CCNP Practice Exam 56 — 20 Questions

Question 1

Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

Accepted Answer

Scalable Group Tags (SGTs) are used to enforce micro-segmentation and policy in the fabric.. SD-Access uses Scalable Group Tags (SGTs) to enforce micro-segmentation and policy. SGTs are assigned to endpoints based on identity (e.g., user, device type) and are carried in the VXLAN header. The fabric edge applies policy based on SGTs, not IP addresses. The Cisco ISE provides centralized policy management and authentication. The control plane node does not enforce policy; it only maintains mappings. Policy enforcement is done at the fabric edge, not the border, for traffic within the fabric.

Answer

SGTs are assigned to endpoints based on their IP address only.

Answer

The fabric border node enforces all policies for traffic within the fabric.

Question 2

Drag and drop each MPLS router role on the left to its matching function on the right.

Accepted Answer

LSR: Forwards packets based on label lookups. LSR performs label switching, LER is at the edge, P is a core transit router, PE provides service to CE, and CE is the customer edge.

Question 3

Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.

Accepted Answer

Create route map with match clause. The correct order starts with creating a route map with a match clause, then setting the VRF using the set vrf command, applying the route map to the incoming interface with ip policy route-map, the router matching the traffic, and finally forwarding the packet to the specified VRF.

Question 4

Which three statements about EIGRP packet types are true? (Choose three.)

Accepted Answer

Hello packets are sent unreliably and do not require an acknowledgment.. EIGRP uses five packet types: Hello (neighbor discovery/maintenance), Update (route information), Query (ask neighbors for routes), Reply (response to Query), and ACK (acknowledgment). Hello packets are multicast to 224.0.0.10, unacknowledged, and used to form and maintain adjacencies. Update packets are sent reliably (with ACK) and can be multicast or unicast. Query packets are multicast and require a Reply. ACK packets are unicast and are used to acknowledge reliable packets.

Answer

Update packets are always sent as multicast to all EIGRP neighbors.

Answer

Reply packets are sent unreliably to conserve bandwidth.

Question 5

Which three statements about OSPF LSA types are true? (Choose three.)

Accepted Answer

Type 1 LSAs are generated by every OSPF router to describe its own interfaces and neighbors.. Type 1 LSAs (Router LSAs) are generated by every router and describe the router's directly attached links. Option B is correct because Type 2 LSAs (Network LSAs) are generated by the DR on broadcast and NBMA networks to describe the segment and attached routers. Option C is correct because Type 5 LSAs (AS External LSAs) are generated by ASBRs to advertise external routes. Option D is incorrect because Type 3 LSAs (Summary LSAs) are generated by ABRs, not ASBRs. Option E is incorrect because Type 4 LSAs (ASBR Summary LSAs) are generated by ABRs, not the ASBR itself.

Answer

Type 3 LSAs are generated by ASBRs to summarize routes between areas.

Answer

Type 4 LSAs are generated by the ASBR to advertise its presence to other areas.

Question 6

Drag and drop the steps of Jinja2 template rendering for device config generation into the correct order, from first to last.

Accepted Answer

Import Environment and FileSystemLoader from jinja2. The process begins by importing the Jinja2 Environment and FileSystemLoader, creating an environment with a loader pointing to the template directory, loading the template file, defining a dictionary with variables, and finally calling render() to produce the configuration string.

Question 7

A network engineer writes the following Python script to collect telemetry data from a Cisco IOS-XE device using NETCONF: ```python from ncclient import manager m = manager.connect( host='192.168.1.1', port=830, username='admin', password='cisco', hostkey_verify=False ) filter = ''' GigabitEthernet1 ''' reply = m.get(filter=('subtree', filter)) print(reply.xml) m.close_session() ``` What is the issue with this code?

Accepted Answer

The filter is passed as a string instead of a tuple with filter type.. The filter is passed as a string but the ncclient library expects a tuple with the filter type and the filter content. The correct syntax is filter=('subtree', filter_string). The code passes a single string, which will cause a TypeError.

Answer

The hostkey_verify=False is insecure and should be set to True.

Answer

The interface name should be 'GigabitEthernet0/0' to match Cisco naming.

Answer

The filter XML uses the wrong namespace for interfaces.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology all-links
EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.1.1.0/24, 1 successors, FD is 1310720, serno 5
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
        via 10.2.2.2 (1587200/1310720), GigabitEthernet0/1
P 10.2.2.0/24, 1 successors, FD is 1310720, serno 6
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
        via 10.2.2.2 (1587200/1310720), GigabitEthernet0/1

Based on this output, what can be concluded?

Accepted Answer

The router has two paths to 10.1.1.0/24, but only one is in the routing table.. The output shows that for 10.1.1.0/24, the feasible distance (FD) is 1310720 and there is only one successor (the route via 192.168.1.2). The alternate path via 10.2.2.2 has a reported distance (RD) of 1310720, which equals the FD, so it does not satisfy the feasibility condition (RD < FD) and therefore is not a feasible successor. Only the successor route is installed in the routing table.

Answer

Both routes have a feasible successor via 10.2.2.2.

Answer

The route 10.1.1.0/24 has two successors.

Answer

The alternate path via 10.2.2.2 will be used immediately if the successor fails.

Question 9

Drag and drop each DSCP value on the left to its matching Per-Hop Behavior (PHB) on the right.

Accepted Answer

DSCP 46: EF. DSCP 46 maps to EF (Expedited Forwarding), DSCP 10 maps to AF11 (Assured Forwarding class 1 low drop), DSCP 18 maps to AF21 (Assured Forwarding class 2 low drop), DSCP 26 maps to AF31 (Assured Forwarding class 3 low drop), DSCP 34 maps to AF41 (Assured Forwarding class 4 low drop).

Question 10

A large enterprise uses Cisco SD-WAN with multiple transport clouds (MPLS and Internet). The network team wants to ensure that voice traffic between two branch offices always uses the MPLS link, even if the Internet link has lower latency. The engineer creates a centralized data policy on the vSmart to match voice traffic based on DSCP EF and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that voice traffic is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason for this failure?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. A centralized data policy on the vSmart must include match conditions for both the traffic (e.g., DSCP EF) and the scope of the policy (e.g., VPN list or site list). Without a site list or VPN list match, the policy may not apply to the specific branch-to-branch traffic, causing the vEdge to fall back to the default routing behavior (e.g., using the Internet link if it has lower latency). The vSmart distributes the policy to vEdges, but the vEdge only enforces it for matched traffic within the specified sites or VPNs.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The DSCP EF marking is not supported in SD-WAN data policies.

Question 11

A network engineer writes the following Python script using the Requests library to retrieve interface information from a Cisco IOS-XE device via RESTCONF:

```python
import requests
import json

url = "https://10.1.1.1:443/restconf/data/ietf-interfaces:interfaces"
headers = {
    "Accept": "application/yang-data+json",
    "Content-Type": "application/yang-data+json"
}
auth = ("admin", "password")
response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the primary issue with this code?

Accepted Answer

The 'Content-Type' header is misspelled as 'Contet-Type', which will cause the server to reject the request.. The primary issue is a typo in the 'Content-Type' header: it is written as 'Contet-Type'. RESTCONF requires the correct header to indicate the YANG data format. This misspelling will cause the server to reject the request with a 400 Bad Request error because it does not recognize the media type. The code is otherwise correct for RESTCONF access.

Answer

The URL uses HTTPS but the device only supports HTTP, causing a connection error.

Answer

The 'verify=False' parameter is not valid for the requests library; it should be 'ssl_verify=False'.

Answer

The 'auth' tuple should be passed as a dictionary with 'username' and 'password' keys.

Question 12

A network engineer runs the following command on Router R6:

R6# show ip route vrf CUSTOMER-D

VRF CUSTOMER-D:
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.400
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.400
      192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask
B        192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00

R6# show ip bgp vpnv4 vrf CUSTOMER-D

BGP table version is 5, local router ID is 10.0.0.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0/24   10.0.0.2                 0    100      0 i

Based on this output, what can be concluded?

Accepted Answer

The route 192.168.1.0/24 is installed in the VRF routing table from BGP. The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Answer

The route 192.168.1.0/24 is learned via OSPF

Answer

The next-hop 10.0.0.2 is not reachable

Answer

VRF CUSTOMER-D has no directly connected networks

Question 13

Drag and drop each DNA Center Intent API on the left to its matching use on the right.

Accepted Answer

inventory: Retrieves detailed device information including serial numbers and software versions. Intent APIs: inventory retrieves device details; topology maps network connections; issues identifies network problems; events provides real-time notifications.

Question 14

A network engineer uses the following Python code to subscribe to telemetry data from a Cisco IOS-XE device via NETCONF using the YANG module 'Cisco-IOS-XE-mdt-oper': ```python from ncclient import manager m = manager.connect( host='192.168.1.1', port=830, username='admin', password='cisco', hostkey_verify=False ) # Create a telemetry subscription subscription = '''

400

yang-push encode-kvgpb 5000 /interfaces/interface/state/counters

10.1.1.100

50051 grpc-tcp

''' reply = m.edit_config(target='running', config=subscription) print(reply.xml) m.close_session() ``` What is the issue with this code?

Accepted Answer

The code uses target='running' which may not be writable; it should use target='candidate' and then commit.. The NETCONF edit-config operation with target='running' is used to directly modify the running configuration. However, on many Cisco IOS-XE devices, the running configuration is not directly writable via NETCONF; you must use target='candidate' and then commit. Additionally, the XML namespace for mdt-config-data may be incorrect; the correct namespace is 'http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg' but the module name is 'Cisco-IOS-XE-mdt-cfg'. However, the primary issue is that the code uses target='running' instead of target='candidate' and a separate commit operation.

Answer

The XML namespace is incorrect; it should be 'http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-oper'.

Answer

The xpath is invalid; it should be '/interfaces/interface/state/counters'.

Answer

The subscription-id should be a string, not an integer.

Question 15

Which four statements about multicast group addresses and Layer 2 mapping are true? (Choose four.)

Accepted Answer

The multicast MAC address is derived by placing the lower 23 bits of the multicast IP address into the OUI 01-00-5E.. Multicast IP addresses in the 224.0.0.0/4 range map to Layer 2 MAC addresses using the OUI 01-00-5E. The lower 23 bits of the IP address are placed into the last three bytes of the MAC address, with the 24th bit set to 0. This mapping is not unique, so multiple IP addresses can map to the same MAC (e.g., 224.0.0.1 maps to 01-00-5E-00-00-01, and 224.128.0.1 also maps to the same MAC). Statement A is correct because it describes the derivation. Statement B is correct because of the 23-bit mapping. Statement C is correct: 224.0.0.1 maps to 01-00-5E-00-00-01. Statement D is false because 224.0.0.0/24 is the local network control block used for link-local communication and is not routable across the internet. Statement E is correct: 01-00-5E-00-00-05 corresponds to 224.0.0.5 since the low 23 bits (0.0.5) match.

Answer

The multicast IP address range 224.0.0.0/24 is reserved for global scope and can be routed across the internet.

Question 16

Drag and drop the steps of Cisco NSO service provisioning workflow into the correct order, from first to last.

Accepted Answer

Operator defines service using YANG model. The Cisco NSO workflow starts with the operator defining a service in YANG model. Then NSO maps the service to device configurations using a service template. Next, NSO pushes the configuration to network devices via NETCONF. After that, NSO updates the service database with the operational state. Finally, NSO verifies the service by checking device state and alarms.

Question 17

Drag and drop the steps of LDP session establishment between LSRs into the correct order, from first to last.

Accepted Answer

LSRs send LDP Hello messages (UDP). LDP session establishment starts with discovering neighbors via Hello messages over UDP, then opening a TCP connection. The LSRs exchange initialization parameters over TCP, followed by Keepalive messages to confirm the session. Finally, label mappings are exchanged for FECs.

Question 18

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.

Question 19

Drag and drop the steps of WLC high availability SSO failover steps into the correct order, from first to last.

Accepted Answer

Active WLC fails (power or link loss). In WLC SSO HA, the active WLC fails, triggering the standby to take over. The standby detects the failure via loss of heartbeat and link state. It then assumes the active role, reinitializing interfaces and applying the synchronized configuration. The standby (now active) sends gratuitous ARP to update the network. Finally, client sessions and CAPWAP tunnels are re-established with the new active WLC.

Question 20

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.

Answer

Local Preference

Answer

Weight

Answer

AS Path