CCNP Practice Exam 57 — 20 Questions

Question 1

Drag and drop each SD-Access layer on the left to its matching technology on the right.

Accepted Answer

Underlay: IS-IS routing protocol for physical network connectivity. The underlay uses IS-IS for physical connectivity, the overlay uses VXLAN and LISP for encapsulation and location mapping, and the policy layer uses CTS for SGT-based segmentation.

Question 2

Drag and drop each Ansible component on the left to its matching function on the right.

Accepted Answer

Inventory: Defines the managed nodes and their groups. Inventory defines managed nodes; playbook is a YAML file of tasks; role is a reusable set of tasks; module is a Python script for a specific action; handler is a task triggered by a notify.

Question 3

Which two statements about 802.1X port states and access control are true? (Choose two.)

Accepted Answer

Before authentication, the switch port is in the unauthorized state and only allows EAPOL frames.. In 802.1X, the switch port starts in the unauthorized state, allowing only EAPOL traffic. After successful authentication, the port transitions to the authorized state, allowing normal traffic. Multi-auth mode allows multiple devices on the same port, each authenticated individually. The port does not become fully authorized before the client sends traffic.

Answer

In multi-auth mode, the port becomes authorized for all devices once the first device authenticates successfully.

Answer

The port remains in the unauthorized state until the client sends data traffic.

Answer

802.1X can be configured on a Layer 3 interface to authenticate users before routing.

Question 4

Drag and drop the steps of configuring NETCONF YANG-based telemetry with on-change subscription into the correct order, from first to last.

Accepted Answer

Enable NETCONF on the device. First, enable NETCONF on the device. Then, define a sensor group that includes the YANG paths to monitor for changes. Next, create a subscription that specifies the sensor group, a receiver, and the on-change update policy. After that, apply the subscription to activate it. Finally, the device sends updates only when the monitored data changes.

Question 5

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Accepted Answer

Apply a standard ACL to the vty lines.. A standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Answer

Apply an extended ACL to the vty lines.

Answer

Apply a named ACL to the interface.

Answer

Apply an ACL to the console line.

Question 6

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Accepted Answer

Step 1: Enable port security (switchport port-security), Step 2: Set maximum MAC addresses (switchport port-security maximum), Step 3: Define secure MAC addresses (switchport port-security mac-address sticky or static), Step 4: Configure violation mode (switchport port-security violation shutdown/restrict/protect). Port security limits unauthorized MAC addresses; violation mode defines action on violation.

Answer

Step 1: Set maximum MAC addresses, Step 2: Enable port security, Step 3: Define secure MAC addresses, Step 4: Configure violation mode

Answer

Step 1: Configure violation mode, Step 2: Enable port security, Step 3: Set maximum MAC addresses, Step 4: Define secure MAC addresses

Answer

Step 1: Enable port security, Step 2: Define secure MAC addresses, Step 3: Set maximum MAC addresses, Step 4: Configure violation mode

Question 7

Which two statements about Ansible inventory and variables are true? (Choose two.)

Accepted Answer

The 'ansible_host' variable can be used to specify the IP address or FQDN for a managed node.. Group variables can be defined in group_vars/ files or directly in the inventory. Host variables can be set inline in the inventory or in host_vars/. The 'ansible_host' variable overrides the hostname for SSH connection. Variables defined in playbooks override inventory variables. Ansible facts are gathered automatically unless disabled.

Answer

Variables defined in the inventory file override variables defined in group_vars/ for the same group.

Answer

Host variables can be defined in the inventory file using the 'host_vars' directory.

Answer

Ansible facts are only gathered when the 'gather_facts: no' option is set in the playbook.

Question 8

Drag and drop each Ansible task return value on the left to its matching meaning on the right.

Accepted Answer

changed: The task made a change to the target system. changed indicates a modification was made, ok means no change but success, failed means error, skipped means condition not met, and unreachable means host could not be contacted.

Question 9

Which three statements about Ansible roles and directory structure are true? (Choose three.)

Accepted Answer

A role must contain at least a 'tasks' directory with a main.yml file to be functional.. Ansible roles have a predefined directory structure including tasks, handlers, vars, defaults, files, templates, and meta. Roles can be shared via Ansible Galaxy. The 'defaults' directory contains lowest-priority variables. The 'meta' directory defines role dependencies.

Answer

Variables defined in the 'defaults' directory of a role have the highest precedence.

Answer

Roles cannot be shared or reused across different Ansible projects.

Question 10

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Accepted Answer

Launch job template from Tower UI or API. Ansible Tower job template execution starts with launching the job template; then, Tower provisions an isolated execution environment; next, it checks out the project from the source control; after that, it runs the playbook against the specified inventory; finally, it collects and displays job results and logs.

Question 11

Drag and drop the steps of Ansible Vault encryption and decryption steps into the correct order, from first to last.

Accepted Answer

Create vault password file for authentication. Ansible Vault encryption starts with creating a password file; then, encrypting a plaintext file with ansible-vault encrypt; next, viewing the encrypted content with ansible-vault view; after that, decrypting the file for editing with ansible-vault decrypt; finally, re-encrypting after modifications.

Question 12

Given the following Ansible playbook snippet:
---
- name: Configure SNMP
  hosts: routers
  gather_facts: no
  tasks:
    - name: SNMP community
      ios_config:
        lines:
          - snmp-server community public RO
What is the result of this playbook?

Accepted Answer

It configures an SNMP community string 'public' with read-only access.. The playbook uses ios_config to add a line globally. The command 'snmp-server community public RO' configures an SNMP community string 'public' with read-only access. This is a valid global configuration command.

Answer

It fails because 'RO' is not a valid keyword; it should be 'read-only'.

Answer

It configures the community string only for SNMPv3.

Answer

It removes any existing SNMP community strings.

Question 13

Drag and drop the steps of Ansible role directory structure and task execution into the correct order, from first to last.

Accepted Answer

Create role directory with tasks/main.yml. Ansible roles follow a standard directory layout: tasks/main.yml is executed first, then handlers are notified, defaults provide variables, vars override defaults, and templates are rendered for configuration files.

Question 14

Drag and drop the steps of cisco.ios.ios_config module idempotent apply flow into the correct order, from first to last.

Accepted Answer

Establish SSH connection to Cisco device. The cisco.ios.ios_config module first connects to the device; then, it retrieves the running configuration; next, it compares the desired config lines with the running config; after that, it applies only the lines that are missing or different; finally, it saves the configuration if the save parameter is set.

Question 15

Drag and drop the steps of creating and applying an Ansible role for network device configuration into the correct order, from first to last.

Accepted Answer

Create role directory structure with subdirectories. First, define the role structure with defaults, vars, tasks, and handlers. Then, write the tasks in main.yml to configure interfaces. Next, set default variables in defaults/main.yml. After that, create a playbook that references the role. Finally, execute the playbook against the target inventory.

Question 16

Drag and drop the steps of using Ansible to push a new VLAN configuration to a Cisco IOS switch into the correct order, from first to last.

Accepted Answer

Define VLAN variables in group_vars file. First, define the VLAN ID and name in a variable file. Then, write a playbook task using ios_vlan module. Next, specify the connection parameters (ansible_network_os, ansible_user, etc.) in the inventory. After that, run the playbook to apply the configuration. Finally, verify the VLAN on the switch using show vlan.

Question 17

Which three statements about Ansible playbooks are true? (Choose three.)

Accepted Answer

A playbook must contain at least one play, and each play must specify a 'hosts' key.. Playbooks are YAML files containing plays, each mapped to a host group. They support variables, conditionals, and loops. The 'hosts' key defines target groups, and 'tasks' lists modules to execute. Playbooks can include other playbooks or roles.

Answer

A playbook can only contain a single play.

Answer

Playbooks must be executed with the 'ansible' command, not 'ansible-playbook'.

Question 18

Which two statements about Ansible inventory files are true? (Choose two.)

Accepted Answer

Ansible can use a dynamic inventory script that queries an external source such as AWS EC2.. Ansible inventory files can be static (INI/YAML) or dynamic (script or plugin). The default location is /etc/ansible/hosts. INI format uses [group] headers and YAML uses a structured hierarchy. Dynamic inventories pull from external sources like cloud APIs.

Answer

Ansible inventory files can only be written in INI format.

Answer

Group variables in an inventory must be defined in separate files under the group_vars directory.

Answer

The inventory file can only contain hostnames, not IP addresses.

Question 19

Drag and drop the steps of Ansible Vault encryption and decryption steps into the correct order, from first to last.

Accepted Answer

Create vault password file 'vault_pass'. To use Ansible Vault, you first create a password file, then encrypt a plaintext file, optionally edit it while encrypted, and finally decrypt it when needed, with the playbook referencing the vault password at runtime.

Question 20

A network engineer runs the following command on Switch SW8:

SW8# show monitor session 8
Session 8
---------
Type                   : Remote Source Session
Source VLANs           :
    Both               : 30
Destination Ports     : Gi1/0/30
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

All traffic on VLAN 30 is mirrored and sent to a remote VLAN via Gi1/0/30.. The output shows a Remote Source SPAN (RSPAN) session, where traffic on VLAN 30 (both sent and received) is replicated and sent out destination port Gi1/0/30. The 'Encapsulation: Replicate' indicates that the mirrored frames are forwarded unchanged to the destination port, which is typically connected to an RSPAN VLAN for transport to a remote monitoring device. Therefore, all traffic on VLAN 30 is mirrored and sent via Gi1/0/30 to a remote VLAN.

Answer

This is a local SPAN session that monitors VLAN 30.

Answer

Only received traffic on VLAN 30 is captured.

Answer

The destination port Gi1/0/30 is used to receive mirrored traffic.