CCNP Practice Exam 68 — 20 Questions

Question 1

Consider this SNMP configuration on a Cisco IOS-XE switch:

snmp-server community public RO
snmp-server community private RW
snmp-server ifindex persist

What is the purpose of the 'snmp-server ifindex persist' command?

Accepted Answer

It prevents SNMP interface indices from changing after a router reload or interface configuration change.. The 'snmp-server ifindex persist' command ensures that SNMP interface indices (ifIndex values) remain consistent across router reloads or configuration changes. This is critical for network management systems (NMS) that rely on stable ifIndex values to correlate interface statistics over time, as without persistence, ifIndex values may be reassigned dynamically upon reboot or interface configuration modifications.

Answer

It enables SNMP traps for interface status changes.

Answer

It forces SNMP to use persistent storage for community strings.

Answer

It allows SNMP to index interfaces by their names instead of numbers.

Question 2

Consider the following BGP configuration on a Cisco IOS-XE router:

router bgp 65001
 neighbor 10.0.0.2 remote-as 65002
 neighbor 10.0.0.2 route-map SET_COMMUNITY out
!
route-map SET_COMMUNITY permit 10
 set community 65001:100

What is the effect of this configuration?

Accepted Answer

The router will set the community to 65001:100 on all routes advertised to neighbor 10.0.0.2.. The route-map SET_COMMUNITY is applied with the 'out' keyword on the neighbor statement, meaning it is evaluated on routes being advertised to neighbor 10.0.0.2. The 'set community 65001:100' action therefore stamps the community value 65001:100 on all outbound routes sent to that neighbor.

Answer

The router will set the community to 65001:100 on all routes received from neighbor 10.0.0.2.

Answer

The router will filter routes with community 65001:100 from being advertised.

Answer

The router will remove the community from routes advertised to the neighbor.

Question 3

Which two statements about DHCP snooping are true? (Choose two.)

Accepted Answer

DHCP snooping treats all ports as untrusted by default, except those explicitly configured as trusted.. Option A is correct because DHCP snooping's default security posture is to treat every port as untrusted, so only ports explicitly configured with the ip dhcp snooping trust command (typically uplinks toward the legitimate DHCP server) are allowed to carry server-originated DHCP messages such as OFFER, ACK, and NAK. Option C is correct because DHCP snooping inspects DHCP traffic and populates a binding table that records the client MAC address, leased IP address, VLAN, lease time, and ingress switch port, which is later used by features like Dynamic ARP Inspection and IP Source Guard. Option B is incorrect because the ip dhcp snooping trust command is applied to ports facing the trusted DHCP server or uplink, not to ports connected to DHCP clients, which must remain untrusted. Option D is incorrect because DHCP snooping must be enabled per VLAN with the ip dhcp snooping vlan command after the global ip dhcp snooping command; global enablement alone does not activate snooping on any VLAN. Option E is incorrect because DHCP snooping does not drop all packets containing option 82 from untrusted ports; it typically strips or replaces option 82 information on untrusted ports and can be configured to allow or drop such packets, so a blanket drop is not accurate.

Answer

The ip dhcp snooping trust command is applied on ports connected to DHCP clients.

Answer

DHCP snooping can be configured globally without enabling it on specific VLANs.

Answer

DHCP snooping drops all DHCP packets that contain option 82 information from untrusted ports.

Question 4

A cloud provider uses Cisco ACI to automate provisioning of tenant networks. A new tenant requires a Layer 2 bridge domain that extends to an external Layer 2 network via a VPC. The engineer creates a bridge domain with the settings: Type: Regular, L2 Unknown Unicast: Flood, L3 Unknown Multicast Flood: Flood, and Multi-Destination Flooding: Flood. The VPC is configured as a virtual port channel. The tenant reports that broadcast traffic is not reaching the external network. What is the most likely cause?

Accepted Answer

The L2Out is not configured to flood BUM traffic.. The bridge domain is configured to flood BUM (Broadcast, Unknown Unicast, and Multicast) traffic internally, but the L2Out (Layer 2 external connection) must also be explicitly configured to flood BUM traffic to the external network. Without this configuration on the L2Out, the ACI fabric will not forward broadcast or multicast frames across the VPC to the external Layer 2 network, even though the bridge domain itself permits flooding.

Answer

The VPC configuration does not support L2 extension.

Answer

The bridge domain is configured as proxy mode for L2 unknown unicast.

Answer

The bridge domain type should be set to 'L2 Only'.

Question 5

A network engineer is deploying Cisco DNA Center in a brownfield network. The engineer wants to use DNA Center to automate the configuration of QoS policies across all access switches. After discovering the devices and adding them to Inventory, the engineer creates a QoS policy and assigns it to a site. However, when attempting to provision, DNA Center reports that the devices are in 'Compliance Error' state. What is the most likely reason?

Accepted Answer

The devices have existing QoS configurations that conflict with the new policy.. In Cisco DNA Center, when a device is provisioned with a configuration template or policy (like a QoS policy assigned at a site), the device enters 'Compliance Error' if its running configuration does not match the intended configuration. In a brownfield network, pre-existing QoS configurations on the access switches commonly conflict with the newly pushed policy, causing the mismatch. DNA Center flags this rather than silently overwriting, which is why the engineer sees the error.

Answer

The devices are not running a supported IOS-XE version for QoS automation.

Answer

The DNA Center appliance does not have enough storage to process the QoS policy.

Answer

The QoS policy was created with an invalid DSCP value.

Question 6

Which three statements about OSPF area types are correct? (Choose three.)

Accepted Answer

A stub area blocks Type 5 AS External LSAs but allows Type 3 Summary LSAs and a default route.. Option A is correct because a stub area, configured with the area stub command, blocks Type 5 AS External LSAs at the ABR while still permitting Type 3 Summary LSAs, and the ABR injects a default route (Type 3 LSA 0.0.0.0) so internal routers can reach external destinations. Option B is correct because a totally stubby area (area stub no-summary) blocks both Type 5 AS External LSAs and Type 3 Summary LSAs, leaving only a single default route injected by the ABR plus intra-area Type 1 and 2 LSAs. Option D is correct because a standard OSPF area carries Type 1 Router LSAs, Type 2 Network LSAs, Type 3 Summary LSAs, Type 4 ASBR Summary LSAs, and Type 5 AS External LSAs. Option C is incorrect because an NSSA does not import Type 5 LSAs; it uses Type 7 LSAs for external routes originated inside the area, which the ABR translates to Type 5 when flooding into the backbone. Option E is incorrect because a totally NSSA blocks Type 3 Summary LSAs (except the default route) and does not allow Type 5 LSAs; external routes inside it are carried as Type 7 LSAs.

Answer

A not-so-stubby-area (NSSA) allows Type 5 LSAs to be imported from external networks.

Answer

A totally NSSA blocks Type 3 LSAs but allows Type 5 LSAs from external sources.

Question 7

A network engineer is troubleshooting a wireless network where clients in a specific area report slow speeds and frequent disconnections. The engineer uses a spectrum analyzer and finds high utilization on channel 11 in the 2.4 GHz band. The engineer also notices that several neighboring access points are using channel 11. What is the most likely cause of the issue?

Accepted Answer

Co-channel interference from neighboring access points using the same channel.. The spectrum analyzer shows high utilization on channel 11, and neighboring APs are also using channel 11. This is a classic case of co-channel interference (CCI), where multiple APs on the same channel cause contention, hidden node problems, and increased collisions, leading to degraded throughput and frequent disconnections for clients in that area.

Answer

Adjacent channel interference from access points using channels 10 and 12.

Answer

Non-WiFi interference from devices like microwaves or cordless phones.

Answer

The access point is overloaded with too many clients.

Question 8

A network engineer runs the following command on Router R8:

R8# show ip mroute count
IP Multicast Statistics
Group: 239.4.4.4, Source: 10.0.0.9
  Packets: 1500, Bytes: 1200000, Average rate: 8000 pps, 5 sec rate: 0 pps

Group: 239.5.5.5, Source: 10.0.0.10
  Packets: 0, Bytes: 0, Average rate: 0 pps, 5 sec rate: 0 pps

Based on this output, what can be concluded?

Accepted Answer

Multicast traffic is flowing for group 239.4.4.4.. The output shows 1500 packets and 1,200,000 bytes received for group 239.4.4.4 from source 10.0.0.9, with an average rate of 8000 pps, indicating active multicast traffic. In contrast, group 239.5.5.5 shows zero packets and bytes, confirming no traffic is flowing for that group. The 'show ip mroute count' command displays per-group and per-source packet and byte counters, directly reflecting multicast forwarding activity.

Answer

Multicast traffic is flowing for group 239.5.5.5.

Answer

Both groups are receiving traffic.

Answer

The source for group 239.4.4.4 is 10.0.0.10.

Question 9

Which three statements about NFV use cases and deployment models are true? (Choose three.)

Accepted Answer

Virtual CPE (vCPE) is a common NFV use case that replaces physical routers and firewalls at customer sites with software-based functions.. Option A is correct because Virtual CPE (vCPE) is a widely recognized NFV use case in which customer-premises functions such as routing, firewalling, and NAT are delivered as software VNFs on commodity hardware or virtualized platforms instead of dedicated physical appliances. Option B is correct because the Virtual Evolved Packet Core (vEPC) virtualizes 4G/LTE core elements including the MME (Mobility Management Entity), SGW (Serving Gateway), and PGW (Packet Data Network Gateway) as VNFs running on NFV infrastructure. Option C is correct because NFV can be deployed across multiple environments, including on-premises data centers, private clouds, and public cloud infrastructures, since the NFV architectural framework separates VNFs from the underlying virtualization and hardware layers. Option D is incorrect because NFV explicitly aims to decouple network functions from proprietary dedicated hardware appliances, running them instead on general-purpose servers and standard virtualization platforms. Option E is incorrect because NFV supports dynamic, elastic, and scalable configurations through MANO (Management and Orchestration) and VNF lifecycle management, rather than being limited to static deployments.

Answer

NFV requires dedicated hardware appliances for each virtualized network function.

Answer

NFV deployments are limited to static, non-scalable configurations.

Question 10

Which three statements about error handling and debugging in Python network automation scripts are true? (Choose three.)

Accepted Answer

The try-except block allows a script to handle connection timeouts without crashing.. Option B is correct because wrapping network calls (e.g., socket.connect or requests.get) in a try-except block lets the script catch exceptions like socket.timeout or TimeoutError and handle them gracefully instead of terminating. Option C is correct because Python's logging module provides configurable handlers such as FileHandler and RotatingFileHandler to persist error and debug messages to a file, which is essential for auditing automation runs. Option D is correct because print() statements are a common, simple debugging technique during development to inspect variable values and trace execution flow before formal logging is added. Option A is not correct because using 'pass' in an except block silently swallows exceptions, hiding failures and making production troubleshooting difficult; best practice is to log or re-raise. Option E is not correct because 'continue' is a loop control statement that skips to the next iteration, not an exception-handling mechanism; exceptions are handled with try-except-finally.

Answer

Using 'pass' in an except block is a best practice to ignore errors in production scripts.

Answer

The continue statement is used to handle exceptions in Python.

Question 11

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 12

Drag and drop each leased line technology on the left to its matching speed on the right.

Accepted Answer

T1: 1.544 Mbps. T1 = 1.544 Mbps, E1 = 2.048 Mbps, DS3 = 44.736 Mbps, OC-3 = 155.52 Mbps, OC-12 = 622.08 Mbps.

Question 13

Which two statements about the Cisco Enterprise Campus Architecture are true? (Choose two.)

Accepted Answer

The distribution layer provides policy-based connectivity and controls traffic flow between access and core layers.. Option A is correct because in the Cisco Enterprise Campus Architecture the distribution layer is the aggregation point that provides policy-based connectivity, inter-VLAN routing, route summarization, and controls traffic flow between the access and core layers. Option C is correct because the core layer is designed as a high-speed transport backbone with minimal latency, so CPU-intensive features such as ACLs, packet inspection, and policy enforcement should be avoided there. Option B is wrong because routing between VLANs and high-speed backbone switching are functions of the distribution and core layers, not the access layer, which primarily provides user/device connectivity and Layer 2 switching with PoE and port security. Option D is wrong because a two-tier collapsed-core design is recommended for smaller campus networks, whereas large campuses with thousands of users typically use a three-tier hierarchical design. Option E is wrong because security policy enforcement and packet inspection belong at the distribution (and access) layers, not the core, which must remain fast and simple.

Answer

The access layer is responsible for routing between VLANs and providing high-speed switching for the campus backbone.

Answer

A two-tier hierarchical design (collapsed core) is recommended for large campus networks with thousands of users.

Answer

The core layer should enforce security policies and perform packet inspection to protect the campus network.

Question 14

Which two statements about SNMP trap and inform operations are true? (Choose two.)

Accepted Answer

An SNMP inform request is acknowledged by the manager with a response PDU.. Option A is correct because an SNMP inform request is a confirmed notification: the receiving manager must reply with a Response PDU (using the same request-id) so the sender knows the notification was received. Option D is correct because informs require the sender to retain the notification in memory until the acknowledgment arrives and to retransmit if no response is received, adding bandwidth and memory overhead compared with unacknowledged traps. Options B, C, and E are not correct: traps are less reliable than informs since they are unacknowledged, SNMPv1 does not support the inform operation (it was introduced with SNMPv2), and traps are sent from an agent to a manager, not from a manager to an agent to request configuration changes.

Answer

SNMP traps are more reliable than informs because they use UDP port 162.

Answer

Both SNMPv1 and SNMPv2c support the inform operation.

Answer

Traps are sent from the manager to the agent to request configuration changes.

Question 15

Which three statements about Cisco SD-Access design are true? (Choose three.)

Accepted Answer

VXLAN is used as the data plane encapsulation in SD-Access to create overlay tunnels.. Cisco SD-Access is a policy-based, intent-driven network architecture that uses VXLAN for overlay tunneling and LISP for control plane. It separates the network into fabric and non-fabric domains. The fabric uses a border node to connect to external networks. Option A is correct because VXLAN provides the data plane encapsulation. Option C is correct because LISP is the control plane that maps endpoints to their locations. Option D is correct because the border node connects the fabric to outside networks (e.g., WAN, Internet). Option B is incorrect because the fabric edge is the access layer switch that connects endpoints, not the border. Option E is incorrect because SD-Access typically uses a two-tier spine-leaf design, not a three-tier core-distribution-access.

Answer

The fabric border node is the access layer switch that connects end devices to the network.

Answer

SD-Access requires a three-tier hierarchical design with core, distribution, and access layers.

Question 16

A network engineer runs the following command on Switch SW1:

SW1# show interfaces gi0/1 trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      desirable    n-802.1q       trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are active in the management domain. This means VLANs 2-9 and 11-19, 21-1005 are allowed but not active (i.e., not created or not present on the switch). Option C correctly identifies that VLANs 2-9 are among those allowed but not active.

Answer

The interface is configured as an access port.

Answer

The trunk is using ISL encapsulation.

Answer

The native VLAN is 10.

Question 17

Which three statements about Ansible playbooks and roles are true? (Choose three.)

Accepted Answer

Roles in Ansible use a standardized directory structure that includes 'tasks', 'handlers', 'vars', 'defaults', and 'meta'.. Option A is correct because Ansible roles follow a standardized directory layout containing subdirectories such as tasks, handlers, vars, defaults, meta, files, and templates, which allows roles to be reused and shared consistently. Option C is correct because handlers are tasks triggered only via the notify directive, and Ansible runs each notified handler only once at the end of a play, even if multiple tasks notify it. Option E is correct because the meta directory holds main.yml, where role dependencies are declared under the dependencies key, and it can also define galaxy metadata. Option B is incorrect because import_role is a static import processed at playbook parsing time, whereas include_role is the module that includes a role dynamically during execution. Option D is incorrect because variables in a role's defaults directory have the lowest precedence among role variables, not the highest; vars files and inventory or play-level variables override them.

Answer

The 'import_role' module includes a role dynamically during play execution.

Answer

Variables defined in the 'defaults' directory of a role have the highest precedence.

Question 18

Which two statements about VLAN trunking using IEEE 802.1Q are true? (Choose two.)

Accepted Answer

The 802.1Q tag includes a 12-bit VLAN ID field.. Option A is correct because the IEEE 802.1Q tag contains a 12-bit VLAN Identifier (VID) field, which allows VLAN IDs from 0 to 4095 (with 0 and 4095 reserved), giving 4094 usable VLANs. Option B is correct because on an 802.1Q trunk, frames belonging to the native VLAN are transmitted untagged, while all other VLAN frames carry the 4-byte tag. Option C is incorrect because the native VLAN is configurable and does not have to be VLAN 1, though VLAN 1 is the default. Option D is incorrect because 802.1Q uses a TPID value of 0x8100, whereas 0x88A8 is associated with 802.1ad (QinQ/Provider Bridging). Option E is incorrect because 802.1Q's 12-bit VID field supports 4096 possible values (4094 usable), not a maximum of 4096 usable VLANs as commonly misstated.

Answer

The native VLAN must always be VLAN 1.

Answer

The 802.1Q tag uses a TPID value of 0x88A8.

Answer

802.1Q supports a maximum of 4096 VLANs.

Question 19

A network engineer is troubleshooting a performance issue with a virtual firewall (vFW) running on a Cisco NFVIS host. The vFW is experiencing high packet loss during peak traffic. The engineer checks the NFVIS monitoring dashboard and sees that the vFW's CPU usage is low, but the host's memory usage is high. What is the most likely cause of the packet loss?

Accepted Answer

The host is under memory pressure, causing the hypervisor to swap or balloon memory from the vFW.. When the NFVIS host experiences high memory pressure, the hypervisor may reclaim memory from virtual machines (VMs) using mechanisms such as ballooning or swapping. This reduces the memory available to the vFW, causing it to drop packets because its packet buffers or operating system memory are forcibly reclaimed. The vFW's CPU remains low because the bottleneck is memory, not processing power.

Answer

The vFW is CPU-bound, but the monitoring is inaccurate.

Answer

The host's CPU is oversubscribed, causing vCPU starvation.

Answer

The vFW's packet buffer is exhausted, but the monitoring does not show it.

Question 20

Drag and drop the steps of QoS pre-classify for encrypted VPN traffic into the correct order, from first to last.

Accepted Answer

Configure crypto map with QoS pre-classify. First, the crypto map is configured with QoS pre-classify (A) to enable the feature. Next, the service-policy is applied to the tunnel interface (B) to enforce QoS. When a packet arrives, the original packet enters the router before encryption (C). Classification and policing are performed based on the original marking (E). Afterwards, the original DSCP is copied to the encrypted packet header (D) to preserve QoS markings. This sequence ensures correct QoS treatment for VPN traffic.