CCNP Mock Exam 75 — 25 Questions

Question 1

Which three statements about MPLS forwarding are true? (Choose three.)

Accepted Answer

MPLS forwarding uses the Label Forwarding Information Base (LFIB) to make forwarding decisions.. Option A is correct because MPLS forwarding decisions are made by matching the incoming label against the Label Forwarding Information Base (LFIB), which maps an incoming label to an outgoing label and next-hop interface. Option B is correct because the LFIB is populated by label distribution protocols such as LDP, which binds labels to routes and advertises them to neighbors. Option C is correct because the Label Information Base (LIB) holds all label bindings learned from LDP neighbors, while the LFIB contains only the best/selected entries actually used for forwarding labeled packets. Option D is incorrect because the FIB is used for IP forwarding lookups, not for MPLS label lookups. Option E is incorrect because the RIB is used by routing protocols to select best routes and populate the FIB/LFIB, but it is not consulted directly for MPLS forwarding decisions.

Answer

MPLS forwarding uses the Forwarding Information Base (FIB) for label lookups.

Answer

MPLS forwarding uses the Routing Information Base (RIB) to determine the next hop.

Question 2

Drag and drop the steps of DNA Center assurance issue detection and root cause into the correct order, from first to last.

Accepted Answer

Collect telemetry from network devices. The correct order starts with collecting telemetry from devices, then analyzing the data to detect anomalies, then generating an issue, then identifying the root cause via guided remediation, and finally presenting the resolution steps. This aligns with Cisco's assurance workflow.

Question 3

Drag and drop each WAN topology type on the left to its matching characteristic on the right.

Accepted Answer

Point-to-point: Simple dedicated link between two sites. Point-to-point is simple and dedicated; hub-and-spoke centralizes traffic; full mesh provides high redundancy; partial mesh balances cost and redundancy; MPLS VPN offers any-to-any connectivity.

Question 4

Drag and drop the steps of OSPFv3 IPv6 neighbor adjacency formation into the correct order, from first to last.

Accepted Answer

Router sends Hello with its router ID. OSPFv3 neighbor formation follows the same state machine as OSPFv2: Down, Init, 2-Way, ExStart, Exchange, Loading, Full. The steps reflect the key actions at each state.

Question 5

A network engineer is configuring 802.1X on a Cisco switch for a voice VLAN deployment. The switchport is connected to an IP phone, which then connects to a PC. The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'switchport voice vlan 10'. The PC authenticates successfully, but the IP phone does not get an IP address from the voice VLAN. The engineer verifies that the phone is configured for 802.1X and the RADIUS server is correct. What is the most likely cause?

Accepted Answer

The IP phone does not support 802.1X and is not configured for MAB.. The IP phone fails to obtain an IP address from the voice VLAN because it is configured for 802.1X but does not support it, and the switchport is not configured for MAC Authentication Bypass (MAB). Without MAB, the switch will not place the phone into the voice VLAN until it successfully authenticates. Since the phone cannot complete 802.1X, it remains in the data VLAN or an unauthorized state, preventing it from receiving a voice VLAN IP address.

Answer

The switchport is missing 'switchport mode access' command.

Answer

The RADIUS server is not sending the voice VLAN ID in the Access-Accept.

Answer

The PC is using the voice VLAN instead of the data VLAN.

Question 6

Drag and drop each 802.11 standard on the left to its matching frequency band and maximum data rate on the right.

Accepted Answer

802.11b: 2.4 GHz, up to 11 Mbps. 802.11b operates at 2.4 GHz with 11 Mbps; 802.11a operates at 5 GHz with 54 Mbps; 802.11g operates at 2.4 GHz with 54 Mbps; 802.11n operates at both 2.4 and 5 GHz with 600 Mbps; 802.11ac operates at 5 GHz with up to 6.9 Gbps.

Question 7

Drag and drop each MQC command on the left to its configuration level on the right.

Accepted Answer

class-map: Defines traffic classification criteria. class-map defines traffic classes. policy-map associates class-maps with QoS actions. service-policy applies the policy-map to an interface. class (within policy-map) references a class-map. match (within class-map) specifies classification criteria.

Question 8

A network engineer issues the following command on Router R9:

R9# show ip sla configuration 7

IP SLAs Infrastructure Engine-II
Entry number: 7
Owner:
Tag:
Type of operation to perform: icmp-echo
Target address: 192.168.9.10
Source address: 192.168.9.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 30
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): 3600
Entry Ageout (seconds): never
Recurring (Starting Everyday, Starting Time: 00:00:01)
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
Number of statistic hours kept: 2
Number of statistic distribution buckets kept: 1
Statistic distribution interval (milliseconds): 20
Enhanced History:

Based on this output, how long will this IP SLA operation run?

Accepted Answer

3600 seconds. The 'Life (seconds): 3600' field explicitly defines the duration for which the IP SLA operation remains active. This value overrides any other timing parameters, meaning the operation will run for 3600 seconds (1 hour) from its start time, regardless of the frequency or threshold settings.

Answer

Forever

Answer

30 seconds

Answer

5000 milliseconds

Question 9

Which three statements about SSL VPNs are true? (Choose three.)

Accepted Answer

SSL VPNs use the TLS protocol to encrypt traffic between client and server.. Option A is correct because SSL VPNs fundamentally rely on the TLS (Transport Layer Security) protocol to provide encryption, integrity, and authentication for the tunnel between the client and the VPN gateway. Option C is correct because clientless SSL VPN mode requires only a standard web browser and typically provides access to web-based applications through a portal, without installing a dedicated client. Option E is correct because SSL VPN clients can support port forwarding, which redirects traffic from specific local TCP ports to resources behind the VPN gateway, enabling access to non-web applications. Option B is not correct because SSL VPNs commonly authenticate users with certificates, usernames/passwords, or multi-factor methods; a pre-shared key is characteristic of IPsec VPNs, not a general SSL VPN requirement. Option D is not correct because although SSL VPNs commonly use TCP port 443, they are not limited to it and can be configured on other ports or use DTLS/UDP for performance.

Answer

SSL VPNs require a pre-shared key for authentication.

Answer

SSL VPNs can only operate over TCP port 443.

Question 10

Which two statements about SD-WAN control plane components are true? (Choose two.)

Accepted Answer

The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.. Option A is correct because the vSmart controller is the centralized control plane component in Cisco SD-WAN that runs OMP and distributes OMP routes, TLOCs, and policies to all vEdge and cEdge devices in the fabric. Option B is correct because the vBond orchestrator handles authentication and initial onboarding of edge devices, validating their certificates and providing the vManage and vSmart information needed to join the overlay. Option C is incorrect because vManage is the management plane (GUI, API, configuration), not the control plane, and it does not establish OMP sessions with edge routers. Option D is incorrect because vEdge and cEdge routers are data plane/edge devices that participate in OMP as clients, not control plane devices. Option E is incorrect because OMP runs between vSmart and the edge devices (and between vSmarts), not between vManage and vSmart.

Answer

The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.

Answer

vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.

Answer

The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.

Question 11

An engineer configures gRPC dial-out telemetry on a Cisco IOS-XE device:

```
telemetry ietf subscription 100
 receiver ip address 10.1.1.100 port 50051 protocol grpc-tcp
 source-address 10.1.1.1
 encoding encode-kvgpb
 filter xpath /interfaces/interface/state/counters
 update-policy periodic 10000
```

What is the purpose of the 'source-address' command?

Accepted Answer

It specifies the source IP address for the telemetry stream.. The 'source-address' command specifies the IP address that the device uses as the source IP when sending telemetry data to the receiver. This ensures that the receiver can identify the device and that the traffic is sourced from a specific interface.

Answer

It specifies the IP address of the telemetry receiver.

Answer

It enables the device to receive telemetry data from the receiver.

Answer

It specifies the IP address of the network management station.

Question 12

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

Accepted Answer

Deploy two core switches configured with VSS or StackWise.. Deploying two core switches with VSS (Virtual Switching System) or StackWise provides both redundancy and active-active load balancing at the core layer. VSS virtualizes two physical switches into a single logical switch, eliminating the need for Spanning Tree Protocol (STP) on inter-switch links and enabling sub-second failover. This design ensures high availability by removing single points of failure and maximizing throughput between distribution and core layers.

Answer

Use a single distribution switch to simplify management.

Answer

Configure the core layer for Layer 2 switching only.

Answer

Use spanning-tree PortFast on all core switch ports.

Question 13

Examine the following configuration snippet applied to a Cisco IOS-XE device:

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/2
 ip address 192.168.1.1 255.255.255.0
 ip nat outside
!
access-list 100 permit ip 10.1.1.0 0.0.0.255 any
ip nat inside source list 100 interface GigabitEthernet0/2 overload

What is the effect of this configuration?

Accepted Answer

It translates all IP traffic from 10.1.1.0/24 to the IP address 192.168.1.1 using port address translation.. The configuration uses 'ip nat inside source list 100 interface GigabitEthernet0/2 overload', which is dynamic NAT with PAT (overload). ACL 100 matches all traffic sourced from 10.1.1.0/24, and the 'overload' keyword enables port address translation so many inside hosts share the single outside interface IP 192.168.1.1. Therefore all IP traffic from 10.1.1.0/24 is translated to 192.168.1.1 using PAT.

Answer

It performs static NAT for the host 10.1.1.1 to 192.168.1.1.

Answer

It translates all traffic from 192.168.1.0/24 to the IP address 10.1.1.1.

Answer

It allows all IP traffic from any source to any destination without translation.

Question 14

An enterprise is deploying a virtual router (vRouter) as part of its NFV infrastructure. The engineer needs to ensure that the vRouter can handle a sudden spike in traffic without dropping packets. The vRouter is running on a KVM hypervisor. What should the engineer configure to guarantee CPU resources for the vRouter during peak demand?

Accepted Answer

Configure CPU pinning and CPU reservation for the vRouter VM.. CPU pinning binds the vRouter's virtual CPUs to specific physical cores, preventing other processes from using them, while CPU reservation guarantees a minimum amount of CPU capacity. Together, they ensure deterministic CPU availability during traffic spikes, preventing packet drops due to resource contention on the KVM hypervisor.

Answer

Enable memory ballooning on the vRouter VM.

Answer

Enable DPDK on the vRouter's virtual NICs.

Answer

Set the vRouter VM to use NUMA node pinning.

Question 15

A company is deploying Cisco CSR1000v virtual routers in a KVM environment. The architect needs to ensure high availability by allowing VMs to move between physical hosts without service interruption. Which feature must be supported by the hypervisor and storage?

Accepted Answer

Live migration with shared storage (e.g., NFS or iSCSI).. Live migration (also known as VM migration) allows a running virtual machine to move between physical hosts with zero downtime. For this to work in a KVM environment with Cisco CSR1000v routers, the hypervisor must support live migration, and the storage must be shared (e.g., NFS or iSCSI) so that the VM's disk image remains accessible from both source and destination hosts. Without shared storage, the VM's disk state cannot be preserved during migration, causing service interruption.

Answer

Cold migration with local storage only.

Answer

Storage vMotion without shared storage.

Answer

Using a distributed virtual switch without shared storage.

Question 16

An engineer is deploying a Linux virtual machine on a KVM hypervisor. The VM needs to be connected to a virtual network that provides isolation from other VMs on the same host but allows communication with the host and external networks. The engineer creates a Linux bridge and attaches the VM's tap interface to it. However, the VM cannot reach the external network. The host has a physical NIC (eth0) connected to the corporate network. What is the missing configuration step?

Accepted Answer

Add the physical NIC (eth0) as a port to the Linux bridge.. A Linux bridge acts like a virtual switch. To allow the VM to reach the external network, the physical NIC (eth0) must be added as a port to the bridge. This bridges the VM's tap interface with the host's physical network, enabling Layer 2 connectivity to the corporate network and upstream routing.

Answer

Configure a default gateway on the VM's network interface.

Answer

Assign an IP address to the Linux bridge interface.

Answer

Enable IP forwarding and configure NAT on the host.

Question 17

Drag and drop the steps of ISE RADIUS policy evaluation order into the correct order, from first to last.

Accepted Answer

ISE receives RADIUS Access-Request from NAD. Cisco ISE evaluates RADIUS policies in a specific order: first authentication policies, then authorization policies (based on conditions), and finally the default rule if no match is found. This ensures proper access control.

Question 18

An engineer is configuring BGP on a router that will act as a route reflector to reduce iBGP peering requirements. The router has several iBGP peers. The engineer wants to ensure that the route reflector does not modify the next-hop attribute of routes it reflects to its clients. Which configuration command should the engineer use?

Accepted Answer

Configure 'neighbor next-hop-unchanged' under the BGP address family for the route reflector clients.. The 'neighbor next-hop-unchanged' command under the BGP address family instructs the route reflector to preserve the original next-hop attribute when reflecting routes to its clients. By default, a route reflector may modify the next-hop to its own address, but this command overrides that behavior, ensuring the next-hop remains as received from the non-client iBGP peer. This is essential in designs where clients must see the original next-hop for optimal path selection or to avoid unnecessary routing hops.

Answer

Configure 'no bgp next-hop-self' under the BGP address family for the route reflector clients.

Answer

Configure 'bgp route-reflector' under the BGP address family.

Answer

Configure 'neighbor next-hop-self' on the route reflector for its clients.

Question 19

Drag and drop the steps of PIM-SM join and source registration into the correct order, from first to last.

Accepted Answer

Receiver's DR sends (*,G) Join toward RP. In PIM-SM, a receiver's DR sends a (*,G) Join toward the RP. The RP then sends a (S,G) Join toward the source. The source's DR registers the source with the RP via a unicast Register message. The RP de-encapsulates the Register and sends a Register-Stop back to the source's DR to stop the registration process.

Question 20

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Accepted Answer

The control policy is not attached to the appropriate site list or VPN list.. In Cisco SD-WAN, centralized control policies must be explicitly attached to a site list or VPN list to define which devices or traffic the policy applies to. If the policy is not attached to the appropriate list, the vSmart controller will not push the policy to the targeted vEdge routers, causing them to continue using the default OMP best-path selection (based on administrative distance and cost). The fact that the vEdge routers are connected to the vSmart confirms the issue is with policy application, not reachability.

Answer

The vEdge routers have not been rebooted after the policy change.

Answer

The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.

Answer

The BFD sessions between vEdge and vSmart are flapping.