CCNP Practice Exam 55 — 20 Questions

Question 1

Drag and drop the steps of VRF import/export route-target policy flow into the correct order, from first to last.

Accepted Answer

PE receives VPNv4 route from MP-BGP neighbor. The correct order begins with the PE receiving a VPNv4 route from MP-BGP, checking the route target against the VRF import list, matching the RT to accept the route, installing the route in the VRF routing table, and then redistributing the route to the CE.

Question 2

Drag and drop the steps of NUMA-aware VM placement process into the correct order, from first to last.

Accepted Answer

Enable NUMA in the host BIOS. The order starts with enabling NUMA in the BIOS, then configuring the hypervisor, creating the VM with NUMA settings, and finally verifying placement and performance.

Question 3

Examine this DHCP configuration:
```
service dhcp
ip dhcp pool POOL2
 network 10.20.20.0 255.255.255.0
 default-router 10.20.20.1
 lease infinite
```
What is the effect of the 'lease infinite' command?

Accepted Answer

Clients will receive an infinite lease and never need to renew.. The 'lease infinite' command in a Cisco DHCP pool configuration sets the lease duration to never expire, meaning clients will not need to renew their IP addresses. This is a valid Cisco IOS command that overrides the default lease time of 1 day, and DHCP clients will treat the lease as having an infinite lifetime, so they will not attempt renewal.

Answer

The lease time is set to the default value of 1 day.

Answer

Clients will be unable to obtain an IP address because infinite is invalid.

Answer

The router will ignore the lease command and use the default.

Question 4

Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.

Accepted Answer

Define VRF and assign route distinguisher. The correct order starts with defining the VRF, then configuring the inside and outside interfaces under the VRF, defining the NAT pool (if used), applying the access list for translation, and finally enabling NAT inside source with the VRF keyword.

Question 5

Drag and drop the steps of troubleshooting a model-driven telemetry subscription using CLI into the correct order, from first to last.

Accepted Answer

Verify telemetry receiver configuration. First, verify the telemetry receiver configuration to ensure the destination is correct. Next, check the sensor group to confirm the correct YANG paths are included. Then, examine the subscription status to see if it is active. After that, review any telemetry error logs for connectivity or data issues. Finally, use debug commands to capture real-time telemetry packets.

Question 6

Drag and drop each IPsec mode on the left to its matching header usage on the right.

Accepted Answer

ESP tunnel mode: New IP header + ESP header + original IP packet + ESP trailer. Tunnel mode encrypts original IP header and adds new IP header; transport mode encrypts only payload; ESP tunnel adds ESP header between new and original IP; AH transport authenticates payload and original header; AH tunnel authenticates entire new packet.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip pim neighbor
PIM Neighbor Table
Neighbor Address  Interface           Uptime    Expires   Mode
10.1.1.2          GigabitEthernet0/0  2w0d      00:01:25  DR
10.1.1.3          GigabitEthernet0/0  2w0d      00:01:20  B

Based on this output, what can be concluded?

Accepted Answer

PIM Bidir mode is configured on this interface.. The output shows PIM neighbor modes of 'DR' and 'B'. In PIM Bidir mode, the Designated Router (DR) is elected to forward traffic upstream, and the 'B' flag indicates a Bidir-capable neighbor. This mode is explicitly identified by the 'B' flag in the PIM neighbor table, which is not present in sparse or dense mode. Therefore, the interface is operating in PIM Bidir mode.

Answer

PIM sparse mode is operating on this interface.

Answer

PIM dense mode is in use on this interface.

Answer

PIM SSM is enabled on this interface.

Question 8

Given the following WLAN configuration on a Cisco 9800 WLC:

wlan test-wlan 1 test-ssid
 client vlan VLAN10
 no security wpa
 no security wpa2
 security wpa3
 no security ft

What is a potential issue with this configuration?

Accepted Answer

The WLAN is missing a security key management (AKM) configuration.. The configuration enables WPA3 but omits a security key management (AKM) policy. WPA3 requires an AKM suite (e.g., SAE for personal or 802.1X for enterprise) to negotiate authentication and key derivation. Without an AKM configured, the WLAN will fail to enable or will not allow clients to associate, as the WLC cannot determine the key management protocol.

Answer

The client VLAN is incorrectly configured.

Answer

WPA3 is not supported on this platform.

Answer

The SSID name is too long.

Question 9

A network engineer runs the following command on Router R6:

R6# show ip pim rp 239.3.3.3
RP 10.0.0.4

Info source: 10.0.0.4, via bootstrap, priority 192, holdtime 150, expires in 00:02:30

Based on this output, what can be concluded?

Accepted Answer

The RP was learned via BSR.. The output shows 'via bootstrap', which indicates the RP was learned through the Bootstrap Router (BSR) mechanism. BSR is a dynamic RP discovery protocol that uses a bootstrap router to distribute RP information throughout the PIM domain, making option B correct.

Answer

The RP was learned via Auto-RP.

Answer

The RP was statically configured.

Answer

The RP is 10.0.0.5.

Question 10

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 15
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65050, (received & used)
    10.0.1.2 from 10.0.1.2 (10.0.0.2)
      Origin IGP, metric 0, localpref 100, weight 0, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what can be concluded?

Accepted Answer

The route is from AS 65050 and is the best path.. The output shows the BGP table entry for 192.168.1.0/24 with path 65050, and the line 'valid, external, best' confirms that this route is from AS 65050 and is selected as the best path. The 'best' keyword in the status flags directly indicates that this path is the best among all available paths for this prefix.

Answer

The route was learned from an internal BGP peer.

Answer

The route has a local preference of 0.

Answer

The route is not valid because it is external.

Question 11

Drag and drop the steps of RSPAN VLAN propagation across trunk links into the correct order, from first to last.

Accepted Answer

Create RSPAN VLAN on source switch. The RSPAN VLAN must be created, allowed on trunks, and then used in sessions to propagate traffic across switches.

Question 12

Consider the following BGP configuration:

router bgp 65000
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50

What is the effect of this configuration?

Accepted Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing inbound path selection in AS 65001.. The route-map SET_MED is applied to outbound updates to neighbor 10.1.1.2, setting the MED (Multi-Exit Discriminator) attribute to 50. MED is a metric that influences inbound path selection in the neighboring AS (AS 65001), telling its routers which path to prefer when multiple entry points exist into AS 65000. Therefore, option A correctly describes the effect.

Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing outbound path selection from AS 65000.

Answer

Routes received from 10.1.1.2 will have the MED set to 50.

Answer

The MED value will be set to 50 for all routes in the BGP table.

Question 13

A network engineer is configuring a DMVPN Phase 3 network. The hub router is a Cisco 4500X and the spokes are Cisco 4321s. The engineer wants to enable spoke-to-spoke direct communication. After configuration, the spokes can communicate via the hub, but not directly. The engineer checks the NHRP cache on a spoke and sees that it has a mapping for the other spoke's tunnel IP to the hub's physical IP. What is the most likely cause?

Accepted Answer

The hub is not configured with NHRP redirect.. In DMVPN Phase 3, spoke-to-spoke direct communication relies on the hub sending NHRP redirect messages to inform a spoke that a better path exists to another spoke. Without the 'ip nhrp redirect' command on the hub tunnel interface, the hub forwards traffic between spokes but never signals the spoke to initiate a direct NHRP resolution. The spoke's NHRP cache shows the other spoke's tunnel IP mapped to the hub's physical IP because the spoke has only learned the hub as the next hop, not the true spoke destination.

Answer

The NHRP network ID is mismatched between the spokes.

Answer

The routing protocol is not redistributing spoke routes.

Answer

The spokes are using GRE instead of mGRE.

Question 14

Consider this configuration:

interface Port-channel1
 switchport mode trunk
 switchport trunk native vlan 999
!
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 channel-group 1 mode active
!
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 999
 channel-group 1 mode active

What is the effect of the 'switchport trunk native vlan 999' command on the EtherChannel?

Accepted Answer

The EtherChannel will use VLAN 999 as the native VLAN, and any untagged frames will be associated with VLAN 999.. The 'switchport trunk native vlan 999' command on each physical interface and on the port-channel interface ensures that the EtherChannel uses VLAN 999 as the native VLAN. Untagged frames received on any member link are associated with VLAN 999, and frames tagged with VLAN 999 are sent untagged. Since the configuration is consistent across all interfaces, the EtherChannel forms correctly and operates with VLAN 999 as the native VLAN.

Answer

The EtherChannel will drop all untagged frames because the native VLAN is not in the allowed list.

Answer

The EtherChannel will not form because the native VLAN must be the same across all interfaces, which it is.

Answer

The EtherChannel will form but the native VLAN will be ignored on the port-channel.

Question 15

A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?

Accepted Answer

Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.. The CoPP policy is dropping SSH packets from the management subnet due to a deny statement in the ACL that matches before any permit for SSH. By adding a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement, the router will classify SSH traffic into a class that can be policed (or permitted) appropriately, allowing SSH access while still protecting the control plane from other unwanted traffic.

Answer

Remove the deny statement from the CoPP ACL to allow all traffic.

Answer

Increase the police rate for the CoPP class that matches SSH traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Question 16

Drag and drop each telemetry encoding on the left to its matching format on the right.

Accepted Answer

JSON_IETF: JSON encoding per IETF draft. JSON_IETF is a specific JSON profile, protobuf is binary, kvGPB is key-value GPB, XML is used in NETCONF, and JSON is generic.

Question 17

Drag and drop the steps of VNF scaling up and scaling out into the correct order, from first to last.

Accepted Answer

VNFM monitors metrics and detects threshold breach. Scaling begins with the VNFM monitoring performance metrics against thresholds. When a threshold is exceeded, the VNFM triggers a scaling action. For scale-up, additional resources are allocated to the existing VNF instance. For scale-out, a new VNF instance is instantiated. Finally, load balancing is updated to distribute traffic across all instances.

Question 18

Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.

Accepted Answer

Client associates to AP and sends DHCP Discover. In DHCP bridging, the AP bridges the client's DHCP request to the wired network. The client first associates and sends a DHCP Discover broadcast. The AP bridges this frame to the wired VLAN. The DHCP server responds with a DHCP Offer, which the AP bridges back to the client. The client then sends a DHCP Request, and the server sends a DHCP Ack to complete the assignment.

Question 19

Which three statements about RSPAN are true? (Choose three.)

Accepted Answer

The RSPAN VLAN must be allowed on all trunk links between the source and destination switches.. RSPAN uses a dedicated VLAN that must be allowed on trunk links between switches. The RSPAN VLAN should not be used for any other traffic. The destination port on the remote switch is placed in the RSPAN VLAN. RSPAN does not support egress mirroring on the source switch (only ingress). The RSPAN VLAN does not participate in STP normally, but it can be configured to do so.

Answer

The RSPAN VLAN can be used for normal data traffic if needed.

Answer

RSPAN supports egress mirroring on the source switch.

Question 20

Review the following configuration:

vrf definition CUSTOMER_A
 rd 65000:100
 route-target export 65000:100
 route-target import 65000:100
!
interface GigabitEthernet0/4
 vrf forwarding CUSTOMER_A
 ip address 192.168.100.1 255.255.255.0
!
router bgp 65000
 address-family ipv4 vrf CUSTOMER_A
  redistribute connected

What is the purpose of the 'redistribute connected' command under the VRF address-family?

Accepted Answer

It advertises the directly connected network of GigabitEthernet0/4 into BGP for VRF CUSTOMER_A.. The 'redistribute connected' command under the BGP address-family for VRF CUSTOMER_A injects the directly connected network on GigabitEthernet0/4 (192.168.100.0/24) into the BGP table for that VRF. This allows BGP to advertise that subnet to BGP peers within the VRF, enabling reachability to the VRF's local interface network.

Answer

It redistributes all BGP routes into the VRF's routing table.

Answer

It enables BGP to exchange routes with other VRFs on the same router.

Answer

It is used to leak routes between VRF CUSTOMER_A and the global routing table.