CCNP Mock Exam 77 — 25 Questions

Question 1

Which two statements about NFV performance considerations are true? (Choose two.)

Accepted Answer

SR-IOV allows a virtual function (VF) to be directly assigned to a VM, providing near-native network performance.. Option A is correct because SR-IOV (Single Root I/O Virtualization) lets a physical NIC expose virtual functions (VFs) that can be directly assigned to a VM via PCI passthrough, so traffic bypasses the hypervisor's virtual switch and gives near-native throughput and low latency. Option C is correct because DPDK (Data Plane Development Kit) supplies user-space libraries, PMD drivers, and hugepage-based memory management that let applications poll NICs directly, bypassing the kernel network stack to achieve high packet-processing rates. Option B is not correct as stated because NUMA awareness is an important optimization for memory locality, but it is not the primary technique for NFV packet processing; SR-IOV, DPDK, and CPU pinning play more central roles. Option D is wrong because bonding multiple uplinks improves redundancy and aggregate bandwidth but does not remove the need for tuning such as DPDK, SR-IOV, or CPU pinning. Option E is wrong because NFV performance can be substantially improved with the right hardware and software optimizations, often approaching or matching physical appliance performance.

Answer

NUMA awareness is the primary technique to improve NFV packet processing performance.

Answer

Using a virtual switch with multiple bonded uplinks eliminates the need for any performance optimization.

Answer

NFV performance is inherently lower than physical appliances and cannot be improved.

Question 2

Drag and drop the steps of Cisco IBNS 2.0 policy configuration into the correct order, from first to last.

Accepted Answer

Define authentication template with method. IBNS 2.0 uses a modular policy framework. First, define the authentication template to specify the method (e.g., dot1x, MAB). Second, create the policy map that references the template and defines the behavior. Third, apply the policy map to the interface. Fourth, enable authentication on the interface. Finally, verify the configuration using show commands.

Question 3

A network engineer executes the following command on Router R5:

R5# show ip sla monitor configuration 4

IP SLAs Monitor Configuration
Entry number: 4
Owner:
Tag:
Type of operation to perform: udp-jitter
Target address: 192.168.5.10
Target port: 16384
Source address: 192.168.5.1
Source port: 0
Type Of Service parameter: 0x0
Request size (ARR data portion): 32
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday, Starting Time: 00:00:01)
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
Number of statistic hours kept: 2
Number of statistic distribution buckets kept: 1
Statistic distribution interval (milliseconds): 20
Enhanced History:

Based on this output, what type of IP SLA operation is configured?

Accepted Answer

UDP jitter. The command output explicitly shows 'Type of operation to perform: udp-jitter', which confirms that the IP SLA operation is configured as UDP jitter. This operation measures round-trip delay, one-way delay, jitter, and packet loss by sending UDP packets to the target address and port (192.168.5.10:16384). The presence of jitter-specific fields like 'Threshold (milliseconds)' and 'Statistic distribution interval (milliseconds)' further validates this type.

Answer

ICMP echo

Answer

TCP connect

Answer

HTTP get

Question 4

Drag and drop the steps of SNMPv3 secure agent configuration into the correct order, from first to last.

Accepted Answer

Enable SNMP agent with snmp-server command. The correct order for SNMPv3 secure agent configuration is: First, define the SNMPv3 group with security model (B). Then, enable the SNMP agent with snmp-server command (A). Next, create the SNMPv3 user with authentication and privacy keys (C). Then, assign the user to the group (D). Finally, configure SNMPv3 view and ACL for access restriction (E). This order ensures that the group and user are defined before enabling the agent, and access control is applied last.

Question 5

Which two statements about Ansible inventory files are true? (Choose two.)

Accepted Answer

Ansible can use a dynamic inventory script that queries an external source such as AWS EC2.. Option A is correct because Ansible supports dynamic inventory, where an executable inventory script (or inventory plugin) queries an external source such as AWS EC2 and returns host data in JSON, allowing hosts to be discovered at runtime. Option B is correct because, when no inventory is specified with -i or configured in ansible.cfg, Ansible falls back to the default inventory file located at /etc/ansible/hosts. Option C is false because inventories can be written in INI, YAML, or as dynamic JSON-producing scripts, not INI only. Option D is false because group variables can be defined directly inside the inventory file (e.g., [group:vars] in INI) as well as in group_vars files. Option E is false because inventory hosts may be specified as hostnames, IP addresses, or FQDNs.

Answer

Ansible inventory files can only be written in INI format.

Answer

Group variables in an inventory must be defined in separate files under the group_vars directory.

Answer

The inventory file can only contain hostnames, not IP addresses.

Question 6

A company is deploying a new data center and needs to choose between a three-tier (core, aggregation, access) and a spine-leaf architecture. The network engineer is concerned about east-west traffic patterns for server virtualization. Which architecture is most suitable and why?

Accepted Answer

Spine-leaf, because it provides equal-cost multipath (ECMP) for all leaf-to-leaf traffic.. Spine-leaf architecture is most suitable for east-west traffic patterns because it provides a full mesh of connections between leaf switches and spine switches, enabling equal-cost multipath (ECMP) routing. This allows all leaf-to-leaf traffic to traverse multiple parallel paths with equal cost, maximizing bandwidth utilization and minimizing latency, which is critical for server virtualization traffic that often moves between hypervisors.

Answer

Three-tier, because it offers more redundancy with multiple aggregation layers.

Answer

Spine-leaf, because it supports legacy spanning tree protocols.

Answer

Three-tier, because it is easier to manage with traditional VLANs.

Question 7

Examine this configuration:
policy-map QOS_POLICY
 class VOICE
  priority percent 10
 class VIDEO
  bandwidth percent 30
 class class-default
  fair-queue
!
interface GigabitEthernet0/0
 service-policy output QOS_POLICY

What is the effect of this policy-map?

Accepted Answer

Voice traffic gets strict priority up to 10% of interface bandwidth, video gets at least 30%, and all other traffic is fair-queued.. The policy-map uses the 'priority percent 10' command under class VOICE, which provides strict priority queuing for voice traffic, guaranteeing it is serviced first up to 10% of the interface bandwidth. The 'bandwidth percent 30' command under class VIDEO allocates a minimum bandwidth guarantee of 30% for video traffic, while the 'fair-queue' command under class-default ensures all other traffic shares the remaining bandwidth fairly using Cisco's Class-Based Weighted Fair Queuing (CBWFQ). This configuration is valid and commonly used in enterprise QoS designs to prioritize real-time traffic while still providing bandwidth guarantees for other critical traffic.

Answer

Voice and video both get priority queuing, with voice at 10% and video at 30%.

Answer

The policy-map is invalid because you cannot use both priority and bandwidth in the same policy-map.

Answer

The policy-map will only shape traffic, not prioritize it.

Question 8

Which two statements about 802.1X authentication with MAC Authentication Bypass (MAB) are true? (Choose two.)

Accepted Answer

MAB is used as a fallback authentication method for devices that do not support 802.1X.. Option A is correct because MAB is specifically designed as a fallback for endpoints that lack an 802.1X supplicant, such as printers, cameras, and legacy devices, allowing the switch to authenticate them by MAC address when EAPoL identity exchange fails or is absent. Option C is correct because in MAB the switch (authenticator) uses the endpoint's source MAC address as both the username and password in a RADIUS Access-Request, typically formatted as the MAC in a consistent case and delimiter scheme (e.g., aabbccddeeff or aa:bb:cc:dd:ee:ff). Option B is wrong because MAB does not use digital certificates; certificate-based authentication belongs to EAP-TLS, which requires a supplicant. Option D is wrong because MAB sends the MAC address in cleartext within RADIUS attributes (e.g., User-Name and User-Password/CHAP), not TLS-encrypted, and RADIUS itself is not inherently TLS-protected. Option E is wrong because EAPoL is used between the supplicant and the switch for 802.1X, whereas MAB is triggered precisely when no EAPoL supplicant responds, and the MAC address is carried to the RADIUS server over RADIUS, not EAPoL.

Answer

MAB requires the supplicant to present a digital certificate for authentication.

Answer

MAB encrypts the MAC address using TLS before sending it to the RADIUS server.

Answer

MAB uses EAPoL to transport the MAC address between the switch and the endpoint.

Question 9

Which two statements about using Python for configuration management and templating in network automation are true? (Choose two.)

Accepted Answer

Jinja2 templates allow the use of variables and control structures like loops and conditionals to generate network device configurations.. Option A is correct because Jinja2 is a templating engine that supports variables, loops ({% for %}), and conditionals ({% if %}), which are used to dynamically generate network device configurations. Option B is correct because a typical Python automation workflow loads a Jinja2 template, renders it with device-specific data (e.g., from YAML/JSON), and then pushes the rendered configuration to the device via libraries like Netmiko or NAPALM. Option C is incorrect because Jinja2 only renders text; it cannot execute CLI commands on devices—that requires a separate connection library. Option D is incorrect because Jinja2 is a templating engine, not a YAML parser; YAML parsing is handled by libraries like PyYAML. Option E is incorrect because Python, combined with Jinja2, is widely used to generate configuration files.

Answer

Jinja2 can be used to execute CLI commands on network devices directly from within the template.

Answer

Jinja2 is a Python library used for parsing YAML files.

Answer

Python cannot be used to generate configuration files because it lacks templating capabilities.

Question 10

Drag and drop the steps of REST API call using Requests library to DNA Center into the correct order, from first to last.

Accepted Answer

Import requests module. The correct order starts with importing the Requests library, sending a POST request to the authentication endpoint with credentials, extracting the token from the JSON response, using the token in headers for a GET request to a resource endpoint, and finally parsing the JSON response.

Question 11

Which two statements about Cisco SD-WAN control plane components are true? (Choose two.)

Accepted Answer

vSmart controllers are responsible for distributing OMP routes and policies to vEdge routers.. Option A is correct because vSmart controllers run the OMP (Overlay Management Protocol) control plane and are the devices that advertise OMP routes, TLOCs, and centralized policies to the vEdge/WAN Edge routers, forming the overlay routing and policy brain of the fabric. Option B is correct because vBond orchestrators handle authentication, authorization, and initial onboarding of vEdge routers, acting as the first point of contact that validates devices and helps them discover vSmart and vManage controllers. Option C is incorrect because vEdge routers are data plane/edge devices that receive OMP routes from vSmart; they do not maintain the routing table for the entire SD-WAN domain. Option D is incorrect because vManage is the management plane (GUI/API for configuration, monitoring, and provisioning), not a control plane component distributing BGP routes. Option E is incorrect because TLOCs (Transport Locators) are attributes carried in OMP updates that identify a WAN Edge's transport endpoints; they are not used by vSmart to redistribute routes between OMP instances.

Answer

vEdge routers function as the control plane devices that maintain the routing table for the entire SD-WAN domain.

Answer

vManage is the control plane component that distributes BGP routes to all WAN Edge routers.

Answer

TLOCs are used by vSmart controllers to redistribute routes between different OMP instances.

Question 12

A network engineer is configuring a Cisco SD-WAN solution for a multinational corporation. The engineer wants to use a centralized data policy to steer all traffic from the Finance department (VPN 10) to a specific WAN link (MPLS) for security reasons. The engineer creates a policy that matches traffic from VPN 10 and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that traffic from VPN 10 is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason?

Accepted Answer

The policy is not attached to the correct site list or VPN list.. The most likely reason is that the centralized data policy was not attached to the correct site list or VPN list. In Cisco SD-WAN, a centralized data policy must be explicitly associated with the sites (via site list) and VPNs (via VPN list) where it should be applied. Even if the policy is received and active on the vEdge routers, without proper attachment to the VPN 10 site list, the policy will not enforce the preferred color 'mpls' for Finance traffic, leaving it to use the default Internet link.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The preferred color is not configured correctly in the policy.

Question 13

An engineer is using the Cisco pyATS framework to test the configuration of a new QoS policy on a router. The engineer writes a testbed file and a test script that logs into the router, applies the configuration, and then verifies the output of 'show policy-map interface'. The test script fails because the verification step cannot find the expected output. The engineer confirms that the configuration was applied successfully. What is the most likely cause of the failure?

Accepted Answer

The test script does not include a sleep or wait mechanism after applying the configuration.. After applying a QoS policy with the `service-policy` command, the router may take a short time to update the operational state shown in `show policy-map interface`. Without an explicit sleep or wait mechanism in the pyATS test script, the verification step executes before the router has processed and reflected the new policy, causing a mismatch even though the configuration was applied successfully.

Answer

The pyATS library requires Python 3.8 or later, and the engineer is using an older version.

Answer

The testbed file has incorrect credentials for the router.

Answer

The test script uses the 'genie' library instead of 'pyats' for parsing.

Question 14

Which three statements about Cisco DNA Center Assurance are true? (Choose three.)

Accepted Answer

Cisco DNA Center Assurance uses streaming telemetry from devices to monitor network health in real time.. Option A is correct because Cisco DNA Center Assurance collects streaming telemetry (model-driven telemetry, e.g., gRPC/telemetry subscriptions) from network devices to provide near real-time visibility into network health rather than relying only on periodic polling. Option C is correct because Assurance computes a client health score that aggregates RF metrics (RSSI, SNR, retries), onboarding/connectivity status, and application performance (via Application Experience) into a single 0-10 score. Option E is correct because Assurance uses machine learning and baseline analytics to proactively detect anomalies and raise issues/alerts before end users are impacted. Option B is not correct because Assurance itself is a monitoring and analytics function; automated configuration changes are performed by separate DNA Center features such as SWIM, Plug and Play, or intent-based automation, not by Assurance remediation. Option D is not correct because Assurance does not rely solely on SNMP polling; it primarily uses streaming telemetry (with SNMP/syslog as supplementary sources), so 'solely' makes the statement false.

Answer

Cisco DNA Center Assurance can automatically remediate issues by changing device configurations.

Answer

Cisco DNA Center Assurance relies solely on SNMP polling for data collection.

Question 15

Which two statements about the Cisco QoS trust boundary are true? (Choose two.)

Accepted Answer

The trust boundary can be set at the access layer switch port connected to an IP phone.. Option A is correct because the trust boundary is typically established at the access layer switch port where an IP phone connects, since the phone can mark voice traffic with CoS/DSCP and the switch can be configured to trust those markings from the phone while untrusting traffic from an attached PC. Option B is correct because the interface-level command 'mls qos trust cos' explicitly configures the port to trust the incoming Layer 2 CoS field, allowing the switch to honor the CoS value for QoS classification and queuing. Option C is incorrect because Cisco switch interfaces do not trust incoming CoS or DSCP by default; they typically trust nothing (or default to a best-effort/CoS 0 behavior) until trust is explicitly configured. Option D is incorrect because the trust boundary is not always at the distribution layer; it is commonly placed at the access layer, though it can be extended to other points depending on design. Option E is incorrect because a switch does not automatically trust DSCP markings from an attached PC; trust must be explicitly configured, and PC traffic is generally untrusted by default.

Answer

By default, all Cisco switch interfaces trust the incoming CoS or DSCP marking.

Answer

The trust boundary is always located at the distribution layer switch.

Answer

When a PC is connected to a switch port, the switch automatically trusts the DSCP value from the PC.

Question 16

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Accepted Answer

CUSTOMER-A. The packet arrives on interface Gi0/1/0, which is configured under VRF CUSTOMER-A (as shown in the exhibit with 'ip vrf forwarding CUSTOMER-A'). When a VRF is applied to an ingress interface, the router uses that VRF's routing table (not the global table) to perform the destination IP lookup. Therefore, the packet with destination 10.1.1.2 is routed using the CUSTOMER-A VRF.

Answer

Global routing table

Answer

Mgmt-intf

Answer

CUSTOMER-B

Question 17

Which two statements about Cisco DNA Center automation workflows are true? (Choose two.)

Accepted Answer

Cisco DNA Center supports Plug and Play (PnP) for zero-touch device onboarding.. Option A is correct because Cisco DNA Center's Plug and Play (PnP) workflow lets new devices automatically discover the controller, authenticate via certificates or pre-shared keys, and receive their day-0/day-1 configuration without manual intervention, enabling true zero-touch onboarding. Option B is correct because DNA Center uses template-based provisioning (for example, CLI templates and regular/compound templates in the Template Editor) to render and push consistent, standardized configurations across many devices, reducing drift and manual errors. Option C is wrong because DNA Center also offers CLI access and APIs (Intent API, REST) alongside the GUI, so it is not GUI-only. Option D is wrong because DNA Center's automation is primarily for Cisco devices (IOS-XE, NX-OS, AireOS, etc.) and does not fully automate all third-party switches. Option E is wrong because configuration changes are pushed via NETCONF/YANG, SSH/CLI, or the PnP protocol, not SNMP, which is used mainly for monitoring and telemetry rather than configuration.

Answer

Cisco DNA Center only supports GUI-based configuration; CLI access is not available.

Answer

Cisco DNA Center automates configuration of all network devices, including third-party switches.

Answer

Cisco DNA Center uses SNMP to push configuration changes to devices.

Question 18

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Accepted Answer

DNA Center uses a declarative model for network configuration.. Option C is correct because Cisco DNA Center is built around intent-based networking, where administrators define the desired end state (intent) declaratively and DNA Center translates that intent into device-level configurations, rather than requiring per-device imperative command sequences. Option D is correct because DNA Center offers a centralized, single-pane-of-glass dashboard that unifies assurance, monitoring, automation, and policy management across the fabric, giving one management view for the network. Options A, B, and E are not correct: DNA Center does not primarily rely on SNMP for management (it uses APIs such as REST, NETCONF, and SSH/CLI for automation and telemetry), it supports both greenfield and brownfield deployments rather than only greenfield, and it does not use an imperative model as its core configuration approach.

Answer

DNA Center primarily uses SNMP to manage devices.

Answer

DNA Center only supports greenfield deployments.

Answer

DNA Center uses an imperative model for network configuration.

Question 19

Drag and drop the steps of IPv6 ACL configuration and application into the correct order, from first to last.

Accepted Answer

Create IPv6 ACL with permit/deny entries. The correct order is: create the ACL with deny/permit entries, apply it inbound on an interface, then verify with show commands. This follows standard Cisco IOS ACL configuration workflow.

Question 20

A network architect is designing QoS for a converged network carrying voice, video, and data. The design must use the DiffServ model and ensure that voice traffic is marked with the highest priority and that video traffic is marked with a lower priority but still above data. Which DSCP markings should be assigned to voice and video traffic, respectively, to comply with the standard Per-Hop Behavior (PHB) definitions?

Accepted Answer

Voice: DSCP 46 (EF); Video: DSCP 34 (AF41). The DiffServ model defines specific Per-Hop Behaviors (PHBs) for different traffic types. Voice traffic requires low latency, jitter, and loss, which is best served by the Expedited Forwarding (EF) PHB, assigned DSCP 46. Video traffic, while still delay-sensitive, can tolerate some loss and is typically marked with Assured Forwarding (AF41, DSCP 34), which provides a lower priority queue than EF but higher than best-effort data.

Answer

Voice: DSCP 56 (CS7); Video: DSCP 48 (CS6)

Answer

Voice: DSCP 40 (AF41); Video: DSCP 46 (EF)

Answer

Voice: DSCP 26 (AF31); Video: DSCP 18 (AF21)