CCNP Mock Exam 78 — 25 Questions

Question 1

Which two statements about DMVPN phase 2 are true? (Choose two.)

Accepted Answer

In DMVPN phase 2, spoke routers can establish direct tunnels to each other without traffic passing through the hub.. Option A is correct because DMVPN phase 2 enables spoke-to-spoke direct tunnels: spokes learn each other's NBMA addresses via NHRP and can build dynamic mGRE tunnels so data traffic bypasses the hub. Option C is correct because in phase 2 the hub uses NHRP redirect messages to tell a spoke that a better path to the destination exists, prompting the spoke to send an NHRP resolution request and build a direct tunnel. Option B is wrong because phase 2 requires mGRE on both the hub and the spokes, not point-to-point GRE on spokes. Option D is wrong because DMVPN phase 2 can run with or without IPsec; encryption is optional. Option E is wrong because spokes use dynamic crypto maps or IPsec profiles, not static crypto maps, to support spoke-to-spoke IPsec tunnels.

Answer

DMVPN phase 2 requires mGRE on the hub only; spokes use point-to-point GRE tunnels.

Answer

DMVPN phase 2 supports only IPsec protection and cannot operate without encryption.

Answer

In DMVPN phase 2, spoke routers must be configured with static crypto maps for IPsec.

Question 2

Which two statements about IP SLA with object tracking are true? (Choose two.)

Accepted Answer

A tracking object can monitor the state of an IP SLA operation and change state when the operation fails.. Option A is correct because a track object tied to an IP SLA operation (via 'track 1 ip sla 1 reachability' or 'state') polls that operation's return code and transitions the object between Up and Down when the probe fails or recovers, which is the core purpose of IP SLA object tracking. Option B is correct because the 'track' command creates the tracking object and references the IP SLA operation by its operation number (for example, 'track 1 ip sla 1'), linking the tracker to that specific probe. Option C is wrong because tracked objects can be referenced by static routes, policy-based routing, HSRP/VRRP, and dynamic routing protocols such as EIGRP or OSPF to influence their behavior. Option D is wrong because the tracking object only changes its own Up/Down state and notifies clients; it does not itself edit the routing table, since the referencing route or protocol must be configured to react to the tracker. Option E is wrong because the IP SLA operation must already exist before the tracking object can reference it by number, so the operation cannot be configured afterward.

Answer

Object tracking can only be used with static routes, not with dynamic routing protocols like EIGRP or OSPF.

Answer

The tracking object automatically modifies the routing table when the IP SLA operation fails.

Answer

An IP SLA operation can be configured after the tracking object that references it.

Question 3

Which three statements about Syslog severity levels are true? (Choose three.)

Accepted Answer

Severity level 0 (Emergency) indicates that the system is unusable.. Option A is correct because Syslog severity level 0 is Emergency, meaning the system is unusable and requires immediate attention. Option B is correct because severity level 5 is Notice, defined as a normal but significant condition that is not an error. Option D is correct because severity level 7 is Debugging, the lowest severity level in the Syslog scale, used for debug-level messages. Option C is incorrect because severity level 6 is Informational, which covers normal operational messages that do not require immediate action. Option E is incorrect because severity level 4 (Warning) is less severe than level 3 (Error), since lower numeric values indicate higher severity in Syslog.

Answer

Severity level 6 (Informational) is used for informational messages that require immediate action.

Answer

Severity level 4 (Warning) is more severe than level 3 (Error).

Question 4

Which two statements about PIM sparse mode (PIM-SM) are true? (Choose two.)

Accepted Answer

PIM-SM uses a pull model where receivers explicitly join the multicast group.. Option A is correct because PIM-SM operates on a pull model: receivers must explicitly signal their interest by sending IGMP joins, which trigger PIM (*,G) Join messages toward the RP, rather than relying on flood-and-prune push behavior. Option B is correct because in PIM-SM the rendezvous point (RP) is the root of the shared distribution tree (the RPT, denoted (*,G)), through which all sources initially send their traffic and receivers join. Option C is incorrect because the switch from the shared tree to the shortest path tree (SPT) is not immediate upon the first packet; it occurs when the last-hop router receives traffic and meets the SPT-switchover threshold, or is triggered administratively. Option D is incorrect because PIM-SM does not require every router to be statically configured with the same RP address; RP information can be learned dynamically via bootstrap router (BSR) or Auto-RP mechanisms. Option E is incorrect because PIM-SM can support multiple RPs per multicast group (for load sharing and redundancy) using anycast RP or MSDP, and a single RP can serve multiple groups.

Answer

PIM-SM automatically switches to the shortest path tree (SPT) immediately after the first multicast packet is received.

Answer

PIM-SM requires all routers in the domain to be configured with the same RP address.

Answer

PIM-SM supports only one RP per multicast group.

Question 5

Which three statements about OSPF route summarization are true? (Choose three.)

Accepted Answer

Inter-area route summarization is configured on ABRs using the "area range" command.. Option A is correct because inter-area summarization is performed on Area Border Routers (ABRs) with the "area range " command, which aggregates Type 3 summary LSAs advertised into other areas. Option B is correct because external route summarization is configured on Autonomous System Boundary Routers (ASBRs) using the "summary-address " command, which aggregates Type 5 (or Type 7) external LSAs. Option C is correct because summarization shrinks the link-state database and routing tables by replacing many specific prefixes with one aggregate, which reduces SPF computation overhead and speeds convergence. Option D is wrong because Type 1 router LSAs describe a router's own links and cannot be summarized, and summarization is not performed on arbitrary routers. Option E is wrong because OSPF summarization applies to Type 3 and Type 5/7 LSAs, not to Type 1 and Type 2 LSAs, which must remain intact within an area for topology accuracy.

Answer

Route summarization can be configured on any OSPF router to reduce Type 1 LSAs.

Answer

Summarization in OSPF can be applied to Type 1 and Type 2 LSAs to reduce flooding.

Question 6

Which three statements about virtual machine (VM) resource allocation and overcommitment are true? (Choose three.)

Accepted Answer

Memory overcommitment allows the sum of all virtual machine memory allocations to exceed the physical RAM of the host.. Option A is correct because memory overcommitment is precisely the technique that lets the total configured guest RAM exceed the host's physical RAM, with the hypervisor reclaiming pages via mechanisms like ballooning, swapping, or transparent page sharing. Option B is correct because CPU overcommitment works by having the hypervisor scheduler time-slice multiple vCPUs onto fewer physical cores, commonly at ratios above 1:1, so vCPUs are not permanently bound to cores. Option D is correct because thin provisioning implements storage overcommitment by allocating blocks on demand, so a virtual disk only consumes physical capacity equal to the data actually written rather than its full nominal size. Option C is incorrect because overcommitment is a trade-off that can degrade performance under contention and never guarantees better performance for all VMs. Option E is incorrect because a hypervisor can and routinely does overcommit CPU resources; pinning each vCPU to a dedicated physical core is optional and not a requirement.

Answer

Overcommitment always guarantees better performance for all virtual machines.

Answer

A hypervisor cannot overcommit CPU resources because each vCPU must be pinned to a dedicated physical core.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors detail
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:12:34   12   100  0  45
  Version 2.0/2.0, Retrans: 0, Retry: 0, Maxseq: 0
  Prefixes: 3
  Topology ids: 0
  Authentication: None
  Topology: base (0x0)

Based on this output, what can be concluded?

Accepted Answer

The neighbor has advertised 3 prefixes to R1.. The output shows 'Prefixes: 3' under the neighbor details, which indicates that the neighbor has advertised exactly three prefixes to R1. This is a direct interpretation of the 'show ip eigrp neighbors detail' command, where the 'Prefixes' field lists the number of routes learned from that neighbor.

Answer

The neighbor is using EIGRP version 1.

Answer

There is a high number of retransmissions indicating packet loss.

Answer

The neighbor is using MD5 authentication.

Question 8

A network engineer runs the following command on Router R9:

R9# show ip ospf interface brief

Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
Gi0/0        1     0               192.168.1.9/24     10    DR    2/2
Gi0/1        1     1               10.0.0.9/24        20    BDR   1/1
Lo0          1     0               9.9.9.9/32         1     LOOP  0/0

Based on this output, what can be concluded?

Accepted Answer

R9 has two fully adjacent neighbors on Gi0/0.. The output shows that on interface Gi0/0, R9 has a state of DR (Designated Router) and 2 fully adjacent neighbors (Nbrs F/C = 2/2). The '2/2' indicates 2 neighbors in a full state out of 2 total neighbors, meaning both neighbors have completed the OSPF adjacency process. Therefore, R9 has two fully adjacent neighbors on Gi0/0, making option B correct.

Answer

R9 is the Designated Router on the segment connected to Gi0/1.

Answer

The loopback interface Lo0 is advertised as a /24 network.

Answer

R9 is an Area Border Router.

Question 9

Which three statements about the Cisco Enterprise WAN design principles are true? (Choose three.)

Accepted Answer

SD-WAN architecture separates the control plane and data plane, allowing centralized policy management.. Option A is correct because SD-WAN (e.g., Cisco Catalyst SD-WAN/Viptela) physically and logically separates the control plane (vSmart controllers using OMP) from the data plane (vEdge/cEdge routers forwarding traffic), which enables centralized policy configuration and distribution. Option B is correct because dual-homing a branch to two distinct service provider edge routers provides path and device redundancy, so a single provider router or link failure does not isolate the branch, thereby increasing WAN availability. Option D is correct because MPLS Layer 3 VPNs use per-customer VRF instances on provider edge routers to keep overlapping customer address spaces and routing tables logically isolated while MPLS labels (e.g., VPNv4 route targets) carry the traffic across the provider core. Option C is not correct because DMVPN is specifically designed to avoid a full mesh of static tunnels; it uses mGRE with NHRP to build dynamic spoke-to-spoke tunnels on demand. Option E is also not correct because DMVPN does not require a full mesh of IPsec tunnels between spokes—spokes register with the hub via NHRP and only form direct IPsec tunnels dynamically when needed.

Answer

DMVPN requires a full mesh of static IPsec tunnels between all spoke routers.

Answer

DMVPN requires a full mesh of IPsec tunnels between all spoke routers.

Question 10

Which two statements about multicast RP (Rendezvous Point) are true? (Choose two.)

Accepted Answer

The RP is used only in PIM sparse mode and is the root of the shared distribution tree.. Option A is correct because the Rendezvous Point is a PIM-SM (sparse mode) concept: sources register with the RP and receivers join the shared tree (*, G) rooted at the RP, which forwards traffic until an SPT switchover occurs. Option B is correct because a single RP can service many groups, and Cisco IOS supports multiple RPs mapped to different group ranges via Anycast RP or MSDP, or by configuring separate RPs for different multicast group address ranges. Option C is incorrect because the RP does not need to be the first-hop router for sources; sources simply unicast-register their traffic to the RP through their DR. Option D is incorrect because receivers join the shared tree via their local DR and IGMP, not through direct connection to the RP. Option E is incorrect because PIM dense mode uses flood-and-prune with no RP; the RP is specific to sparse mode.

Answer

The RP must be the first-hop router for all multicast sources in the network.

Answer

The RP must be directly connected to all multicast receivers.

Answer

In PIM dense mode, the RP is used to limit multicast flooding.

Question 11

Which three statements about syslog message severity levels are correct? (Choose three.)

Accepted Answer

Severity level 0 (emergencies) indicates the system is unusable.. Option A is correct because syslog severity level 0 is defined as "emergencies," meaning the system is unusable and immediate attention is required. Option B is correct because severity level 3 is "errors," which covers error conditions that still allow the system to continue functioning, unlike level 0-2. Option C is correct because severity level 5 is "notifications," used for normal but significant conditions such as interface up/down events. Option D is incorrect because debugging messages are severity level 7, while level 6 is "informational" for normal operational messages. Option E is incorrect because the default logging console severity level on Cisco IOS is level 2 (critical), not level 3 (errors).

Answer

Severity level 6 (informational) is used for debugging messages that are only useful during troubleshooting.

Answer

The default logging console severity level on Cisco IOS is 3 (errors).

Question 12

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

Accepted Answer

Each VDC can have its own admin account and separate management interface.. Each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

Answer

VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

Answer

VDCs provide Layer 3 routing isolation by default across all VDCs.

Answer

VDCs are supported on all Cisco IOS-XE switches.

Question 13

A network administrator is deploying a new QoS policy to prioritize voice traffic across a WAN link. The policy must ensure that voice packets are not dropped even during congestion, and that bandwidth is guaranteed for voice. Which queuing mechanism should be used for the voice class?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that voice traffic is placed into a strict priority queue that is serviced before any other queues. This guarantees low latency and prevents voice packet drops during congestion by allowing the priority queue to be policed to a configured bandwidth limit, while still providing bandwidth guarantees for the voice class.

Answer

Weighted Random Early Detection (WRED)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO) queuing

Question 14

A network engineer uses the following Python script with Netmiko to send a command to a Cisco IOS-XE device:

```python
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '10.1.1.1',
    'username': 'admin',
    'password': 'password',
    'secret': 'enable_secret'
}

connection = ConnectHandler(**device)
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()
```

What is the purpose of the 'secret' parameter in the device dictionary?

Accepted Answer

It is used to enter enable mode after connecting to the device.. In Netmiko, the 'secret' parameter in the device dictionary is the enable password used to enter privileged EXEC (enable) mode after the initial SSH connection is established. When Netmiko connects, it authenticates with the username/password, and if 'secret' is provided, it can send the enable command to elevate privileges. This is required for commands that need privileged access, such as 'show running-config' on some platforms.

Answer

It is used for SSH key-based authentication.

Answer

It is used to encrypt the session.

Answer

It is used to set the SNMP community string.

Question 15

Which THREE are common causes of high CPU utilization on a Cisco Catalyst switch? (Choose three.)

Accepted Answer

Broadcast storms. Broadcast storms (A) are a classic cause of high CPU utilization on a Catalyst switch because flooded broadcast frames are punted to the CPU for processing and replication to all ports in the VLAN, overwhelming the control plane. Frequent STP topology changes (D) drive high CPU because each TCN forces the switch to recompute the spanning-tree topology, flush MAC address entries, and process BPDUs, consuming significant control-plane cycles. ACL logging with the 'log' keyword (E) is correct because every matching packet is punted to the CPU to generate a syslog message, and a high volume of matches can saturate the CPU. Excessive hardware switching of packets (B) is not a cause of high CPU since hardware (ASIC) switching is designed to forward packets at wire speed without involving the CPU. Low memory conditions (C) affect memory, not CPU utilization, and are not a common cause of high CPU on a Catalyst switch.

Answer

Excessive hardware switching of packets

Answer

Low memory conditions

Question 16

A network engineer is planning to use Cisco DNA Center to automate the deployment of a new branch office. The engineer has already discovered the devices and added them to Inventory. The engineer wants to use a template to configure the devices consistently. Which tool in DNA Center should the engineer use to create and apply the template?

Accepted Answer

Use the 'Template Editor' to create a CLI template and apply it during provisioning.. The Template Editor in Cisco DNA Center is specifically designed for creating reusable CLI templates that can be applied to devices during provisioning. It allows engineers to define variables and conditional logic, ensuring consistent configuration across multiple devices. This tool is part of the Design > Templates workflow and integrates directly with the provisioning process, making it the correct choice for automating branch office deployments.

Answer

Use the 'Policy Editor' to create a policy-based configuration.

Answer

Use the 'Command Runner' to execute commands on multiple devices.

Answer

Use the 'Network Profiles' to define the configuration.

Question 17

A network engineer is using the Cisco DNA Center REST API to retrieve the list of network devices. The engineer sends a GET request to '/dna/intent/api/v1/network-device' and receives a 400 Bad Request response. The API documentation indicates that the request requires a query parameter 'siteId'. What should the engineer do to resolve the issue?

Accepted Answer

Include the 'siteId' query parameter in the request URL.. A 400 Bad Request indicates the server could not process the request due to a client-side error, and the API documentation explicitly states that the 'siteId' query parameter is required. Adding it to the URL (e.g., /dna/intent/api/v1/network-device?siteId=<id>) supplies the missing input and resolves the error. The HTTP method and endpoint are already correct per the documentation.

Answer

Change the HTTP method to POST because GET is not supported for this endpoint.

Answer

Add an 'Authorization' header with a valid token because the API requires authentication.

Answer

Use a different API endpoint, such as '/dna/intent/api/v1/site', to retrieve device information.

Question 18

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1
Gi0/2      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005
Gi0/2       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20
Gi0/2       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20
Gi0/2       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active on the trunk.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Answer

The trunk is using ISL encapsulation.

Answer

VLAN 1 is pruned from the trunk.

Answer

Only VLANs 10 and 20 are forwarding traffic.

Question 19

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary | include 10.0.1.5
10.0.1.5        4        65005    3456    3457       15    0    0 00:15:22        5

Based on this output, what can be concluded?

Accepted Answer

The BGP session with 10.0.1.5 is up and has received 5 prefixes.. The 'show bgp ipv4 unicast summary' output displays BGP neighbor status. The column 'Up/Down' shows '00:15:22', indicating the session has been established for 15 minutes and 22 seconds, not down. The last column shows '5', which under the 'PfxRcd' (Prefixes Received) column indicates the number of prefixes received from the neighbor. Therefore, the session is up and has received 5 prefixes.

Answer

The BGP session with 10.0.1.5 has been down for 15 minutes and 22 seconds.

Answer

The BGP session with 10.0.1.5 is in the 'Active' state.

Answer

The BGP session with 10.0.1.5 has sent 5 prefixes.

Question 20

An engineer is using a Python script to retrieve interface statistics from a Cisco IOS-XE device via the REST API. The script sends a GET request to 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/statistics' and receives a 404 Not Found response. The interface exists and is operational. What is the most likely issue?

Accepted Answer

The URI is incorrect; statistics are under 'interfaces-state' not 'interfaces'.. In the IETF YANG models used by RESTCONF, operational state data (including interface statistics such as counters and rates) is exposed under the 'ietf-interfaces:interfaces-state' container, not under the configuration-oriented 'interfaces' container. The 'interfaces' container holds configurable attributes like enabled/disabled and description, while 'interfaces-state' holds read-only operational data. Requesting statistics from the 'interfaces' path returns 404 because that data node does not exist there.

Answer

The interface name must be URL-encoded because it contains a slash.

Answer

The device requires authentication; the script must include a valid token.

Answer

The REST API is not enabled on the device; the engineer must enable it first.