CCNP Practice Exam 55 — 20 Questions

Question 1

A network engineer executes the following command on Router R3:

R3# show ip igmp groups 239.2.2.2
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter
239.2.2.2        GigabitEthernet0/0       1d04h     00:02:10  192.168.1.100

Based on this output, what can be concluded?

Accepted Answer

A host at 192.168.1.100 has joined group 239.2.2.2.. The output shows that the multicast group 239.2.2.2 has an active member on interface GigabitEthernet0/0, with the last reporter being 192.168.1.100. In IGMP, the 'Last Reporter' is the host that most recently sent an IGMP membership report for that group, confirming that a host at that IP address has joined the group. Therefore, option B is correct.

Answer

The multicast group is being sourced from 192.168.1.100.

Answer

The router is the RP for this group.

Answer

The group is using IGMP version 3.

Question 2

Examine the following configuration:

interface Port-channel1
 switchport mode trunk
!
interface GigabitEthernet0/1
 switchport mode trunk
 channel-group 1 mode desirable
!
interface GigabitEthernet0/2
 switchport mode access
 channel-group 1 mode desirable

What is the problem with this configuration?

Accepted Answer

The switchport mode mismatch between Gi0/1 (trunk) and Gi0/2 (access) will prevent the EtherChannel from forming.. EtherChannel requires all member interfaces to have identical switchport modes (all trunk or all access). In this configuration, GigabitEthernet0/1 is configured as a trunk port while GigabitEthernet0/2 is configured as an access port. This switchport mode mismatch violates the EtherChannel consistency checks, preventing the logical bundle from forming. Cisco switches enforce this rule to ensure consistent VLAN tagging behavior across all links in the bundle.

Answer

The channel-group mode desirable is incompatible with trunk ports.

Answer

The port-channel interface must also be configured as access to match Gi0/2.

Answer

The EtherChannel will form but only Gi0/1 will be active.

Question 3

An architect is designing a QoS policy for a Cisco SD-Access fabric. The policy must prioritize voice traffic from wireless clients connected to fabric-enabled access points over other traffic types. The design should use the fabric's built-in capabilities to simplify deployment. Which approach should the architect take?

Accepted Answer

Use Cisco TrustSec to assign an SGT to voice traffic based on ISE authentication, then apply a QoS policy on the fabric edge node that matches the SGT and provides priority queuing.. Cisco SD-Access uses TrustSec to propagate Security Group Tags (SGTs) from ISE to the fabric edge nodes. By matching the SGT assigned to voice traffic (e.g., via ISE profiling and authentication), the fabric edge node can apply a QoS policy that places that traffic into a priority queue. This leverages the fabric's built-in SGT-based policy enforcement, simplifying deployment without requiring per-device ACLs or complex marking configurations.

Answer

Configure QoS policies on the wireless LAN controller (WLC) only, marking voice traffic with DSCP EF, and rely on the fabric to preserve the marking.

Answer

Implement a centralized QoS policy on the fabric border node that matches the source IP addresses of voice devices.

Answer

Use VXLAN network identifiers (VNIs) to classify voice traffic and apply QoS on the control plane node.

Question 4

A network engineer is configuring a Cisco router for AAA using a RADIUS server. The engineer wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication for console access. The engineer configures 'aaa authentication login default group radius local' and 'aaa authentication login CONSOLE local'. The console line is configured with 'login authentication CONSOLE'. However, when the RADIUS server is down, the engineer cannot log in via the console. What is the problem?

Accepted Answer

The router has no local usernames configured, so the 'local' method has no users to authenticate against.. The 'aaa authentication login CONSOLE local' command tells the router to use only local authentication for the CONSOLE list. When the RADIUS server is down, the console login fails because no local usernames have been configured, so there are no credentials to authenticate against. The fallback to local authentication in the default list is irrelevant because the console line explicitly uses the CONSOLE list, which does not include RADIUS.

Answer

The 'aaa authentication login CONSOLE local' command should be 'aaa authentication login CONSOLE group radius local' to include RADIUS as a fallback.

Answer

The console line should use the default authentication list instead of a named list.

Answer

The 'aaa new-model' command is missing, so AAA is not enabled.

Question 5

What is the default IGMP version on a Cisco IOS interface when IP multicast routing is enabled?

Accepted Answer

IGMPv2. When IP multicast routing is enabled on a Cisco IOS interface, the default IGMP version is IGMPv2. This is because IGMPv2 provides the necessary functionality for host membership querying and reporting, including the leave group message, which IGMPv1 lacks. The default is independent of PIM configuration, as IGMP operates at Layer 2/3 for group management, while PIM handles multicast routing between routers.

Answer

IGMPv1

Answer

IGMPv3

Answer

IGMPv2 is default only if PIM is enabled; otherwise, no IGMP.

Question 6

A network engineer is troubleshooting a connectivity issue in a switched network. The network uses Rapid PVST+ with multiple VLANs. The engineer notices that a host connected to an access port on SW1 cannot communicate with the default gateway, which is on a distribution switch. The access port is configured with PortFast and BPDU Guard. The engineer checks the switch logs and sees that the port went into errdisable state. What is the most likely cause of the errdisable state?

Accepted Answer

Another switch was connected to the access port, causing BPDU Guard to disable the port.. The access port is configured with PortFast and BPDU Guard. PortFast immediately transitions the port to forwarding, but BPDU Guard monitors for incoming BPDUs. When another switch is connected to this access port, it sends BPDUs, triggering BPDU Guard to error-disable the port to prevent a potential bridging loop. This matches the log entry showing the port went into errdisable state. Note that BPDU Guard is specifically designed to protect against unauthorized switches, and Root Guard is a separate mechanism used on uplinks.

Answer

A broadcast storm occurred due to a loop in the network.

Answer

The host connected to the port caused a duplex mismatch.

Answer

The cable connecting the host is faulty, causing link flaps.

Question 7

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 mpls ip
 mpls label protocol ldp
!
router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
!
router ldp
 interface GigabitEthernet0/1
!
What is the effect of this configuration?

Accepted Answer

MPLS forwarding is enabled on GigabitEthernet0/1, and LDP will distribute labels for all routes in the routing table.. The `mpls ip` command under the interface enables MPLS forwarding, and the `router ldp` configuration with the interface specified activates LDP on that interface. LDP will then distribute labels for all routes in the routing table (including OSPF, static, connected, etc.) by default, as LDP does not filter based on routing protocol. The `mpls label protocol ldp` command is indeed redundant since LDP is the default label distribution protocol in Cisco IOS, but it does not break the configuration.

Answer

Only OSPF routes are labeled; static routes are excluded from LDP label distribution.

Answer

The 'mpls label protocol ldp' command is redundant because LDP is the default.

Answer

The configuration will fail because 'router ldp' requires an LDP router-id to be set.

Question 8

An enterprise is deploying Cisco SD-WAN and must ensure that data plane traffic between branch sites is encrypted and authenticated. The design must also allow the use of application-aware routing to steer traffic based on real-time performance metrics. Which component is responsible for establishing and managing the IPsec tunnels between branch routers?

Accepted Answer

vEdge/cEdge routers. The vEdge/cEdge routers are the correct answer because they are the SD-WAN edge devices that terminate IPsec tunnels for data plane traffic. In Cisco SD-WAN, the data plane is fully distributed: each vEdge or cEdge router establishes and manages its own IPsec tunnels (using DTLS/TLS for control and IPsec for data) directly with other branch routers. This allows the routers to apply application-aware routing by monitoring real-time performance metrics (e.g., loss, latency, jitter) and steering traffic across the encrypted tunnels accordingly.

Answer

vSmart controllers

Answer

vManage

Answer

vBond

Question 9

A network engineer runs the following command on Router R7:

R7# show ip ospf neighbor vrf CUSTOMER-E

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.8         1   FULL/DR         00:00:35    10.0.1.2        GigabitEthernet0/0.500
10.0.0.9         1   FULL/BDR        00:00:31    10.0.2.2        GigabitEthernet0/0.600

Based on this output, what can be concluded?

Accepted Answer

OSPF is operating within VRF CUSTOMER-E with two neighbors. The command `show ip ospf neighbor vrf CUSTOMER-E` explicitly queries OSPF neighbors within the VRF named CUSTOMER-E. The output shows two neighbors (10.0.0.8 and 10.0.0.9) with states FULL/DR and FULL/BDR, confirming that OSPF is actively operating inside that VRF. Therefore, option C is correct because it accurately states that OSPF is operating within VRF CUSTOMER-E with two neighbors.

Answer

OSPF is not configured for VRF CUSTOMER-E

Answer

There is only one OSPF neighbor in VRF CUSTOMER-E

Answer

The DR is 10.0.0.9

Question 10

Which three statements about OSPF LSA types are correct? (Choose three.)

Accepted Answer

Type 1 LSAs (Router LSAs) are generated by every OSPF router and describe the router's interfaces and neighbors within an area.. Option A is correct because Type 1 Router LSAs are originated by every OSPF-enabled router, are scoped to a single area, and describe that router's links (interfaces, IP addresses, metrics) and its neighbors on those links. Option B is correct because Type 2 Network LSAs are generated only by the Designated Router on multi-access segments such as broadcast and NBMA networks, and they list the DR, the BDR, and all attached routers to represent the transit network. Option D is correct because Type 4 ASBR Summary LSAs are produced by Area Border Routers to tell routers in other areas how to reach an Autonomous System Boundary Router located in a different area. Option C is wrong because Type 3 Summary LSAs are generated by ABRs to advertise inter-area routes, not by ASBRs to advertise external routes. Option E is wrong because Type 5 AS External LSAs are flooded throughout the entire OSPF autonomous system (except stub/NSSA areas), not confined to the originating area.

Answer

Type 3 LSAs (Summary LSAs) are generated by ASBRs to advertise external routes into the OSPF domain.

Answer

Type 5 LSAs (AS External LSAs) are flooded only within the area where they originate.

Question 11

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-1

AP Statistics for AP-1
----------------------
Channel Utilization: 45%
Interference: 10%
Noise Floor: -95 dBm
Total Packets Received: 15000
Total Packets Sent: 12000
Total Errors: 200

Based on this output, what can be concluded?

Accepted Answer

The channel utilization is moderate and the noise floor is low.. The channel utilization of 45% is considered moderate (typically below 50% is acceptable), and the noise floor of -95 dBm is very low (excellent), indicating a clean RF environment. The interference value of 10% is also low, and the error count of 200 out of 15,000 received packets (1.33%) is not significant. This output shows a healthy AP with no major issues.

Answer

The channel is heavily congested with utilization above 80%.

Answer

The noise floor is high, indicating potential interference.

Answer

The AP is experiencing a significant number of errors relative to packets received.

Question 12

A network engineer runs the following command on Switch SW6:

SW6# show spanning-tree vlan 60

VLAN0060
  Spanning tree enabled protocol ieee
  Root ID    Priority    24636
             Address     aabb.cc00.0a00
             Cost        8
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32768  (priority 32768 sys-id-ext 60)
             Address     aabb.cc00.0b00
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 8         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Altn BLK 4         128.3    P2p
Gi0/4               Desg FWD 4         128.4    P2p

Based on this output, what is the bridge priority of the root bridge for VLAN 60?

Accepted Answer

24636. The root bridge's priority is shown in the 'Root ID' section as 'Priority 24636'. This value includes the system ID extension (VLAN 60), so the actual bridge priority is 24636 - 60 = 24576. However, the question asks for the bridge priority as displayed in the output, which is 24636. Option B is correct because the output explicitly lists the root bridge priority as 24636.

Answer

24576

Answer

32768

Answer

32828

Question 13

Given the following policy-map:

policy-map QOS_POLICY
 class VOICE
  priority percent 30
 class VIDEO
  bandwidth percent 20
  queue-limit 100 packets
 class class-default
  fair-queue

What is the effect of the 'priority percent 30' command in the VOICE class?

Accepted Answer

Voice traffic is placed in a strict priority queue with a guaranteed bandwidth of 30% of the interface bandwidth.. The 'priority percent 30' command in the VOICE class configures a strict priority queue (LLQ) that guarantees voice traffic up to 30% of the interface bandwidth. During congestion, voice packets are always transmitted before other traffic, but they are policed to ensure they do not exceed the allocated 30%, preventing starvation of other queues.

Answer

Voice traffic is limited to 30% of the interface bandwidth and will be dropped if exceeded.

Answer

Voice traffic is given a weight of 30 in the weighted fair queueing algorithm.

Answer

Voice traffic is re-marked with IP precedence 30.

Question 14

A network engineer is troubleshooting QoS on a Cisco Nexus 9000 switch. The switch is configured with a policy map that uses a class-default with a bandwidth remaining percent of 100. However, during congestion, traffic in a priority queue (class-map for EF) is experiencing drops even though the priority queue is not fully utilized. What is the most likely cause?

Accepted Answer

The priority queue is implicitly policed to a default rate on Nexus switches. On Cisco Nexus 9000 switches, a priority queue (class-map for EF) is implicitly policed to a default rate of 1 Gbps (or the interface speed, whichever is lower) when no explicit policer is configured. This implicit policing can cause drops in the priority queue even if the queue itself is not fully utilized, because the policer rate limits the traffic before it enters the queue. The class-default bandwidth remaining percent of 100 is unrelated to this issue, as it only affects non-priority queues during congestion.

Answer

The class-default bandwidth remaining percent should be set to 0

Answer

The priority queue is not configured with a queue-limit

Answer

The switch is using strict priority queuing without any shaping

Question 15

A company is migrating its legacy firewall services to a virtualized environment using Cisco NFV. The network engineer deploys a virtual firewall (vFW) on an NFVIS-enabled UCS platform. After the deployment, traffic through the vFW is intermittent and performance monitoring shows high CPU usage on the host. Which action should the engineer take to improve performance?

Accepted Answer

Enable SR-IOV on the physical NICs and assign VFs to the vFW.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch and reducing CPU overhead for packet processing. In an NFVIS environment, high host CPU usage with intermittent traffic indicates that the vFW is consuming excessive CPU cycles due to software-based I/O. Assigning VFs to the vFW offloads packet handling to the NIC hardware, lowering host CPU utilization and stabilizing traffic.

Answer

Increase the number of vCPUs allocated to the vFW VM.

Answer

Configure QoS policies on the vFW to prioritize traffic.

Answer

Disable hyperthreading on the host CPU.

Question 16

An architect is planning a Cisco SD-Access fabric deployment. The design must support host mobility across multiple fabric edge nodes while ensuring consistent policy enforcement. Which fabric component is responsible for tracking endpoint locations and mapping them to the fabric?

Accepted Answer

Fabric control plane node. In Cisco SD-Access, the fabric control plane node (based on LISP) is responsible for maintaining the endpoint database (EID-to-RLOC mappings). When a host moves between fabric edge nodes, the control plane node updates the mapping, ensuring consistent policy enforcement by providing the correct location information to all edge nodes.

Answer

Fabric border node

Answer

Fabric edge node

Answer

Fabric wireless controller

Question 17

An engineer is designing an MPLS L3VPN service for a customer that requires overlapping IP addresses between two sites. The customer uses OSPF as the PE-CE protocol. The engineer configures VRFs on the PE routers and assigns unique route distinguishers (RDs) and route targets (RTs). However, the customer reports that routes from one site are not being installed in the other site's VRF. What is the most likely cause?

Accepted Answer

The route-target export on PE1 does not match the route-target import on PE2.. In MPLS L3VPN, route targets (RTs) control the import and export of VPN routes between VRFs. For routes from one site to be installed in another site's VRF, the route-target export on the exporting PE must match the route-target import on the importing PE. If they do not match, the routes are not imported, even if route distinguishers (RDs) are unique and OSPF is properly configured.

Answer

The overlapping IP addresses cause a routing loop in OSPF.

Answer

OSPF cannot carry overlapping prefixes in different VRFs.

Answer

The route distinguisher is not unique between the two sites.

Question 18

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

Accepted Answer

Configure auto QoS for VoIP on the access ports to ensure proper classification and queuing.. Auto QoS for VoIP automatically configures the necessary class maps, policy maps, and trust settings to properly classify and queue voice traffic (CoS 5) while ensuring data traffic is not starved. The default QoS configuration trusts CoS at the port level, but without proper queuing and scheduling, voice and data may compete for buffers, causing intermittent slow file transfers. Auto QoS sets up strict priority queuing for voice and allocates bandwidth for data, resolving the performance issue without manual misconfiguration.

Answer

Apply a policy map that polices voice traffic to 128 kbps to free bandwidth for data.

Answer

Disable QoS entirely on all switches to eliminate any potential QoS-related drops.

Answer

Configure trust DSCP on the access ports to prioritize all traffic based on DSCP values.

Question 19

Which of the following is used by EIGRP to calculate the feasible distance (FD) of a route?

Accepted Answer

The sum of the advertised distance (AD) of the successor and the link cost to the successor.. EIGRP calculates the Feasible Distance (FD) as the sum of the Advertised Distance (AD) from the successor neighbor and the link cost (metric) to that neighbor. This represents the total metric from the local router to the destination network via that path. The FD is used to determine the best route (successor) and to compare against feasible successors.

Answer

The lowest hop count among all paths to the destination.

Answer

The highest bandwidth among all paths to the destination.

Answer

The sum of all delays along the path.

Question 20

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Accepted Answer

It uses Security Group Tags (SGTs) to classify traffic.. C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

Answer

It uses IPsec to encrypt traffic between network devices.

Answer

It uses VLANs to segment traffic based on security roles.