CCNP Practice Test 8 — 10 Questions

Question 1

Given the following configuration:

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip access-group 101 in
!
access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 101 deny ip any any

What is the effect of this configuration?

Accepted Answer

Incoming traffic from 192.168.1.0/24 to any destination on port 80 is permitted; all other incoming traffic is denied.. The configuration applies access-list 101 inbound on GigabitEthernet0/0. The first ACE permits TCP traffic from source network 192.168.1.0/24 to any destination on port 80 (HTTP). The second ACE denies all other IP traffic. Since the access list is applied in the inbound direction, it filters traffic entering the router through that interface. Therefore, only incoming traffic matching the permit statement is allowed; everything else is denied.

Answer

Outgoing traffic from the router to 192.168.1.0/24 on port 80 is permitted; all other outgoing traffic is denied.

Answer

Incoming traffic from any source to 192.168.1.0/24 on port 80 is permitted; all other incoming traffic is denied.

Answer

The access-list will permit all TCP traffic from 192.168.1.0/24, regardless of destination port.

Question 2

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Accepted Answer

Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).. In an SD-Access fabric, the underlay network must provide IP connectivity between all fabric devices (edge, control plane, border nodes) using a routed access layer with a link-state routing protocol like IS-IS or OSPF. This ensures fast convergence, loop-free topology, and support for the overlay's VXLAN tunnels. A routed access layer eliminates spanning-tree dependencies and aligns with the fabric's requirement for a simple, scalable IP-based transport.

Answer

Implement PIM-SM for multicast routing in the underlay.

Answer

Preserve existing VLANs across the fabric to minimize changes.

Answer

Deploy VRF-lite on all edge nodes to isolate tenants.

Question 3

What is the purpose of the 'ip nat inside source list' command in Cisco IOS?

Accepted Answer

It identifies the traffic to be translated and the translation method.. The 'ip nat inside source list' command is used to define which traffic (identified by an access list) should be translated and to specify the translation method, such as dynamic NAT, PAT, or static NAT. It links the ACL that matches the source IP addresses to a NAT pool or interface, enabling the router to perform the translation for outbound traffic.

Answer

It defines the inside interface for NAT.

Answer

It filters inbound traffic before NAT is applied.

Answer

It configures the router as a DHCP server.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip route vrf CUSTOMER-A

VRF CUSTOMER-A:
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.100
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.100
B        10.0.2.0/24 [200/0] via 192.168.1.2, 00:12:34

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-A has a BGP-learned route to 10.0.2.0/24. The output shows a BGP-learned route to 10.0.2.0/24 with the code 'B' and the administrative distance [200/0], indicating it is an external BGP route. The route is installed in the VRF CUSTOMER-A routing table, confirming that VRF CUSTOMER-A is using BGP and has learned this prefix via BGP from the next-hop 192.168.1.2.

Answer

VRF CUSTOMER-A is not using BGP for routing

Answer

The default route is learned via BGP

Answer

GigabitEthernet0/0.100 is not associated with VRF CUSTOMER-A

Question 5

Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.

Accepted Answer

Create extended ACL to match traffic. The correct order starts with creating an extended ACL to match the traffic (A), then defining a route-map using the match ip and set vrf commands (B), applying the route-map to the incoming interface (C), after which the router evaluates the policy for each packet (D), and finally matching packets are forwarded into the specified VRF (E). Configuration steps must precede operational steps.

Question 6

Examine the following configuration snippet:
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
 ip ospf dead-interval 40
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF adjacency will form with a neighbor using hello/dead intervals of 10/40 seconds.. The configuration sets the OSPF network type to point-to-point on the interface, which allows OSPF to form an adjacency with a neighbor using the configured hello interval of 10 seconds and dead interval of 40 seconds. These intervals are valid for point-to-point networks, and the network command under router ospf correctly enables OSPF on the interface. Therefore, an adjacency will form as long as the neighbor's intervals match.

Answer

OSPF adjacency will not form because the hello interval is too low for point-to-point.

Answer

The network command under router ospf will be ignored because the interface has an explicit network type.

Answer

OSPF will use the default broadcast network type because the point-to-point keyword is misspelled.

Question 7

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Accepted Answer

Fabric border node. In a centralized policy model for SD-Access, the fabric border node is the correct role to enforce inter-VN traffic policies because it is the only node that can route traffic between different virtual networks (VNs) while applying firewall inspection. The border node connects the fabric to external networks and, when configured with a firewall, can enforce policies such as IP-based ACLs or zone-based firewalls for traffic crossing VNs. This design ensures that all inter-VN traffic is funneled through the border node for inspection, aligning with the centralized policy model where policy enforcement occurs at the network edge.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Fabric WAN router

Question 8

Which component in Cisco SD-WAN is responsible for orchestrating the overlay network, including authentication and NAT traversal?

Accepted Answer

vBond orchestrator. The vBond orchestrator is responsible for the initial authentication of all SD-WAN components (vSmart, vManage, vEdge/cEdge) into the overlay network. It also performs NAT traversal by discovering and distributing the public IP addresses and port numbers of vEdge routers behind NAT, enabling secure DTLS/TLS connections between them. Without vBond, new devices cannot securely join the fabric or establish control-plane connectivity.

Answer

vSmart controller

Answer

vManage NMS

Answer

vEdge router

Question 9

Drag and drop the steps of VNF service chain instantiation into the correct order, from first to last.

Accepted Answer

Define service chain requirements. Service chain instantiation begins with defining the chain, then selecting VNFs, allocating resources, connecting VNFs via virtual links, and finally testing the chain to verify functionality.

Question 10

A network administrator is configuring a new Cisco IOS switch and wants to ensure that the management VLAN is isolated from user traffic. The administrator needs to assign an IP address to VLAN 1 for management access. Which command should be used to enter the interface configuration mode for VLAN 1?

Accepted Answer

interface vlan 1. To assign an IP address to a VLAN for management, you must enter the SVI configuration using 'interface vlan 1'. This creates a logical Layer 3 interface for that VLAN. The other options either configure physical interfaces, create the VLAN without Layer 3, or are incomplete without entering the interface mode first.

Answer

ip address 192.168.1.1 255.255.255.0

Answer

interface fastethernet 0/1

Answer

vlan 1