CCNP Mock Exam 74 — 25 Questions

Question 1

A network engineer runs the following command on Router R9:

R9# show ip pim neighbor
PIM Neighbor Table
Neighbor Address     Interface          Uptime    Expires    Mode
192.168.1.10         GigabitEthernet0/0 1w2d      00:01:30   Dense
192.168.1.11         GigabitEthernet0/0 2w0d      00:01:25   Sparse
192.168.1.12         GigabitEthernet0/1 3d04h     00:01:28   Sparse

Based on this output, what can be concluded?

Accepted Answer

Router R9 has three PIM neighbors, one in Dense mode and two in Sparse mode.. The output shows three PIM neighbors: 192.168.1.10 with mode 'Dense', and 192.168.1.11 and 192.168.1.12 with mode 'Sparse'. This indicates that Router R9 has one neighbor operating in PIM Dense mode and two in PIM Sparse mode, which is consistent with the 'Mode' column in the 'show ip pim neighbor' output.

Answer

All PIM neighbors are operating in Sparse mode.

Answer

The PIM neighbor 192.168.1.12 is on the same interface as the others.

Answer

All PIM neighbors are in the 'Expires' state.

Question 2

A network engineer is configuring 802.1X on a Cisco Catalyst 9300 switch for a wired network. The engineer wants to allow devices that do not support 802.1X (e.g., printers) to still access the network using MAB (MAC Authentication Bypass). The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'mab'. However, after connecting a printer, the switch logs show 'MAB failed' repeatedly. The printer's MAC address is in the RADIUS server database. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured to accept MAC addresses in the format sent by the switch (e.g., with dots or colons).. The most likely cause is that the RADIUS server expects the MAC address in a specific format (e.g., with colons or hyphens), but the switch sends it in a different format (e.g., with dots or no separators). MAB works by the switch sending the printer's MAC address as the username and password in a RADIUS Access-Request. If the format does not match the server's database, authentication fails, even though the MAC is present. This is a common configuration mismatch between Cisco switches and RADIUS servers.

Answer

The switch is not configured with 'dot1x timeout tx-period' to initiate MAB.

Answer

The interface is configured as 'switchport mode trunk', which does not support MAB.

Answer

The printer is not responding to EAP-Request/Identity packets.

Question 3

An engineer is troubleshooting an EIGRP convergence issue in a network with redundant links. The engineer notices that when a primary link fails, the backup link takes over immediately, but the routing table shows the route with a higher metric. The engineer wants to ensure that the backup link is used only when the primary fails, and that traffic is not load-balanced. The engineer has configured 'variance 2' on all routers. What is the most likely effect of this configuration?

Accepted Answer

The variance 2 command causes EIGRP to install both the primary and backup routes, resulting in unequal-cost load balancing.. The 'variance 2' command in EIGRP allows the router to install multiple routes to the same destination network in the routing table, even if their metrics are not equal, as long as the metric of the alternate route is within the variance multiplier (2x) of the best metric (the feasible distance). Since the backup link has a higher metric but is within the variance, EIGRP installs both routes, causing unequal-cost load balancing. This explains why the backup link is actively used for traffic, contrary to the engineer's desire to use it only as a failover.

Answer

The variance 2 command causes EIGRP to install only the best metric route, so the backup link is not used.

Answer

The variance 2 command has no effect on route installation; it only affects the feasible successor selection.

Answer

The variance 2 command is used for equal-cost load balancing only.

Question 4

Which two statements about MPLS label operations are true? (Choose two.)

Accepted Answer

The ingress LSR imposes a label onto the packet.. Option A is correct because the ingress LSR (label edge router) is the entry point of the MPLS domain and performs label imposition (push), adding an MPLS shim header to the incoming IP packet before forwarding it into the LSP. Option B is correct because the egress LSR (also an LER) performs label disposition (pop), removing the MPLS label so the packet leaves the domain as a normal IP packet toward its destination. Option C is wrong because pushing a new label is an ingress/transit function, not something the egress LSR does when exiting the MPLS domain. Option D is wrong because label imposition occurs only at the ingress edge, not at every LSR along the LSP. Option E is wrong because transit LSRs perform label swapping (swap), not imposition, forwarding packets based on the incoming label.

Answer

The egress LSR pushes a new label onto the packet.

Answer

Each LSR in the LSP performs label imposition.

Answer

Transit LSRs perform label imposition.

Question 5

Which three statements about RADIUS and TACACS+ are true? (Choose three.)

Accepted Answer

RADIUS combines authentication and authorization in a single packet.. Option A is correct because RADIUS, defined in RFC 2865/2866, performs authentication and authorization together in a single Access-Request/Access-Accept exchange, so the two functions are not separated into distinct transactions. Option B is correct because TACACS+ operates over TCP and listens on port 49 by default, providing reliable transport unlike RADIUS's use of UDP. Option D is correct because TACACS+ is designed with fully separated AAA functions, allowing authentication, authorization, and accounting to be handled as independent processes and even directed to different servers. Option C is incorrect because RADIUS only encrypts the password (User-Password attribute) using a shared secret and MD5, leaving the rest of the packet payload, such as other attributes, in cleartext. Option E is incorrect because per-command authorization for shell/CLI sessions is a hallmark of TACACS+, whereas RADIUS lacks native support for granular per-command authorization.

Answer

RADIUS encrypts the entire packet payload for all attributes.

Answer

RADIUS supports per-command authorization for shell sessions.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip eigrp traffic
EIGRP-IPv4 Traffic Statistics for AS(100)
  Hellos sent/received: 1000/950
  Updates sent/received: 45/40
  Queries sent/received: 2/3
  Replies sent/received: 3/2
  Acks sent/received: 50/48
  Input queue high water mark: 1
  Input queue depth: 0
  Total packets sent: 1100
  Total packets received: 1043

Based on this output, what can be concluded?

Accepted Answer

The network is stable with few topology changes.. The output shows a very low number of EIGRP Queries (2 sent, 3 received) and Replies (3 sent, 2 received), which indicates that the network has experienced very few topology changes. A stable EIGRP network with minimal route flaps will have a high ratio of Hellos to Updates/Queries, as seen here (1000 Hellos vs. 45 Updates). Therefore, the network is stable with few topology changes, making option B correct.

Answer

The router has experienced many route flaps.

Answer

The router is using EIGRP stub to suppress queries.

Answer

There is a high packet loss on the network.

Question 7

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook runs successfully on most switches, but one switch fails with an error indicating that the VLAN configuration command is not recognized. What is the most likely cause?

Accepted Answer

The switch runs a different IOS version with different VLAN CLI syntax. The most likely cause is that the switch runs a different IOS version with different VLAN CLI syntax. Ansible executes commands via SSH, and if the switch expects a different command format (e.g., 'vlan 10' vs. 'vlan database' on older CatOS), the playbook will fail with a command-not-recognized error. This is a common issue when automating across heterogeneous network devices.

Answer

Ansible lacks the appropriate module for VLAN configuration

Answer

The inventory file has a syntax error for that specific host

Answer

SSH connectivity to the switch is blocked by an ACL

Question 8

Which three statements about RRM (Radio Resource Management) in a Cisco wireless LAN are true? (Choose three.)

Accepted Answer

RRM automatically selects the best channel for each AP based on interference measurements.. Option A is correct because RRM's Dynamic Channel Assignment (DCA) continuously monitors each AP's RF environment—using metrics like noise, interference, and neighboring AP beacons—and automatically assigns the least-interfered channel to each radio. Option C is correct because RRM's Transmit Power Control (TPC) algorithm adjusts each AP's radio transmit power to balance coverage and capacity, shrinking cells to reduce co-channel interference while maintaining adequate signal for clients. Option D is correct because RRM organizes APs into RF groups, and within each group a single AP is elected as the RF group leader; that leader aggregates the neighbor and interference data (via NMSP/CCX measurements) and computes channel and power plans that are distributed to all members. Option B is not correct because RRM is a software feature of the WLC (and, in newer architectures, of Catalyst 9800 controllers or embedded wireless in Catalyst 9000 switches)—no dedicated hardware appliance is required. Option E is not correct because client load balancing is a separate feature (Aggressive Load Balancing / band steering) and is not part of RRM's DCA/TPC/RF-group functions.

Answer

RRM requires a dedicated hardware controller to perform RF calculations.

Answer

RRM automatically enables client load balancing across APs in the same coverage area.

Question 9

Given the configuration:

interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10-20
!
interface GigabitEthernet0/1
 switchport mode trunk
 channel-group 1 mode passive
!
interface GigabitEthernet0/2
 switchport mode trunk
 channel-group 1 mode passive

What is missing for this EtherChannel to form with a neighbor that uses LACP active?

Accepted Answer

Nothing is missing; the configuration is valid and the EtherChannel will form with the neighbor.. The configuration is valid because LACP uses a negotiation system where one side must be in active mode and the other in passive mode to form an EtherChannel. Here, the neighbor is configured with LACP active, and the local member interfaces are configured with 'channel-group 1 mode passive', which is the correct counterpart. The 'switchport trunk allowed vlan' command is only needed on the port-channel interface, not on the member interfaces, as the port-channel interface inherits and propagates the VLAN list to the member ports.

Answer

The member interfaces must also have the 'switchport trunk allowed vlan 10-20' command.

Answer

The port-channel interface must be configured with 'channel-group 1' to associate the member ports.

Answer

The member interfaces must use LACP active mode to form the channel.

Question 10

Which three statements about model-driven telemetry are true? (Choose three.)

Accepted Answer

Model-driven telemetry uses YANG data models to define the data to be streamed.. Option A is correct because model-driven telemetry is built on YANG data models, which define the structure and semantics of the data that the device streams to the collector. Option B is correct because telemetry data is pushed from the network device to a collector using protocols such as gRPC (often with gNMI as the transport/encoding interface), rather than being polled. Option C is correct because model-driven telemetry supports subscription types including periodic (sample/dial-in or dial-out intervals) and on-change (event-driven) subscriptions. Option D is incorrect because model-driven telemetry does not require SSH for data transport; it typically uses gRPC/gNMI over TLS, and SSH is not the streaming transport. Option E is incorrect because model-driven telemetry is push-based and generally reduces polling overhead compared to SNMP polling, not increases it.

Answer

Model-driven telemetry requires SSH for secure data transport.

Answer

Model-driven telemetry increases the polling overhead compared to SNMP.

Question 11

Which three statements about Cisco DNA Center wireless assurance are true? (Choose three.)

Accepted Answer

DNA Center collects telemetry from wireless controllers and access points to provide health scores for clients and APs.. Option A is correct because DNA Center's wireless assurance gathers streaming telemetry and statistics from wireless controllers and access points, then aggregates them into health scores for clients, APs, and the wireless network. Option B is correct because DNA Center retains historical client data, allowing administrators to replay past association, authentication, and roaming events to troubleshoot connectivity problems. Option C is correct because DNA Center supports synthetic test clients (sensors) that emulate real client traffic to proactively measure wireless performance such as onboarding, throughput, and latency. Option D is not correct because client association and roaming decisions remain with the wireless LAN controller (or AP in local mode), not DNA Center, which is a management and assurance platform. Option E is not correct because DNA Center does not require a dedicated WLC solely for assurance; it collects telemetry from the existing wireless infrastructure already managed by DNA Center.

Answer

DNA Center replaces the WLC for real-time client association and roaming decisions.

Answer

DNA Center requires a dedicated wireless LAN controller to be deployed solely for assurance data collection.

Question 12

Which three statements about VRF-lite are true? (Choose three.)

Accepted Answer

VRF-lite allows multiple routing instances on a single router using static or dynamic routing protocols.. VRF-lite is a technology that creates multiple independent routing and forwarding instances on a single physical router, and each VRF can run its own static routes or dynamic routing protocols such as OSPF, EIGRP, or BGP, which is exactly what option A states. Option B is correct because VRF-lite is essentially VRF without MPLS; it relies on separate routing/forwarding tables and interface assignment rather than label switching, so no MPLS infrastructure is needed. Option C is correct because the core mechanism of VRF-lite is path isolation through per-VRF routing tables (and associated FIBs), keeping traffic from different VRFs separate even though they share the same physical device. Option D is incorrect because MPLS VPN inter-AS option B is a feature of full MPLS L3VPN deployments involving ASBRs exchanging labeled VPNv4 routes, which is beyond VRF-lite's scope. Option E is incorrect because VRF-lite does not mandate BGP; any supported routing protocol or static routing can be used within each VRF.

Answer

VRF-lite supports MPLS VPN inter-AS option B.

Answer

VRF-lite requires BGP as the routing protocol between VRFs.

Question 13

Which two statements about Rapid PVST+ are true? (Choose two.)

Accepted Answer

Rapid PVST+ uses a proposal/agreement handshake to achieve rapid convergence.. Rapid PVST+ is an enhancement of the original 802.1D STP that provides faster convergence by using a proposal/agreement handshake. It runs a separate instance of RSTP for each VLAN, enabling per-VLAN load balancing. The UplinkFast feature is not needed because RSTP already handles uplink convergence quickly. The root bridge is elected based on bridge priority, not MAC address alone. Port roles include alternate and backup, not just designated and root.

Answer

Rapid PVST+ requires the UplinkFast feature to be enabled for fast uplink convergence.

Answer

In Rapid PVST+, the root bridge is elected based on the lowest MAC address only.

Answer

Rapid PVST+ supports only two port roles: designated and root.

Question 14

Examine the following Python script snippet that uses netmiko to configure a Cisco IOS-XE device:

```python
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
}

connection = ConnectHandler(**device)
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()
```

What is the primary purpose of this script?

Accepted Answer

It retrieves and prints the output of 'show ip interface brief'.. The script uses netmiko's `send_command()` method, which sends a show command to the device and returns the output. It does not include any configuration commands or file transfer operations. Therefore, its primary purpose is to retrieve and print the output of 'show ip interface brief'.

Answer

It configures an IP address on an interface.

Answer

It saves the running configuration to startup configuration.

Answer

It backs up the configuration to a TFTP server.

Question 15

Drag and drop the steps of TrustSec SGT assignment and propagation via SXP into the correct order, from first to last.

Accepted Answer

ISE assigns SGT to endpoint during authentication. SGT propagation via SXP starts with ISE assigning an SGT to an endpoint, the access switch mapping IP-to-SGT, then the SXP speaker sending that mapping to an SXP listener, which updates its local SGT cache, and finally the listener uses the SGT for policy enforcement.

Question 16

Which of the following is a valid VLAN range that can be created on a Cisco IOS switch?

Accepted Answer

VLAN 100. VLAN 100 is a valid VLAN ID because Cisco IOS switches support VLANs in the range 1–1005 for normal-range VLANs, and VLAN 100 falls within this range. Normal-range VLANs are stored in the vlan.dat file and can be created on a standard IOS switch without requiring extended VLAN configuration.

Answer

VLAN 0

Answer

VLAN 4095

Answer

VLAN 1006

Question 17

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

Accepted Answer

The next-hop IP addresses are in the global routing table, not in the VRF.. When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.

Answer

LISP is not configured to map the virtual network.

Answer

OSPF is not redistributing the routes into the VRF.

Answer

The physical interface is not configured as a trunk.

Question 18

Which statement correctly describes the difference between RADIUS and TACACS+?

Accepted Answer

RADIUS encrypts only the password; TACACS+ encrypts the entire packet body.. RADIUS encrypts only the password attribute in the Access-Request packet using a shared secret and MD5 hash, leaving the rest of the packet (e.g., username, service type) in cleartext. TACACS+ encrypts the entire body of the packet (all fields except the standard header) using a shared secret and MD5-based encryption, providing confidentiality for all AAA information. This makes option B correct because it accurately describes the encryption scope difference between the two protocols.

Answer

RADIUS encrypts the entire packet; TACACS+ encrypts only the password.

Answer

Both protocols encrypt the entire packet.

Answer

Neither protocol encrypts any part of the packet.

Question 19

Which two statements about IGMP snooping are true? (Choose two.)

Accepted Answer

IGMP snooping reduces unnecessary multicast flooding on a Layer 2 switch.. Option A is correct because IGMP snooping allows a Layer 2 switch to examine IGMP messages and forward multicast traffic only to ports that have interested receivers, rather than flooding it to all ports in the VLAN. Option D is correct because the switch snoops IGMP membership reports and leave messages to dynamically build and maintain a Layer 2 multicast forwarding table mapping groups to ports. Option B is incorrect because querier election is an IGMP function performed by multicast routers (or a snooping switch acting as querier), not a mechanism that defines IGMP snooping itself. Option C is incorrect because IGMP snooping operates transparently on the switch and does not replace IGMP on router interfaces. Option E is incorrect because IGMP snooping does not modify IP headers; it only inspects IGMP control messages to build forwarding state.

Answer

IGMP snooping uses the IGMP querier election process to select the switch with the highest IP address as the querier.

Answer

IGMP snooping can be configured to replace IGMP on the router interface.

Answer

IGMP snooping modifies the IP header of multicast packets to include group membership information.

Question 20

Drag and drop the steps of MPLS L3VPN packet forwarding steps into the correct order, from first to last.

Accepted Answer

Ingress PE receives IP packet from CE. The order begins with the ingress PE receiving an IP packet from the CE, looking up the VRF to find the next hop and label, pushing the MPLS label stack, forwarding the labeled packet across the MPLS core, and finally the egress PE popping the label and forwarding the IP packet to the destination CE.