CCNP Practice Exam 62 — 20 Questions

Question 1

Examine this configuration for a site-to-site VPN on a Cisco router:

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.1
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/0/0
 ip address 10.0.0.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

Which statement about this configuration is true?

Accepted Answer

The access-list 101 defines the traffic that will be encrypted; traffic from 192.168.10.0/24 to 192.168.20.0/24 will be protected.. Access-list 101 is used by the crypto map to match traffic that should be encrypted via IPsec. The ACL permits traffic from source network 192.168.10.0/24 to destination network 192.168.20.0/24, so that traffic will be protected by the IPsec tunnel. This is the standard method for defining interesting traffic in a site-to-site VPN.

Answer

The crypto map uses IKEv2 for key exchange because the transform set uses SHA-256.

Answer

The ISAKMP policy lifetime of 86400 seconds is too long and will cause the tunnel to fail.

Answer

The crypto map should be applied to the tunnel interface, not the physical interface.

Question 2

A network engineer is using Ansible to automate the deployment of a new VLAN on a Cisco Nexus switch. The playbook uses the nxos_vlan module. The engineer wants to ensure that if the VLAN already exists, the playbook does not make any changes (idempotent). However, the playbook always reports 'changed' even when the VLAN exists with the same configuration. What is a likely reason?

Accepted Answer

The playbook does not include the 'vlan_state' parameter, and the existing VLAN is in 'suspend' state, while the module defaults to 'active'.. The nxos_vlan module defaults the 'vlan_state' parameter to 'active'. If the existing VLAN is in 'suspend' state, the module detects a configuration drift and reports a change even if the VLAN ID and name match. This violates idempotency because the module attempts to set the VLAN to 'active', resulting in a 'changed' status.

Answer

The playbook uses the 'vlan_id' parameter but not the 'name' parameter, causing the module to ignore the name mismatch.

Answer

The nxos_vlan module is not idempotent by design and always reports changes.

Answer

The engineer is using the '--diff' flag, which forces the module to report changes.

Question 3

A network engineer is deploying Cisco TrustSec (CTS) with Security Group Access Control Lists (SGACLs) on a campus network. The engineer configures the switch with 'cts role-based enforcement' and assigns SGTs to users via 802.1X. The engineer tests connectivity between a user in SGT 10 and a server in SGT 20. The SGACL permits traffic from SGT 10 to SGT 20, but the user cannot reach the server. The engineer checks 'show cts role-based sgt map' and sees that the user's SGT is 0. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured to send the SGT in the Access-Accept message.. The user's SGT is shown as 0 in the 'show cts role-based sgt map' output, which is the default SGT assigned when no SGT is received from the RADIUS server. Since the SGACL permits traffic from SGT 10 to SGT 20, but the user has SGT 0, the SGACL does not match, and traffic is implicitly denied. The most likely cause is that the RADIUS server is not configured to send the SGT in the Access-Accept message, so the switch cannot dynamically assign the correct SGT.

Answer

The SGACL is applied to the wrong interface.

Answer

The switch is not configured with 'cts role-based enforcement'.

Answer

The user's SGT is 0, which is a valid SGT that denies all traffic.

Question 4

A network engineer runs the following command on Switch SW6:

SW6# show monitor session 6
Session 6
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 200
Destination Ports      : Gi1/0/12
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.. The output shows a Remote Destination Session, meaning this switch (SW6) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 200 and forwards it out of the destination port Gi1/0/12. The 'Source RSPAN VLAN: 200' indicates the VLAN carrying the mirrored traffic from the source switch, and 'Destination Ports: Gi1/0/12' confirms the local egress interface for the mirrored packets.

Answer

This is a local SPAN session with source VLAN 200.

Answer

The RSPAN VLAN 200 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

Based on this output, what can be concluded?

Accepted Answer

Static NAT is configured for two internal hosts.. The output shows two inside global addresses (192.0.2.10 and 192.0.2.11) mapped one-to-one to inside local addresses (10.0.0.10 and 10.0.0.11), with no outside local or outside global entries. This is characteristic of static NAT, where each internal host is permanently assigned a specific global address, typically configured with 'ip nat inside source static' commands.

Answer

Dynamic NAT is configured with a pool of addresses.

Answer

PAT is translating multiple internal addresses to a single global address.

Answer

NAT is not operational because no outside local addresses are shown.

Question 6

Drag and drop each YANG statement on the left to its matching function on the right.

Accepted Answer

container: Groups related nodes in the data tree. Correct pairings: container groups related nodes; leaf holds a single scalar value; list defines a sequence of entries; leaf-list holds an ordered set of scalar values; typedef defines a new derived type.

Question 7

Drag and drop each YANG statement on the left to its matching function on the right.

Accepted Answer

container: Groups related nodes into a subtree. In YANG, container groups related nodes, leaf holds a single scalar value, list defines a sequence of entries, leaf-list is an array of scalar values, and typedef defines a derived type.

Question 8

Drag and drop the steps of RESTCONF GET with depth and field query parameters into the correct order, from first to last.

Accepted Answer

Construct RESTCONF URI path. The correct order starts with constructing the RESTCONF URI, appending the depth parameter, adding the field parameter, sending the GET request, and finally parsing the filtered JSON/XML response.

Question 9

Drag and drop each data encoding format on the left to its typical use case on the right.

Accepted Answer

JSON: Human-readable, commonly used in REST APIs. Correct pairings: JSON is human-readable and widely used in REST APIs; XML is verbose with schema support; YAML is human-friendly for configuration files; Protobuf is a compact binary format for high-performance RPC.

Question 10

Drag and drop each RESTCONF method on the left to its matching NETCONF equivalent on the right.

Accepted Answer

GET: Retrieve data (equivalent to get or get-config). RESTCONF GET retrieves data (like NETCONF get/get-config), POST creates a resource (like edit-config with operation create), PUT replaces a resource (like edit-config with operation replace), PATCH partially updates (like edit-config with operation merge), and DELETE removes a resource (like edit-config with operation delete).

Question 11

A company is deploying a multi-tenant data center using VMware vSphere. The architect must ensure that each tenant’s virtual machines (VMs) are isolated at Layer 2 while sharing the same physical NICs. Which design approach best meets this requirement?

Accepted Answer

Configure a single standard virtual switch and assign each VM to a separate port group with unique VLAN IDs.. Configuring a standard virtual switch with separate port groups and unique VLAN IDs provides Layer 2 isolation between tenants by leveraging 802.1Q VLAN tagging. Each VM’s traffic is tagged with its assigned VLAN ID, ensuring that VMs in different port groups cannot communicate directly at Layer 2, even though they share the same physical NICs.

Answer

Deploy a separate physical NIC for each tenant and bridge them to the VMs.

Answer

Use a distributed virtual switch with VLAN trunking and assign all VMs to the same port group.

Answer

Enable promiscuous mode on the virtual switch to allow all VMs to see each other’s traffic.

Question 12

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/0(P)    Gi0/1(P)    Gi0/2(s)    Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

Interface Gi0/2 is suspended due to a configuration mismatch.. The output shows Gi0/2 with an '(s)' flag, which means 'suspended'. In LACP EtherChannel, a port is suspended when there is a configuration mismatch (e.g., different speed, duplex, VLAN settings, or trunk allowed VLANs) that prevents it from being bundled. The '(D)' flag on Gi0/3 indicates the port is down, not suspended.

Answer

Port-channel 1 is operating as a Layer 3 interface.

Answer

Interface Gi0/3 is in standby mode waiting to join the bundle.

Answer

All four interfaces are actively forwarding traffic in the EtherChannel.

Question 13

A network engineer configures IP SLA 1 to monitor HTTP server availability at 10.1.1.1 using HTTP GET. The operation is used as a track object for a backup static route. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 200 ms', but the track object shows 'Track 1: up' even though the HTTP server returns a 404 error. What is the cause?

Accepted Answer

The IP SLA HTTP operation does not interpret HTTP status codes by default; it only checks if a TCP connection is established.. The IP SLA HTTP operation, by default, only verifies that a TCP three-way handshake completes with the destination host on port 80 (or the configured port). It does not parse or evaluate the HTTP response status code (e.g., 404). Therefore, even though the server returns a 404 error, the TCP connection succeeds, the operation shows 'Active', and the track object remains 'up'. To detect a 404, you must use the 'http-get' operation with a specific URL and enable status code checking via the 'expect' option.

Answer

The IP SLA HTTP operation must be configured with a 'url' that includes the full path, otherwise it defaults to the root and returns 404.

Answer

The track object must be configured with a 'down' threshold to trigger when the HTTP response time exceeds a value.

Answer

The HTTP server is responding, so the IP SLA operation correctly shows success; the engineer must use a different type of probe, like TCP connect, to detect the 404.

Question 14

Drag and drop the steps of EIGRP neighbor establishment into the correct order, from first to last.

Accepted Answer

Send Hello packets to discover neighbors. EIGRP neighbor formation begins with sending Hello packets, then exchanging full routing tables via Update packets, acknowledging with ACK packets, and finally entering the Established state where incremental updates are sent.

Question 15

Which TWO statements about NETCONF and YANG are true?

Accepted Answer

YANG is a data modeling language used to define the structure of configuration and state data. YANG (RFC 7950) is a data modeling language specifically designed to define the structure of configuration and state data, as well as notifications and RPCs, for network devices. It provides a hierarchical, schema-based representation of data that can be serialized into XML or JSON, making it the standard for modeling NETCONF and RESTCONF datastores.

Answer

NETCONF sessions are stateless

Answer

YANG defines both the data model and the RPC operations for network devices

Answer

NETCONF uses TLS as the mandatory transport protocol

Question 16

Drag and drop the steps of OSPF virtual link configuration into the correct order, from first to last.

Accepted Answer

Identify the ABR in the transit area. A virtual link connects a non-backbone area to Area 0 through a transit area. First, identify the ABR with the transit area, then configure the virtual link on both ABRs using the router ID of the neighbor, ensure the transit area has full OSPF adjacency, and finally verify the virtual link is operational.

Question 17

A service provider is migrating from a traditional IP core to an MPLS core. The engineer has configured LDP on all core routers and verified that LDP sessions are established. However, some prefixes learned via OSPF are not being assigned labels. The 'show mpls ldp bindings' command shows missing bindings for certain routes. What is the most likely cause?

Accepted Answer

The routes are not present in the global routing table on the router.. LDP assigns labels to every prefix present in the global routing table by default. If a prefix is not in the routing table (e.g., because it is a directly connected subnet that is not advertised via OSPF or is filtered by a route-map), LDP will not generate a label binding for it. The 'show mpls ldp bindings' command only displays bindings for routes that exist in the routing table, so missing bindings indicate the routes are absent from the global RIB.

Answer

The OSPF process is not redistributed into LDP.

Answer

LDP is configured to only assign labels to BGP routes.

Answer

The 'mpls ldp autoconfig' command is missing on OSPF.

Question 18

Which three statements about Control Plane Policing (CoPP) are true? (Choose three.)

Accepted Answer

CoPP applies QoS policy-map logic to traffic that is destined to the control plane of the router.. Control Plane Policing (CoPP) protects the router's control plane by applying QoS policies to traffic destined to the router itself. It is configured under the 'control-plane' global configuration mode using class-maps and policy-maps. Option C is correct: CoPP can apply to both IPv4 and IPv6 traffic in a single policy-map by using multiple class-maps (one for each protocol). Option D describes data-plane ACLs, not CoPP. Option E is wrong because the default action of CoPP is to drop unmatched traffic, not permit.

Answer

CoPP is applied to traffic transiting the router, not to traffic originated by the router.

Answer

The default action for CoPP is to permit all control-plane traffic.

Question 19

Drag and drop the steps of MST region configuration and operation into the correct order, from first to last.

Accepted Answer

Enter MST configuration mode and set region name. MST configuration begins with entering MST mode and defining the region name, revision number, and VLAN-to-instance mapping. After configuration, the switch computes an MD5 digest of the MST configuration to identify region membership. Switches in the same region then run IST (Internal Spanning Tree) and CIST (Common and Internal Spanning Tree) to elect a root bridge for the region. Finally, per-instance spanning trees are calculated within the region.

Question 20

Which three statements about the Cisco Enterprise WAN design principles are true? (Choose three.)

Accepted Answer

SD-WAN architecture separates the control plane and data plane, allowing centralized policy management.. Enterprise WAN design focuses on connecting remote sites reliably and efficiently. SD-WAN decouples control and data planes for centralized management. Dual-homing provides redundancy. MPLS VPNs offer any-to-any connectivity but with a full mesh of VRFs. Option A is correct because SD-WAN's centralized controller manages policies and path selection. Option B is correct because dual-homing to different provider routers improves availability. Option D is correct because MPLS VPNs use VRFs to isolate customer routing, allowing overlapping addresses. Option C is incorrect because DMVPN uses dynamic tunnels (mGRE/NHRP), not static IPsec tunnels. Option E is incorrect because DMVPN does not require a full mesh; it uses a hub-and-spoke or partial mesh topology.

Answer

DMVPN requires a full mesh of static IPsec tunnels between all spoke routers.

Answer

DMVPN requires a full mesh of IPsec tunnels between all spoke routers.