CCNP Mock Exam 80 — 25 Questions

Question 1

Which three statements about Cisco TrustSec (CTS) are true? (Choose three.)

Accepted Answer

Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity.. Option A is correct because Cisco TrustSec classifies traffic by applying Security Group Tags (SGTs) that represent the identity/role of the user or device, enabling group-based policy rather than IP-based rules. Option C is correct because 802.1X authentication can drive dynamic SGT assignment: after the supplicant authenticates, the ISE/AAA server returns an authorization result (e.g., cisco-av-pair with an SGT value) that the switch applies to the port/session. Option E is correct because TrustSec supports inline tagging, where the 16-bit SGT is inserted into the Ethernet frame (using the Cisco Meta Data / CMD header with EtherType 0x8909) so the tag travels with the packet hop-by-hop. Option B is not correct as stated because SGTs are not 'typically assigned to IP addresses' via a centralized mapping database; SGT-to-IP mappings are used for devices that cannot tag natively (e.g., via SXP or IP-to-SGT mapping), but the primary assignment is identity/session-based, not IP-based. Option D is not correct because TrustSec augments, but does not eliminate, traditional ACLs; SGACL enforcement still relies on underlying ACL-like constructs and existing ACLs may remain for other purposes.

Answer

SGTs are typically assigned to IP addresses using a centralized SGT mapping database.

Answer

Cisco TrustSec eliminates the need for all traditional ACLs in the network.

Question 2

Which two statements about the Cisco FlexConnect architecture are true? (Choose two.)

Accepted Answer

FlexConnect APs can locally switch client data traffic when the CAPWAP tunnel to the WLC is down.. Option A is correct because FlexConnect's defining feature is local switching: the AP bridges client traffic directly onto the local wired VLAN at the branch, and this continues to function in standalone mode when the CAPWAP control tunnel to the WLC is lost. Option C is correct because FlexConnect groups let you apply a common set of VLAN-to-WLAN mappings, ACLs, and other settings to multiple APs, simplifying branch configuration and enabling features like VLAN-based central switching. Option B is wrong because FlexConnect explicitly supports local switching rather than requiring all client traffic to be tunneled to the WLC. Option D is wrong because FlexConnect APs are designed for branch deployments where the WLC is remote over a Layer 3 network, not directly Layer 2 attached. Option E is wrong because FlexConnect APs do support native VLAN tagging on their uplink switch port.

Answer

FlexConnect APs must always tunnel all client traffic back to the WLC for central switching.

Answer

FlexConnect APs require a direct Layer 2 connection to the WLC at all times.

Answer

FlexConnect APs cannot support native VLAN tagging on the uplink interface.

Question 3

Which three statements about SNMP trap and inform operations are true? (Choose three.)

Accepted Answer

Traps are unacknowledged notifications sent from the SNMP agent to the manager.. Option A is correct because SNMP traps are asynchronous, unacknowledged notifications that an agent (or managed device) sends to a manager on UDP port 162 without expecting any reply. Option B is correct because SNMP informs are also notifications, but they are acknowledged: the manager must send a Response PDU back to the sender, and the sender retransmits if no acknowledgment arrives within a timeout. Option C is correct because informs are delivered to the manager on the same well-known UDP port 162 used by traps; the difference is the acknowledgment behavior, not the transport port. Option D is not correct because traps are actually less reliable than informs—traps are fire-and-forget with no acknowledgment, and SNMP does not assign them higher priority. Option E is not correct because informs require the sender to keep state (storing the request and waiting for a response, with retries), so they consume more memory and processing than traps, not less.

Answer

Traps are more reliable than informs because they are sent with a higher priority.

Answer

Informs consume less memory and processing than traps because they do not require state tracking.

Question 4

Which two statements about IP SLA probe scheduling and operation states are true? (Choose two.)

Accepted Answer

The 'schedule' command with 'start-time now' causes the IP SLA operation to begin immediately.. Option A is correct because the 'schedule' command with 'start-time now' instructs the IP SLA operation to begin executing immediately upon configuration, rather than waiting for a future start time. Option B is correct because the 'active' state of an IP SLA operation means the probe is currently running—packets are being sent and responses are being collected according to the configured frequency and timeout. Option C is incorrect because the 'life' parameter defines how long the operation remains scheduled (its total lifetime), not the probe frequency; frequency is set by the 'frequency' command. Option D is incorrect because an operation does not stay in 'pending' merely until start-time if the configuration is complete—it transitions to 'active' when the schedule starts, and 'pending' typically indicates the operation is not yet scheduled or is waiting for scheduling resources. Option E is incorrect because 'life forever' means the operation continues indefinitely until manually stopped, not that it stops after a single probe.

Answer

The 'life' parameter in the IP SLA configuration sets the frequency at which probes are sent.

Answer

An IP SLA operation remains in the 'pending' state until the 'start-time' is reached, even if the configuration is complete.

Answer

The 'schedule' command with 'life forever' causes the operation to stop after a single probe.

Question 5

Which two statements about YANG data models and their role in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG is a data modeling language used to define the structure of configuration and operational state data.. Option A is correct because YANG (RFC 6020/7950) is a data modeling language that defines the hierarchical structure, syntax, and semantics of configuration data and operational state data on network devices, which is the foundation for model-driven telemetry. Option C is correct because native YANG models are authored by the device vendor (e.g., Cisco IOS XE native models) and can expose platform-specific features and proprietary data nodes not covered by standard models. Option B is incorrect because OpenConfig YANG models are vendor-neutral, community-developed models intended to work across multiple vendors, not vendor-specific or Cisco-only. Option D is incorrect because model-driven telemetry subscriptions can use native, OpenConfig, and IETF YANG models, not IETF models exclusively. Option E is incorrect because YANG is a modeling language, not a transport protocol; telemetry streaming is carried by protocols such as gRPC, NETCONF, or RESTCONF.

Answer

OpenConfig YANG models are vendor-specific and only supported on Cisco devices.

Answer

IETF YANG models are the only models that can be used for model-driven telemetry subscriptions.

Answer

YANG is a transport protocol used to stream telemetry data from network devices to collectors.

Question 6

Which three statements about the classification and marking tools in Cisco IOS are true? (Choose three.)

Accepted Answer

The trust boundary can be configured using the 'mls qos trust' command on a switch port to trust the CoS or DSCP value received from an attached device.. Option A is correct because the 'mls qos trust' interface command (e.g., 'mls qos trust cos' or 'mls qos trust dscp') establishes the trust boundary on a switch port, instructing the switch to accept and honor the CoS or DSCP values already present in frames received from an attached device rather than re-marking them. Option B is correct because NBAR is a Cisco IOS classification engine that inspects packet payloads and matches application signatures, including HTTP URL strings and SSL/TLS certificate fields, allowing granular application-aware classification beyond simple Layer 3/Layer 4 criteria. Option C is correct because the 802.1Q tag carries a 3-bit Priority Code Point (CoS) field yielding 8 values (0-7), while the IP header's DSCP field is 6 bits yielding 64 values (0-63), which is the fundamental difference in granularity between Layer 2 and Layer 3 marking. Option D is incorrect because 'set dscp' in a policy map can be applied on ingress or egress, not exclusively egress. Option E is incorrect because MPLS EXP bits are not automatically mapped from IP DSCP; mapping between DSCP and EXP requires explicit configuration (e.g., via table-map or policy), so the 'always directly mapped' claim is false.

Answer

The 'set dscp' command in a policy map can be used to mark packets with a DSCP value, but only on egress interfaces.

Answer

MPLS EXP bits are a 3-bit field used for QoS in MPLS networks and are always directly mapped from the IP DSCP value without any configuration.

Question 7

Which two statements about OSPF neighbor states are true? (Choose two.)

Accepted Answer

The 2-Way state indicates that both routers have seen their own router ID in the neighbor's hello packet.. Option A is correct because the 2-Way state is reached when a router receives a Hello packet from a neighbor that contains its own Router ID in the neighbor list field, confirming bidirectional communication. Option B is correct because Full state means the two routers have successfully completed database synchronization, so their link-state databases (LSDBs) are identical and they are fully adjacent. Option C is incorrect because Database Description (DBD) packets with LSA headers are exchanged in the Exchange state, not the ExStart state; ExStart only negotiates the master/slave relationship and initial DBD sequence numbers. Option D is incorrect because Link State Requests and Link State Updates are exchanged in the Loading state, not the Exchange state. Option E is incorrect because Down is the initial state, not the final state, when no Hello packets have been received from the neighbor.

Answer

In the ExStart state, routers exchange Database Description packets containing LSA headers.

Answer

In the Exchange state, routers send Link State Requests and receive Link State Updates.

Answer

The Down state is the final state when a neighbor is unreachable.

Question 8

Which two statements about AAA accounting are true? (Choose two.)

Accepted Answer

RADIUS accounting uses UDP as the transport protocol.. Option A is correct because RADIUS accounting operates over UDP, using destination port 1813 (or the legacy 1646), since RADIUS is a UDP-based protocol for authentication, authorization, and accounting. Option C is correct because the wait-start accounting method requires the accounting start record to be acknowledged by the AAA server before the user is granted access, unlike start-stop which sends the start record without waiting for confirmation. Option B is incorrect because TACACS+ uses TCP (port 49), not UDP, for its accounting traffic. Option D is incorrect because AAA accounting can be applied to EXEC sessions, network access (such as PPP or VPDN), and system-level events, not EXEC sessions alone. Option E is incorrect because TACACS+ encrypts the entire packet body, not just the password portion, which is a characteristic of RADIUS.

Answer

TACACS+ accounting uses UDP as the transport protocol.

Answer

AAA accounting is only supported for EXEC sessions, not for network access.

Answer

TACACS+ encrypts only the password portion of the accounting packet.

Question 9

Which two statements about Ansible automation in a Cisco environment are true? (Choose two.)

Accepted Answer

Ansible uses a push-based model to configure network devices.. Option A is correct because Ansible operates on a push-based (agentless) model: the control node connects to managed Cisco devices over SSH (or NETCONF/RESTCONF via connection plugins) and pushes modules/playbooks to them, so no persistent agent is needed. Option C is correct because Ansible Tower (now Red Hat Ansible Automation Platform's controller) provides a web-based GUI, REST API, and role-based access control (RBAC) for managing inventories, credentials, and job templates. Option B is wrong because Ansible is agentless and does not require installing software on managed Cisco devices. Option D is wrong because the default Ansible inventory file is INI-formatted (hosts), though YAML inventories are supported. Option E is wrong because playbooks are written in YAML, not Python (Python is used for modules and plugins).

Answer

Ansible requires an agent to be installed on managed Cisco devices.

Answer

The default Ansible inventory file is written in YAML format.

Answer

Ansible playbooks are written in Python.

Question 10

Which two statements about NetFlow flow records and export are correct? (Choose two.)

Accepted Answer

NetFlow v9 uses a template-based export format.. Option A is correct because NetFlow v9 introduced a template-based export format, where the exporter periodically sends template records that define the layout and field types of subsequent data records, allowing flexible and extensible flow record definitions. Option B is correct because IPFIX (Internet Protocol Flow Information Export) is the IETF standard (RFC 7011) derived from and based on NetFlow v9, adopting its template-based architecture while standardizing field specifications. Option C is incorrect because NetFlow v5 uses a fixed, predefined record format with fixed-length fields and a fixed flow key, not variable-length fields or custom keys. Option D is incorrect because NetFlow export traditionally uses UDP (typically port 2055) for efficiency, not TCP by default, though TCP is an option in some implementations like IPFIX. Option E is incorrect because NetFlow v5 only supports IPv4 flow information; IPv6 support was introduced with NetFlow v9 and IPFIX.

Answer

NetFlow v5 supports variable-length fields and custom flow keys.

Answer

NetFlow export uses TCP by default to ensure reliable delivery.

Answer

NetFlow v5 can export IPv6 flow information.

Question 11

Which two statements about IPsec IKEv2 are true? (Choose two.)

Accepted Answer

IKEv2 uses UDP port 500 for initial negotiation and can switch to UDP port 4500 for NAT traversal.. Option A is correct because IKEv2 performs its initial IKE_SA_INIT exchange over UDP port 500, and when NAT is detected it switches to UDP port 4500 (NAT-T) to encapsulate ESP/IKE traffic and traverse NAT devices. Option C is correct because IKEv2 natively supports EAP methods (e.g., EAP-MSCHAPv2, EAP-TLS) as an authentication mechanism, which is commonly used for remote-access VPN clients. Option B is wrong because IKEv2 establishes the IKE SA once and then creates multiple child SAs (IPsec SAs) under that single IKE SA without requiring a separate authentication phase for each. Option D is wrong because IKEv2 supports multiple authentication methods including pre-shared keys, digital certificates (RSA/ECDSA), and EAP. Option E is wrong because IKEv2 is not backward compatible with IKEv1; the two versions do not interoperate and require separate implementations or negotiation fallback mechanisms.

Answer

IKEv2 requires a separate authentication phase for each security association established.

Answer

IKEv2 uses only pre-shared keys for authentication and does not support digital certificates.

Answer

IKEv2 is backward compatible with IKEv1 and can interoperate with older peers.

Question 12

Which two statements about MPLS Layer 3 VPNs are true? (Choose two.)

Accepted Answer

PE routers use MP-BGP to exchange VPNv4 routes that include the route distinguisher and the VPN label.. Option A is correct because in an MPLS Layer 3 VPN, PE routers use MP-BGP (multiprotocol BGP, specifically the VPNv4 address family) to exchange customer routes, and each VPNv4 NLRI carries the 8-byte route distinguisher that makes the prefix unique plus the VPN label (an inner MPLS label) used by the egress PE to identify the customer VRF. Option D is correct because each VRF on a PE router is a separate routing and forwarding instance with its own RIB and FIB, which is what keeps overlapping customer address space isolated and allows per-VRF label assignment. Option B is wrong because P routers in the core only need to forward labeled packets based on the outer transport label; they do not hold per-customer VRF tables (that is the whole point of the MPLS L3VPN architecture). Option C is wrong because CE routers are typically ordinary IP routers that do not run MPLS or participate in label distribution; they simply peer with the PE via a routing protocol or static routes. Option E is wrong because the MPLS label stack in an L3VPN normally contains at least two labels: an outer IGP/LDP transport label used to reach the egress PE and an inner VPN label used to identify the customer VRF, and it can contain more labels in some scenarios.

Answer

P routers in the MPLS core must maintain a full routing table for each customer VRF.

Answer

CE routers must run MPLS and participate in the label distribution with the PE router.

Answer

The MPLS label stack in a Layer 3 VPN always contains exactly one label.

Question 13

Which two statements about OSPF network types are true? (Choose two.)

Accepted Answer

On a broadcast multiaccess network, OSPF elects a DR and BDR to reduce LSA flooding.. Option A is correct because on a broadcast multiaccess network OSPF does elect a DR and BDR, which reduces the number of adjacencies and LSA flooding by having all other routers form full adjacencies only with the DR/BDR. Option C is correct because on an NBMA network OSPF does not automatically discover neighbors via multicast, so the neighbor command is used to manually specify neighbor IP addresses and enable unicast Hello packets. Option B is incorrect because the point-to-point network type does not require a DR/BDR election; it forms a direct adjacency. Option D is incorrect because point-to-multipoint treats the network as a collection of point-to-point links and does not elect a DR/BDR. Option E is incorrect because the default OSPF network type for a loopback interface is loopback, which is advertised as a stub host route, not point-to-point.

Answer

The OSPF point-to-point network type requires a DR/BDR election.

Answer

The OSPF point-to-multipoint network type always elects a DR.

Answer

The default OSPF network type for a loopback interface is point-to-point.

Question 14

Which two statements about NetFlow are true? (Choose two.)

Accepted Answer

NetFlow records are unidirectional by default.. Option A is correct because a standard NetFlow flow record is defined by a unidirectional 5-tuple (source IP, destination IP, source port, destination port, and protocol), so each direction of a conversation is tracked as a separate flow entry. Option B is correct because Sampled NetFlow applies a sampling rate (for example, 1 out of every 100 packets) so the router or switch only inspects a subset of traffic, which lowers CPU and memory overhead compared with full NetFlow accounting. Option C is not correct because user-defined flow keys and flexible field selection require Flexible NetFlow export formats such as NetFlow v9 or IPFIX, not the fixed NetFlow v5 record layout. Option D is not correct because NetFlow provides flow-level traffic detail and is complementary to SNMP interface counters, not a drop-in replacement for SNMP polling of interface utilization. Option E is not correct because NetFlow v9 is template-based and can carry IPv4, IPv6, MPLS, and other protocol fields, not only IPv4 traffic.

Answer

Flexible NetFlow can export user-defined flow keys using NetFlow v5 format.

Answer

NetFlow can be used as a replacement for SNMP polling for interface utilization.

Answer

NetFlow v9 supports only IPv4 traffic.

Question 15

Which three statements about REST API authentication and security are true? (Choose three.)

Accepted Answer

Token-based authentication typically uses the HTTP Authorization header to pass the token.. Option A is correct because token-based authentication (e.g., Bearer tokens) conventionally transmits the token in the HTTP Authorization header, such as 'Authorization: Bearer <token>', allowing the server to validate the caller's identity on each request. Option B is correct because HTTPS (HTTP over TLS) encrypts data in transit, protecting credentials, tokens, and payloads from eavesdropping and man-in-the-middle attacks, and is a baseline recommendation for any REST API. Option E is correct because OAuth 2.0 is an authorization framework that issues access tokens with defined scopes, enabling delegated, limited access to REST API resources without sharing user credentials. Option C is incorrect because API keys are simple static identifiers with no built-in scoping, expiration, or delegation, so they do not provide the same security level as OAuth 2.0 tokens. Option D is incorrect because base64 encoding is not encryption; Basic authentication over HTTP exposes credentials in easily decodable form and is only safe when layered over HTTPS.

Answer

API keys provide the same level of security as OAuth 2.0 tokens.

Answer

Basic authentication over HTTP is secure because the credentials are base64-encoded.

Question 16

Which TWO statements about virtual switching in a hypervisor environment are correct?

Accepted Answer

A virtual switch can be connected to a physical network through uplink ports.. Option A is correct because a virtual switch (vSwitch) uses uplink ports, also called physical NICs or pNICs, to bridge virtual machine traffic onto the physical network, allowing VMs to communicate beyond the host. Option D is correct because a virtual switch operates at Layer 2, learning MAC addresses and forwarding Ethernet frames between virtual machines (and to uplinks) based on destination MAC addresses, just like a physical switch. Option B is wrong because virtual switches do support VLAN tagging, typically via VLAN IDs on port groups or virtual switch ports (e.g., 802.1Q tagging). Option C is wrong because a virtual switch is a Layer 2 device and does not perform IP routing between subnets; routing requires a router or Layer 3 device. Option E is wrong because a virtual switch is a software construct running inside the hypervisor, not a physical device installed in the host.

Answer

A virtual switch does not support VLAN tagging.

Answer

A virtual switch performs routing between different subnets.

Answer

A virtual switch is a physical device installed in the hypervisor host.

Question 17

A network engineer is deploying Cisco DNA Center in a large campus network with 5000+ devices. After initial setup, the engineer notices that the Assurance module is not receiving telemetry data from many access switches. The switches are running IOS-XE 16.12 and are reachable via SNMP. What is the most likely cause of this issue?

Accepted Answer

The switches are not configured with NETCONF/YANG or telemetry streaming.. Cisco DNA Center Assurance relies on telemetry data collected via NETCONF/YANG or gRPC, not just SNMP. If the switches are not configured for telemetry, Assurance will not receive the necessary data. SNMP is used for inventory and basic monitoring, but not for the rich telemetry required by Assurance.

Answer

The DNA Center appliance is not licensed for the Assurance module.

Answer

The switches are not running the correct IOS-XE version for DNA Center compatibility.

Answer

The SNMP community string is incorrect on the switches.

Question 18

An architect is designing an SD-Access fabric for a campus with multiple buildings. The design must support wireless clients seamlessly roaming across fabric edge nodes. Which technology is used in the fabric to provide mobility for wireless endpoints?

Accepted Answer

LISP. LISP (Locator/ID Separation Protocol) is the correct technology because it decouples the endpoint identifier (EID) from its routing locator (RLOC), enabling seamless roaming across fabric edge nodes. In SD-Access, LISP maintains a mapping database that tracks wireless endpoint locations, allowing traffic to be forwarded to the correct fabric edge without re-anchoring or tunneling changes as clients move between access points.

Answer

VXLAN

Answer

OTV

Answer

MPLS

Question 19

What is the default update interval for a Cisco IOS-XE telemetry subscription when using update-policy periodic without specifying a value?

Accepted Answer

10000 milliseconds. The default periodic interval is 10000 milliseconds (10 seconds) if not explicitly configured.

Answer

1000 milliseconds

Answer

5000 milliseconds

Answer

The command requires a value; there is no default.

Question 20

A network engineer runs the following command on Switch SW1:

SW1# show dtp interface gi0/1

DTP information on GigabitEthernet0/1:
  DTP:                      Enabled
  DTP mode:                 Desirable
  DTP negotiate:            TRUE
  DTP status:               Trunk
  DTP trunk status:         Trunking
  DTP timer:                30
  DTP max-age:              2
  DTP encapsulation:        802.1q
  DTP refresh rate:         Both
  DTP requests:             10
  DTP errors:               0

Based on this output, what can be concluded?

Accepted Answer

The interface will not form a trunk unless the neighbor is set to trunk or desirable.. The output shows DTP is enabled, mode is 'Desirable', and the interface is already trunking with 802.1q encapsulation. Option A is incorrect because the interface is trunking, not in access mode. Option B is incorrect because dynamic desirable can form a trunk with dynamic auto as well as trunk or desirable modes; the statement that it 'will not form a trunk unless the neighbor is set to trunk or desirable' is false. Option C is incorrect because encapsulation is 802.1q, not ISL. Option D is incorrect because DTP is enabled. Since all provided options are incorrect, no correct conclusion can be selected from the given choices.

Answer

The interface is in access mode.

Answer

The interface is using ISL encapsulation.

Answer

DTP is disabled on this interface.