CCNP Mock Exam 76 — 25 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show policy-map interface GigabitEthernet0/0

GigabitEthernet0/0

Service-policy input: QOS_POLICY

Class-map: VOICE (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      police cir 1000000 bc 31250 be 31250
        conformed 0 bytes; actions:  transmit
        exceeded 0 bytes; actions:  drop
        violated 0 bytes; actions:  drop

Class-map: class-default (match-any)
      100 packets, 12000 bytes
      5 minute offered rate 8000 bps, drop rate 0 bps
      Match: any 
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 100/12000

Based on this output, what can be concluded?

Accepted Answer

Voice traffic is being policed at 1 Mbps and any excess is dropped.. The output shows a police statement for the VOICE class with a CIR of 1,000,000 bps (1 Mbps) and actions to transmit conforming traffic while dropping exceeding and violating traffic. This confirms that voice traffic is being policed at 1 Mbps and any excess is dropped. The presence of policing (not shaping) and the input direction (Service-policy input) further support this conclusion.

Answer

The policy is applied in the output direction.

Answer

All traffic is being policed at 8 kbps.

Answer

The policy is shaping traffic to 1 Mbps.

Question 2

Drag and drop the steps of the 802.11 client association process into the correct order, from first to last.

Accepted Answer

Client sends Probe Request. The 802.11 client association process begins with the client sending a Probe Request to discover networks, followed by a Probe Response from the AP. Then the client sends an Authentication Request, the AP replies with an Authentication Response, and finally the client sends an Association Request, which the AP confirms with an Association Response.

Question 3

A network administrator is deploying Cisco Identity Services Engine (ISE) for wired 802.1X authentication on a Cisco Catalyst 9200 switch. The RADIUS server is reachable at 10.10.10.50 with shared secret 'C1sco123'. The administrator wants the switch to authenticate users before granting access to the data VLAN, and to place unauthenticated devices into a restricted VLAN. Which command sequence correctly enables 802.1X on a switch port?

Accepted Answer

aaa new-model; radius server ISE; address ipv4 10.10.10.50 auth-port 1812 acct-port 1813; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control auto; dot1x pae authenticator. 802.1X on a Cisco switch requires enabling AAA, defining the RADIUS server with the correct ports and key, and configuring the interface as an authenticator with 'authentication port-control auto'. The switch acts as the authenticator, ISE as the authentication server, and the endpoint as the supplicant. Using 'force-authorized' bypasses authentication, TACACS+ is not used for 802.1X, and legacy ports 1645/1646 are incorrect.

Answer

aaa new-model; radius server ISE; address ipv4 10.10.10.50 auth-port 1812 acct-port 1813; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control force-authorized; dot1x pae authenticator

Answer

aaa new-model; tacacs server ISE; address ipv4 10.10.10.50; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control auto; dot1x pae supplicant

Answer

aaa new-model; radius server ISE; address ipv4 10.10.10.50 auth-port 1645 acct-port 1646; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control auto; dot1x pae authenticator

Question 4

A network administrator is deploying a new Cisco Catalyst switch in a campus network. The administrator wants to enable a feature that automatically assigns a voice VLAN to Cisco IP phones connected to the switch, based on CDP or LLDP information. Which feature should be configured?

Accepted Answer

Voice VLAN. The Voice VLAN feature allows a switch to automatically assign a VLAN to Cisco IP phones using CDP or LLDP. When a phone is detected, the switch instructs the phone to tag voice traffic with the voice VLAN ID. This separates voice and data traffic, enabling QoS and security policies. The other options are unrelated to automatic voice VLAN assignment.

Answer

VLAN Trunking Protocol

Answer

Private VLAN

Answer

Dynamic ARP Inspection

Question 5

A network engineer is using Cisco DNA Center to automate the deployment of a new VLAN across multiple access switches. The engineer creates a new network profile with the VLAN definition and assigns it to a site. However, after provisioning, the VLAN is not created on any of the switches. The engineer verifies that the devices are in the Inventory and are reachable. What is the most likely cause?

Accepted Answer

The engineer did not run the Provision workflow to push the configuration to the devices.. In Cisco DNA Center, creating a network profile and assigning it to a site only defines the intent — it does not push configuration to devices. The engineer must run the Provision workflow (Design > Network Settings, then Provision > Devices) to actually generate and deploy the CLI configuration, including the new VLAN, to the target switches. Until provisioning is executed, the devices remain unchanged even though they are in Inventory and reachable.

Answer

The VLAN ID conflicts with an existing VLAN on the switches.

Answer

The switches do not support the VLAN ID range.

Answer

The DNA Center appliance is not licensed for the Automation module.

Question 6

A network administrator is configuring a new Cisco IOS switch. The administrator needs to assign switch port GigabitEthernet0/1 to VLAN 20 and ensure that the port is in access mode. Which command sequence is correct?

Accepted Answer

interface GigabitEthernet0/1; switchport mode access; switchport access vlan 20. To assign a switch port to a VLAN and set it as an access port, the correct commands are 'switchport mode access' followed by 'switchport access vlan 20'. This ensures the port operates in access mode and carries traffic for VLAN 20. The other options either configure trunking or dynamic negotiation, which do not meet the access mode requirement.

Answer

interface GigabitEthernet0/1; switchport mode trunk; switchport trunk allowed vlan 20

Answer

interface GigabitEthernet0/1; switchport mode dynamic auto; switchport access vlan 20

Answer

interface GigabitEthernet0/1; switchport access vlan 20; switchport mode access

Question 7

A security team is hardening a Cisco IOS router that terminates IPsec site-to-site tunnels to several branch offices. The team wants to protect the control plane by rate-limiting and filtering traffic destined to the router's own CPU. Which two mechanisms are designed specifically for control plane protection on Cisco IOS? (Choose two.)

Accepted Answer

Control Plane Policing (CoPP). Control plane protection on Cisco IOS is provided by CoPP, which uses MQC policies on the control-plane interface, and CPPr, which adds subinterface granularity for host, transit, and CEF-exception traffic. Both are purpose-built to classify and rate-limit traffic destined to the route processor. Data plane mechanisms such as MACsec and ZBFW, and tunneling architectures such as DMVPN, do not protect the CPU from control plane floods.

Answer

MACsec on the WAN interface

Answer

Zone-Based Policy Firewall (ZBFW)

Answer

IPsec DMVPN with IKEv2

Question 8

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then specify the destination network and subnet mask, then specify the next-hop IP address or exit interface.. Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

Specify the destination network and subnet mask, then enter global configuration mode, then specify the next-hop IP address or exit interface.

Answer

Specify the next-hop IP address or exit interface, then specify the destination network and subnet mask, then enter global configuration mode.

Answer

Enter global configuration mode, then specify the next-hop IP address or exit interface, then specify the destination network and subnet mask.

Question 9

Given the following configuration:

interface GigabitEthernet0/1
 service-policy output QOS_POLICY

Which statement is true about applying a service-policy in the output direction?

Accepted Answer

The policy-map is applied to traffic exiting the interface, allowing queuing and scheduling decisions.. When a service-policy is applied in the output direction, the policy-map inspects and acts on packets as they leave the interface. This allows the policy to perform queuing and scheduling decisions (e.g., CBWFQ, LLQ, shaping) on outbound traffic, which is the correct behavior for managing bandwidth and latency on egress.

Answer

The policy-map is applied to traffic entering the interface, performing classification and marking.

Answer

The policy-map can only be applied if the interface is in a shutdown state.

Answer

The policy-map must contain a class-default with a shape command to be valid.

Question 10

Which two statements about Cisco SD-WAN overlay routing and OMP are true? (Choose two.)

Accepted Answer

OMP (Overlay Management Protocol) is used to exchange routing, policy, and service information between vSmart controllers and vEdge routers.. Option A is correct because OMP (Overlay Management Protocol) is the control-plane protocol in Cisco SD-WAN that runs between vSmart controllers and vEdge/cEdge routers, carrying routing information (OMP routes), policy, and service-related data such as TLOCs and VPN membership. Option B is correct because OMP can advertise both IPv4 and IPv6 prefixes in the overlay, allowing the SD-WAN fabric to route IPv6 traffic natively alongside IPv4. Option C is incorrect because OMP does not run directly between vEdge routers; vEdge devices form data-plane IPsec tunnels between themselves, but OMP adjacencies are established only with vSmart controllers (and vBond for orchestration). Option D is incorrect because OMP routes are not automatically redistributed into BGP on vEdge routers; redistribution between OMP and BGP (or OSPF) must be explicitly configured via route policies. Option E is incorrect because OMP uses TCP port 12346 (not UDP) for control-plane communication between vSmart and vEdge devices.

Answer

OMP runs directly between vEdge routers to establish a full mesh of routing adjacencies.

Answer

OMP routes are automatically redistributed into the local BGP process on the vEdge router.

Answer

OMP uses UDP port 12346 for communication between vSmart and vEdge devices.

Question 11

A network engineer is implementing QoS on a Cisco router that connects to a service provider. The provider uses MPLS and expects the MPLS EXP bits to be set for voice traffic. The engineer configures a policy-map that sets the MPLS EXP to 5. However, the provider reports that the EXP bits are not being set. What is the most likely reason?

Accepted Answer

The policy-map is applied to the incoming interface, but MPLS EXP marking must be done on the outgoing interface.. The most likely reason is that the policy-map is applied to the incoming interface, but MPLS EXP marking must be applied on the outgoing interface. MPLS EXP bits are set at the imposition (ingress) of the MPLS label stack, which occurs when the packet is forwarded out of an interface that has MPLS enabled. If the policy-map is applied inbound, it marks the IP packet before MPLS encapsulation, and the EXP bits are not set on the MPLS label. The correct approach is to apply the policy-map outbound on the interface facing the service provider, so that the 'set mpls experimental' command marks the EXP bits on the imposed label.

Answer

The router does not support setting MPLS EXP bits.

Answer

The MPLS EXP bits are set automatically based on the IP precedence.

Answer

The policy-map must use 'set mpls experimental imposition 5' instead of 'set mpls experimental 5'.

Question 12

Drag and drop each Cisco security feature on the left to its matching OSI layer on the right.

Accepted Answer

Port security: Layer 2. Port security operates at Layer 2; ACL at Layer 3; zone-based firewall at Layer 3/4; IPS at Layer 4-7; MACsec at Layer 2.

Question 13

A network administrator is deploying QoS in a converged network. Which approach correctly implements trust boundaries and marking?

Accepted Answer

Set trust boundary at the access layer switch and re-mark packets based on source.. In a converged network, trust boundaries should be established at the access layer to ensure that marking decisions are made as close to the source as possible. By setting the trust boundary at the access layer switch and re-marking packets based on source (e.g., trusting only IP phones while re-marking workstation traffic), the network can enforce policy before traffic enters the core, preventing unauthorized or misconfigured endpoints from influencing QoS markings. This aligns with Cisco's best practice of trusting only known devices and re-marking all other traffic to a default or lower priority.

Answer

Configure marking only at the core layer to simplify policy.

Answer

Trust only the distribution layer switches to mark traffic.

Answer

Trust the DSCP values set by IP phones and workstations.

Question 14

A network engineer runs the following command on Router R2:

R2# show crypto ipsec sa peer 10.2.2.2
interface: Tunnel0
    Crypto map tag: CMAP, local addr 10.1.1.2
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
   current_peer 10.2.2.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500
    #pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200
    #pkts compressed: 0, #pkts decompress: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

Based on this output, what can be concluded?

Accepted Answer

There is a routing problem causing packets to be dropped in one direction.. The output shows 1500 packets encapsulated and encrypted (outbound) but only 1200 packets decapsulated and decrypted (inbound). This asymmetry indicates that 300 packets were sent but not returned, which points to a routing issue causing packets to be dropped in one direction. A properly functioning IPsec tunnel should have roughly symmetric packet counts in both directions if traffic is bidirectional.

Answer

The IPsec tunnel is functioning correctly with no issues.

Answer

The tunnel is using compression, as shown by the compress counters.

Answer

The remote peer is not responding to IKE requests.

Question 15

Which two statements about VRF configuration in Cisco IOS-XE are true? (Choose two.)

Accepted Answer

A VRF instance maintains its own routing table, CEF table, and forwarding table.. Option A is correct because a VRF (Virtual Routing and Forwarding) instance creates a fully separate Layer 3 routing domain, maintaining its own RIB (routing table), its own CEF/FIB (forwarding table), and its own set of interfaces, which is exactly what provides traffic isolation between VRFs on the same physical router. Option B is correct because IOS-XE supports running routing protocols per VRF; OSPF is enabled inside a VRF by entering router ospf vrf (or by configuring the process under the VRF context), giving that VRF its own OSPF instance, LSDB, and adjacencies. Option C is not required: MPLS is a common transport for VRF traffic across a provider core (as in MPLS L3VPN), but a VRF works locally on a single router without MPLS enabled. Option D is wrong because VRFs are not automatically bound to VLANs; interface-to-VRF association is an explicit configuration (e.g., ip vrf forwarding under the SVI), and VLANs are a Layer 2 construct independent of VRF membership. Option E is wrong because VRF is a Layer 3 isolation mechanism; Layer 2 isolation is provided by VLANs (or VRF-lite's Layer 3 separation over separate subinterfaces), not by VRF itself.

Answer

VRF requires MPLS to be enabled on the router.

Answer

A VRF is automatically associated with all VLANs on a switch.

Answer

VRF is a Layer 2 isolation mechanism.

Question 16

A network engineer runs the following command on Switch SW8:

SW8# show spanning-tree vlan 80

VLAN0080
  Spanning tree enabled protocol ieee
  Root ID    Priority    24656
             Address     aabb.cc00.0e00
             Cost        12
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32768  (priority 32768 sys-id-ext 80)
             Address     aabb.cc00.0f00
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 12        128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p
Gi0/4               Altn BLK 4         128.4    P2p

Based on this output, what is the cost of the root port?

Accepted Answer

12. The root port cost is the cost to reach the root bridge, which is explicitly shown in the 'Root ID' section as 'Cost 12'. This cost is associated with the root port (Gi0/1), which has a role of 'Root' and a status of 'FWD'. Therefore, the correct answer is 12.

Answer

4

Answer

8

Answer

16

Question 17

Which three statements about gRPC and gNMI in the context of model-driven telemetry are true? (Choose three.)

Accepted Answer

gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.. Option A is correct because gRPC is built on HTTP/2 for transport (providing multiplexed streams, flow control, and header compression) and uses Protocol Buffers as its IDL for defining services and messages. Option B is correct because gNMI is a gRPC-based protocol defined by OpenConfig that supports both telemetry subscriptions (Subscribe RPC) and configuration operations (Get, Set, Capabilities RPCs). Option E is correct because gNMI defines subscription modes including SAMPLE (periodic) and ON_CHANGE, allowing devices to stream updates either at fixed intervals or when values change. Option C is incorrect because gNMI subscriptions can use any YANG-modeled paths, including native vendor models, not only OpenConfig models. Option D is incorrect because gNMI operates directly over gRPC/HTTP/2 and does not rely on NETCONF for session establishment or encoding; it uses Protocol Buffers for encoding.

Answer

gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.

Answer

gNMI relies on NETCONF for session establishment and data encoding.

Question 18

Which two statements about 802.1X port-based authentication on a Cisco switch are true? (Choose two.)

Accepted Answer

The switch acts as the authenticator in the 802.1X framework.. Option A is correct because in the 802.1X framework the switch port functions as the authenticator, controlling access to the LAN by relaying credentials between the supplicant and the authentication server. Option D is correct because EAPoL (EAP over LAN, EtherType 0x888E) is the Layer 2 protocol used between the supplicant (client) and the authenticator (switch) to carry EAP authentication messages. Option B is wrong because the RADIUS server acts as the authentication server, not the authenticator; it validates credentials and returns Accept/Reject to the switch. Option C is wrong because 802.1X is a port-based access control method configured on switch ports (and can also run on some router interfaces), not limited to routers. Option E is wrong because 802.1X is widely deployed on wired Ethernet switch ports as well as wireless networks.

Answer

The RADIUS server acts as the authenticator in the 802.1X framework.

Answer

802.1X can only be configured on router interfaces, not on switch ports.

Answer

802.1X authentication is only applicable to wireless networks.

Question 19

A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?

Accepted Answer

Check the cable and connectors for damage or loose connections.. CRC errors and runts on a trunk link typically indicate a Layer 1 physical-layer issue, such as faulty cabling, damaged connectors, or poor termination. The first and most logical step is to inspect and test the physical cable and connectors, as this is the most common root cause and the easiest to verify before making configuration changes.

Answer

Increase the MTU size on the interface.

Answer

Configure the interface with a different duplex setting.

Answer

Disable Dynamic Trunking Protocol (DTP) on the interface.

Question 20

Which two statements about the Cisco SD-Access fabric roles are true? (Choose two.)

Accepted Answer

The fabric edge node is responsible for connecting end devices and enforcing SGT-based policies.. Option A is correct because the fabric edge node is the device (typically a Catalyst switch) that connects wired endpoints into the SD-Access fabric, registers them with the control plane, and enforces group-based policies using SGTs (Security Group Tags) via SGACL and CTS. Option B is correct because the fabric border node provides the handoff between the SD-Access fabric and external Layer 3 networks (such as the data center, WAN, or Internet), performing VRF-aware route leaking and SGT propagation across the fabric boundary. Option C is incorrect because the control plane node (running LISP map-server/map-resolver) handles endpoint registration and location mapping, not user traffic encapsulation; that is the role of edge and border nodes using VXLAN. Option D is incorrect because intermediate nodes simply forward VXLAN-encapsulated traffic between fabric edge and border nodes based on the underlay routing, and they do not perform policy enforcement or segmentation. Option E is incorrect because in SD-Access the wireless controller (WLC) integrates with the fabric as a fabric-enabled WLC (or is replaced by embedded wireless on Catalyst 9800), not as a dedicated fabric border node for wireless traffic.

Answer

The control plane node is responsible for encapsulating and forwarding user traffic across the fabric.

Answer

The intermediate node is responsible for policy enforcement and traffic segmentation within the fabric.

Answer

The wireless controller in SD-Access acts as a dedicated fabric border node for wireless traffic.