CCNP Practice Exam 67 — 20 Questions

Question 1

A network engineer runs the following command on Switch SW2:

SW2# show spanning-tree vlan 20

VLAN0020
  Spanning tree enabled protocol ieee
  Root ID    Priority    24596
             Address     aabb.cc00.0200
             Cost        4
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 20)
             Address     aabb.cc00.0300
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Altn BLK 4         128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

GigabitEthernet0/3 is in the Blocking state to prevent a loop.. The output shows that SW2's Gi0/3 is in the Alternate (Altn) role and Blocking (BLK) state. In Rapid PVST+ (IEEE 802.1w), an alternate port provides a backup path to the root bridge and is placed in a blocking state to prevent Layer 2 loops. This confirms that Gi0/3 is blocking to maintain a loop-free topology.

Answer

SW2 is the root bridge for VLAN 20.

Answer

The root port cost is 8.

Answer

SW2's bridge priority is 32768.

Question 2

A network engineer uses the Cisco DNA Center REST API to retrieve the list of devices. The API returns the following JSON:

```json
{
  "response": [
    {
      "id": "12345678-1234-1234-1234-123456789abc",
      "managementIpAddress": "192.168.1.1",
      "hostname": "Router1",
      "platformId": "ISR4331",
      "role": "ACCESS",
      "series": "ISR4300 Series"
    }
  ],
  "version": "1.0"
}
```

The engineer writes the following Python code to extract the hostname of the first device:

```python
import requests

url = 'https://dna-center.local/dna/intent/api/v1/network-device'
headers = {'X-Auth-Token': 'valid_token', 'Accept': 'application/json'}
response = requests.get(url, headers=headers, verify=False)
data = response.json()
hostname = data['response'][0]['hostname']
print(hostname)
```

What is a potential issue with this code?

Accepted Answer

The code does not check if the HTTP response status is 200 before parsing JSON, which could lead to errors if the token is invalid.. The code assumes the API call succeeds and the 'response' list is non-empty. If the token is expired or the API returns an error, response.json() may not have the expected structure, causing a KeyError or IndexError. The code lacks error handling for HTTP status codes and empty responses.

Answer

The URL is missing the '/v1' version segment.

Answer

The 'Accept' header should be 'application/yang-data+json' for DNA Center.

Answer

The 'X-Auth-Token' header is not the correct authentication method; DNA Center uses Basic Auth.

Question 3

Drag and drop the steps of configuring a site-to-site IPsec VPN on Cisco IOS into the correct order, from first to last.

Accepted Answer

Define IKE policy. The correct order for configuring a site-to-site IPsec VPN is: first define the IKE policy (Phase 1 parameters), then define the IPsec transform set (Phase 2 parameters), then create the crypto ACL to match interesting traffic, then configure the crypto map to bind all parameters, and finally apply the crypto map to the outgoing interface.

Question 4

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Accepted Answer

GM initiates ISAKMP SA with KS. In GET VPN, a group member (GM) first registers with the key server (KS) using ISAKMP. The KS authenticates the GM and then pushes the current policy and encryption keys (TEK and KEK) to the GM. The KS periodically sends a rekey message to all GMs to update the keys before they expire.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/0 | include access list
  Inbound  access list is 101
  Outbound access list is not set

R1# show access-lists 101
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 80 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from sources outside 192.168.1.0/24 is denied.. The ACL 101 is applied inbound on GigabitEthernet0/0. The first line permits TCP traffic from source 192.168.1.0/24 to any destination on port 80 (HTTP). The second line denies TCP traffic from any source to any destination on port 80, which catches HTTP traffic from sources outside 192.168.1.0/24. Since ACLs process in order, traffic from outside the permitted subnet is denied, making option A correct.

Answer

All HTTP traffic is permitted.

Answer

The ACL is applied outbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 6

A company has a campus network with two distribution switches (DSW1 and DSW2) connected via a Layer 2 trunk. Each distribution switch connects to two access switches. Spanning Tree Protocol (STP) is running with default settings. Recently, a network administrator added a new access switch (ASW3) and connected it to both distribution switches. After the connection, network performance degraded significantly, and users in VLAN 10 reported intermittent connectivity. The administrator checked the logs and saw multiple TCN notifications. What is the most likely cause of the issue?

Accepted Answer

The new switch is causing a Layer 2 loop due to redundant links without proper STP configuration.. When ASW3 is connected to both DSW1 and DSW2 via Layer 2 trunk links, it creates a physical loop in the network. With default STP settings, the new switch will participate in the spanning tree algorithm, but the sudden addition of redundant links can cause a temporary loop or instability until STP converges. The multiple TCN (Topology Change Notification) messages indicate that the spanning tree topology is flapping, leading to MAC address table flushes and intermittent connectivity for VLAN 10 users. This is the classic symptom of a Layer 2 loop caused by redundant links without proper STP configuration or before convergence completes.

Answer

The new switch is not configured with the same VLANs as the distribution switches.

Answer

The new switch has a lower bridge priority than the current root bridge.

Answer

The new switch has become the root bridge and is sending inferior BPDUs.

Question 7

An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?

Accepted Answer

Cisco ISE. Cisco ISE is the policy decision point in a TrustSec-enabled SD-Access fabric. When an endpoint authenticates via 802.1X, MAB, or web authentication, ISE evaluates the authentication result and the applicable authorization policy, then dynamically assigns a Security Group Tag (SGT) to the endpoint. This SGT is passed to the network access device (e.g., fabric edge node) via RADIUS attributes in the Access-Accept message, enabling consistent policy enforcement throughout the fabric.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Cisco DNA Center

Question 8

Drag and drop the steps of AAA method list fallback from RADIUS to local into the correct order, from first to last.

Accepted Answer

User attempts to authenticate to network device. When a method list specifies RADIUS then local, the device first attempts RADIUS authentication. If the RADIUS server is unreachable (timeout), the device falls back to the next method in the list, which is local authentication using the local user database.

Question 9

Which BGP attribute is preferred with the lowest value?

Accepted Answer

MULTI_EXIT_DISC (MED). In BGP path selection, the LOCAL_PREF attribute is used to prefer paths within an AS. A higher LOCAL_PREF is preferred, but the question asks for the attribute preferred with the lowest value. The WEIGHT attribute is Cisco-specific and is preferred with the highest value. The MULTI_EXIT_DISC (MED) attribute is preferred with the lowest value.

Answer

LOCAL_PREF

Answer

AS_PATH

Answer

WEIGHT

Question 10

Drag and drop the steps of EIGRP redistribution from OSPF with metric seeding into the correct order, from first to last.

Accepted Answer

Enter EIGRP router configuration mode. First, the EIGRP routing process must be entered. Then, the redistribute command is used with the OSPF process and a metric. Optionally, route-map filtering can be applied. Finally, verification ensures routes appear in the EIGRP topology table.

Question 11

Drag and drop the steps of connecting to a network device via Netmiko into the correct order, from first to last.

Accepted Answer

Import netmiko library. The correct order starts with importing the Netmiko library, then creating a device dictionary with connection parameters, establishing the SSH connection using ConnectHandler, sending a command (e.g., 'show ip interface brief'), and finally closing the connection with disconnect(). This sequence follows standard Netmiko workflow for device access.

Question 12

An engineer is using a Python script to retrieve interface statistics from a Cisco IOS-XE device via the REST API. The script sends a GET request to 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/statistics' and receives a 404 Not Found response. The interface exists and is operational. What is the most likely issue?

Accepted Answer

The URI is incorrect; statistics are under 'interfaces-state' not 'interfaces'.. The 404 error indicates the resource was not found. In RESTCONF, the URI must use the correct encoding for interface names, especially if they contain special characters like a slash. The interface name 'GigabitEthernet1' should be URL-encoded as 'GigabitEthernet1' (no encoding needed here), but the issue is that the URI path must match the YANG module structure exactly. The statistics data is often under a separate container like 'interfaces-state' in the ietf-interfaces model, not directly under 'interface'. The correct URI for operational statistics is typically 'ietf-interfaces:interfaces-state/interface=GigabitEthernet1/statistics'.

Answer

The interface name must be URL-encoded because it contains a slash.

Answer

The device requires authentication; the script must include a valid token.

Answer

The REST API is not enabled on the device; the engineer must enable it first.

Question 13

A network engineer runs the following command on Switch SW3:

SW3# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip

EtherChannel Load-Balancing Operational State:
        src-dst-ip

Based on this output, what can be concluded?

Accepted Answer

The load-balancing method is based on source and destination IP addresses.. The command output shows both the configured and operational load-balancing method as 'src-dst-ip', which means the switch uses a hash of both the source and destination IP addresses to select the EtherChannel link. This is the correct interpretation because 'src-dst-ip' explicitly indicates IP-based load balancing, not MAC-based or round-robin.

Answer

The switch uses source MAC and destination MAC for load balancing.

Answer

The operational state differs from the configured state, indicating a problem.

Answer

The switch is using round-robin to distribute traffic across ports.

Question 14

A network team is using Ansible with the iosxr_config module to push configuration changes to a Cisco IOS-XR router. The playbook uses the REST API via the 'ansible_connection: restconf' setting. The engineer notices that the changes are applied but the playbook reports 'changed: false' even when changes were made. What is the most likely reason for this behavior?

Accepted Answer

The engineer should use the 'uri' module with the REST API instead of the 'iosxr_config' module.. When using RESTCONF, the Ansible module may not detect changes if the module does not properly parse the response from the device. However, in this scenario, the issue is that the 'iosxr_config' module is designed for CLI-based connections, not RESTCONF. The correct approach is to use a module like 'iosxr_restconf' or a generic 'uri' module. The 'ansible_connection: restconf' is not a valid connection type for Ansible; Ansible uses 'network_cli' or 'ansible.netcommon.restconf' connection plugin. The engineer should use the 'uri' module or a dedicated RESTCONF module.

Answer

The REST API on the router does not return a proper response, so Ansible cannot determine if a change occurred.

Answer

The playbook is missing the 'gather_facts: no' directive, causing Ansible to skip change detection.

Answer

The router requires a commit operation after configuration changes, and Ansible does not perform that.

Question 15

Drag and drop each NFV management layer on the left to its matching function on the right.

Accepted Answer

VNF Manager (VNFM): Lifecycle management of VNF instances (instantiate, scale, terminate). VNFM manages individual VNFs; NFVO orchestrates network services; VIM controls NFVI resources.

Question 16

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6, Gi0/7
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

Interfaces Gi0/1, Gi0/2, and Gi0/3 are in VLAN 1.. The 'show vlan brief' output explicitly lists Gi0/1, Gi0/2, and Gi0/3 under VLAN 1 (default), confirming these interfaces are access ports assigned to VLAN 1. VLAN 1 is the default VLAN on Cisco switches, and all ports not explicitly configured otherwise belong to it.

Answer

All ports shown are in trunk mode.

Answer

VLANs 1002-1005 are active and supported.

Answer

VLAN 20 has no ports assigned.

Question 17

A network engineer writes an Ansible playbook to configure a VLAN on a Cisco Nexus switch:

```yaml
---
- name: Configure VLAN
  hosts: nxos_switches
  gather_facts: no
  tasks:
    - name: Create VLAN 100
      cisco.nxos.nxos_vlan:
        vlan_id: 100
        name: test_vlan
        state: present
```

What is a potential issue with this playbook?

Accepted Answer

The playbook is missing the 'connection: network_cli' and 'become: yes' directives to enable privileged mode.. Ansible modules for Cisco NX-OS require `connection: network_cli` (or `ansible_connection: network_cli`) to use the CLI transport, and `become: yes` to elevate privileges to enable mode (similar to `enable` on a switch). Without these, the playbook will fail to authenticate or execute privileged commands, as the `nxos_vlan` module needs to send configuration commands that require enable access.

Answer

The module name is incorrect; it should be 'nxos_vlan_config' instead of 'nxos_vlan'.

Answer

The VLAN ID must be a string, not an integer.

Answer

The 'state: present' is invalid; it should be 'state: create'.

Question 18

An organization is migrating from a traditional three-tier architecture to a leaf-spine fabric using VXLAN EVPN. The design requires that virtual machines can move between racks without IP address changes. Which technology must be enabled at the leaf switches to support this mobility?

Accepted Answer

VXLAN with EVPN control plane.. VXLAN with EVPN control plane (B) is correct because it provides a Layer 2 overlay network that extends VLANs across the leaf-spine fabric, enabling virtual machine mobility without IP address changes. EVPN uses BGP to distribute MAC and IP address information, allowing the leaf switches to learn and forward traffic to VMs regardless of their physical location, which is essential for seamless VM migration between racks.

Answer

Overlay Transport Virtualization (OTV).

Answer

VRF-Lite with route redistribution.

Answer

MPLS L3VPN with BGP.

Question 19

An engineer configures model-driven telemetry on a Cisco IOS-XE device with the following gRPC dial-out configuration:

```
telemetry ietf subscription 101
 encoding encode-kvgpb
 filter xpath /interfaces/interface/state/counters
 source-address 10.1.1.1
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.2.2.2 50001 protocol grpc-tcp
```

What is the purpose of the 'encoding encode-kvgpb' command?

Accepted Answer

It specifies that the data should be encoded using the Key-Value Google Protocol Buffers format.. The 'encoding encode-kvgpb' command specifies that the telemetry data should be encoded using the Key-Value Google Protocol Buffers (KV-GPB) format, which is a compact binary encoding used for efficient data transmission.

Answer

It sets the encoding to JSON format for human readability.

Answer

It enables compression of the telemetry data.

Answer

It sets the encoding to XML format.

Question 20

An engineer configures EIGRP on a new router in a DMVPN network. The router has a single physical interface with two subinterfaces: one for the DMVPN tunnel and one for a direct point-to-point link to a hub router. The engineer notices that EIGRP adjacencies form only on the point-to-point link, not on the DMVPN tunnel. The tunnel interface is configured with ip nhrp network-id 1 and ip nhrp nhs 10.1.1.1. What is the most likely reason?

Accepted Answer

The tunnel interface is not configured with the 'ip eigrp' command under the interface configuration.. The most common reason for EIGRP not forming an adjacency over a tunnel interface is the absence of the 'ip eigrp' command under that interface. Without this command, EIGRP is not enabled on the tunnel, so it will not send or process Hello packets, preventing adjacency formation even if NHRP and tunnel parameters are correctly configured.

Answer

The tunnel interface is not configured with the 'ip nhrp map' command for the hub router.

Answer

The DMVPN tunnel is using a different autonomous system number than the point-to-point link.

Answer

The tunnel interface is in a different VRF than the point-to-point link.