CCNP Practice Exam 62 — 20 Questions

Question 1

Drag and drop the steps of ISE profiling-based dynamic ACL assignment into the correct order, from first to last.

Accepted Answer

Endpoint connects; switch sends RADIUS accounting start. ISE profiling identifies the device type via DHCP/HTTP probes, matches it to a profile, then ISE downloads a dynamic ACL to the switch, which applies it to the port, and finally the switch enforces the ACL on traffic from that endpoint.

Question 2

Examine the following HSRP configuration on a Cisco IOS-XE switch:

interface Vlan10
 ip address 10.0.0.2 255.255.255.0
 standby 10 ip 10.0.0.1
 standby 10 priority 150
 standby 10 preempt

What is the effect of the 'standby 10 preempt' command?

Accepted Answer

The router will immediately become the active router if it has a higher priority than the current active.. The 'standby 10 preempt' command enables preemption, allowing the router to take over as the active router if it has a higher priority than the current active router. Without preempt, a router with higher priority will not become active until the current active fails. With preempt, it will immediately become active if its priority is higher.

Answer

The router will become active only if the current active fails.

Answer

The router will send a gratuitous ARP to update the virtual MAC address.

Answer

The router will lower its priority to avoid becoming active.

Question 3

Drag and drop the steps of DNA Center site hierarchy creation into the correct order, from first to last.

Accepted Answer

Create a top-level site (e.g., continent). The correct order starts with defining the top-level site (e.g., continent or country), then adds the area, then the building, then the floor, and finally assigns the floor plan. This hierarchical structure is required for proper network segmentation and assurance in Cisco DNA Center.

Question 4

What is the maximum number of active member links supported in a single EtherChannel on Cisco Catalyst switches?

Accepted Answer

8. Cisco Catalyst switches support a maximum of 8 active member links in a single EtherChannel. This limit is defined by the IEEE 802.3ad standard and Cisco's implementation, ensuring that the load-balancing algorithm distributes traffic effectively across all links. The 8-link limit applies to both PAgP and LACP modes.

Answer

4

Answer

16

Answer

32

Question 5

Given this configuration on a Cisco IOS-XE router:

crypto ikev2 keyring KEYRING
 peer SPOKE1
  address 192.168.2.1
  pre-shared-key cisco123
!
crypto ikev2 profile IKEV2_PROF
 match identity remote address 192.168.2.1 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING
!

What is missing from this configuration for a successful IKEv2 tunnel to the peer at 192.168.2.1?

Accepted Answer

The IKEv2 proposal and policy are not defined and must be referenced by the profile or the IPsec profile.. The configuration is missing an IKEv2 proposal and an IKEv2 policy, which define the encryption, integrity, and DH group parameters for the IKEv2 SA. The profile must reference these via the 'proposal' command under the IKEv2 proposal or the 'match proposal' command under the IKEv2 policy; without them, the router has no agreed-upon parameters to negotiate with the peer, so the tunnel cannot be established.

Answer

The configuration is complete; no additional commands are needed.

Answer

The profile is missing the 'set transform-set' command to specify the IPsec transform set.

Answer

The keyring must use a different name to match the profile.

Question 6

Drag and drop the steps of DNA Center SWIM (Software Image Management) upgrade flow into the correct order, from first to last.

Accepted Answer

Import software image into DNA Center. SWIM upgrade begins with importing the image, then distributing it to the device, performing a pre-check, activating the image, and finally committing the upgrade.

Question 7

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Accepted Answer

Load YANG model into YANG DevKit environment. Validation starts by loading the YANG model, parsing the path, checking it against the schema, testing it on a device, and then confirming the output.

Question 8

Drag and drop the steps of OpenAPI schema validation for DNA Center REST call into the correct order, from first to last.

Accepted Answer

Retrieve the OpenAPI specification for DNA Center. Validation begins with retrieving the OpenAPI spec, then parsing the endpoint, validating the request against the schema, checking the response, and finally handling any validation errors.

Question 9

Review the following OSPF configuration:

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 1
 default-information originate always metric 20 metric-type 1
!

What is the effect of the 'default-information originate always metric 20 metric-type 1' command?

Accepted Answer

It injects a default route into OSPF unconditionally, with metric 20 and type E1.. The 'default-information originate always' command injects a default route into the OSPF link-state database unconditionally, even if no default route exists in the routing table. The 'metric 20' sets the OSPF cost to 20, and 'metric-type 1' makes it an E1 (Type 1) external route, meaning the metric includes the internal cost to the ASBR plus the external cost.

Answer

It injects a default route into OSPF only if a default route exists in the routing table, with metric 20 and type E1.

Answer

It injects a default route into OSPF with metric 20 and type E2, but only if a default route exists.

Answer

It injects a default route into OSPF with metric 20 and type E1, but only for area 0.

Question 10

Which two statements about virtual machine migration (vMotion/VMware) or live migration (Hyper-V) are true? (Choose two.)

Accepted Answer

Live migration copies the memory state of the VM from the source host to the destination host while the VM continues to run.. Option B is correct because live migration (Hyper-V) and vMotion (VMware) are designed to transfer the running VM's memory state, including the active memory pages and CPU register state, from the source host to the destination host while the VM remains powered on and continues servicing requests, with only a brief pause during the final switchover. Option D is correct because the destination host's processor must expose a compatible CPU feature set (e.g., matching instruction set extensions such as SSE4.2, AVX, or NX/DEP) so that the migrated VM does not execute instructions unsupported by the new physical CPU; VMware uses Enhanced vMotion Compatibility (EVC) baselines and Hyper-V uses processor compatibility mode to mask differences. Option A is wrong because live migration explicitly avoids powering off the VM; that describes a cold migration instead. Option C is wrong because shared storage is not strictly required — vMotion can use shared storage, but Hyper-V live migration and VMware vMotion also support migrating the VM's virtual disks (storage migration) or using SMB 3.0/CSV paths without identical shared storage. Option E is wrong because live migration preserves the VM's network identity, including its IP address, since the virtual NIC and its configuration move with the VM; the IP does not change unless the guest OS or network configuration is altered.

Answer

During live migration, the virtual machine must be powered off to transfer memory contents.

Answer

Live migration requires that both source and destination hosts use the same shared storage for the VM's virtual disks.

Answer

After a live migration, the virtual machine's IP address changes to match the new network segment.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology all-links
EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.1.1.0/24, 1 successors, FD is 1310720, serno 5
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
        via 10.2.2.2 (1587200/1310720), GigabitEthernet0/1
P 10.2.2.0/24, 1 successors, FD is 1310720, serno 6
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
        via 10.2.2.2 (1587200/1310720), GigabitEthernet0/1

Based on this output, what can be concluded?

Accepted Answer

The router has two paths to 10.1.1.0/24, but only one is in the routing table.. The output shows that for 10.1.1.0/24, the feasible distance (FD) is 1310720 and there is only one successor (the route via 192.168.1.2). The alternate path via 10.2.2.2 has a reported distance (RD) of 1310720, which equals the FD, so it does not satisfy the feasibility condition (RD < FD) and therefore is not a feasible successor. Only the successor route is installed in the routing table.

Answer

Both routes have a feasible successor via 10.2.2.2.

Answer

The route 10.1.1.0/24 has two successors.

Answer

The alternate path via 10.2.2.2 will be used immediately if the successor fails.

Question 12

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

Accepted Answer

The router does not have NAT hairpinning enabled, so internal traffic to the public IP is not translated.. The issue is that NAT hairpinning (also known as NAT reflection or NAT loopback) is not enabled by default on Cisco IOS. When an internal host sends traffic to the public IP address (203.0.113.1), the router sees the destination as its own outside interface IP and forwards the packet out that interface without performing the static NAT translation. The packet never reaches the internal web server (192.168.1.10). To fix this, the engineer must enable hairpinning using the 'ip nat enable' command on the inside interface or configure a route-map to force the router to translate traffic sourced from the inside network destined to the public IP.

Answer

The static NAT entry is missing the extendable keyword.

Answer

The internal hosts have a route to the public IP via the router's outside interface.

Answer

The access list used for NAT is blocking internal traffic.

Question 13

Drag and drop each DSCP value on the left to its matching Per-Hop Behavior (PHB) on the right.

Accepted Answer

DSCP 46: EF. DSCP 46 maps to EF (Expedited Forwarding), DSCP 10 maps to AF11 (Assured Forwarding class 1 low drop), DSCP 18 maps to AF21 (Assured Forwarding class 2 low drop), DSCP 26 maps to AF31 (Assured Forwarding class 3 low drop), DSCP 34 maps to AF41 (Assured Forwarding class 4 low drop).

Question 14

An enterprise network uses 802.1X for wired access. The authentication server is a Cisco ISE. Recently, some Windows 10 clients fail to authenticate, while others succeed. The engineer checks the switch configuration and finds 'authentication port-control auto' and 'dot1x pae authenticator' are configured. The failing clients show 'EAP failure' in the logs. The engineer suspects a mismatch in EAP method. Which EAP method is most likely causing the issue if the ISE is configured to require EAP-TLS but the Windows clients are configured for PEAP-MSCHAPv2?

Accepted Answer

EAP-TLS requires a client certificate, which the Windows clients do not have.. EAP-TLS requires a client-side certificate for authentication. If the ISE is configured to require EAP-TLS but the Windows 10 clients are configured for PEAP-MSCHAPv2, the clients will not present a certificate, causing the ISE to send an EAP failure. This mismatch in EAP method explains why only clients without the proper certificate configuration fail.

Answer

EAP-FAST requires a PAC file that the Windows clients do not have.

Answer

LEAP uses a shared secret that is not configured on the clients.

Answer

EAP-MD5 does not support mutual authentication, causing the failure.

Question 15

A network engineer runs the following command on Switch SW3:

SW3# show etherchannel summary

Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+---------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel is using LACP protocol.. The output shows the EtherChannel is using LACP as the protocol, as indicated in the 'Protocol' column. The 'SU' flags on Po1 mean the port-channel is Layer 2 (S) and in use (U), confirming it is active. Therefore, option B is correct because LACP is explicitly listed as the protocol for this EtherChannel.

Answer

All three ports are actively participating in the EtherChannel.

Answer

The EtherChannel is a Layer 3 port-channel.

Answer

Port Gi0/3 is in standby mode.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology
EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.1.1.0/24, 1 successors, FD is 1310720
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
P 10.2.2.0/24, 1 successors, FD is 1310720
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
P 10.3.3.0/24, 1 successors, FD is 1310720
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

Each route has exactly one successor and no feasible successor.. The output shows each route with a code 'P' (Passive) and exactly one successor, with no feasible successor listed. In EIGRP, a feasible successor is only present if there is a backup route that satisfies the feasibility condition (reported distance < feasible distance). Since only one next-hop is shown per route and no additional entries exist, there is no feasible successor. Option C correctly identifies this.

Answer

All routes have a feasible successor.

Answer

The routes are in Active state, meaning the router is querying for alternate paths.

Answer

The router is using EIGRP stub routing.

Question 17

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Accepted Answer

Security Group Access Control Lists (SGACLs). Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.

Answer

Change of Authorization (CoA)

Answer

802.1X authentication

Answer

MACsec encryption

Question 18

An engineer is configuring multicast on a Cisco router. The router receives multicast traffic from a source on interface GigabitEthernet0/0 and needs to forward it to receivers on interface GigabitEthernet0/1. The engineer enables PIM sparse mode on both interfaces and configures a static RP. However, the router does not create a multicast routing entry for the (S,G) pair. What is the most likely missing configuration?

Accepted Answer

The global command 'ip multicast-routing' is not configured.. The most likely missing configuration is the global command 'ip multicast-routing'. Without this command, the router cannot enable multicast forwarding or build multicast routing tables, regardless of PIM configuration on interfaces or static RP definition. PIM sparse mode and RP configuration are dependent on multicast routing being globally enabled first.

Answer

The interface GigabitEthernet0/0 is not configured with an IP address.

Answer

The RP address is not reachable from the router.

Answer

The router is not configured as a candidate RP.

Question 19

A network engineer runs the following command on Router R7:

R7# show ip sla monitor statistics 6

Round Trip Time (RTT) for Index 6
Latest RTT: NoConnection/Busy/Timeout
Latest Operation Start Time: 18:00:00.000 UTC Mon Mar 1 2021
Latest Operation Return Code: Timeout
Number of successes: 0
Number of failures: 15
Over thresholds: 0

Based on this output, what is the status of the IP SLA operation?

Accepted Answer

The target is unreachable, as all probes have timed out.. The output shows 15 failures with a 'Timeout' return code and no successes, indicating that every probe sent has timed out. In IP SLA, a 'NoConnection/Busy/Timeout' RTT and a 'Timeout' return code mean the target is not responding to the probe, confirming unreachability. Option C correctly states the target is unreachable because all probes have failed.

Answer

The operation is functioning normally with occasional timeouts.

Answer

The target is reachable but with high latency.

Answer

The operation has been configured but not started.

Question 20

Drag and drop the steps of Cisco NSO service provisioning workflow into the correct order, from first to last.

Accepted Answer

Operator defines service using YANG model. The Cisco NSO workflow starts with the operator defining a service in YANG model. Then NSO maps the service to device configurations using a service template. Next, NSO pushes the configuration to network devices via NETCONF. After that, NSO updates the service database with the operational state. Finally, NSO verifies the service by checking device state and alarms.