CCNP Practice Exam 53 — 20 Questions

Question 1

Consider the following configuration:

class-map match-any VOICE
 match ip dscp ef
class-map match-any VIDEO
 match ip dscp af41
 match ip dscp af42

What is the effect of the match-any keyword in these class-maps?

Accepted Answer

A packet matching any one of the specified DSCP values is classified into that class.. The `match-any` keyword in a Cisco class-map means that a packet needs to match only one of the listed match criteria to be classified into that class. In the VIDEO class-map, a packet matching either DSCP AF41 or AF42 will be classified as VIDEO. This is the default behavior for class-maps when no keyword is specified, but explicitly using `match-any` reinforces that logical OR operation is applied.

Answer

A packet must match all specified DSCP values to be classified into the class.

Answer

A packet matching either DSCP EF or AF41 will be classified into both classes.

Answer

The match-any keyword is invalid for DSCP matching; only match-all is supported.

Question 2

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

Accepted Answer

Define a flow record that matches the specific application using NBAR or an ACL, and apply a flow monitor with a sampler rate to reduce CPU impact.. Flexible NetFlow allows you to define a flow record that matches specific application traffic using NBAR or an ACL, and applying a flow monitor with a sampler rate reduces the number of packets processed, minimizing CPU impact. This approach targets only the desired traffic without the overhead of monitoring all flows, making it the most efficient method for the engineer's goal.

Answer

Enable NetFlow on all interfaces and export all flows to the collector, then filter at the collector.

Answer

Use SNMP to poll interface counters and calculate the bandwidth used by the application.

Answer

Configure port mirroring (SPAN) to send all traffic to an external probe for analysis.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.10       192.168.1.10       ---                ---
--- 203.0.113.11       192.168.1.11       ---                ---
tcp 203.0.113.10:1024 192.168.1.10:1024  198.51.100.5:80    198.51.100.5:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing static NAT for two internal hosts.. The output shows two entries with '---' for protocol, indicating static NAT translations that map inside local addresses (192.168.1.10, 192.168.1.11) to inside global addresses (203.0.113.10, 203.0.113.11). The third entry is a dynamic translation for TCP traffic, but the presence of static entries confirms that static NAT is configured for at least two internal hosts. Therefore, option A is correct.

Answer

The router is performing dynamic NAT for all translations.

Answer

The router is performing Port Address Translation (PAT) for all translations.

Answer

The router is translating outside global addresses to inside local addresses.

Question 4

A Python script using Netmiko is written to send a command to a Cisco router:

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
    'secret': 'enable'
}

connection = ConnectHandler(**device)
connection.enable()
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()

What is the potential issue with this script?

Accepted Answer

The script lacks exception handling for authentication or connection failures, which can cause the script to crash.. The script lacks exception handling (e.g., try-except blocks) to catch authentication failures, connection timeouts, or device unreachable errors. Without this, if the device is down, credentials are wrong, or the SSH/Telnet service is unavailable, the script will crash with an unhandled exception, making it unreliable for production automation.

Answer

The script will fail because 'device_type' should be 'cisco_ios_telnet' for telnet connections.

Answer

The script will work correctly without any issues.

Answer

The script will fail because 'secret' is misspelled; it should be 'enable_secret'.

Question 5

A company uses Cisco Catalyst Center (formerly DNA Center) for intent-based networking. After upgrading the Catalyst Center appliance, the engineer notices that some devices are unreachable via the network, but the Catalyst Center GUI shows them as 'Managed'. What is the most likely cause?

Accepted Answer

The IP address of the Catalyst Center appliance changed after the upgrade. When the Catalyst Center appliance is upgraded, its IP address may change if the upgrade process resets network configuration or if the appliance is redeployed with a new IP. Devices are managed via IP-based communication (e.g., SSH, SNMP, NETCONF), and if the Catalyst Center IP changes, devices will still show as 'Managed' in the GUI because the database retains the device state, but the devices themselves cannot be reached because they are trying to communicate with the old IP address. This mismatch causes unreachability despite the managed status.

Answer

SNMP community strings are misconfigured

Answer

Devices were reassigned to different roles

Answer

Certificate trust between devices and Catalyst Center expired

Question 6

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network broadcast
 ip ospf priority 0
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of setting the OSPF priority to 0 on this interface?

Accepted Answer

The router will never become the DR or BDR on this segment.. Setting the OSPF priority to 0 on an interface prevents the router from participating in the Designated Router (DR) and Backup Designated Router (BDR) election process. This means the router will never become the DR or BDR on that broadcast segment, as per RFC 2328. It will instead remain a DROTHER and only form full adjacencies with the DR and BDR, not with other DROTHER routers.

Answer

The router will have a higher chance of becoming the DR.

Answer

The router will only form adjacencies with other routers that have priority 0.

Answer

The router will use a longer hello interval.

Question 7

Consider the following configuration:

class-map match-all HTTP
 match protocol http

policy-map QOS
 class HTTP
  police 2000000 1500 3000 conform-action transmit exceed-action drop

interface GigabitEthernet0/1
 service-policy input QOS

What is the effect of this configuration?

Accepted Answer

HTTP traffic is policed to an average rate of 2 Mbps; packets that exceed the rate are dropped, while conforming packets are transmitted.. The 'police' command in the policy-map enforces a traffic policer on HTTP traffic matched by the class-map. The parameters '2000000' (2 Mbps) define the committed information rate (CIR), '1500' is the normal burst (Bc), and '3000' is the excess burst (Be). Conforming packets are transmitted, while packets exceeding the rate are dropped, which is the standard behavior of a policer in the input direction.

Answer

HTTP traffic is shaped to an average rate of 2 Mbps; excess packets are buffered.

Answer

The police command will mark HTTP packets with a DSCP value of 0 if they exceed the rate.

Answer

The configuration is invalid because 'police' cannot be used in a 'service-policy input' direction.

Question 8

Which TWO STP features are used to improve convergence time after a topology change?

Accepted Answer

UplinkFast. UplinkFast is correct because it enables a switch to immediately use an alternate root port when its current root port fails, bypassing the usual 30-second listening and learning delay. This is achieved by artificially lowering the bridge priority of the switch to trigger a topology change notification, allowing the backup port to transition directly to forwarding. BackboneFast is correct because it reduces convergence time by detecting indirect link failures in the backbone and allowing a switch to expire its Max Age timer (default 20 seconds) immediately, rather than waiting for the full timer to expire, thus speeding up the transition to a new root port.

Answer

Root Guard

Answer

BPDU Guard

Answer

PortFast

Question 9

A network engineer is designing a WAN connection for a branch office that requires high availability and bandwidth aggregation. The branch has two internet connections from different ISPs. The engineer wants to use both links actively for load balancing and failover. Which design approach should be used?

Accepted Answer

Deploy SD-WAN to actively use both links with policy-based load balancing.. SD-WAN is the correct design because it natively supports active/active utilization of multiple WAN links with policy-based load balancing, allowing traffic to be distributed across both ISP connections based on application policies, SLA metrics, or other criteria. It also provides seamless failover by dynamically rerouting traffic if one link fails, meeting the requirements for high availability and bandwidth aggregation without relying on a single active link.

Answer

Configure static routes with different metrics for each link and use HSRP for failover.

Answer

Use BGP with both ISPs and rely on BGP best path selection for load balancing.

Answer

Implement a VPN tunnel between the branch and headquarters using only one link.

Question 10

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

Accepted Answer

The RSPAN VLAN must be configured with the 'remote-span' command on all switches.. RSPAN (Remote SPAN) requires the RSPAN VLAN to be configured with the 'remote-span' command on all switches that participate in the RSPAN session. This command marks the VLAN as a dedicated RSPAN VLAN, preventing it from being used for normal data traffic and ensuring that the mirrored frames are flooded correctly across the trunk links to the destination switch. Without this command, the VLAN behaves as a regular data VLAN, which can cause forwarding loops or incorrect delivery of mirrored traffic.

Answer

The RSPAN VLAN must be configured as the native VLAN on all trunk ports.

Answer

The RSPAN VLAN must be pruned from all trunk ports to prevent loops.

Answer

The RSPAN VLAN must be the same as the management VLAN for the switches.

Question 11

An engineer is managing a Cisco NFVIS host running multiple virtual network functions (VNFs). The engineer needs to upgrade the NFVIS software to a new version that includes critical security patches. The upgrade process must minimize downtime. Which upgrade method should the engineer use?

Accepted Answer

Use the 'software install add' command to stage the image, then 'activate' and 'commit' with a single reboot.. The 'software install add' command stages the new NFVIS image, followed by 'activate' and 'commit' with a single reboot, which minimizes downtime by performing the upgrade in a single reboot cycle. This method is the recommended approach for upgrading NFVIS while preserving existing VNF configurations and minimizing service disruption.

Answer

Use the 'patch install' command to apply the upgrade without rebooting.

Answer

Perform a clean installation of the new NFVIS version and redeploy all VNFs.

Answer

Migrate all VNFs to another NFVIS host, then upgrade the original host.

Question 12

A network engineer needs to monitor traffic between two VLANs on a Cisco Catalyst 9300 switch. The engineer wants to capture all packets that traverse the switch between VLAN 10 and VLAN 20. The monitoring station is connected to port Gi1/0/24. Which configuration should the engineer use to capture this inter-VLAN traffic?

Accepted Answer

Configure 'monitor session 1 source vlan 10 - 20 both' and 'monitor session 1 destination interface Gi1/0/24'.. Inter-VLAN traffic on a switch is routed by the switch virtual interface (SVI) and appears on the VLANs themselves. By using 'monitor session 1 source vlan 10 - 20 both', the SPAN session captures all packets entering or leaving VLANs 10 and 20, which includes the routed traffic between them. The destination interface Gi1/0/24 receives this mirrored traffic, allowing the monitoring station to see all inter-VLAN packets.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source vlan 10 - 20' and 'monitor session 1 destination remote vlan 100'.

Answer

Configure an ERSPAN session with source IP and destination IP.

Question 13

A network engineer runs the following command on Switch SW4:

SW4# show monitor session 4
Session 4
---------
Type                   : Local Session
Source VLANs           :
    RX Only            : 10,20
Destination Ports     : Gi1/0/25
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.. The output shows a local SPAN session with source VLANs 10 and 20 configured for RX Only, meaning only incoming traffic on those VLANs is mirrored to the destination port Gi1/0/25. The 'Ingress: Disabled' confirms that the destination port does not inject any traffic back into the switch, and 'Encapsulation: Native' indicates the mirrored frames are sent without an additional VLAN tag. Therefore, option A is correct because the session explicitly mirrors only received (incoming) traffic from VLANs 10 and 20.

Answer

Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.

Answer

This is an RSPAN session using VLANs 10 and 20 as remote VLANs.

Answer

The destination port Gi1/0/25 is configured to receive mirrored traffic.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip route 10.1.1.0
Routing entry for 10.1.1.0/24
  Known via "bgp 65001", distance 200, metric 0
  Tag 65002, type external
  Last update from 192.168.1.2 00:00:15 ago
  Routing Descriptor Blocks:
  * 192.168.1.2, from 192.168.1.2, 00:00:15 ago
      Route metric is 0, traffic share count is 1
      AS Hops 1
      Route tag 65002
      MPLS label: 18

Based on this output, what can be concluded?

Accepted Answer

The route is learned via BGP and has an MPLS label assigned, indicating MPLS forwarding.. The output shows the route is known via BGP (AS 65001) with a distance of 200, which is the administrative distance for external BGP routes. The presence of an MPLS label (18) in the routing table indicates that MPLS forwarding is enabled for this prefix, typically via Label Distribution Protocol (LDP) or BGP label distribution. This confirms that the route is learned via BGP and has an MPLS label assigned, making option B correct.

Answer

The route is learned via OSPF and tagged with an MPLS label.

Answer

The route is a directly connected interface with an MPLS label.

Answer

The route is a static route with an MPLS label.

Question 15

A network engineer is configuring an EtherChannel between two Cisco switches. The engineer wants to use LACP and ensure that the local switch is the one that determines which ports are active in the channel. Which configuration should be applied?

Accepted Answer

Configure 'lacp system-priority 100' on the local switch.. LACP uses the system priority to determine which switch controls port selection when negotiating an EtherChannel. The switch with the lower system priority (higher preference) becomes the 'controlling' switch that decides which ports are active in the channel. By configuring 'lacp system-priority 100' on the local switch, you lower its priority value, making it the preferred decision-maker for active port selection.

Answer

Configure 'lacp port-priority 100' on the physical ports of the local switch.

Answer

Configure 'channel-group 1 mode active' on the physical ports.

Answer

Configure 'lacp fast-switchover' on the port-channel interface.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)

Interface                   Peers    Xmit Queue   Mean   Pacing Time   Multicast    Pending
                           Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0                         1       0/0       12       0/10        50           0
Gi0/1                         1       0/0       15       0/10        55           0

Based on this output, what can be concluded?

Accepted Answer

Interface Gi0/1 has higher latency than Gi0/0.. The 'Mean SRTT' (Smooth Round-Trip Time) column shows the average time in milliseconds for EIGRP packets to reach a neighbor and receive an acknowledgment. Gi0/1 has an SRTT of 15 ms, while Gi0/0 has an SRTT of 12 ms, indicating higher latency on Gi0/1. This directly correlates to the path's delay, which EIGRP uses in its composite metric calculation.

Answer

Both interfaces have pending routes to send.

Answer

The router is using EIGRP named mode.

Answer

There is a queue backlog on Gi0/0.

Question 17

Which two statements about policing and shaping in a QoS architecture are true? (Choose two.)

Accepted Answer

Policing can be configured on both ingress and egress interfaces, while shaping is only supported on egress interfaces.. Policing drops or re-marks traffic exceeding a rate, while shaping buffers excess traffic to smooth bursts. Policing is applied inbound or outbound, shaping is typically outbound. Policing does not introduce delay, shaping does. Both can use token bucket algorithms.

Answer

Shaping uses a token bucket algorithm to meter traffic and drops packets that exceed the configured rate.

Answer

Policing introduces variable delay because it buffers excess traffic before forwarding.

Answer

Both policing and shaping can re-mark packets that conform to the configured rate.

Question 18

A network engineer runs the following command on a Cisco WLC:

WLC# show ap rf-profile summary

RF-Profile Name: default-rf-profile
Description: Default RF Profile
Band: 2.4 GHz
Channel Width: 20 MHz
Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps
Power Level: 1 (max)

RF-Profile Name: low-power
Description: Low Power Profile
Band: 2.4 GHz
Channel Width: 20 MHz
Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps
Power Level: 5

Based on this output, what can be concluded?

Accepted Answer

The low-power profile reduces the transmit power of the AP.. The 'Power Level: 5' in the low-power profile indicates a lower transmit power setting compared to 'Power Level: 1 (max)' in the default profile. On Cisco WLCs, power levels are numbered inversely to actual transmit power, with higher numbers representing lower power output. Therefore, the low-power profile reduces the AP's transmit power.

Answer

The default profile uses 40 MHz channels.

Answer

The low-power profile disables all data rates below 12 Mbps.

Answer

The low-power profile is for 5 GHz band.

Question 19

A company has a requirement to provide redundancy for the default gateway on a subnet. Two switches are configured with HSRP. Which requirement must be met for the interfaces on the switches to form the HSRP group?

Accepted Answer

The interfaces must be in the same VLAN.. HSRP is a First Hop Redundancy Protocol that provides a virtual gateway for hosts. To form an HSRP group, the participating interfaces must be Layer 3 interfaces (either SVIs on switches or routed ports on multilayer switches) that are configured with IP addresses and belong to the same VLAN. Option B is incorrect because HSRP does not run on Layer 2 switchports; those ports do not have IP addresses and cannot send HSRP messages. Option D is correct because being in the same VLAN ensures the switches share the same broadcast domain, allowing HSRP multicast hello messages to reach each other.

Answer

The interfaces must be on the same physical switch.

Answer

The interfaces must be Layer 2 switchports.

Answer

The interfaces must have the same IP address.

Question 20

Drag and drop the steps of YANG module import and augmentation resolution into the correct order, from first to last.

Accepted Answer

Import the YANG module into the system. The correct order follows YANG module processing: first the module is imported, then its base schema is parsed, next augmentations are resolved, then conflicts are detected, and finally the complete schema tree is built.