CCNP Mock Exam 73 — 25 Questions

Question 1

Drag and drop each Python library on the left to its matching network use case on the right.

Accepted Answer

Netmiko: Multi-vendor SSH connection and command execution. Netmiko is used for multi-vendor SSH connections, NAPALM for network automation and configuration management, Nornir for parallel task execution, Scrapli for screen-scraping network devices, and Paramiko for low-level SSH connections.

Question 2

Which two statements about REST API HTTP methods are true? (Choose two.)

Accepted Answer

GET requests are idempotent and safe.. In REST APIs, the GET method is used to retrieve a representation of a resource without side effects (idempotent and safe). The PUT method is used to update or create a resource at a specific URI and is idempotent, meaning multiple identical requests have the same effect as a single request. POST is not idempotent; it is typically used to create a new resource at a server-defined URI. DELETE is idempotent but not safe. PATCH is used for partial updates and is not necessarily idempotent.

Answer

POST requests are idempotent and safe.

Answer

DELETE requests are safe.

Answer

PATCH requests are always idempotent.

Question 3

Which three statements about configuring model-driven telemetry on Cisco IOS-XE devices are true? (Choose three.)

Accepted Answer

The 'telemetry' command enters the telemetry configuration submode, where subscriptions and sensor groups are defined.. On IOS-XE, telemetry is configured under the 'telemetry' submode. A subscription defines the destination (e.g., IP, port, protocol) and the sensor paths (YANG paths). Multiple sensor groups can be associated with one subscription. The 'update-policy' command sets the periodic interval. The 'receiver' command specifies the collector details. TLS is supported for secure dial-out connections.

Answer

The 'update-policy' command is used to set the on-change trigger for a subscription.

Answer

A single subscription can only have one sensor group and one receiver.

Question 4

Which three statements about HTTP response status codes in REST APIs are true? (Choose three.)

Accepted Answer

200 OK is used to indicate a successful GET request.. The correct answers are A, B, and D. A is correct because 200 OK is the standard success response for GET. B is correct because 201 Created is used for successful resource creation via POST. D is correct because 400 Bad Request indicates a client error such as malformed syntax. C is incorrect because 404 Not Found indicates the resource does not exist, not a server error. E is incorrect because 500 Internal Server Error is a server-side error, not a client error.

Answer

404 Not Found indicates a server-side error.

Answer

500 Internal Server Error is a client error.

Question 5

Drag and drop the steps of DNA Center site hierarchy creation into the correct order, from first to last.

Accepted Answer

Create a top-level site (e.g., continent). The correct order starts with defining the top-level site (e.g., continent or country), then adds the area, then the building, then the floor, and finally assigns the floor plan. This hierarchical structure is required for proper network segmentation and assurance in Cisco DNA Center.

Question 6

What is the maximum number of active member links supported in a single EtherChannel on Cisco Catalyst switches?

Accepted Answer

8. Cisco Catalyst switches support a maximum of 8 active member links in a single EtherChannel. This limit is defined by the IEEE 802.3ad standard and Cisco's implementation, ensuring that the load-balancing algorithm distributes traffic effectively across all links. The 8-link limit applies to both PAgP and LACP modes.

Answer

4

Answer

16

Answer

32

Question 7

Drag and drop the steps of DNA Center SWIM (Software Image Management) upgrade flow into the correct order, from first to last.

Accepted Answer

Import software image into DNA Center. SWIM upgrade begins with importing the image, then distributing it to the device, performing a pre-check, activating the image, and finally committing the upgrade.

Question 8

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

Accepted Answer

The traffic is taking multiple paths, causing packets to arrive out of order.. The anti-replay check in IPsec uses sequence numbers to protect against replay attacks. When packets arrive out of order, the anti-replay window (default size 64 or 1024 packets) may reject packets that fall outside the window, causing the counter to increment. This is typical when traffic takes multiple paths, as packets can be reordered before reaching the peer.

Answer

The IPsec SA is using a weak encryption algorithm.

Answer

The IPsec SA is using ESP in tunnel mode with authentication only.

Answer

The IPsec SA lifetime is too short, causing frequent rekeying.

Question 9

Drag and drop the steps of DNA Center network discovery and device sync into the correct order, from first to last.

Accepted Answer

Define discovery range and credentials. Discovery starts with defining the discovery scope, running the discovery, adding discovered devices to inventory, syncing device details, and finally assigning devices to a site.

Question 10

Drag and drop each telemetry protocol on the left to its matching transport on the right.

Accepted Answer

gRPC: HTTP/2. gRPC uses HTTP/2, gNMI uses gRPC (HTTP/2), NETCONF uses SSH, and RESTCONF uses HTTPS.

Question 11

Which three statements about Ansible modules for Cisco IOS-XE are true? (Choose three.)

Accepted Answer

The ios_config module supports idempotent configuration changes by comparing the desired state with the running configuration.. The ios_config module manages configuration snippets and supports idempotency via the 'lines' parameter. The ios_command module sends show commands and returns output. The ios_facts module gathers device facts. The ios_vlan module is a dedicated resource module for VLANs. The ios_lldp module manages LLDP settings. Idempotency means applying the same config multiple times yields the same result.

Answer

The ios_facts module gathers only interface statistics from the device.

Answer

The ios_lldp module can only enable LLDP globally, not on specific interfaces.

Question 12

Drag and drop the steps of DNA Center network discovery and device sync into the correct order, from first to last.

Accepted Answer

Define discovery range (IP/subnet). The correct order starts with defining the discovery range (IP/subnet), then running the discovery, then the discovered devices are added to inventory, then DNA Center syncs the device configurations, and finally the devices are assigned to sites. This ensures devices are properly discovered, inventoried, and placed in the hierarchy.

Question 13

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Accepted Answer

Load YANG model into YANG DevKit environment. Validation starts by loading the YANG model, parsing the path, checking it against the schema, testing it on a device, and then confirming the output.

Question 14

Which two statements about Ansible automation in a Cisco environment are true? (Choose two.)

Accepted Answer

Ansible uses a push-based model to configure network devices.. Ansible uses a push-based model where the control node pushes modules to managed nodes. It is agentless, relying on SSH or API connections. Ansible Tower provides a web UI and RBAC, while the default inventory is INI-based. Playbooks are written in YAML, not Python. Ansible Galaxy is a community hub for roles.

Answer

Ansible requires an agent to be installed on managed Cisco devices.

Answer

The default Ansible inventory file is written in YAML format.

Answer

Ansible playbooks are written in Python.

Question 15

Which three statements about Ansible playbooks and roles are true? (Choose three.)

Accepted Answer

Roles in Ansible use a standardized directory structure that includes 'tasks', 'handlers', 'vars', 'defaults', and 'meta'.. Roles use a predefined directory structure with tasks, handlers, vars, defaults, and meta. The 'import_role' statically includes a role at playbook parse time, while 'include_role' dynamically includes it at runtime. Handlers are triggered by 'notify' and run once even if notified multiple times. The 'vars' directory holds high-precedence variables, while 'defaults' holds low-precedence defaults. The 'meta' directory contains role dependencies.

Answer

The 'import_role' module includes a role dynamically during play execution.

Answer

Variables defined in the 'defaults' directory of a role have the highest precedence.

Question 16

Drag and drop the steps of OpenAPI schema validation for DNA Center REST call into the correct order, from first to last.

Accepted Answer

Retrieve the OpenAPI specification for DNA Center. Validation begins with retrieving the OpenAPI spec, then parsing the endpoint, validating the request against the schema, checking the response, and finally handling any validation errors.

Question 17

Drag and drop the steps of NUMA-aware VM placement process into the correct order, from first to last.

Accepted Answer

Check host NUMA topology. NUMA-aware VM placement begins by inspecting the host's NUMA topology to understand node boundaries and memory topology (A). Next, the VM's vCPU count is compared to the node size to determine if it fits entirely within a single NUMA node (B). If it fits, the VM is assigned to a specific NUMA node (C). Then, memory is allocated from that assigned NUMA node to ensure locality (D). Finally, the VM is powered on with NUMA pinning to enforce the placement (E). This order ensures resource awareness and proper allocation before pinning.

Question 18

Which two statements about local SPAN configuration are true? (Choose two.)

Accepted Answer

The SPAN destination port must be in STP forwarding state to forward traffic.. Local SPAN copies traffic from source ports or VLANs to a destination port on the same switch. The destination port must be in STP forwarding state to forward traffic, but it does not participate in STP for the SPAN session. The source can be a port or VLAN, but not a port-channel interface directly; however, individual member ports can be sources. The destination port cannot be used as a source port simultaneously.

Answer

A SPAN destination port can also be used as a source port in another SPAN session.

Answer

A SPAN source can be a single port, a VLAN, or an EtherChannel interface.

Answer

SPAN destination ports participate in Spanning Tree Protocol normally.

Question 19

Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

Accepted Answer

Scalable Group Tags (SGTs) are used to enforce micro-segmentation and policy in the fabric.. SD-Access uses Scalable Group Tags (SGTs) to enforce micro-segmentation and policy. SGTs are assigned to endpoints based on identity (e.g., user, device type) and are carried in the VXLAN header. The fabric edge applies policy based on SGTs, not IP addresses. The Cisco ISE provides centralized policy management and authentication. The control plane node does not enforce policy; it only maintains mappings. Policy enforcement is done at the fabric edge, not the border, for traffic within the fabric.

Answer

SGTs are assigned to endpoints based on their IP address only.

Answer

The fabric border node enforces all policies for traffic within the fabric.

Question 20

Review the following OSPF configuration:

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 1
 default-information originate always metric 20 metric-type 1
!

What is the effect of the 'default-information originate always metric 20 metric-type 1' command?

Accepted Answer

It injects a default route into OSPF unconditionally, with metric 20 and type E1.. The 'default-information originate always' command injects a default route into the OSPF link-state database unconditionally, even if no default route exists in the routing table. The 'metric 20' sets the OSPF cost to 20, and 'metric-type 1' makes it an E1 (Type 1) external route, meaning the metric includes the internal cost to the ASBR plus the external cost.

Answer

It injects a default route into OSPF only if a default route exists in the routing table, with metric 20 and type E1.

Answer

It injects a default route into OSPF with metric 20 and type E2, but only if a default route exists.

Answer

It injects a default route into OSPF with metric 20 and type E1, but only for area 0.