CCNP Practice Exam 61 — 20 Questions

Question 1

Consider the following partial configuration on Router R1:

ip sla 5
 icmp-echo 10.5.5.5
 frequency 10
ip sla schedule 5 life forever start-time now
ip sla reaction-configuration 5 react rtt threshold-type immediate threshold-value 200 action-type triggerAndReset

What is the effect of the 'action-type triggerAndReset' parameter?

Accepted Answer

It triggers an event each time the RTT exceeds 200 ms and resets the counter after each trigger.. The 'action-type triggerAndReset' parameter in the IP SLA reaction configuration causes the router to generate an event (e.g., a syslog message or SNMP trap) each time the measured round-trip time (RTT) exceeds the specified threshold of 200 ms. After each trigger, the monitoring state is reset, allowing the router to continue monitoring and trigger again on subsequent threshold violations. This is why option B is correct.

Answer

It triggers an event once and then stops monitoring.

Answer

It triggers an event only if the RTT exceeds 200 ms for 5 consecutive probes.

Answer

It triggers an event and then immediately stops the IP SLA operation.

Question 2

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Accepted Answer

start-time: Defines when the operation begins. start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration; ageout removes the operation after inactivity; recurring repeats the schedule daily.

Question 3

An engineer is using the Cisco SD-WAN vManage REST API to retrieve the list of WAN edge devices. The engineer sends a GET request to 'https://vmanage/dataservice/device' and receives a 401 Unauthorized error. The engineer has already obtained a JSESSIONID cookie by authenticating with the API. What is the most likely cause of the error?

Accepted Answer

The JSESSIONID cookie must be included in the request headers for authentication.. A 401 error indicates that authentication is required or has failed. Even with a JSESSIONID cookie, the engineer must include it in the request headers. Additionally, vManage APIs often require a CSRF token for state-changing operations, but for GET requests, the JSESSIONID should suffice. The most likely cause is that the cookie is not being sent with the request, or the session has expired.

Answer

The engineer must use a different authentication method, such as OAuth2, instead of cookies.

Answer

The URI is incorrect; the correct URI should be 'https://vmanage/dataservice/device/wanedge'.

Answer

The engineer must include a CSRF token in the request header for GET requests.

Question 4

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 5

Drag and drop the steps of the QoS trust boundary configuration process into the correct order, from first to last.

Accepted Answer

Enable trust on the interface (e.g., trust cos). The trust boundary process starts by enabling trust on the interface, then optionally setting a default CoS/DSCP for untrusted traffic, and finally applying a service policy to enforce policing or marking. Verification ensures the trust boundary is correctly applied.

Question 6

A network engineer is deploying IP multicast in an OSPF-based enterprise network. The network uses PIM sparse mode with a static RP. The engineer notices that multicast traffic from a source to a group is not reaching receivers in a remote subnet, even though the RP is reachable and the receivers have sent IGMP joins. The engineer checks the multicast routing table on the last-hop router and sees that the (S,G) entry is present, but the outgoing interface list (OIL) is empty. What is the most likely reason for the empty OIL?

Accepted Answer

The RP is not configured on the last-hop router.. In PIM sparse mode, the last-hop router must have the RP address configured (either statically or via Auto-RP/BSR) to send PIM join messages toward the RP for the multicast group. Without the RP configured, the router cannot initiate the shared tree join, so even though the (S,G) entry exists (learned via IGMP or data-driven events), the outgoing interface list (OIL) remains empty because the router has no path to forward traffic downstream. The fact that the RP is reachable does not substitute for the explicit RP configuration on the last-hop router.

Answer

The multicast source is not registered with the RP.

Answer

PIM dense mode is enabled on the last-hop router.

Answer

The TTL of the multicast packets is too low.

Question 7

Drag and drop the steps of VNF life cycle management into the correct order, from first to last.

Accepted Answer

Onboard VNF package into NFVI. The correct order follows the ETSI NFV lifecycle: first onboard the VNF package, then instantiate the VNF, configure the VNF, scale the VNF as needed, and finally terminate the VNF when no longer required.

Question 8

A network administrator is troubleshooting an issue where OSPF routes are not being learned from a neighbor. The administrator checks the OSPF configuration and sees that both routers are in the same area. The neighbor state is stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU does not match.. When OSPF neighbors are stuck in the EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange process. The most common cause is an MTU mismatch between the interfaces, because OSPF will not proceed to the Exchange state if the DBD packet is larger than the interface MTU and gets silently dropped. This prevents the routers from agreeing on the master/slave relationship and exchanging link-state information.

Answer

The router ID is the same on both routers.

Answer

The area ID is different.

Answer

The hello timer is set to 30 seconds on one router.

Question 9

An enterprise network has two routers, R1 and R2, both running BGP. R1 is an eBGP speaker with ISP1, and R2 is an eBGP speaker with ISP2. Both routers are in the same AS 65000. The engineer wants to ensure that traffic from the enterprise to the Internet prefers the path through ISP1 when both links are up. R1 learns a default route from ISP1, and R2 learns a default route from ISP2. Which BGP attribute should the engineer modify on R1 to influence outbound traffic selection?

Accepted Answer

Set a higher local preference on R1 for the default route learned from ISP1.. Local preference is the BGP attribute used to influence outbound traffic from an AS. It is propagated within the AS and a higher value is preferred. By setting a higher local preference on R1 for the default route learned from ISP1, R1 will prefer that route over the default route from ISP2, ensuring traffic from the enterprise to the Internet exits via ISP1.

Answer

Set a lower MED on R1 for the default route learned from ISP1.

Answer

Prepend AS 65000 multiple times on R2's updates to ISP2.

Answer

Configure a community on R1 to mark the default route as no-export.

Question 10

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Accepted Answer

Define prefix-list for more-specific routes. The correct order for BGP route aggregation with suppress-map is: first, define a prefix-list to match the more-specific routes you want to suppress. Second, create a route-map with a suppress clause that references the prefix-list. Third, configure the aggregate-address in BGP under the address-family. Fourth, apply the suppress-map to the aggregate-address command (typically as part of the aggregate-address command itself). Finally, verify the summary route and the suppressed routes.

Question 11

Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.

Accepted Answer

Create VRF and assign route distinguisher. First, you create the VRF and assign an RD. Then, you configure the NAT inside and outside interfaces under the VRF. Next, you define the NAT pool and access list for translation. After that, you apply the NAT rules with 'ip nat inside source' referencing the VRF. Finally, you verify NAT translations using 'show ip nat translations vrf'.

Question 12

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Desg FWD 4         128.1    P2p
Gi0/2            Desg FWD 4         128.2    P2p
Gi0/3            Desg FWD 4         128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

This switch is the root bridge for VLAN 10.. The output explicitly states 'This bridge is the root' for VLAN 10, and the Root ID and Bridge ID are identical (same priority 32778 and address 0011.2233.4455), confirming SW1 is the root bridge for VLAN 10. All interfaces are in the Designated (Desg) role and Forwarding (FWD) state, which is expected for a root bridge because root bridges have no root ports.

Answer

Gi0/2 is a root port.

Answer

The spanning-tree mode is PVST+.

Answer

VLAN 10 has a forwarding delay of 30 seconds.

Question 13

Drag and drop the steps of traffic shaping vs policing configuration steps into the correct order, from first to last.

Accepted Answer

Define class map to match traffic. The correct order for configuring traffic shaping or policing is: first, define a class map to match the desired traffic (A); second, create a policy map that specifies the shape or police action (B); third, apply the service policy to the interface (C); fourth, verify the policy using the show policy-map interface command (D); and finally, adjust the shaping rate or policing burst as needed based on verification results (E). This sequence ensures that traffic classification and policy definition are completed before applying the policy, and verification is done before making adjustments.

Question 14

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Accepted Answer

Define prefix-list to match routes. First, you define the prefix-list to match specific routes. Then you create the route-map with the suppress clause. Next, you configure the aggregate-address command referencing the route-map. After that, you verify the aggregated route in the BGP table. Finally, you check that more specific routes are suppressed.

Question 15

Consider the following configuration snippet:

interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
!
interface GigabitEthernet0/1
 channel-group 1 mode active
!
interface GigabitEthernet0/2
 channel-group 1 mode passive

What is the effect of this configuration?

Accepted Answer

The EtherChannel will form using LACP, and the port-channel will operate as a trunk carrying VLANs 10, 20, and 30.. The configuration uses LACP with one side in active mode (GigabitEthernet0/1) and the other in passive mode (GigabitEthernet0/2). LACP allows an active/passive combination to form an EtherChannel, unlike PAgP which requires at least one side to be in desirable mode. The trunk and allowed VLANs are configured on the port-channel interface, which applies to all member ports once the channel is established.

Answer

The EtherChannel will not form because both sides must use the same LACP mode.

Answer

The EtherChannel will form using PAgP because the mode is not specified as lacp.

Answer

The EtherChannel will form but only VLAN 1 will be allowed on the trunk.

Question 16

Drag and drop the steps of FlexVPN IKEv2 spoke registration to hub into the correct order, from first to last.

Accepted Answer

Spoke initiates IKEv2 SA to hub. FlexVPN uses IKEv2 for authentication and tunnel setup. The spoke initiates IKEv2 SA negotiation with the hub. After authentication, the hub assigns an IP address to the spoke via configuration payload. The spoke then registers its identity with the hub using IKEv2 notify messages. Finally, the spoke installs the tunnel route and can communicate.

Question 17

An enterprise is migrating from a traditional three-tier campus network to Cisco SD-Access. The network engineer has deployed a fabric with a single fabric edge node and a single control plane node. Users in VLAN 10 report that they cannot reach the default gateway, which is a virtual IP on the fabric edge. The fabric edge is configured with a VLAN 10 SVI and the anycast gateway feature is enabled. What is the most likely cause of the problem?

Accepted Answer

The control plane node is not reachable from the fabric edge, causing the fabric edge to drop traffic.. In Cisco SD-Access, the fabric edge node relies on the control plane node for endpoint registration and LISP mapping. If the control plane node is unreachable, the fabric edge cannot verify the source of traffic from the endpoints, causing it to drop traffic destined for the virtual default gateway. This is the most likely cause given that the SVI and anycast gateway are correctly configured per the stem.

Answer

The fabric edge node is not configured with the VLAN 10 SVI or the anycast gateway feature is disabled.

Answer

The endpoints are not configured with the correct IP address for the default gateway.

Answer

The fabric edge node is in Layer 2 mode and cannot route traffic.

Question 18

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from a neighboring AS. A lower MED value is preferred because it indicates a more preferred path into the AS, making it the correct answer when the question asks for the attribute preferred with the lowest value.

Answer

Local Preference

Answer

Weight

Answer

AS Path

Question 19

A network team is designing an SD-Access fabric for a large enterprise. The design must support automated provisioning and policy management. Which management platform is essential for deploying and managing the fabric?

Accepted Answer

Cisco DNA Center. Cisco DNA Center is the essential management platform for deploying and managing an SD-Access fabric because it provides a centralized, intent-based interface for automating the entire fabric lifecycle, including design, provisioning, policy creation, and assurance. It integrates with Cisco ISE for policy enforcement and with network devices via APIs (e.g., NETCONF/YANG) to push configurations such as VXLAN, LISP, and CTS SGTs. Without DNA Center, the automated provisioning and policy management required for SD-Access cannot be achieved at scale.

Answer

Cisco ISE

Answer

Cisco Prime Infrastructure

Answer

Cisco vManage

Question 20

Examine the following configuration:

interface GigabitEthernet0/0
 ip address 172.16.1.1 255.255.255.0
 ipv6 address 2001:db8:1::1/64
 ipv6 ospf 100 area 0
!

What is missing from this configuration to enable OSPFv3 on this interface?

Accepted Answer

The command 'ipv6 router ospf 100' must be added globally to create the OSPFv3 process.. OSPFv3 requires an active OSPFv3 process on the router before it can be enabled on any interface. The 'ipv6 router ospf 100' global command creates the OSPFv3 process with process ID 100, which is necessary for the interface-level 'ipv6 ospf 100 area 0' command to function. Without this global process, the interface configuration is incomplete and OSPFv3 will not operate.

Answer

The configuration is complete; no additional commands are needed.

Answer

The interface needs the 'ipv6 ospf network point-to-point' command to work.

Answer

The 'ipv6 unicast-routing' command must be enabled globally.