CCNP Mock Exam 71 — 25 Questions

Question 1

A network architect is designing a campus network for a large university with 10,000+ users. The design must provide high availability, minimize failure domains, and allow for easy scaling of the access layer. The core layer should be resilient and support fast convergence. Which hierarchical design model best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Three-tier hierarchical design with access, distribution, and core layers, using redundant links and VRRP for gateway redundancy. The three-tier hierarchical design (access, distribution, core) is the correct choice because it provides clear separation of failure domains, allows easy scaling by adding access switches, and supports high availability through redundant links and VRRP (or HSRP/GLBP) for first-hop gateway redundancy. The core layer can be designed with fast-converging protocols like ECMP and BFD to meet the resilience and convergence requirements for a large campus with 10,000+ users.

Answer

Collapsed core design with core and distribution combined into one layer

Answer

Flat Layer 2 design with all switches in a single VLAN

Answer

Leaf-spine design with all switches acting as leafs and spines

Question 2

Drag and drop the steps of TrustSec SGT classification and enforcement into the correct order, from first to last.

Accepted Answer

Switch classifies endpoint and assigns SGT. The correct order for TrustSec SGT classification and enforcement begins with the switch classifying the endpoint and assigning an SGT (A). The ingress switch then tags the packet with that SGT (B). The packet is forwarded with the SGT in the header (C). On the egress switch, the SGT is looked up in the SGACL (D), and finally the switch permits or denies the traffic based on the SGACL (E).

Question 3

Drag and drop the steps of REST API call using Requests library to DNA Center into the correct order, from first to last.

Accepted Answer

Import requests library in Python script. The correct order starts with importing the requests library, then obtaining an authentication token via POST to the login endpoint. Next, the token is used as a header in a GET request to retrieve network devices, the response is parsed as JSON, and finally the token is used for subsequent API calls.

Question 4

Drag and drop each NAT terminology on the left to its matching definition on the right.

Accepted Answer

Inside local: The IP address of the host as seen from inside the network. Inside local is the private IP of the host; inside global is the public IP after translation; outside local is the private IP of the remote host; outside global is the public IP of the remote host.

Question 5

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Accepted Answer

Client establishes TLS/DTLS tunnel to ASA. The AnyConnect client first establishes a TLS/DTLS tunnel to the ASA headend. The ASA then authenticates the user via AAA. After authentication, the ASA pushes client configuration and assigns an IP address from a pool. The client installs the virtual adapter with the assigned IP. Finally, the client can send encrypted traffic through the tunnel.

Question 6

Which two statements about EIGRP stub routing are true? (Choose two.)

Accepted Answer

A stub router advertises only connected and summary routes by default.. EIGRP stub routing limits the routes a stub router advertises, preventing it from being used as a transit router. Common stub types include connected, static, summary, and receive-only.

Answer

A stub router can still be used as a transit router for other EIGRP neighbors.

Answer

The 'eigrp stub' command is configured on the hub router in a hub-and-spoke topology.

Answer

A stub router can be configured with the 'receive-only' keyword to advertise all its routes.

Question 7

Drag and drop the steps of DSCP re-marking at enterprise WAN edge into the correct order, from first to last.

Accepted Answer

Define class maps to match existing DSCP values. The correct order for DSCP re-marking at the WAN edge begins with configuring a trust boundary on access ports to ensure that DSCP values are trusted from trusted sources. Next, define class maps to match existing DSCP values. Then create a policy map with set dscp commands to re-mark the DSCP values. Apply the service policy to the WAN edge interface. Finally, verify the re-marking using the show policy-map interface command.

Question 8

Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.

Accepted Answer

Define the external network and VLAN mapping. The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.

Question 9

Drag and drop the steps of IP Source Guard binding and enforcement into the correct order, from first to last.

Accepted Answer

Enable DHCP snooping to populate binding table. IP Source Guard relies on the DHCP snooping binding table. It is enabled on an interface, and then the switch creates a PVACL based on the binding. When a packet arrives, the source IP is checked against the binding; if it matches, the packet is forwarded; otherwise, it is dropped.

Question 10

Which two statements about NFV performance considerations are true? (Choose two.)

Accepted Answer

SR-IOV allows a virtual function (VF) to be directly assigned to a VM, providing near-native network performance.. NFV performance can be improved using various acceleration techniques. Single Root I/O Virtualization (SR-IOV) allows a physical NIC to be directly assigned to a VM, bypassing the hypervisor's virtual switch for better performance. Data Plane Development Kit (DPDK) provides a set of libraries for fast packet processing in user space. Option A is correct because SR-IOV provides near-native performance. Option C is correct because DPDK accelerates packet processing. Option B is incorrect because NUMA awareness helps but is not the primary technique. Option D is incorrect because vSwitch bonding does not eliminate the vSwitch overhead. Option E is incorrect because NFV performance can be optimized with software techniques.

Answer

NUMA awareness is the primary technique to improve NFV packet processing performance.

Answer

Using a virtual switch with multiple bonded uplinks eliminates the need for any performance optimization.

Answer

NFV performance is inherently lower than physical appliances and cannot be improved.

Question 11

Drag and drop the steps of a NETCONF get-config operation into the correct order, from first to last.

Accepted Answer

Establish SSH session to the device. The NETCONF get-config operation begins with establishing a secure SSH session, then the client sends a hello message to exchange capabilities. After the server responds with its hello, the client sends the get-config request. The server retrieves the configuration and sends the reply.

Question 12

Drag and drop the steps of Cisco DNA Center device onboarding via PnP into the correct order, from first to last.

Accepted Answer

Device boots and obtains IP via DHCP with PnP options. The PnP onboarding process begins with the device obtaining an IP address via DHCP and receiving the PnP server address from DHCP options. The device then discovers the Cisco DNA Center PnP server and authenticates using a certificate or credentials. After authentication, the device downloads its Day 0 configuration and image from DNA Center. Finally, the device applies the configuration and joins the fabric or network.

Question 13

Drag and drop the steps of EIGRP DUAL route computation into the correct order, from first to last.

Accepted Answer

Identify feasible successors using reported distance. EIGRP DUAL first identifies feasible successors via reported distance, then selects the best path as successor. If the successor fails, it checks feasible successors; if none exist, it goes active and queries neighbors. After replies, it computes a new successor.

Question 14

Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.

Accepted Answer

Client associates and authenticates to AP. In DHCP bridging, the client first associates and authenticates. The AP then bridges the DHCP Discover from the client to the wired network. The DHCP server replies with Offer, the client sends Request, and the server sends Ack, completing the process.

Question 15

Drag and drop the steps of MPLS Traffic Engineering (TE) tunnel setup (RSVP) into the correct order, from first to last.

Accepted Answer

IGP floods TE link attributes (bandwidth, affinity). MPLS TE tunnel setup using RSVP begins with IGP extension (OSPF/IS-IS) to flood TE link attributes, then CSPF computes the path, RSVP Path message is sent, RSVP Resv message reserves resources, and finally the tunnel is signaled and installed in the forwarding table.

Question 16

Which two statements about MPLS label operations are true? (Choose two.)

Accepted Answer

The ingress LSR performs a label push operation.. In MPLS, the ingress LSR pushes a label onto the packet, and transit LSRs swap the incoming label with an outgoing label based on the LFIB. PHP removes the label before the egress LSR, so the egress LSR does not perform a label lookup. The egress LSR forwards based on the IP header after label removal.

Answer

The egress LSR performs a label push operation.

Answer

PHP (Penultimate Hop Popping) causes the egress LSR to pop the label.

Answer

The egress LSR always performs an IP lookup after label removal.

Question 17

In BGP best path selection, which of the following is compared first?

Accepted Answer

Highest weight. BGP best path selection begins by comparing the weight attribute, which is Cisco-proprietary and local to the router. The path with the highest weight is preferred first, making option A correct. Weight is evaluated before any other BGP attribute, including local preference, AS-path length, and MED.

Answer

Highest local preference

Answer

Shortest AS-path

Answer

Lowest MED

Question 18

Drag and drop the steps of STP portfast and BPDU guard configuration into the correct order, from first to last.

Accepted Answer

Enter interface configuration mode. PortFast is configured on an access port to immediately transition to forwarding. BPDU guard is then enabled to protect against rogue BPDUs. The configuration is applied at the interface level, and verification ensures the port is in forwarding state. If a BPDU is received, BPDU guard errdisables the port.

Question 19

Drag and drop the steps of MPLS FRR (Fast Reroute) backup tunnel activation into the correct order, from first to last.

Accepted Answer

Configure backup tunnel on PLR. MPLS FRR begins with configuring the backup tunnel on the PLR. The PLR then merges the backup tunnel with the protected LSP. When a link or node failure is detected, the PLR immediately switches traffic to the backup tunnel. After the failure is repaired, traffic reverts to the primary LSP via make-before-break.

Question 20

Drag and drop the steps of configuring and applying a QoS policy using MQC into the correct order, from first to last.

Accepted Answer

Create class-map to match traffic. The MQC process first defines traffic classes with class maps, then associates actions with policy maps, and finally applies the policy to an interface with a service-policy statement. Verification ensures correct operation.