CCNP Practice Exam 63 — 20 Questions

Question 1

Drag and drop the steps of Rapid PVST+ convergence process into the correct order, from first to last.

Accepted Answer

Elect root bridge and assign port roles (RP, DP, AP). Rapid PVST+ first elects the root bridge and determines port roles. It then uses synchronization handshakes between bridges to quickly transition ports to forwarding without relying on timers. Edge ports (connected to hosts) immediately transition to forwarding. Finally, the topology change notification propagates to update MAC address tables.

Question 2

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Accepted Answer

Configure trust dscp on the ingress interface. First, trust the DSCP on the ingress interface. Then, map DSCP to CoS using a table-map. Apply the table-map in a policy-map. Finally, apply the policy-map to the interface.

Question 3

A network engineer runs the following command on Router R4:

R4# show ip sla monitor statistics 3

Round Trip Time (RTT) for Index 3
Latest RTT: 25 ms
Latest Operation Start Time: 14:30:00.000 UTC Mon Mar 1 2021
Latest Operation Return Code: OK
Number of successes: 100
Number of failures: 0
Over thresholds: 0

Based on this output, what can be concluded about the IP SLA operation?

Accepted Answer

The operation is working correctly with no failures.. The output shows 'Number of successes: 100' and 'Number of failures: 0', with a 'Latest Operation Return Code: OK', indicating that the IP SLA operation has been consistently successful without any failures. The latest RTT of 25 ms and the absence of threshold violations confirm the operation is working correctly.

Answer

The operation has experienced failures.

Answer

The operation is currently failing.

Answer

The round-trip time exceeds the threshold.

Question 4

A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?

Accepted Answer

Chef client. In a Chef-managed brownfield environment with Cisco IOS XE devices, the Chef client is the agent that runs on each device (or on a proxy like a guest shell) and applies the desired state defined in cookbooks. It is responsible for converging the device's configuration to match the policy, making it the correct component for state management.

Answer

Ohai

Answer

Chef workstation

Answer

Chef server

Question 5

A network engineer is using Cisco DNA Center to automate the deployment of a new VLAN across multiple access switches. The engineer creates a new network profile with the VLAN definition and assigns it to a site. However, after provisioning, the VLAN is not created on any of the switches. The engineer verifies that the devices are in the Inventory and are reachable. What is the most likely cause?

Accepted Answer

The engineer did not run the Provision workflow to push the configuration to the devices.. In Cisco DNA Center, network profiles are used to define settings, but they must be applied to a site and then the devices must be provisioned with that site's settings. If the engineer only created the profile and assigned it to a site, but did not run the provisioning workflow (which pushes the configuration to devices), the VLAN will not be created.

Answer

The VLAN ID conflicts with an existing VLAN on the switches.

Answer

The switches do not support the VLAN ID range.

Answer

The DNA Center appliance is not licensed for the Automation module.

Question 6

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

Accepted Answer

FlexConnect. FlexConnect (option D) is the correct architecture because it allows client data traffic to be switched locally at the remote site, while the control plane remains centralized. This design eliminates the need for a central controller to process every roaming event, as clients can roam between FlexConnect APs using local switching and 802.11r (Fast Roaming) without requiring a WLC in the data path.

Answer

Mesh networking

Answer

Autonomous APs

Answer

Centralized switching with a WLC

Question 7

Drag and drop the steps of MPLS LDP label distribution and FIB population into the correct order, from first to last.

Accepted Answer

Converge IGP (e.g., OSPF or IS-IS). First, IP routing must be operational so that the IGP converges. Then LDP is enabled on interfaces and forms neighbor relationships. LDP then assigns local labels to FECs and advertises them to neighbors. The remote label is received and installed in the LIB. Finally, the LFIB is populated with the best label bindings for forwarding.

Question 8

A network engineer is troubleshooting BGP peering between two routers in different autonomous systems. The peering is established over a directly connected Ethernet link. The engineer notices that the BGP session is flapping every few minutes. The configuration on both routers appears correct, and the IP connectivity is stable. The engineer checks the BGP logs and sees messages like 'BGP-3-NOTIFICATION: sent 4/0 (Hold Timer Expired)'. What is the most likely cause of this issue?

Accepted Answer

The hold timer values are mismatched between the two routers.. The BGP notification 'Hold Timer Expired' indicates that the router did not receive keepalive or update messages within the configured hold time. When hold timers are mismatched between two eBGP peers, the router with the shorter hold timer will expire first, causing the session to reset. Since the IP connectivity is stable and the configuration appears correct, a mismatch in hold timer values is the most direct cause of the flapping session.

Answer

The MTU on the link is mismatched, causing BGP packets to be fragmented.

Answer

The TTL for eBGP is set to 1, and the routers are not directly connected.

Answer

The BGP update timer is set too high, causing delays in sending updates.

Question 9

Drag and drop each VRF-Lite or MPLS VPN characteristic on the left to its matching description on the right.

Accepted Answer

VRF-Lite: Uses trunk ports and subinterfaces to separate traffic without MPLS. VRF-Lite uses only local VRFs without MPLS or MP-BGP, requiring trunk links; MPLS VPN uses MPLS labels and MP-BGP for scalable path isolation; VRF-Lite is simpler but limited to a single router or switch; MPLS VPN scales across an entire provider network; VRF-Lite does not support overlapping address spaces between sites without NAT.

Question 10

A network engineer configures IP SLA 20 to monitor the response time of a DNS server at 10.1.1.1 using DNS query for 'example.com'. The operation is used to influence routing decisions. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 50 ms', but the DNS server is actually down and not responding to any queries. What is the most likely reason?

Accepted Answer

The IP SLA DNS probe is using a cached DNS response from the router's DNS resolver, so it does not actually query the server.. IP SLA DNS probes rely on the router's local DNS resolver. If the resolver has a cached response for 'example.com', the probe will return the cached RTT without actually querying the DNS server. This explains why the operation shows 'Active' and a 50 ms RTT even though the DNS server is down.

Answer

The IP SLA DNS probe must be configured with a 'timeout' value lower than 50 ms to detect the failure.

Answer

The DNS server is responding to the probe but not to other queries because the probe uses a different port.

Answer

The IP SLA operation is configured with a 'frequency' that is too low, causing the probe to be sent before the server times out.

Question 11

Given the following Ansible playbook snippet:
---
- name: Backup running config
  hosts: routers
  gather_facts: no
  tasks:
    - name: Save config
      ios_config:
        backup: yes
        backup_options:
          dir_path: /backup/
What is the purpose of the 'backup_options' parameter?

Accepted Answer

It specifies the directory where the backup file will be saved.. The 'backup_options' parameter in the ios_config module allows you to customize the backup behavior. Specifically, the 'dir_path' sub-option defines the directory path where the backup file will be saved. Without this parameter, the backup file is saved in the default location (the 'backup' subdirectory of the playbook's root directory). Option A correctly identifies this purpose.

Answer

It specifies the filename for the backup.

Answer

It enables compression of the backup file.

Answer

It is ignored because backup: yes is already set.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list
  Inbound  access list is not set
  Outbound access list is 140

R1# show access-lists 140
Extended IP access list 140
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    20 deny tcp any any eq 443 (10 matches)
    30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.. The ACL 140 is applied outbound on GigabitEthernet0/1. It permits TCP port 443 (HTTPS) traffic only from source 192.168.1.0/24, then denies all other HTTPS traffic, and finally permits all other IP traffic. Since the deny statement (line 20) blocks HTTPS from any source not matching the permit (line 10), traffic from outside 192.168.1.0/24 is denied when exiting the interface, making option A correct.

Answer

All HTTPS traffic is permitted outbound.

Answer

The ACL is applied inbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 13

Drag and drop the steps of troubleshooting a failed EtherChannel bundle into the correct order, from first to last.

Accepted Answer

Verify port-channel interface exists with show running-config. First, verify that the port-channel interface exists. Then check that physical ports are in the same VLAN and have matching configurations. Next, confirm that the channel-group mode is compatible on all ports. After that, inspect LACP or PAgP counters for errors. Finally, check for hardware or cabling issues if all else fails. This systematic approach isolates configuration errors before hardware faults.

Question 14

Drag and drop the steps of MPLS traffic engineering (MPLS-TE) tunnel setup into the correct order, from first to last.

Accepted Answer

Configure IGP with TE extensions (OSPF TE or IS-IS TE). First, IGP must be configured with TE extensions (e.g., OSPF TE) to flood link attributes. Then MPLS-TE is enabled on interfaces. The headend router computes a path using CSPF based on constraints. The tunnel interface is configured with the destination and constraints. Finally, RSVP-TE signals the LSP and reserves bandwidth along the path.

Question 15

Drag and drop the steps of PPPoE session establishment into the correct order, from first to last.

Accepted Answer

Client sends PADI broadcast. PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

Question 16

Drag and drop the steps of configuring a native VLAN mismatch detection into the correct order, from first to last.

Accepted Answer

Configure native VLAN 10 on trunk interface. First, configure mismatched native VLANs: configure neighbor trunk with native VLAN 20 (B) and then configure native VLAN 10 on the local trunk interface (A). Then, CDP detects the mismatch and reports an error (C). The switch then error-disables the trunk port (D). Finally, fix the mismatch by setting both sides to the same native VLAN (E).

Question 17

Which two statements about LISP in Cisco SD-Access are true? (Choose two.)

Accepted Answer

The LISP Map Server stores the mapping between endpoint identifiers (EIDs) and routing locators (RLOCs).. LISP (Locator/ID Separation Protocol) is the control plane in SD-Access. The Map Server (MS) maintains the EID-to-RLOC mapping database, and the Map Resolver (MR) handles Map-Request queries. The EID represents the endpoint identity (IP address), while the RLOC is the routing locator (IP address of the fabric node). LISP does not perform encapsulation; VXLAN does. LISP uses UDP ports 4342 (data plane) and 4341 (control plane), not TCP. The EID is typically the host IP, not the MAC address.

Answer

LISP encapsulation is used to forward data traffic between fabric edge nodes.

Answer

LISP uses TCP port 4342 for control plane communication.

Answer

The EID in LISP represents the MAC address of the endpoint device.

Question 18

A network engineer is troubleshooting an OSPF issue where a router is not learning a route to a network that is advertised via a type 5 LSA from an ASBR. The engineer checks the OSPF database and sees the type 5 LSA, but the route is not in the routing table. The forwarding address in the LSA is 0.0.0.0. What is the most likely cause?

Accepted Answer

The ASBR is not reachable via an OSPF internal route.. When a Type 5 LSA has a forwarding address of 0.0.0.0, OSPF routers will use the ASBR as the next hop for the external route. For the route to be installed in the routing table, the ASBR must be reachable via an OSPF intra-area or inter-area route. If the ASBR is not reachable (e.g., no valid OSPF route to the ASBR's router ID), the Type 5 LSA is considered unreachable and is not installed, even though it exists in the OSPF database.

Answer

The type 5 LSA has a metric of 16777215.

Answer

The OSPF process ID on the ASBR is different from the other routers.

Answer

The type 5 LSA is being filtered by an outbound route filter.

Question 19

A network engineer runs the following command on Router R2:

R2# show mpls forwarding-table
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  10.1.1.1/32      0             Gi0/0      192.168.1.1
17         18         10.2.2.0/24      1500          Gi0/1      192.168.2.3
18         Untagged   10.3.3.0/24      0             Gi0/2      192.168.3.4

Based on this output, what is the correct interpretation?

Accepted Answer

For prefix 10.1.1.1/32, the router will pop the MPLS label before forwarding because the outgoing label is 'Pop Label'.. The 'Pop Label' entry in the 'Outgoing Label' column indicates that for the prefix 10.1.1.1/32, Router R2 is the penultimate hop (PHP) in the MPLS network. According to MPLS PHP behavior, the router will remove (pop) the top label from the MPLS packet before forwarding the IP packet to the next hop (192.168.1.1), which is the egress LSR.

Answer

For prefix 10.2.2.0/24, the router will impose label 18 onto the packet.

Answer

For prefix 10.3.3.0/24, the router will forward the packet with an MPLS label of 18.

Answer

The router has received 1500 bytes for prefix 10.2.2.0/24, and the outgoing interface is Gi0/1.

Question 20

Which three statements about extended ACLs on Cisco IOS are true? (Choose three.)

Accepted Answer

Extended ACLs can filter based on source and destination IP addresses.. Extended ACLs can filter based on source and destination IP addresses, protocol, and port numbers. They are processed sequentially until a match is found, and an implicit deny any is at the end. They can be applied to interfaces using the 'ip access-group' command. Extended ACLs cannot filter based on MAC addresses; that is done by MAC ACLs. They are not limited to source-only filtering.

Answer

Extended ACLs can filter based on source MAC addresses.

Answer

Extended ACLs only filter traffic based on the source IP address.