CCNP Practice Exam 52 — 20 Questions

Question 1

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.. The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic. CoPP (Control Plane Policing) protects the switch's CPU by rate-limiting control plane traffic, including ICMP. When the policer rate is set too low, even legitimate ICMP echo requests from the monitoring server are dropped, causing intermittent reachability issues.

Answer

An ACL applied to the management interface is blocking ICMP from the monitoring server.

Answer

The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.

Answer

The switch's CPU is overloaded, causing CoPP to drop all packets.

Question 2

An engineer is troubleshooting a network where OSPF neighbors are stuck in the EXSTART state. What is the most likely cause?

Accepted Answer

MTU mismatch between the routers. The EXSTART state in OSPF indicates that routers have formed a bidirectional communication (2-Way state) and are now attempting to exchange Database Description (DBD) packets to negotiate the master/slave relationship and the initial sequence number. An MTU mismatch between the routers is the most common cause of neighbors being stuck in EXSTART because the router with the smaller MTU will drop DBD packets that exceed its interface MTU, preventing the exchange from progressing to the Loading state.

Answer

Dead timer mismatch

Answer

Authentication misconfiguration

Answer

Mismatched OSPF area IDs

Question 3

A network engineer is configuring a Cisco router to use TACACS+ for authentication and authorization of EXEC sessions. The engineer configures 'aaa new-model', 'aaa authentication login default group tacacs+ local', and 'aaa authorization exec default group tacacs+ local'. When a user tries to log in via SSH, the router prompts for username and password, but after entering correct credentials, the user is immediately disconnected. The TACACS+ server logs show that the authentication was successful. What is the most likely cause?

Accepted Answer

The TACACS+ server is not configured to authorize the user for EXEC access, so it sends a 'deny' response, causing the router to disconnect the user.. The TACACS+ authentication succeeded, but the user was disconnected immediately after login. This indicates that the authorization step failed. With 'aaa authorization exec default group tacacs+ local', the router sends an authorization request to the TACACS+ server for EXEC shell access. If the server responds with a 'deny' (or does not include the necessary service=shell attribute), the router denies the session and disconnects the user, even though authentication passed.

Answer

The 'aaa authorization exec' command should be 'aaa authorization commands 15' to allow the user to execute commands after login.

Answer

The router's SSH configuration is missing the 'ip ssh authentication-retries' command.

Answer

The 'local' fallback in the authorization command is overriding the TACACS+ response.

Question 4

Which statement about RSPAN is true?

Accepted Answer

RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.. RSPAN (Remote SPAN) uses a dedicated RSPAN VLAN to carry mirrored traffic from the source switch to one or more destination switches across a network. This allows monitoring of traffic on remote switches, unlike local SPAN which is confined to a single switch. The RSPAN VLAN must be configured on all intermediate switches and trunked appropriately to ensure the mirrored traffic reaches the destination.

Answer

RSPAN can only monitor traffic within the same switch.

Answer

RSPAN requires the use of ERSPAN encapsulation.

Answer

RSPAN destination ports must be in trunk mode.

Question 5

Examine the following configuration snippet on a Cisco IOS switch:

interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 50
 spanning-tree portfast

Which statement is true about this interface?

Accepted Answer

The interface will immediately forward traffic without any spanning-tree delay.. The `spanning-tree portfast` command on an access port configured with `switchport mode access` and `switchport access vlan 50` causes the interface to bypass the normal spanning-tree listening and learning states. This allows the port to transition directly to the forwarding state, enabling immediate traffic forwarding without the usual 30-second delay (15 seconds for listening, 15 seconds for learning) associated with Rapid Spanning Tree Protocol (RSTP) or the 50-second delay with classic STP (802.1D).

Answer

The interface will participate in trunking and forward multiple VLANs.

Answer

The interface will still go through listening and learning states before forwarding.

Answer

The interface will only forward traffic for VLAN 1.

Question 6

A company has a network with multiple VLANs connected via a Layer 3 switch acting as the gateway for all VLANs. The network uses Rapid PVST+ for spanning tree. Recently, the network team added a new access switch to VLAN 100. After the switch was connected, users in VLAN 100 experienced intermittent connectivity, and the Layer 3 switch logs show 'SPANTREE-2-ROOTGUARD_BLOCK' messages for the port connected to the new switch. The new switch is intended to provide additional access ports for VLAN 100. The network team ensured that the new switch's configuration is correct for VLAN 100 access. What is the most likely cause of the issue, and what action should be taken to resolve it?

Accepted Answer

Configure the new switch with a higher bridge priority (e.g., 28672) to prevent it from becoming the root bridge.. The issue is that the new switch, intended as an access switch, has a lower bridge priority (or default priority of 32768) than the existing root bridge for VLAN 100. When connected, it becomes the new root bridge, causing topology changes and intermittent connectivity. Root Guard on the Layer 3 switch port detects this superior BPDU and blocks the port to protect the root bridge position. Configuring the new switch with a higher bridge priority (e.g., 28672) ensures it cannot become the root bridge, resolving the Root Guard blocks.

Answer

Change the port configuration on the new switch to access mode for VLAN 100.

Answer

Disable Root Guard on the Layer 3 switch port connected to the new switch.

Answer

Remove the new switch from the network because it is causing a BPDU attack.

Question 7

An enterprise is deploying a leaf-spine architecture in its data center to support high-bandwidth east-west traffic. The design must include QoS to prioritize storage replication traffic (iSCSI) over backup traffic, while ensuring low latency for real-time applications. Where should the architect apply QoS classification and queuing policies in this topology?

Accepted Answer

Apply classification and marking on the leaf switches at ingress, and queuing policies on egress interfaces of both leaf and spine switches.. In a leaf-spine architecture, QoS classification and marking must occur at the ingress of leaf switches (where traffic enters the fabric) to identify iSCSI, backup, and real-time flows. Queuing policies must be applied on egress interfaces of both leaf and spine switches to manage congestion and prioritize latency-sensitive traffic across the entire path, ensuring end-to-end QoS for east-west traffic.

Answer

Apply all QoS policies only on the spine switches, since they handle inter-leaf traffic.

Answer

Configure QoS only on the default gateway router, which is upstream of the leaf-spine fabric.

Answer

Use a single QoS policy on all interfaces with default settings, relying on hardware buffers.

Question 8

Which of the following is true about the STP max age timer?

Accepted Answer

It is the maximum time a switch stores BPDU information before discarding it.. The STP max age timer defines the maximum time a switch will store a received BPDU before discarding it. If a switch does not receive a new BPDU from the root bridge within this interval (default 20 seconds), it assumes the root bridge has failed and initiates a topology change, recalculating the spanning tree.

Answer

It is the time a port spends in the listening state.

Answer

It is the interval between BPDU transmissions.

Answer

It is the time a port waits before transitioning from blocking to listening.

Question 9

What is the default STP port cost for a 10 Gigabit Ethernet interface?

Accepted Answer

2. The default STP port cost for a 10 Gigabit Ethernet interface is 2, as defined by the IEEE 802.1D-2004 standard (which uses a 32-bit path cost formula: 20,000,000 / link speed in Mbps). For 10 Gbps (10,000 Mbps), the calculation is 20,000,000 / 10,000 = 2,000, but the standard caps the cost at a maximum of 200,000 and a minimum of 1, with 10 Gbps assigned a cost of 2. This value is used by Rapid PVST+ and MST in Cisco IOS.

Answer

1

Answer

4

Answer

19

Question 10

A network engineer runs the following command on switch SW4:

SW4# show cts environment-data

CTS Environment Data:

Device ID: SW4.cisco.com
Device Name: SW4
CTS Capabilities: SGT, SXP, CTSD, CTSA
SGT: 100
SXP Node: Enabled
SXP Connection: 10.1.1.1:64999

Based on this output, what can be concluded?

Accepted Answer

The switch has an SXP connection to a peer at 10.1.1.1.. The output shows 'SXP Connection: 10.1.1.1:64999', which directly indicates that the switch has an active SXP (Security Exchange Protocol) connection to a peer at IP address 10.1.1.1. SXP is used to propagate Security Group Tags (SGTs) between Cisco TrustSec devices, and the presence of this line confirms the connection is established.

Answer

The switch is using 802.1X for authentication.

Answer

The switch's SGT is 10.

Answer

The switch is not capable of SGT assignment.

Question 11

Which two statements about multicast RPF check are true? (Choose two.)

Accepted Answer

The RPF check uses the unicast routing table (or a dedicated multicast routing table) to determine the best path back to the multicast source.. RPF check is a fundamental loop prevention mechanism in multicast. It verifies that the incoming interface of a multicast packet is the same interface the router would use to reach the source. If the check fails, the packet is dropped. RPF can be influenced by static mroutes and is performed on all multicast packets, not just data.

Answer

The RPF check is performed only on the first packet of a multicast stream; subsequent packets are forwarded without verification.

Answer

The RPF check can be overridden by configuring a static multicast route (mroute) that points to a different incoming interface.

Answer

The RPF check is only relevant for PIM-SM and not for PIM-DM.

Question 12

A network engineer runs the following command on Router R9:

R9# show mpls ldp bindings 10.9.9.0 255.255.255.0
  lib entry: 10.9.9.0/24, rev 10
        local binding:  label: 22
        remote binding: lsr: 10.9.9.1:0, label: 23
        remote binding: lsr: 10.9.9.2:0, label: 24
        remote binding: lsr: 10.9.9.3:0, label: 25

Based on this output, how many remote LDP peers have advertised a label for the prefix 10.9.9.0/24?

Accepted Answer

3. The output shows three remote bindings, each from a different LSR (10.9.9.1:0, 10.9.9.2:0, and 10.9.9.3:0), advertising a label for the prefix 10.9.9.0/24. The local binding (label 22) is not a remote peer, so only the three remote entries count. Therefore, the correct answer is 3.

Answer

1

Answer

2

Answer

4

Question 13

Examine the following partial configuration on a Cisco IOS-XE device:

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip ospf hello-interval 5
 ip ospf dead-interval 20
!

What is the effect of this configuration?

Accepted Answer

The router will send OSPF hello packets every 5 seconds and declare a neighbor dead after 20 seconds of no hello.. The `ip ospf hello-interval 5` command sets the OSPF hello interval to 5 seconds, and the `ip ospf dead-interval 20` command sets the dead interval to 20 seconds. These per-interface commands override the default hello interval of 10 seconds and dead interval of 40 seconds for broadcast networks, allowing the router to send hello packets every 5 seconds and declare a neighbor dead after 20 seconds of no hello reception.

Answer

The router will send OSPF hello packets every 10 seconds and declare a neighbor dead after 40 seconds, overriding the configuration.

Answer

The configuration is invalid because the dead interval must be exactly four times the hello interval.

Answer

The router will not form OSPF adjacencies because the hello and dead intervals are not default.

Question 14

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

Accepted Answer

The router is performing NAT only for the source IP, but the return traffic is taking a different path that does not go through the NAT router.. The presence of a source NAT translation for the internal host indicates that the router is correctly translating the outbound SSH traffic. However, the absence of the remote server's IP in the NAT translation table suggests that the return traffic from the server is not reaching the NAT router. This typically occurs when the return path takes a different route through the network, bypassing the router that performed the NAT, so the router never sees the reply packets and cannot create the necessary reverse translation entry. As a result, the SSH session times out because the host receives no response.

Answer

The SSH server is blocking connections from the public IP address.

Answer

The NAT overload is causing port conflicts for SSH.

Answer

The access list used for NAT is denying the SSH traffic.

Question 15

interface GigabitEthernet0/3
 spanning-tree guard root
 end

What is the effect of this configuration?

Accepted Answer

The port will error-disable if it receives a BPDU that would cause the switch to become a non-root bridge.. The `spanning-tree guard root` command enables Root Guard on the interface. Root Guard prevents the port from becoming a root port by error-disabling the port if it receives a superior BPDU (one that would cause the switch to become a non-root bridge). This protects the spanning-tree root bridge placement from being usurped by an unauthorized switch.

Answer

The port will block all BPDUs received from other switches.

Answer

The port will become the root port for the VLAN.

Answer

The port will ignore BPDUs from switches with lower bridge ID.

Question 16

An enterprise is deploying QoS across a network that includes both Cisco and non-Cisco devices. The engineer wants to use a marking scheme that is end-to-end and not stripped at Layer 3 boundaries. Which marking field should the engineer use?

Accepted Answer

DSCP. DSCP (Differentiated Services Code Point) is the correct choice because it is defined in RFC 2474 as a Layer 3 marking field in the IP header. Unlike CoS (Layer 2) or MPLS EXP (which is stripped at MPLS boundaries), DSCP markings are preserved across Layer 3 boundaries (routers) and can be used end-to-end across both Cisco and non-Cisco devices, as long as the intermediate devices trust the DSCP value.

Answer

CoS

Answer

IP Precedence

Answer

MPLS EXP

Question 17

Given the following configuration:

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.100 key Cisco123
radius-server host 192.168.1.101 key Cisco123

Which statement is true about this configuration?

Accepted Answer

If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local.. The configuration uses the 'default' method list for login authentication, exec authorization, and exec accounting. The order 'group radius local' means the router first attempts authentication, authorization, and accounting via the RADIUS servers in the order they are configured. If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local authentication. This is because the 'group radius' keyword directs the router to try all configured RADIUS servers in sequence before resorting to the 'local' fallback method.

Answer

The RADIUS servers are used for authentication only, not for authorization or accounting.

Answer

Local authentication is always attempted first, then RADIUS.

Answer

The RADIUS key is optional; if omitted, the router uses an empty key.

Question 18

A network engineer runs the following command on Router R8:

R8# show ip dhcp server statistics
Memory usage: 12345
Address pools: 2
Database agents: 0
Automatic bindings: 10
Manual bindings: 2
Expired bindings: 1
Malformed messages: 0

Message        Received
BOOTREQUEST    0
DHCPDISCOVER   100
DHCPREQUEST    95
DHCPDECLINE    1
DHCPRELEASE    2
DHCPINFORM     0

Based on this output, what can be concluded?

Accepted Answer

The DHCP server has received more DHCPDISCOVER messages than DHCPREQUEST messages, indicating some clients did not proceed to request.. The DHCP server received 100 DHCPDISCOVER messages but only 95 DHCPREQUEST messages. This indicates that 5 clients sent DHCPDISCOVER messages but did not proceed to send a DHCPREQUEST, which could be due to network issues, client configuration, or the client not selecting an offered IP address. The DHCP process requires a client to send a DHCPREQUEST after receiving a DHCPOFFER, so the discrepancy shows incomplete DORA (Discover, Offer, Request, Acknowledge) cycles.

Answer

The DHCP server has 12 active leases.

Answer

The DHCP server rejected 5 DHCPDISCOVER messages.

Answer

The DHCP server has 2 manual bindings that are static reservations.

Question 19

An architect is designing a virtualized service chain for a campus network using NFV. The chain must include a firewall, WAN optimizer, and IPS. The architect needs to minimize latency by placing VNFs on the same hypervisor host. Which design consideration is most important?

Accepted Answer

Ensure all VNFs are pinned to the same NUMA node on the hypervisor host.. Pinning all VNFs to the same NUMA node on the hypervisor host minimizes inter-NUMA memory access latency, which is critical for achieving low-latency packet processing in an NFV service chain. When VNFs are placed on different NUMA nodes, memory accesses must traverse the QPI/UPI interconnect, adding significant latency. By co-locating the firewall, WAN optimizer, and IPS on the same NUMA node, the architect ensures that all packet processing stays within the same memory domain, reducing latency to the minimum possible on that host.

Answer

Use a Type 2 hypervisor to reduce overhead.

Answer

Place each VNF on a separate physical host to avoid resource contention.

Answer

Enable DPDK on the virtual switch to accelerate packet processing.

Question 20

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-3

AP Statistics for AP-3
----------------------
Channel Utilization: 75%
Interference: 30%
Noise Floor: -80 dBm
Total Packets Received: 5000
Total Packets Sent: 4500
Total Errors: 1500

Based on this output, what can be concluded?

Accepted Answer

The high error rate suggests possible co-channel interference or signal issues.. The output shows a total error count of 1500 out of 5000 received packets, which is a 30% error rate. This high error rate, combined with 75% channel utilization and 30% interference, strongly indicates co-channel interference or signal degradation issues. In wireless networks, excessive errors often stem from overlapping channels, poor signal-to-noise ratio, or adjacent-cell interference, making option B the correct conclusion.

Answer

The AP is operating in a clean environment with low interference.

Answer

The channel utilization is low, indicating spare capacity.

Answer

The noise floor is excellent at -80 dBm.