CCNP Practice Exam 64 — 20 Questions

Question 1

Examine the following configuration:

aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet1/0/4
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout quiet-period 30

What is the effect of the 'dot1x timeout quiet-period 30' command?

Accepted Answer

The switch will wait 30 seconds before sending a new EAPOL-Start after a failed authentication.. The 'dot1x timeout quiet-period 30' command sets the duration (in seconds) that the switch waits before sending a new EAPOL-Start frame to a supplicant after a previous authentication attempt has failed. This quiet period prevents repeated authentication attempts from overwhelming the port or the RADIUS server, allowing time for the supplicant to recover or for administrative intervention. The default quiet period is typically 60 seconds, and reducing it to 30 seconds speeds up re-authentication attempts after a failure.

Answer

The switch will wait 30 seconds for a response from the supplicant before timing out.

Answer

The switch will wait 30 seconds before placing the port in the unauthorized state after a link up event.

Answer

The switch will wait 30 seconds for the RADIUS server to respond before failing authentication.

Question 2

Drag and drop the steps of syslog message generation and storage into the correct order, from first to last.

Accepted Answer

Application or kernel generates syslog message. A process or kernel generates a syslog message with a facility and severity, the syslogd daemon compares the severity to the configured logging level, then writes the message to the local buffer, optionally forwards it to a remote syslog server, and finally the message is stored or displayed.

Question 3

A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?

Accepted Answer

Internet Group Management Protocol (IGMP). IGMP is the protocol used between hosts and their directly connected routers to signal membership in multicast groups. When a host wants to receive traffic for a specific IPTV multicast stream, it sends an IGMP membership report, and the router uses this information to build its multicast forwarding state for that subnet. Without IGMP, the router would have no way of knowing which groups are of interest to local hosts.

Answer

Rendezvous Point (RP)

Answer

Protocol Independent Multicast (PIM)

Answer

Multicast Source Discovery Protocol (MSDP)

Question 4

Drag and drop the steps of PAgP EtherChannel negotiation into the correct order, from first to last.

Accepted Answer

Ports configured with PAgP auto send PAgP packets. PAgP negotiation begins with ports in auto mode sending PAgP packets, then desirable mode ports reply with PAgP messages, followed by negotiation of parameters, agreement on bundle membership, and finally ports are bundled into EtherChannel.

Question 5

A network engineer runs the following command on Router R1:

R1# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy output: QOS_POLICY

Class-map: VOICE (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      police cir 1000000 bc 15625 be 15625
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 100/10000

Based on this output, what can be concluded?

Accepted Answer

Voice traffic is not being classified because no packets match the VOICE class.. The output shows 0 packets matched for the VOICE class, meaning no traffic has been classified as voice despite the policy being configured. The police action is configured but never triggered because no packets match the class. Therefore, the correct conclusion is that voice traffic is not being classified.

Answer

Voice traffic is being marked with DSCP EF and is being policed at 1 Mbps.

Answer

All traffic is being dropped due to the police action.

Answer

The policy-map is applied in the input direction.

Question 6

Drag and drop the steps of the 802.1X/EAP authentication process for a wireless client into the correct order, from first to last.

Accepted Answer

Client sends EAPoL-Start to AP. The correct order is: 1. Client sends EAPoL-Start to the AP (A). 2. AP sends EAP-Request Identity (B). 3. Client sends EAP-Response Identity (C). 4. RADIUS sends EAP-Request credentials (D). 5. Client sends EAP-Response credentials (E). This sequence is standard for 802.1X/EAP wireless authentication.

Question 7

Drag and drop the steps of SNMP trap generation and forwarding into the correct order, from first to last.

Accepted Answer

Agent detects event matching a trap condition. The SNMP agent monitors the device for a defined event, then builds a trap message including the OID and value, encapsulates it in a UDP packet, looks up the trap destination in the SNMP configuration, and finally forwards the packet to the NMS.

Question 8

Drag and drop the steps of configuring a local SPAN session on a Cisco IOS switch into the correct order, from first to last.

Accepted Answer

Clear any existing SPAN session configuration. The correct order begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, then defining the destination interface for the analyzer, then optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active.

Question 9

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

Accepted Answer

The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.. The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic. CoPP (Control Plane Policing) protects the switch's CPU by rate-limiting control plane traffic, including ICMP. When the policer rate is set too low, even legitimate ICMP echo requests from the monitoring server are dropped, causing intermittent reachability issues.

Answer

An ACL applied to the management interface is blocking ICMP from the monitoring server.

Answer

The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.

Answer

The switch's CPU is overloaded, causing CoPP to drop all packets.

Question 10

An engineer is troubleshooting a network where OSPF neighbors are stuck in the EXSTART state. What is the most likely cause?

Accepted Answer

MTU mismatch between the routers. The EXSTART state in OSPF indicates that routers have formed a bidirectional communication (2-Way state) and are now attempting to exchange Database Description (DBD) packets to negotiate the master/slave relationship and the initial sequence number. An MTU mismatch between the routers is the most common cause of neighbors being stuck in EXSTART because the router with the smaller MTU will drop DBD packets that exceed its interface MTU, preventing the exchange from progressing to the Loading state.

Answer

Dead timer mismatch

Answer

Authentication misconfiguration

Answer

Mismatched OSPF area IDs

Question 11

A network engineer is configuring an EtherChannel between two Cisco switches. The engineer wants to use PAgP and ensure that the channel forms only if the neighboring switch is also configured for PAgP. Which mode should be configured on the local switch?

Accepted Answer

Configure 'channel-group 1 mode desirable' on the physical ports.. PAgP (Port Aggregation Protocol) is a Cisco proprietary protocol that negotiates EtherChannel links. The 'desirable' mode actively sends PAgP packets to initiate negotiation and will form a channel only with a neighbor also running PAgP (either in 'desirable' or 'auto' mode). This meets the requirement of ensuring the channel forms only if the neighbor is configured for PAgP.

Answer

Configure 'channel-group 1 mode auto' on the physical ports.

Answer

Configure 'channel-group 1 mode active' on the physical ports.

Answer

Configure 'channel-group 1 mode on' on the physical ports.

Question 12

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

Accepted Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.. The most likely cause is that traffic is exceeding the police rate in bursts, even though the average rate is 500 kbps and the configured police rate is 1 Mbps. Policing uses a token bucket, and TCP SSH traffic from the management subnet can burst above the configured rate. When bursts exceed the police rate, the exceed-action (by default, drop) drops the excess packets, causing intermittent SSH drops. If the conform-action were set to drop, all conforming traffic would be dropped consistently, not intermittently. The default conform-action is transmit, and there is no indication it was changed.

Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.

Answer

The ACL is denying SSH traffic from the management subnet.

Answer

The CoPP policy is applied to the wrong interface, so it is not affecting SSH traffic.

Question 13

A network engineer is troubleshooting connectivity issues in a multi-tenant environment where each tenant's traffic is isolated using VRF-Lite. The engineer notices that tenants in the same VRF cannot communicate with each other across different access switches. Which design change should be implemented to enable inter-switch VRF communication?

Accepted Answer

Create trunk links with 802.1Q subinterfaces on each switch and assign each subinterface to the appropriate VRF.. VRF-Lite requires 802.1Q trunking to extend Layer 3 VRF boundaries across switches. By creating subinterfaces on trunk links and assigning each subinterface to the appropriate VRF, traffic from the same VRF on different switches can be routed through the VRF-specific routing table, enabling inter-switch communication while maintaining isolation.

Answer

Use the same VLAN for all tenants and rely on VLAN ACLs.

Answer

Configure static routes on each switch pointing to the next-hop IP in the global routing table.

Answer

Enable OSPF with a single area on all switches and redistribute between VRFs.

Question 14

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Accepted Answer

The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.. The ACL is designed to match BGP traffic from host 10.0.0.1 (permit) and deny all other BGP traffic. However, CoPP class-maps match traffic based on permit statements in the ACL; a deny statement in the ACL causes the traffic to not be matched by that class. As a result, BGP traffic from other peers is not classified into the rate-limiting class and falls through to the default class, which typically permits all traffic. This explains why BGP sessions from other peers are still being established.

Answer

The ACL is applied in the wrong order; the deny statement should be before the permit statement.

Answer

BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

Answer

CoPP does not affect BGP sessions because they are established before the policy is applied.

Question 15

Drag and drop the steps of configuring model-driven telemetry with gRPC on a Cisco IOS-XE device into the correct order, from first to last.

Accepted Answer

Enable telemetry feature globally. First, enable telemetry and define the destination. Then, create a subscription with a sensor path. Next, set the update policy. Finally, verify the telemetry data is being sent.

Question 16

Examine this configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line vty 0 4
 login authentication default
 privilege level 15

What is missing to ensure that VTY users are authenticated via TACACS+?

Accepted Answer

The 'aaa authentication login default' command should include 'group tacacs+' before 'local'.. The 'aaa authentication login default local' command specifies that the default login authentication method is local, meaning VTY users are authenticated against the local user database. To authenticate via TACACS+, the command must include 'group tacacs+' before 'local' so that TACACS+ is tried first, with local as a fallback. Without this, TACACS+ is never consulted for authentication, even though authorization and accounting are configured for TACACS+.

Answer

The 'aaa authorization exec default' command should include 'group tacacs+'.

Answer

The 'aaa accounting exec default' command should include 'group tacacs+'.

Answer

The 'privilege level 15' command under VTY lines is missing.

Question 17

A network engineer runs the following command on Router R1:

R1# show access-lists 130
Extended IP access list 130
    10 permit icmp host 10.1.1.1 any echo (8 matches)
    20 permit icmp host 10.1.1.1 any echo-reply (5 matches)
    30 deny icmp any any (3 matches)
    40 permit ip any any (12 matches)

Based on this output, what can be concluded?

Accepted Answer

ICMP packets from sources other than 10.1.1.1 are denied.. The ACL explicitly denies all ICMP traffic (line 30) except for echo and echo-reply from host 10.1.1.1 (lines 10 and 20). The 'deny icmp any any' statement matches ICMP packets from any source other than 10.1.1.1, and the 'permit ip any any' at line 40 only permits non-ICMP traffic. Therefore, ICMP packets from sources other than 10.1.1.1 are denied.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all traffic from 10.1.1.1.

Answer

The ACL is applied inbound on an interface.

Question 18

Drag and drop the steps of Ansible inventory grouping and variable inheritance into the correct order, from first to last.

Accepted Answer

Define group variables in group_vars directory. Ansible inventory grouping and variable inheritance follows a hierarchy: first, group variables are defined in group_vars files; then, host variables are defined in host_vars files; next, the inventory parser resolves group parent-child relationships; after that, variables are merged with child groups overriding parent groups; finally, host-specific variables take highest precedence.

Question 19

Drag and drop the steps of Control Plane Policing (CoPP) rate-limit evaluation into the correct order, from first to last.

Accepted Answer

Configure class-map to match control plane traffic. CoPP evaluates packets by first classifying them into a class-map, then applying the policy-map to the control plane, which specifies the rate-limit action. The order ensures that classification happens before rate-limiting, and the final step is the action taken when the rate is exceeded.

Question 20

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Accepted Answer

The dialer interface does not have an IP address negotiated via IPCP.. In a PPPoE setup, the dialer interface typically obtains its IP address dynamically from the ISP via IPCP (IP Control Protocol) during PPP negotiation. If IPCP fails or is not configured to negotiate an address, the dialer interface remains unnumbered or without a usable IP address. Even though the PPPoE session is established and a default route exists, the router cannot route traffic because it lacks a valid source IP address on the dialer interface to send packets to the ISP's gateway.

Answer

The physical interface is configured with 'no ip address'.

Answer

The default route is pointing to the wrong next-hop IP.

Answer

The ISP's gateway is not responding to ICMP.