CCNP Practice Exam 60 — 20 Questions

Question 1

Drag and drop the steps of OSPF virtual link configuration into the correct order, from first to last.

Accepted Answer

Identify the ABR in the transit area. A virtual link connects a non-backbone area to Area 0 through a transit area. First, identify the ABR with the transit area, then configure the virtual link on both ABRs using the router ID of the neighbor, ensure the transit area has full OSPF adjacency, and finally verify the virtual link is operational.

Question 2

A service provider is migrating from a traditional IP core to an MPLS core. The engineer has configured LDP on all core routers and verified that LDP sessions are established. However, some prefixes learned via OSPF are not being assigned labels. The 'show mpls ldp bindings' command shows missing bindings for certain routes. What is the most likely cause?

Accepted Answer

The routes are not present in the global routing table on the router.. LDP assigns labels to every prefix present in the global routing table by default. If a prefix is not in the routing table (e.g., because it is a directly connected subnet that is not advertised via OSPF or is filtered by a route-map), LDP will not generate a label binding for it. The 'show mpls ldp bindings' command only displays bindings for routes that exist in the routing table, so missing bindings indicate the routes are absent from the global RIB.

Answer

The OSPF process is not redistributed into LDP.

Answer

LDP is configured to only assign labels to BGP routes.

Answer

The 'mpls ldp autoconfig' command is missing on OSPF.

Question 3

Which three statements about Control Plane Policing (CoPP) are true? (Choose three.)

Accepted Answer

CoPP applies QoS policy-map logic to traffic that is destined to the control plane of the router.. Control Plane Policing (CoPP) protects the router's control plane by applying QoS policies to traffic destined to the router itself. It is configured under the 'control-plane' global configuration mode using class-maps and policy-maps. Option C is correct: CoPP can apply to both IPv4 and IPv6 traffic in a single policy-map by using multiple class-maps (one for each protocol). Option D describes data-plane ACLs, not CoPP. Option E is wrong because the default action of CoPP is to drop unmatched traffic, not permit.

Answer

CoPP is applied to traffic transiting the router, not to traffic originated by the router.

Answer

The default action for CoPP is to permit all control-plane traffic.

Question 4

Drag and drop the steps of MST region configuration and operation into the correct order, from first to last.

Accepted Answer

Enter MST configuration mode and set region name. MST configuration begins with entering MST mode and defining the region name, revision number, and VLAN-to-instance mapping. After configuration, the switch computes an MD5 digest of the MST configuration to identify region membership. Switches in the same region then run IST (Internal Spanning Tree) and CIST (Common and Internal Spanning Tree) to elect a root bridge for the region. Finally, per-instance spanning trees are calculated within the region.

Question 5

Which three statements about the Cisco Enterprise WAN design principles are true? (Choose three.)

Accepted Answer

SD-WAN architecture separates the control plane and data plane, allowing centralized policy management.. Enterprise WAN design focuses on connecting remote sites reliably and efficiently. SD-WAN decouples control and data planes for centralized management. Dual-homing provides redundancy. MPLS VPNs offer any-to-any connectivity but with a full mesh of VRFs. Option A is correct because SD-WAN's centralized controller manages policies and path selection. Option B is correct because dual-homing to different provider routers improves availability. Option D is correct because MPLS VPNs use VRFs to isolate customer routing, allowing overlapping addresses. Option C is incorrect because DMVPN uses dynamic tunnels (mGRE/NHRP), not static IPsec tunnels. Option E is incorrect because DMVPN does not require a full mesh; it uses a hub-and-spoke or partial mesh topology.

Answer

DMVPN requires a full mesh of static IPsec tunnels between all spoke routers.

Answer

DMVPN requires a full mesh of IPsec tunnels between all spoke routers.

Question 6

Drag and drop the steps of Rapid PVST+ convergence process into the correct order, from first to last.

Accepted Answer

Elect root bridge and assign port roles (RP, DP, AP). Rapid PVST+ first elects the root bridge and determines port roles. It then uses synchronization handshakes between bridges to quickly transition ports to forwarding without relying on timers. Edge ports (connected to hosts) immediately transition to forwarding. Finally, the topology change notification propagates to update MAC address tables.

Question 7

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Accepted Answer

Configure trust dscp on the ingress interface. First, trust the DSCP on the ingress interface. Then, map DSCP to CoS using a table-map. Apply the table-map in a policy-map. Finally, apply the policy-map to the interface.

Question 8

A network engineer runs the following command on Router R4:

R4# show ip sla monitor statistics 3

Round Trip Time (RTT) for Index 3
Latest RTT: 25 ms
Latest Operation Start Time: 14:30:00.000 UTC Mon Mar 1 2021
Latest Operation Return Code: OK
Number of successes: 100
Number of failures: 0
Over thresholds: 0

Based on this output, what can be concluded about the IP SLA operation?

Accepted Answer

The operation is working correctly with no failures.. The output shows 'Number of successes: 100' and 'Number of failures: 0', with a 'Latest Operation Return Code: OK', indicating that the IP SLA operation has been consistently successful without any failures. The latest RTT of 25 ms and the absence of threshold violations confirm the operation is working correctly.

Answer

The operation has experienced failures.

Answer

The operation is currently failing.

Answer

The round-trip time exceeds the threshold.

Question 9

A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?

Accepted Answer

Chef client. In a Chef-managed brownfield environment with Cisco IOS XE devices, the Chef client is the agent that runs on each device (or on a proxy like a guest shell) and applies the desired state defined in cookbooks. It is responsible for converging the device's configuration to match the policy, making it the correct component for state management.

Answer

Ohai

Answer

Chef workstation

Answer

Chef server

Question 10

A network engineer is using Cisco DNA Center to automate the deployment of a new VLAN across multiple access switches. The engineer creates a new network profile with the VLAN definition and assigns it to a site. However, after provisioning, the VLAN is not created on any of the switches. The engineer verifies that the devices are in the Inventory and are reachable. What is the most likely cause?

Accepted Answer

The engineer did not run the Provision workflow to push the configuration to the devices.. In Cisco DNA Center, network profiles are used to define settings, but they must be applied to a site and then the devices must be provisioned with that site's settings. If the engineer only created the profile and assigned it to a site, but did not run the provisioning workflow (which pushes the configuration to devices), the VLAN will not be created.

Answer

The VLAN ID conflicts with an existing VLAN on the switches.

Answer

The switches do not support the VLAN ID range.

Answer

The DNA Center appliance is not licensed for the Automation module.

Question 11

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

Accepted Answer

FlexConnect. FlexConnect (option D) is the correct architecture because it allows client data traffic to be switched locally at the remote site, while the control plane remains centralized. This design eliminates the need for a central controller to process every roaming event, as clients can roam between FlexConnect APs using local switching and 802.11r (Fast Roaming) without requiring a WLC in the data path.

Answer

Mesh networking

Answer

Autonomous APs

Answer

Centralized switching with a WLC

Question 12

Drag and drop the steps of MPLS LDP label distribution and FIB population into the correct order, from first to last.

Accepted Answer

Converge IGP (e.g., OSPF or IS-IS). First, IP routing must be operational so that the IGP converges. Then LDP is enabled on interfaces and forms neighbor relationships. LDP then assigns local labels to FECs and advertises them to neighbors. The remote label is received and installed in the LIB. Finally, the LFIB is populated with the best label bindings for forwarding.

Question 13

Drag and drop each VRF-Lite or MPLS VPN characteristic on the left to its matching description on the right.

Accepted Answer

VRF-Lite: Uses trunk ports and subinterfaces to separate traffic without MPLS. VRF-Lite uses only local VRFs without MPLS or MP-BGP, requiring trunk links; MPLS VPN uses MPLS labels and MP-BGP for scalable path isolation; VRF-Lite is simpler but limited to a single router or switch; MPLS VPN scales across an entire provider network; VRF-Lite does not support overlapping address spaces between sites without NAT.

Question 14

Given the following Ansible playbook snippet:
---
- name: Backup running config
  hosts: routers
  gather_facts: no
  tasks:
    - name: Save config
      ios_config:
        backup: yes
        backup_options:
          dir_path: /backup/
What is the purpose of the 'backup_options' parameter?

Accepted Answer

It specifies the directory where the backup file will be saved.. The 'backup_options' parameter in the ios_config module allows you to customize the backup behavior. Specifically, the 'dir_path' sub-option defines the directory path where the backup file will be saved. Without this parameter, the backup file is saved in the default location (the 'backup' subdirectory of the playbook's root directory). Option A correctly identifies this purpose.

Answer

It specifies the filename for the backup.

Answer

It enables compression of the backup file.

Answer

It is ignored because backup: yes is already set.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list
  Inbound  access list is not set
  Outbound access list is 140

R1# show access-lists 140
Extended IP access list 140
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    20 deny tcp any any eq 443 (10 matches)
    30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.. The ACL 140 is applied outbound on GigabitEthernet0/1. It permits TCP port 443 (HTTPS) traffic only from source 192.168.1.0/24, then denies all other HTTPS traffic, and finally permits all other IP traffic. Since the deny statement (line 20) blocks HTTPS from any source not matching the permit (line 10), traffic from outside 192.168.1.0/24 is denied when exiting the interface, making option A correct.

Answer

All HTTPS traffic is permitted outbound.

Answer

The ACL is applied inbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 16

Drag and drop the steps of troubleshooting a failed EtherChannel bundle into the correct order, from first to last.

Accepted Answer

Verify port-channel interface exists with show running-config. First, verify that the port-channel interface exists. Then check that physical ports are in the same VLAN and have matching configurations. Next, confirm that the channel-group mode is compatible on all ports. After that, inspect LACP or PAgP counters for errors. Finally, check for hardware or cabling issues if all else fails. This systematic approach isolates configuration errors before hardware faults.

Question 17

Drag and drop the steps of MPLS traffic engineering (MPLS-TE) tunnel setup into the correct order, from first to last.

Accepted Answer

Configure IGP with TE extensions (OSPF TE or IS-IS TE). First, IGP must be configured with TE extensions (e.g., OSPF TE) to flood link attributes. Then MPLS-TE is enabled on interfaces. The headend router computes a path using CSPF based on constraints. The tunnel interface is configured with the destination and constraints. Finally, RSVP-TE signals the LSP and reserves bandwidth along the path.

Question 18

Drag and drop the steps of PPPoE session establishment into the correct order, from first to last.

Accepted Answer

Client sends PADI broadcast. PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

Question 19

Drag and drop the steps of configuring a native VLAN mismatch detection into the correct order, from first to last.

Accepted Answer

Configure native VLAN 10 on trunk interface. First, configure mismatched native VLANs: configure neighbor trunk with native VLAN 20 (B) and then configure native VLAN 10 on the local trunk interface (A). Then, CDP detects the mismatch and reports an error (C). The switch then error-disables the trunk port (D). Finally, fix the mismatch by setting both sides to the same native VLAN (E).

Question 20

Which two statements about LISP in Cisco SD-Access are true? (Choose two.)

Accepted Answer

The LISP Map Server stores the mapping between endpoint identifiers (EIDs) and routing locators (RLOCs).. LISP (Locator/ID Separation Protocol) is the control plane in SD-Access. The Map Server (MS) maintains the EID-to-RLOC mapping database, and the Map Resolver (MR) handles Map-Request queries. The EID represents the endpoint identity (IP address), while the RLOC is the routing locator (IP address of the fabric node). LISP does not perform encapsulation; VXLAN does. LISP uses UDP ports 4342 (data plane) and 4341 (control plane), not TCP. The EID is typically the host IP, not the MAC address.

Answer

LISP encapsulation is used to forward data traffic between fabric edge nodes.

Answer

LISP uses TCP port 4342 for control plane communication.

Answer

The EID in LISP represents the MAC address of the endpoint device.