentication and NAT traversal?

Accepted Answer

vBond orchestrator. The vBond orchestrator is responsible for the initial authentication of all SD-WAN components (vSmart, vManage, vEdge/cEdge) into the overlay network. It also performs NAT traversal by discovering and distributing the public IP addresses and port numbers of vEdge routers behind NAT, enabling secure DTLS/TLS connections between them. Without vBond, new devices cannot securely join the fabric or establish control-plane connectivity.

Answer

vSmart controller

Answer

vManage NMS

Answer

vEdge router

Question 13

An engineer is designing a redundant Layer 2 network with multiple VLANs. The network uses Rapid PVST+ for STP. The engineer wants to ensure that different VLANs have different root bridges to optimize traffic flow. The distribution switches are Cisco Catalyst 9300s. The engineer has configured one distribution switch as the root for VLANs 10 and 20, and the other as the root for VLANs 30 and 40. However, after implementation, the engineer notices that all VLANs have the same root bridge. What is the most likely cause?

Accepted Answer

The engineer used the 'spanning-tree root primary' command without specifying the VLAN, which sets the priority for all VLANs.. The 'spanning-tree root primary' command without specifying a VLAN sets the bridge priority to 24576 for all VLANs on the switch, making it the root for every VLAN. Since the engineer intended different root bridges per VLAN, this command overrides any per-VLAN priority settings and causes all VLANs to elect the same root bridge.

Answer

The engineer enabled BPDU guard on all access ports, which prevents the switch from receiving superior BPDUs.

Answer

The engineer enabled PortFast on all trunk ports, which causes the switch to ignore BPDUs and become root.

Answer

The engineer enabled UplinkFast, which forces the switch to become the root bridge for all VLANs.

Question 14

Drag and drop each queuing mechanism on the left to its matching use case on the right.

Accepted Answer

PQ: Strict priority queuing for delay-sensitive traffic. PQ gives strict priority to one queue, CBWFQ guarantees bandwidth to classes, LLQ combines strict priority with CBWFQ, WFQ provides fair queuing for flows, and CBWFQ is often used for data classes.

Question 15

A campus network architect is redesigning the LAN to support high availability and east-west traffic growth. The current design uses a traditional three-tier hierarchy with a collapsed core. The architect must choose a new design that provides predictable latency, simple scalability, and efficient use of uplinks. Which design should the architect select?

Accepted Answer

Leaf-spine design with all leaf switches connected to all spine switches.. The leaf-spine design (option B) provides predictable latency because every leaf switch is exactly one hop away from any other leaf switch via the spine, regardless of traffic path. This design also scales simply by adding more leaf or spine switches without reconfiguring existing connections, and it uses uplinks efficiently through equal-cost multipath (ECMP) load balancing, making it ideal for east-west traffic growth in a modern data center or campus LAN.

Answer

Collapsed core design with redundant core switches and distribution layers.

Answer

Mesh design where every switch connects to every other switch.

Answer

Traditional three-tier design with access, distribution, and core layers.