CCNP Practice Test 7 — 10 Questions

Question 1

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Accepted Answer

Phase 1: Hub-and-spoke with NHRP registration. DMVPN has only three phases. Phase 1 uses NHRP for hub registration only; Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel creation via resolution request/reply; Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.

Answer

Phase 4: NHRP with BGP for routing

Answer

Phase 5: NHRP with OSPF for routing

Question 2

A network team is designing an SD-WAN overlay for a multinational enterprise with 500+ branch sites. The design must ensure that control plane traffic (e.g., OMP updates) is encrypted and authenticated between all vSmart controllers and vEdge routers, while allowing data plane traffic to use IPsec tunnels between branch sites directly. Which architectural element is responsible for orchestrating the initial authentication and certificate enrollment of all SD-WAN devices?

Accepted Answer

vBond. C is correct because the vBond orchestrator is the sole component responsible for initial authentication and certificate enrollment in Cisco SD-WAN. It acts as a trusted certificate authority (CA) proxy, validating the serial numbers and certificates of all vSmart controllers and vEdge routers before they join the overlay network. Without vBond, devices cannot establish trust or receive the authorized list of vSmart and vManage IP addresses.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 3

Given the configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache timeout active 60
 cache timeout inactive 15
!

What is the effect of the 'cache timeout active 60' command?

Accepted Answer

Flows that are active for more than 60 seconds are exported immediately and then removed from the cache.. The 'cache timeout active 60' command configures the NetFlow cache to export and remove any flow that has been active for 60 seconds, even if it is still ongoing. This ensures that long-lived flows are reported periodically rather than waiting until the flow ends, which could delay visibility into sustained traffic patterns.

Answer

Flows that are inactive for 60 seconds are exported and removed from the cache.

Answer

The cache will hold a maximum of 60 active flows at any time.

Answer

Flow records are sent to the exporter every 60 seconds.

Question 4

Consider the following BGP configuration:

router bgp 65000
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50

What is the effect of this configuration?

Accepted Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing inbound path selection in AS 65001.. The route-map SET_MED is applied to outbound updates to neighbor 10.1.1.2, setting the MED (Multi-Exit Discriminator) attribute to 50. MED is a metric that influences inbound path selection in the neighboring AS (AS 65001), telling its routers which path to prefer when multiple entry points exist into AS 65000. Therefore, option A correctly describes the effect.

Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing outbound path selection from AS 65000.

Answer

Routes received from 10.1.1.2 will have the MED set to 50.

Answer

The MED value will be set to 50 for all routes in the BGP table.

Question 5

A network engineer is deploying Cisco SD-WAN in a hybrid cloud environment. The company requires secure segmentation between guest, employee, and IoT traffic across all branches. The engineer must ensure that traffic from each segment is isolated and that policies can be applied per segment. Which two components are used to achieve this segmentation? (Choose two.)

Accepted Answer

VPN segments in vManage. In Cisco SD-WAN, segmentation is achieved by creating VPN segments in vManage and mapping them to VRF instances on the WAN Edge devices. The VPN segments define the logical separation, and the VRFs enforce it by maintaining separate routing and forwarding tables. Together, they provide end-to-end isolation and allow policies to be applied per segment. Other options like VLANs or IPsec tunnels do not provide fabric-wide segmentation, and application-aware routing policies are for path selection, not isolation.

Answer

Application-aware routing policies

Answer

IPsec tunnels between branches

Answer

VLANs on the WAN Edge routers

Question 6

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied. The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 7

A network engineer is troubleshooting voice quality issues on a WAN link. The engineer notices that voice packets are being dropped during congestion. The QoS policy uses LLQ for voice traffic, but the priority queue is not providing the expected bandwidth. What is the most likely cause?

Accepted Answer

The priority queue has a built-in policer that drops traffic exceeding the configured bandwidth.. The priority queue in LLQ uses a built-in policer that drops traffic exceeding the configured bandwidth. When congestion occurs, the policer enforces the bandwidth limit by dropping excess packets, which explains why voice packets are being dropped despite the priority queue being active. This is a fundamental behavior of LLQ to prevent the priority queue from starving other queues.

Answer

The priority queue is not configured with a bandwidth statement.

Answer

The class-map is not matching voice traffic correctly.

Answer

The router is using FIFO queuing instead of LLQ.

Question 8

An engineer is troubleshooting an MPLS VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are running OSPF with the CE routers. On PE1, the 'show ip route vrf CUSTOMER' output shows 10.2.2.0/24 as an OSPF route, but the prefix is not present in the global BGP table. What is the most likely cause?

Accepted Answer

Redistribution from OSPF into BGP under the VRF is not configured on PE1.. In an MPLS VPN, the PE router must redistribute OSPF routes learned from the CE into MP-BGP under the VRF to propagate them across the MPLS backbone. Without this redistribution, the prefix 10.2.2.0/24 appears in the VRF routing table as an OSPF route but is never injected into the BGP table, so it cannot be advertised to the remote PE. This explains why CE1 cannot reach CE2 despite the route being present locally on PE1.

Answer

The OSPF adjacency between PE1 and CE1 is down.

Answer

The VRF forwarding table on PE1 is full.

Answer

MPLS LDP is not enabled on the PE1-CE1 link.

Question 9

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 10

Which two statements about Type 1 and Type 2 hypervisors are true? (Choose two.)

Accepted Answer

A Type 1 hypervisor runs directly on the physical hardware without a host operating system.. Option A is correct because a Type 1 (bare-metal) hypervisor, such as VMware ESXi, Microsoft Hyper-V Server, or Citrix XenServer, installs and runs directly on the physical hardware and does not require an underlying host operating system. Option D is correct because VMware Workstation is a Type 2 (hosted) hypervisor that installs as an application on top of an existing host OS like Windows or Linux. Option B is incorrect because it describes a Type 1, not a Type 2, hypervisor — Type 2 hypervisors require a host operating system. Option C is incorrect because VMware ESXi is a Type 1 bare-metal hypervisor, not Type 2. Option E is incorrect because Type 1 hypervisors are typically deployed in data centers and server virtualization scenarios, whereas Type 2 hypervisors are more commonly used for desktop virtualization and testing.

Answer

A Type 2 hypervisor runs directly on the physical hardware without a host operating system.

Answer

VMware ESXi is an example of a Type 2 hypervisor.

Answer

Type 1 hypervisors are typically used for desktop virtualization in enterprise environments.