CCNP Practice Test 48 — 15 Questions

Question 1

What is the maximum number of WLANs that can be configured on a single AP in a Cisco 9800 WLC deployment?

Accepted Answer

16. In a Cisco 9800 WLC deployment, each AP supports up to 16 WLANs (SSIDs). This is a hard limit enforced by the controller, regardless of the AP model. The 9800 WLC maps WLANs to APs via policy profiles, and the AP can serve a maximum of 16 unique SSIDs simultaneously.

Answer

8

Answer

32

Answer

64

Question 2

Drag and drop each MPLS VPN role on the left to its matching description on the right.

Accepted Answer

CE: Customer edge router that connects to the provider network. CE routers connect customer sites to the provider; PE routers label customer routes and exchange VPNv4 prefixes via MP-BGP; P routers perform label switching without storing customer routes; ASBR routers connect different MPLS domains; RRs propagate VPN routes within an AS.

Question 3

A network engineer issues the following command on Router R7:

R7# show ip pim tunnel
Tunnel1:
  Type: PIM Encap
  Source: 10.0.0.7, Destination: 10.0.0.8
  Status: up

Based on this output, what can be concluded?

Accepted Answer

This tunnel is used for PIM register encapsulation to the RP.. The 'show ip pim tunnel' output displays a PIM Encap tunnel, which is automatically created by Cisco IOS to encapsulate multicast packets from a source that is outside the Rendezvous Point (RP) tree. The tunnel sends these encapsulated packets to the RP (10.0.0.8) using unicast PIM register messages, making option A correct.

Answer

This tunnel is used for MDT data group forwarding.

Answer

This tunnel is used for BSR messages.

Answer

This tunnel is used for Auto-RP announcements.

Question 4

Consider the following TrustSec configuration on a Cisco switch:

cts role-based enforcement
interface GigabitEthernet1/0/3
 cts manual
 sap pmk 0123456789ABCDEF mode-list both

What is the purpose of this configuration?

Accepted Answer

It enables CTS inline tagging with a pre-shared key for SGT exchange between peers.. The `cts manual` command with `sap pmk` and `mode-list both` configures Cisco TrustSec (CTS) inline tagging on the interface. This enables the exchange of Security Group Tags (SGTs) between directly connected peers using a pre-shared key (PSK) for authentication and encryption of the SGT metadata, without requiring 802.1X or SXP. The `mode-list both` specifies that both Layer 2 (802.1AE MACsec) and Layer 3 (SGT encapsulation) protection are used.

Answer

It enables 802.1X authentication with a pre-shared key.

Answer

It configures the interface to use SGT (Security Group Tag) propagation via SXP.

Answer

It enables dynamic VLAN assignment based on user authentication.

Question 5

Drag and drop each MP-BGP address family on the left to its matching use case on the right.

Accepted Answer

VPNv4 unicast: Carries MPLS Layer 3 VPN routes with route distinguisher and route target. The VPNv4 unicast address family carries MPLS VPN routes with RD and RT; IPv4 unicast carries standard IPv4 routes; IPv6 unicast carries IPv6 routes; VPNv6 unicast carries IPv6 MPLS VPN routes; L2VPN address family carries Layer 2 VPN information like VPLS.

Question 6

Drag and drop each CPU feature on the left to its matching virtualization purpose on the right.

Accepted Answer

VT-x: Intel hardware virtualization support. VT-x enables hardware-assisted virtualization for Intel CPUs. EPT (Extended Page Tables) reduces memory overhead by handling guest page tables in hardware. SR-IOV allows a physical NIC to appear as multiple virtual functions. VT-d provides direct I/O access for VMs. AMD-V is AMD’s equivalent of VT-x.

Question 7

Drag and drop the steps of vSphere VM snapshot creation and revert steps into the correct order, from first to last.

Accepted Answer

Take snapshot of running VM. The correct order starts with taking the snapshot and ends with reverting to it. First, the snapshot is taken while the VM is running. Then, changes are made to the VM. Next, the snapshot is reverted to restore the previous state. After that, the snapshot is deleted to free storage. Finally, the VM continues running without the snapshot.

Question 8

Given this configuration:

aaa new-model
aaa authentication login default group radius
aaa authorization exec default group radius
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.1 auth-port 1645 acct-port 1646 key radiuskey
radius-server host 192.168.1.2 auth-port 1645 acct-port 1646 key radiuskey

Which statement is true about the RADIUS server ports?

Accepted Answer

The RADIUS authentication port is 1645 and accounting port is 1646.. The configuration explicitly sets the RADIUS authentication port to 1645 and the accounting port to 1646 using the `auth-port 1645` and `acct-port 1646` keywords in the `radius-server host` commands. These are the legacy RADIUS ports (as defined in RFC 2138/2139), which Cisco devices support by default when ports are not specified, but here they are explicitly configured.

Answer

The RADIUS authentication port is 1812 and accounting port is 1813.

Answer

The RADIUS authentication port is 1646 and accounting port is 1645.

Answer

The RADIUS ports are not configurable; this command will be rejected.

Question 9

A network engineer checks the AAA server status:

R1# show aaa servers

RADIUS: id 1, priority 1, host 10.1.1.10, auth-port 1812, acct-port 1813
  State: current DEAD, duration 0s, previous duration 500s
  Dead: total 1, retransmit 3
RADIUS: id 2, priority 2, host 10.1.1.20, auth-port 1812, acct-port 1813
  State: current UP, duration 200s, previous duration 0s
  Dead: total 0, retransmit 0

Based on this output, what can be concluded?

Accepted Answer

The backup server is currently handling authentication.. The output shows that the primary RADIUS server (10.1.1.10) is in a DEAD state, while the backup server (10.1.1.20) is UP and has been handling authentication for 200 seconds. This confirms that the backup server is currently processing AAA requests, making option B correct.

Answer

Both RADIUS servers are operational.

Answer

The primary server has never failed before.

Answer

TACACS+ is also configured on these servers.

Question 10

Given the following Ansible playbook snippet:
---
- name: Configure VLAN
  hosts: switches
  gather_facts: no
  tasks:
    - name: Create VLAN 100
      ios_vlan:
        vlan_id: 100
        name: Engineering
        state: present
Which statement is true about this playbook?

Accepted Answer

It creates VLAN 100 with name Engineering if it does not exist.. The `ios_vlan` module with `state: present` ensures the VLAN exists with the specified parameters. Since `gather_facts: no` is set, the playbook does not gather device facts but still performs the configuration task. The correct answer is A because the module will create VLAN 100 with the name 'Engineering' if it does not already exist on the switch.

Answer

It only checks if VLAN 100 exists and reports its status.

Answer

It deletes VLAN 100 if it exists.

Answer

It fails because 'name' is not a valid parameter for ios_vlan.

Question 11

Given the following configuration:

interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip pim sparse-mode
 ip igmp version 3

What is the purpose of the 'ip igmp version 3' command?

Accepted Answer

It enables IGMP version 3, which allows hosts to join multicast groups from specific sources, supporting SSM.. The 'ip igmp version 3' command enables IGMPv3 on the interface, which supports Source-Specific Multicast (SSM) by allowing hosts to specify both the multicast group and the source address in their membership reports. This is essential for SSM operation with PIM sparse-mode, as IGMPv3 provides the source filtering capability that IGMPv2 lacks.

Answer

It enables IGMP version 3, which increases the number of multicast groups supported to 1024.

Answer

It enables IGMP version 3, which is required for PIM dense-mode operation.

Answer

It enables IGMP version 3, which disables IGMP snooping on the interface.

Question 12

Given the following WLAN configuration on a Cisco 9800 WLC:

wlan test-wlan 1 test-ssid
 client vlan VLAN10
 no security wpa
 no security wpa2
 security wpa3
 no security ft

What is a potential issue with this configuration?

Accepted Answer

The WLAN is missing a security key management (AKM) configuration.. The configuration enables WPA3 but omits a security key management (AKM) policy. WPA3 requires an AKM suite (e.g., SAE for personal or 802.1X for enterprise) to negotiate authentication and key derivation. Without an AKM configured, the WLAN will fail to enable or will not allow clients to associate, as the WLC cannot determine the key management protocol.

Answer

The client VLAN is incorrectly configured.

Answer

WPA3 is not supported on this platform.

Answer

The SSID name is too long.

Question 13

Drag and drop the steps of NUMA-aware VM placement process into the correct order, from first to last.

Accepted Answer

Enable NUMA in the host BIOS. The order starts with enabling NUMA in the BIOS, then configuring the hypervisor, creating the VM with NUMA settings, and finally verifying placement and performance.

Question 14

What is the default value of the BGP 'weight' attribute for routes learned from a neighbor?

Accepted Answer

0. The BGP 'weight' attribute is a Cisco-proprietary attribute that is locally significant only to the router on which it is configured. By default, routes learned from a BGP neighbor have a weight of 0, while routes originated locally on the router (e.g., via network or aggregate-address commands) have a weight of 32768. Weight is the highest priority BGP attribute in the path selection process, so a route with a higher weight is preferred over one with a lower weight.

Answer

100

Answer

32768

Answer

1

Question 15

A network engineer runs the following command on Router R6:

R6# show ip pim rp 239.3.3.3
RP 10.0.0.4

Info source: 10.0.0.4, via bootstrap, priority 192, holdtime 150, expires in 00:02:30

Based on this output, what can be concluded?

Accepted Answer

The RP was learned via BSR.. The output shows 'via bootstrap', which indicates the RP was learned through the Bootstrap Router (BSR) mechanism. BSR is a dynamic RP discovery protocol that uses a bootstrap router to distribute RP information throughout the PIM domain, making option B correct.

Answer

The RP was learned via Auto-RP.

Answer

The RP was statically configured.

Answer

The RP is 10.0.0.5.