CCNP Practice Exam 69 — 20 Questions

Question 1

An engineer retrieves telemetry data from a Cisco IOS-XE device using RESTCONF and receives the following response:

```json
{
  "ietf-interfaces:interfaces": {
    "interface": [
      {
        "name": "GigabitEthernet1",
        "type": "iana-if-type:ethernetCsmacd",
        "enabled": true,
        "ipv4": {
          "address": [
            {
              "ip": "192.168.1.1",
              "netmask": "255.255.255.0"
            }
          ]
        }
      }
    ]
  }
}
```

What is the correct way to access the IP address of the interface using Python?

Accepted Answer

data['ietf-interfaces:interfaces']['interface'][0]['ipv4']['address'][0]['ip']. The JSON response nests the interface data under the top-level key 'ietf-interfaces:interfaces', then under 'interface' (a list), then indexes the first element, then accesses 'ipv4', then 'address' (a list), then indexes the first element, then accesses 'ip'. The correct path must include the module-prefixed top-level key, the list indexing on 'interface', and the list indexing on 'address'.

Answer

data['interface'][0]['ipv4']['address']['ip']

Answer

data['interfaces']['interface']['ipv4']['address']['ip']

Answer

data['ietf-interfaces:interfaces']['interface']['ipv4']['address'][0]['ip']

Question 2

Which two statements about Cisco DNA Center software image management (SWIM) are true? (Choose two.)

Accepted Answer

Cisco DNA Center allows administrators to define a golden image for each device family and automatically enforce compliance.. Option A is correct because Cisco DNA Center SWIM lets administrators designate a golden (approved) image per device family and then run compliance checks that flag and remediate devices whose running image deviates from that golden image. Option B is correct because SWIM performs remote image distribution and activation over the management network, so devices can be upgraded without an engineer physically visiting them. Option C is wrong because SWIM uses DNA Center's own image repository and file transfer mechanisms (for example, HTTPS/SCP-style transfer to devices), not a locally configured TFTP server on each device. Option D is wrong because SWIM does include image compliance status, version tracking, and audit/history reporting. Option E is wrong because SWIM supports a broad range of Cisco platforms (including many Catalyst switching and routing families), not only Catalyst 9000 series devices.

Answer

Cisco DNA Center SWIM requires all devices to have a TFTP server configured locally to receive new images.

Answer

Cisco DNA Center SWIM does not provide any compliance reporting or audit trails for image versions.

Answer

Cisco DNA Center SWIM only supports Cisco Catalyst 9000 series switches and cannot manage older platforms.

Question 3

Drag and drop each WAN encapsulation on the left to its matching use case on the right.

Accepted Answer

HDLC: Cisco proprietary point-to-point serial encapsulation. HDLC is Cisco proprietary and used for point-to-point serial links. PPP supports authentication and multilink. PPPoE is used for DSL broadband connections. Frame Relay is a legacy packet-switched WAN technology. MLPPP bundles multiple PPP links.

Question 4

An Ansible playbook uses the cisco.dnac.site module to create a new building site. The playbook is:

- name: Create building site
  cisco.dnac.site:
    host: "{{ dnac_host }}"
    username: "{{ dnac_username }}"
    password: "{{ dnac_password }}"
    validate_certs: no
    state: present
    site:
      name: Building-B
      type: building
      parentName: Area-1
      address: "123 Main St"
      latitude: 37.7749
      longitude: -122.4194
  register: result

What is the purpose of the 'parentName' parameter?

Accepted Answer

It specifies the name of the building's parent in the hierarchy, such as an area or global site.. The 'parentName' parameter specifies the name of the building's parent in the Cisco DNA Center site hierarchy, such as an area or the global site. In the cisco.dnac.site module, this parameter establishes the hierarchical relationship, ensuring the new building is created under the correct parent site (e.g., Area-1) rather than at the root level.

Answer

It defines the DNS domain name for the building.

Answer

It sets the name of the network profile associated with the building.

Answer

It is used to specify the building's primary IP address.

Question 5

Which three statements about the Differentiated Services (DiffServ) QoS model are true? (Choose three.)

Accepted Answer

DiffServ uses the 6-bit DSCP field in the IP header to mark packets, allowing up to 64 different classes of service.. DiffServ is a class-based model that uses the DSCP field in the IP header to classify traffic. It provides per-hop behavior (PHB) and is scalable because core routers only need to inspect the DSCP field. The model does not guarantee end-to-end bandwidth reservation like IntServ does; instead, it relies on traffic conditioning at the edge.

Answer

In DiffServ, core routers perform complex classification and marking based on deep packet inspection.

Answer

DiffServ requires end-to-end signaling using RSVP to reserve bandwidth along the path.

Question 6

Which three statements about the Multiple Spanning Tree Protocol (MSTP) are true? (Choose three.)

Accepted Answer

MSTP allows multiple VLANs to be mapped to a single spanning-tree instance.. Option A is correct because MSTP (IEEE 802.1s) lets you group many VLANs into a single Multiple Spanning Tree Instance (MSTI), so one topology serves all VLANs mapped to it, greatly reducing the number of spanning-tree instances compared with PVST+. Option B is correct because MSTP builds an Internal Spanning Tree (IST) as instance 0, which carries the Common and Internal Spanning Tree (CIST) information and connects MST regions to each other and to other STP domains. Option C is correct because MSTP is designed to interoperate with 802.1D (classic STP) and 802.1w (RSTP) devices, treating them as part of the CIST so legacy switches can participate in the topology. Option D is wrong because requiring one instance per VLAN describes PVST+/RPVST+, whereas MSTP's whole purpose is to map multiple VLANs to a single instance. Option E is wrong because MSTP uses the same RSTP-style BPDU format (with MSTP-specific extensions in the MSTI configuration messages), not a fundamentally different BPDU format.

Answer

MSTP requires a separate spanning-tree instance for every VLAN.

Answer

MSTP uses a different BPDU format than RSTP.

Question 7

A mid-size enterprise is deploying a new branch office with 50 users. The branch will have its own router, switch, and wireless AP. The WAN link is a 50 Mbps MPLS circuit. The company uses VoIP and requires Quality of Service. The network administrator has configured the router with a QoS policy that marks VoIP traffic with DSCP EF and all other traffic with DSCP 0. The policy also shapes traffic to 50 Mbps. After deployment, users report that voice quality is poor during peak hours. The administrator checks the router and sees that the output queue on the WAN interface is often full and drops are occurring. Which action should the administrator take to improve voice quality?

Accepted Answer

Configure a priority queue for DSCP EF traffic within the shaper.. The shaper is limiting traffic to 50 Mbps, but during peak hours, the aggregate traffic exceeds this rate, causing the output queue to fill and drop packets indiscriminately. By configuring a priority queue for DSCP EF (VoIP) traffic within the shaper, the router will service VoIP packets before other traffic, ensuring low latency and jitter even when the link is congested. This is the standard Cisco approach for voice quality on shaped links, as priority queuing bypasses the normal FIFO or CBWFQ behavior for marked traffic.

Answer

Increase the shaping rate to 60 Mbps to allow for burst.

Answer

Replace shaping with policing to drop non-voice traffic.

Answer

Change the marking to use CoS instead of DSCP for better QoS.

Question 8

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Accepted Answer

description. In a YANG module for interface configuration, the 'description' leaf (option B) is a standard attribute used to set a human-readable interface description via the CLI equivalent 'description '. The 'mtu' leaf (option C) is also standard, representing the interface Maximum Transmission Unit, commonly configured with 'mtu ' and modeled in YANG as an unsigned integer. The 'ip address' node (option D) is included to assign an IPv4 address and subnet mask to an interface, typically modeled as a container or list with 'address' and 'prefix-length' leaves. Option A, 'switchport mode', is a Layer 2 switching attribute found in vendor-specific or Cisco YANG models (e.g., Cisco IOS XE native model) but is not a generic interface configuration attribute in standard IETF YANG models like ietf-interfaces. Option E, 'mac address', is usually a read-only operational state or a hardware-assigned value, not a typical configurable attribute in a YANG interface configuration module.

Answer

switchport mode

Answer

mac address

Question 9

Drag and drop each BGP path selection criterion on the left to its order of preference (1 = highest priority) on the right.

Accepted Answer

Weight: 1. Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH (shortest), then ORIGIN (IGP < EGP < incomplete).

Question 10

What is the default OSPF hello interval on an Ethernet link in Cisco IOS?

Accepted Answer

10 seconds. In Cisco IOS, the default OSPF hello interval for broadcast multi-access networks such as Ethernet is 10 seconds. This value is defined in RFC 2328 and is used to maintain neighbor adjacencies; if a hello is not received within the dead interval (default 40 seconds, or 4 times the hello interval), the neighbor is declared down.

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 11

Which three statements about RADIUS server configuration and operation are true? (Choose three.)

Accepted Answer

The default UDP port for RADIUS authentication is 1812.. Option A is correct because RADIUS authentication uses UDP port 1812 by default (with 1813 for accounting), as defined in RFC 2865/2866. Option B is correct because the shared secret is a pre-shared key used to encrypt and authenticate RADIUS messages, so the value configured on the Cisco device (via the 'radius-server key' or per-host 'key') must exactly match the value on the RADIUS server or authentication will fail. Option C is correct because the 'radius-server host' command supports an optional 'key' parameter, allowing a per-server shared secret to be specified, e.g., 'radius-server host 10.1.1.1 key MySecret'. Option D is incorrect because RADIUS uses UDP, not TCP, for transport. Option E is incorrect because the legacy port 1645 is not the default; the standard default authentication port is 1812 (1645 was used by some early implementations but is not the default).

Answer

RADIUS uses TCP to ensure reliable delivery of authentication packets.

Answer

If no port is specified, RADIUS uses port 1645 for authentication by default.

Question 12

Drag and drop each NFV component on the left to its matching role on the right.

Accepted Answer

Virtual Network Function (VNF): Software instance of a network function running on NFVI. VNFs are software implementations of network functions; NFVI provides the infrastructure; MANO orchestrates and manages the lifecycle.

Question 13

A network engineer issues the following command on Router R6:

R6# debug ip ospf hello

OSPF: Send hello to 224.0.0.5 via GigabitEthernet0/0 (192.168.1.6)
OSPF: Rcv hello from 1.1.1.1, GigabitEthernet0/0, area 0.0.0.0
  Neighbor state is 2WAY, options 0x2
OSPF: End of hello processing

Based on this output, what can be concluded?

Accepted Answer

R6 and 1.1.1.1 are neighbors, but a full adjacency may not yet be formed.. The debug output shows the neighbor state is 2WAY, which indicates that R6 has received a hello from 1.1.1.1 and bidirectional communication is established, but a full adjacency has not yet been formed. In OSPF, the 2WAY state is a prerequisite for advancing to the ExStart state and eventually to FULL, but on multiaccess networks, the router must also wait for the Designated Router (DR) and Backup Designated Router (BDR) election process to complete before proceeding. Therefore, option C correctly states that R6 and 1.1.1.1 are neighbors, but a full adjacency may not yet be formed.

Answer

R6 has formed a full adjacency with neighbor 1.1.1.1.

Answer

The hello packet was sent to the DR/BDR multicast address 224.0.0.6.

Answer

The OSPF network type is point-to-point.

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all)
      50 packets, 2500 bytes
      5 minute offered rate 500 bps
      Match: access-group name BGP-ACL
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 50 packets, 2500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SNMP-CLASS (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: access-group name SNMP-ACL
      police:
          cir 16000 bps, bc 2000 bytes, be 2000 bytes
        conformed 150 packets, 7500 bytes; actions:
          transmit
        exceeded 40 packets, 2000 bytes; actions:
          drop
        violated 10 packets, 500 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: any
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 100 packets, 5000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.. The output shows that for the SNMP-CLASS, 40 packets exceeded and 10 packets violated the policer, resulting in drops, while the BGP-CLASS had 0 exceeded and 0 violated packets, meaning all BGP traffic conformed to its CIR of 64000 bps. This confirms that SNMP traffic is being dropped due to exceeding its policer rate, while BGP traffic is within its rate.

Answer

BGP traffic is being dropped because it exceeds the CIR.

Answer

All traffic to the control plane is being dropped.

Answer

The control-plane policy is applied in the output direction.

Question 15

Drag and drop the steps of a VM live migration process in vSphere into the correct order, from first to last.

Accepted Answer

Initiate vMotion from source host. The correct order for vMotion live migration begins with initiating the migration from the source host (A). Then, initial memory pages are copied to the destination (B). While the VM continues running, dirty memory pages are tracked and iteratively copied (C). Next, the VM is quiesced and the final state is copied (D). Finally, the VM is resumed on the destination host (E).

Question 16

Drag and drop the steps to configure OSPF on a Cisco router in the correct order.

Accepted Answer

Enter global configuration mode, then configure 'router ospf ', then configure 'network

area '. OSPF configuration starts with enabling the OSPF process, then defining networks and areas.

Answer

Enter global configuration mode, then configure 'network

area ', then configure 'router ospf '

Answer

Configure 'router ospf ', then enter global configuration mode, then configure 'network

area '

Answer

Enter global configuration mode, then configure 'router ospf ', then configure 'network

' without the 'area' keyword

Question 17

Drag and drop each MPLS role on the left to its matching function on the right.

Accepted Answer

LSR: Forwards MPLS packets by performing label lookup and swapping. LSR forwards packets based on labels, LER pushes/pops labels at the edge, P is a core LSR that only swaps labels, PE provides VPN services at the edge, and CE is the customer device connecting to the MPLS network.

Question 18

Which two statements about AAA authentication methods are true? (Choose two.)

Accepted Answer

The enable method for authentication uses the enable password or secret.. Option B is correct because the AAA 'enable' authentication method prompts for the enable password (configured with 'enable password') or the enable secret (configured with 'enable secret'), which is exactly what this method is designed to verify. Option D is correct because the 'login local' method authenticates users against the local username/password database created with the 'username' command, rather than against a remote AAA server. Option A is wrong because the 'local' method uses the local username database, not the enable password, for authentication. Option C is wrong because the 'none' method performs no authentication at all and does not fall back to the local database. Option E is wrong because the line password method uses the line password configured with the 'password' command under 'line con/vty', not the enable secret.

Answer

The local method for authentication uses the enable password for privilege level 15 access.

Answer

The none method for authentication provides fallback to the local database if the server is unreachable.

Answer

The line password method for authentication uses the enable secret password.

Question 19

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Accepted Answer

switchport port-security maximum 2
switchport port-security violation shutdown. The 'shutdown' violation mode places the interface into an err-disabled state when a port security violation occurs, which matches the requirement to disable the interface. The 'maximum 2' command limits the number of allowed MAC addresses to two, and the first two learned MAC addresses are dynamically secured. This combination ensures that any additional MAC address triggers a violation and disables the port.

Answer

switchport port-security maximum 2
switchport port-security violation err-disable

Answer

switchport port-security maximum 2
switchport port-security violation protect

Answer

switchport port-security maximum 2
switchport port-security violation restrict

Question 20

Which three statements about Cisco QoS policing and shaping are true? (Choose three.)

Accepted Answer

Policing can re-mark traffic that exceeds the configured rate to a lower priority.. Policing drops or re-marks traffic exceeding a rate, while shaping buffers excess traffic. Policing is typically applied inbound, shaping outbound. Option A is correct because policing can mark down traffic (e.g., set DSCP to 0) when the rate is exceeded. Option B is correct because shaping buffers traffic to smooth bursts, reducing drops. Option C is correct because both use a token bucket model to measure conformance. Option D is incorrect because policing does not buffer; it drops or re-marks. Option E is incorrect because shaping is applied on egress, not ingress.

Answer

Policing buffers traffic that exceeds the rate to reduce packet loss.

Answer

Shaping is typically applied on the ingress interface to control incoming traffic.