CCNP Practice Exam 58 — 20 Questions

Question 1

What is the default OSPF reference bandwidth used for cost calculation in Cisco IOS?

Accepted Answer

100 Mbps. In Cisco IOS, the default OSPF reference bandwidth is 100 Mbps. OSPF calculates the cost of an interface as the reference bandwidth divided by the interface bandwidth. With the default reference of 100 Mbps, a FastEthernet (100 Mbps) interface gets a cost of 1, which is the minimum cost. This default was established when FastEthernet was considered high-speed, but it can be changed using the 'auto-cost reference-bandwidth' command to accommodate faster links like GigabitEthernet.

Answer

1000 Mbps

Answer

10 Mbps

Answer

1 Mbps

Question 2

A network team must design QoS for a campus network that carries voice, video, and data traffic. The design must use the DiffServ model and ensure that voice traffic is prioritized over all other traffic classes. Which DSCP marking and queuing strategy should be used for voice?

Accepted Answer

Mark voice with EF and place in a strict priority queue.. Voice traffic requires strict priority to ensure minimal jitter and latency. DSCP EF (Expedited Forwarding, per RFC 3246) is the standard marking for real-time traffic like voice, and placing it in a strict priority queue (LLQ) guarantees that voice packets are serviced before any other queue, which is essential for meeting QoS requirements in a DiffServ model.

Answer

Mark voice with AF41 and place in a weighted fair queue.

Answer

Mark voice with CS3 and place in a low-latency queue.

Answer

Mark voice with BE and rely on WRED for drop precedence.

Question 3

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Accepted Answer

It uses Security Group Tags (SGTs) to classify traffic.. C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

Answer

It uses IPsec to encrypt traffic between network devices.

Answer

It uses VLANs to segment traffic based on security roles.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "ospf 1", distance 110, metric 20, type inter area
  Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago
      Route metric is 20, traffic share count is 1

Based on this output, what can be concluded?

Accepted Answer

The route is an OSPF inter-area route. The output shows 'type inter area' and a metric of 20, which is the default OSPF metric for inter-area routes (type 3 LSAs). The administrative distance of 110 confirms OSPF as the routing protocol. Therefore, the route is an OSPF inter-area route, making option B correct.

Answer

The route is an OSPF intra-area route

Answer

The route is an OSPF external route

Answer

The route is learned via EIGRP

Question 5

Drag and drop the steps of OpenAPI schema validation for DNA Center REST call into the correct order, from first to last.

Accepted Answer

Retrieve OpenAPI specification. The correct order begins with retrieving the OpenAPI specification from DNA Center, then parsing the endpoint definition, validating the request parameters against the schema, checking the response structure, and finally confirming compliance with the API contract.

Question 6

Drag and drop the steps of BGP session establishment between eBGP peers into the correct order, from first to last.

Accepted Answer

TCP SYN sent from active peer. BGP session establishment begins with the TCP three-way handshake (SYN, SYN-ACK, ACK). Once TCP is established, BGP sends an OPEN message to negotiate capabilities. The peer responds with an OPEN message. After both OPENs are exchanged, BGP sends KEEPALIVE messages. Finally, the session moves to the Established state and UPDATE messages can be exchanged.

Question 7

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

Accepted Answer

Each VDC can have its own admin account and separate management interface.. Each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

Answer

VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

Answer

VDCs provide Layer 3 routing isolation by default across all VDCs.

Answer

VDCs are supported on all Cisco IOS-XE switches.

Question 8

Consider the following configuration snippet:

policy-map QOS_POLICY
 class VOICE
  priority percent 30
 class VIDEO
  bandwidth percent 20
  queue-limit 50 packets
 class class-default
  fair-queue
  queue-limit 100 packets

What is the effect of this configuration?

Accepted Answer

The VOICE class traffic is always sent before other classes, but if it exceeds 30% of the interface bandwidth, excess traffic is dropped.. The 'priority percent 30' command under the VOICE class enables strict priority queuing, meaning VOICE traffic is always transmitted before any other class. However, the priority queue is policed at 30% of the interface bandwidth; any traffic exceeding this rate is dropped, not queued. This is a fundamental behavior of the priority command in Cisco IOS — excess priority traffic is dropped to prevent starvation of other queues.

Answer

The VOICE class traffic is always sent before other classes, and excess traffic beyond 30% is queued in the default class.

Answer

The VIDEO class traffic is treated with strict priority after the VOICE class.

Answer

The class-default uses Weighted Fair Queuing with a maximum queue size of 100 packets, and all classes share the remaining bandwidth equally.

Question 9

A network engineer runs the following command on a Cisco WLC:

WLC# show client summary

Client MAC Address   AP Name     WLAN   State   Protocol   RSSI   SNR
00:11:22:33:44:55   AP-1       1      Run     802.11ac   -65    25
00:11:22:33:44:66   AP-2       2      Run     802.11n    -70    20
00:11:22:33:44:77   AP-1       1      Run     802.11ac   -60    30
00:11:22:33:44:88   AP-3       3      Probe   802.11ax   -75    15

Based on this output, what can be concluded?

Accepted Answer

The client with MAC 00:11:22:33:44:88 is attempting to associate but is not yet connected.. The client with MAC 00:11:22:33:44:88 is in the 'Probe' state, which indicates it has sent a probe request and is attempting to associate with the WLC, but it has not yet completed the association process or transitioned to the 'Run' state. Only clients in the 'Run' state are fully associated and passing traffic, making option B correct.

Answer

All clients are fully associated and passing traffic.

Answer

The client with MAC 00:11:22:33:44:55 has the best signal strength.

Answer

All clients are using 802.11ac or higher.

Question 10

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

Accepted Answer

Google Protocol Buffers (GPB) encoding.. Google Protocol Buffers (GPB) is the correct encoding because it provides a compact, binary serialization format that minimizes bandwidth and CPU overhead, making it ideal for high-volume streaming telemetry. Cisco IOS-XE devices support GPB encoding natively for model-driven telemetry, allowing efficient data transmission to analytics platforms like Kafka.

Answer

JSON encoding.

Answer

XML encoding.

Answer

CSV encoding.

Question 11

An enterprise network uses OSPF as its IGP. The network engineer notices that a particular route learned via OSPF is not being installed in the routing table, even though the neighbor adjacency is up and the route appears in the OSPF database. The route is an external route redistributed from EIGRP. What is the most likely cause?

Accepted Answer

The forwarding address in the type 5 LSA is not reachable via an OSPF internal route.. OSPF requires the forwarding address (FA) in a Type 5 LSA to be reachable via an OSPF internal route (intra-area or inter-area) for the external route to be installed in the routing table. If the FA is not reachable, the router will ignore the LSA and not install the route, even though the LSA exists in the OSPF database and the neighbor adjacency is up.

Answer

The OSPF process ID is different on the routers.

Answer

The external route has a higher administrative distance than the internal route.

Answer

The OSPF metric for the external route is too high.

Question 12

A network engineer is configuring a Cisco SD-WAN solution for a retail chain with hundreds of stores. The engineer wants to use a centralized data policy to steer all YouTube traffic to a specific WAN link (broadband) to save MPLS bandwidth. The engineer creates a policy that matches YouTube traffic by destination IP and sets the preferred color to 'biz-internet'. After applying the policy, the engineer tests and finds that YouTube traffic is still using the MPLS link. The vEdge routers show that the policy is received and active. What is the most likely reason?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. A centralized data policy in Cisco SD-WAN must include match conditions for both the VPN (service-side VRF) and the site list to which the policy applies. Without specifying the correct VPN or site list, the policy may be received and active on the vEdge but will not match the traffic flows, causing them to fall through to the default routing behavior (e.g., MPLS). The policy matches destination IPs, but if the VPN or site scope is missing or incorrect, the vEdge will not apply the policy to the relevant traffic.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

YouTube traffic is encrypted and cannot be matched by destination IP.

Question 13

Examine the following Python script that uses the netmiko library to send configuration commands to a Cisco IOS-XE device:

```python
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
}

connection = ConnectHandler(**device)
config_commands = [
    'interface GigabitEthernet1/0/1',
    'description Link to Core',
    'ip address 10.1.1.1 255.255.255.0',
    'no shutdown'
]
output = connection.send_config_set(config_commands)
print(output)
connection.disconnect()
```

What is the purpose of this script?

Accepted Answer

It configures interface GigabitEthernet1/0/1 with a description, IP address, and enables it.. The script uses Netmiko's `send_config_set()` method to push a list of configuration commands to the device. The commands configure interface GigabitEthernet1/0/1 with a description, assign an IP address, and issue `no shutdown` to enable the interface. This matches option B exactly.

Answer

It retrieves the running configuration of the device.

Answer

It saves the configuration to the startup configuration.

Answer

It tests connectivity to the device using ping.

Question 14

Given the following configuration on a Cisco IOS router:

policy-map SHAPE
 class class-default
  shape average 1000000

interface Serial0/0/0
 service-policy output SHAPE

What is the effect of this configuration?

Accepted Answer

The router will limit the transmit rate on Serial0/0/0 to an average of 1 Mbps by queuing excess packets.. The configuration applies a shaping policy to the Serial0/0/0 interface, which limits the transmit rate to an average of 1 Mbps. Shaping works by queuing excess packets that exceed the configured rate, smoothing the traffic burst and preventing packet loss due to interface congestion. This is why Option A is correct.

Answer

The router will drop any traffic exceeding 1 Mbps on Serial0/0/0.

Answer

The router will mark all traffic with a rate limit of 1 Mbps but not enforce it.

Answer

The configuration is invalid because 'shape average' requires a class-map with a match statement.

Question 15

Match each wireless standard to its frequency band and maximum data rate.

Accepted Answer

802.11b: 2.4 GHz, 11 Mbps. The correct matches are: 802.11b with 2.4 GHz / 11 Mbps; 802.11g with 2.4 GHz / 54 Mbps; 802.11n with 2.4/5 GHz / 600 Mbps; 802.11ac with 5 GHz / 1.3 Gbps. Common confusions arise from mixing up data rates or frequency bands across generations.

Answer

802.11b: 5 GHz, 54 Mbps

Answer

802.11g: 2.4 GHz, 11 Mbps

Question 16

Match each Cisco IOS command to its function.

Accepted Answer

show ip route: Displays the IP routing table. The correct matches are: show ip route displays the routing table, show ip interface brief summarizes interface status, ping tests connectivity, and traceroute traces the path. Common confusions arise from swapping the functions of show ip route and ping.

Answer

show ip route: Tests network connectivity

Answer

ping: Displays the IP routing table

Question 17

Match each First Hop Redundancy Protocol (FHRP) to its description.

Accepted Answer

HSRP: A Cisco-proprietary FHRP that uses an active/standby model with a virtual IP and MAC address, disabled preemption by default.. FHRPs provide default gateway redundancy. HSRP is Cisco proprietary, active/standby, preemption disabled by default. VRRP is open standard, preemption enabled. GLBP allows load balancing among multiple routers.

Answer

HSRP: An open standard FHRP that uses a virtual IP and MAC, preemption enabled.

Answer

VRRP: A Cisco-proprietary FHRP that uses active/standby model.

Answer

GLBP: An FHRP that uses active/standby model with no load balancing.

Question 18

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

Accepted Answer

The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.. When a port is configured as a SPAN destination port, the switch automatically disables normal switching (Layer 2 forwarding) on that interface. This is because the destination port is dedicated to receiving mirrored copies of traffic from the source port and forwarding them to an external monitoring device. As a result, the destination port will not forward any normal traffic, which explains the engineer's observation.

Answer

The destination port must be configured as a trunk port to forward SPAN traffic.

Answer

The destination port must be configured as an access port to forward SPAN traffic.

Answer

The destination port is in an err-disabled state due to a loop.

Question 19

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.. The scenario states that DHCP snooping is configured globally and on VLAN 10, and that GigabitEthernet0/1 is connected to the DHCP server. However, for DHCP snooping to allow DHCP server messages (OFFER, ACK) to be forwarded, the interface connected to the legitimate DHCP server must be explicitly configured as a trusted port using the 'ip dhcp snooping trust' interface command. Without this, the switch treats all DHCP server responses as untrusted and drops them, preventing clients from receiving IP addresses.

Answer

The switch has IP Source Guard enabled, blocking valid DHCP traffic.

Answer

The DHCP server is on a different subnet and the switch lacks an IP helper address.

Answer

The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.

Question 20

Given the following SD-WAN CLI output on a Cisco IOS-XE router:

show sdwan omp routes

10.1.1.0/24, received, admin-distance: 250
   via 10.0.0.1, interface GigabitEthernet0/0/1, color biz-internet, loss: 0, latency: 10
   via 10.0.0.2, interface GigabitEthernet0/0/2, color 3g, loss: 1, latency: 50

Which statement is true?

Accepted Answer

The route via 10.0.0.1 (biz-internet) is preferred because it has lower loss and latency.. OMP (Overlay Management Protocol) in Cisco SD-WAN selects the best path based on the lowest path cost, which is calculated using metrics such as loss, latency, and jitter. In this output, the route via 10.0.0.1 (biz-internet) has loss 0 and latency 10, which is lower than the route via 10.0.0.2 (3g) with loss 1 and latency 50, making it the preferred path. The admin-distance of 250 is specific to OMP routes and does not affect this comparison.

Answer

The route via 10.0.0.2 (3g) is preferred because it has a higher latency, which indicates a more stable path.

Answer

Both routes are equally preferred because OMP uses ECMP by default.

Answer

The admin-distance of 250 indicates that these routes are learned via BGP.