CCNP Mock Exam 81 — 25 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: MGMT-CLASS (match-all)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: access-group name MGMT-ACL
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 80 packets, 4000 bytes; actions:
          transmit
        exceeded 15 packets, 750 bytes; actions:
          drop
        violated 5 packets, 250 bytes; actions:
          drop

Class-map: class-default (match-any)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 200 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

Management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.. The output shows that the CoPP-POLICY policy map is applied to the control plane in the input direction. For the MGMT-CLASS class, the policer has a CIR of 32000 bps, and the counters show 15 packets exceeded and 5 packets violated, both with a drop action. This confirms that some management traffic is being dropped because it exceeds the configured rate, making option A correct.

Answer

All management traffic is being transmitted without drops.

Answer

The policer is configured in the output direction.

Answer

The class-default is dropping packets.

Question 2

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

Accepted Answer

Define a flow record that matches the specific application using NBAR or an ACL, and apply a flow monitor with a sampler rate to reduce CPU impact.. Flexible NetFlow allows you to define a flow record that matches specific application traffic using NBAR or an ACL, and applying a flow monitor with a sampler rate reduces the number of packets processed, minimizing CPU impact. This approach targets only the desired traffic without the overhead of monitoring all flows, making it the most efficient method for the engineer's goal.

Answer

Enable NetFlow on all interfaces and export all flows to the collector, then filter at the collector.

Answer

Use SNMP to poll interface counters and calculate the bandwidth used by the application.

Answer

Configure port mirroring (SPAN) to send all traffic to an external probe for analysis.

Question 3

Drag and drop the steps of DMVPN phase 2 spoke-to-spoke tunnel establishment into the correct order, from first to last.

Accepted Answer

Spoke registers with hub via NHRP. In DMVPN phase 2, each spoke first registers with the hub via mGRE and NHRP. When a spoke wants to reach another spoke, it sends an NHRP Resolution Request to the hub. The hub forwards the request to the destination spoke, which replies with its real (non-NBMA) address. The source spoke then initiates a direct mGRE tunnel to the destination spoke, and finally the spokes exchange routing information over the direct tunnel.

Question 4

Drag and drop the steps of VNF scaling up and scaling out steps into the correct order, from first to last.

Accepted Answer

VNFM detects performance threshold breach. Scaling up (vertical) or scaling out (horizontal) begins with the VNFM monitoring performance metrics and detecting a threshold breach. The VNFM then notifies the NFVO of the scaling requirement. The NFVO authorizes the scaling action. The VNFM then coordinates with the VIM to allocate additional resources (scale up) or instantiate new VNF instances (scale out). Finally, the VNFM updates the VNF configuration to use the new resources or instances.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.10       192.168.1.10       ---                ---
--- 203.0.113.11       192.168.1.11       ---                ---
tcp 203.0.113.10:1024 192.168.1.10:1024  198.51.100.5:80    198.51.100.5:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing static NAT for two internal hosts.. The output shows two entries with '---' for protocol, indicating static NAT translations that map inside local addresses (192.168.1.10, 192.168.1.11) to inside global addresses (203.0.113.10, 203.0.113.11). The third entry is a dynamic translation for TCP traffic, but the presence of static entries confirms that static NAT is configured for at least two internal hosts. Therefore, option A is correct.

Answer

The router is performing dynamic NAT for all translations.

Answer

The router is performing Port Address Translation (PAT) for all translations.

Answer

The router is translating outside global addresses to inside local addresses.

Question 6

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255 to prevent routing loops, which is a hard limit enforced by the protocol. This value is configurable via the 'metric maximum-hops' command under the EIGRP process, but the absolute maximum is 255. Unlike distance-vector protocols like RIP, EIGRP is an advanced distance-vector protocol that uses the Diffusing Update Algorithm (DUAL) for loop avoidance, but the hop count serves as a final safety mechanism.

Answer

15

Answer

128

Answer

Unlimited

Question 7

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

Accepted Answer

The DHCP pool is not associated with the correct VLAN interface using the network command.. The most likely cause is that the DHCP pool is not associated with the correct VLAN interface via the `network` command. Even if the `dns-server` command is correctly configured, the router will not apply that pool to clients on a different subnet. The DHCP server uses the `network` statement to match the client's subnet (derived from the interface IP) to the correct pool; if the pool's network does not match the VLAN interface's subnet, clients will receive an address from a different pool (or no pool) that lacks the correct DNS server.

Answer

The DNS server is unreachable from the DHCP server.

Answer

The ip dhcp excluded-address command is blocking the DNS server IP.

Answer

The DHCP client is configured with a static DNS server address.

Question 8

A Python script using Netmiko is written to send a command to a Cisco router:

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
    'secret': 'enable'
}

connection = ConnectHandler(**device)
connection.enable()
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()

What is the potential issue with this script?

Accepted Answer

The script lacks exception handling for authentication or connection failures, which can cause the script to crash.. The script lacks exception handling (e.g., try-except blocks) to catch authentication failures, connection timeouts, or device unreachable errors. Without this, if the device is down, credentials are wrong, or the SSH/Telnet service is unavailable, the script will crash with an unhandled exception, making it unreliable for production automation.

Answer

The script will fail because 'device_type' should be 'cisco_ios_telnet' for telnet connections.

Answer

The script will work correctly without any issues.

Answer

The script will fail because 'secret' is misspelled; it should be 'enable_secret'.

Question 9

A network engineer is designing an EIGRP network with multiple routers. The network has a core layer where all routers are fully meshed. The engineer wants to ensure that if a link fails, EIGRP converges quickly without relying on route redistribution or static routes. The engineer configures EIGRP with default timers. However, during a failure simulation, convergence takes over 15 seconds. What is the most likely reason?

Accepted Answer

The failed link was the only feasible successor for the affected routes, causing EIGRP to go into active state and query neighbors.. When the only feasible successor (FS) for a route fails, EIGRP cannot perform a local recomputation and must transition the route to the active state. It then sends query packets to all neighbors to find an alternative path, which introduces significant delay due to the need to wait for replies from every neighbor in a fully meshed core. With default timers, this query/reply process can easily exceed 15 seconds, especially if any neighbor is slow to respond.

Answer

EIGRP is using passive interfaces on the core routers, preventing rapid updates.

Answer

EIGRP hold timers are set to 180 seconds by default, causing slow detection.

Answer

The engineer configured 'eigrp stub' on the core routers, which prevents query propagation.

Question 10

A company uses Cisco Catalyst Center (formerly DNA Center) for intent-based networking. After upgrading the Catalyst Center appliance, the engineer notices that some devices are unreachable via the network, but the Catalyst Center GUI shows them as 'Managed'. What is the most likely cause?

Accepted Answer

The IP address of the Catalyst Center appliance changed after the upgrade. When the Catalyst Center appliance is upgraded, its IP address may change if the upgrade process resets network configuration or if the appliance is redeployed with a new IP. Devices are managed via IP-based communication (e.g., SSH, SNMP, NETCONF), and if the Catalyst Center IP changes, devices will still show as 'Managed' in the GUI because the database retains the device state, but the devices themselves cannot be reached because they are trying to communicate with the old IP address. This mismatch causes unreachability despite the managed status.

Answer

SNMP community strings are misconfigured

Answer

Devices were reassigned to different roles

Answer

Certificate trust between devices and Catalyst Center expired

Question 11

A network engineer is configuring EIGRP on a router that connects to multiple remote sites via Frame Relay. The engineer wants to ensure that EIGRP does not form adjacencies over the Frame Relay interfaces to reduce overhead, but still wants to advertise the connected networks. The engineer applies the 'passive-interface' command to the Frame Relay interfaces. However, the remote sites stop receiving the routes. What is the most likely reason?

Accepted Answer

The 'passive-interface' command also prevents EIGRP from sending routing updates on that interface.. The 'passive-interface' command in EIGRP prevents both hello and routing updates from being sent on the specified interface. Since EIGRP relies on hello packets to form and maintain neighbor adjacencies, applying this command to the Frame Relay interfaces stops adjacency formation. Without an adjacency, no routes are exchanged, so the remote sites stop receiving the advertised networks.

Answer

The 'passive-interface' command only affects hello packets, not updates, but the remote sites are not configured correctly.

Answer

The engineer should use the 'neighbor' command under the EIGRP process to specify the remote routers.

Answer

The remote sites are using a different EIGRP autonomous system number.

Question 12

Consider this AAA configuration:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default stop-only group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
tacacs-server host 10.0.0.2 key SecretKey

What is the effect of the accounting command?

Accepted Answer

Accounting records are sent to TACACS+ only when the exec session ends.. The `aaa accounting exec default stop-only group tacacs+` command configures TACACS+ accounting to send records only when an exec session ends. The `stop-only` keyword explicitly instructs the device to generate a single accounting record at session termination, not at session start. This is a standard TACACS+ accounting feature used to minimize network overhead while still capturing session duration and resource usage.

Answer

Accounting records are sent to TACACS+ at both session start and end.

Answer

Accounting records are sent to TACACS+ only at session start.

Answer

Accounting is disabled because the command uses 'stop-only' incorrectly.

Question 13

Which TWO statements are true about RESTCONF and NETCONF in a Cisco IOS XE environment? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods (GET, POST, PUT, DELETE) and supports JSON and XML encoding.. RESTCONF is designed to use standard HTTP methods (GET, POST, PUT, DELETE, PATCH) for CRUD operations on YANG-defined data, and it supports both JSON and XML encoding formats. This aligns with its goal of providing a simpler, web-friendly interface compared to NETCONF.

Answer

RESTCONF supports the candidate datastore for editing configurations.

Answer

NETCONF uses HTTP as its transport protocol.

Answer

RESTCONF and NETCONF both support JSON and XML encoding.

Question 14

A REST API call is made to Cisco DNA Center to get the list of network devices:

GET /dna/intent/api/v1/network-device
Headers:
  X-Auth-Token: <token>

The response is:

{
  "response": [
    {
      "id": "123456",
      "managementIpAddress": "10.10.10.1",
      "platformId": "C9300-24P",
      "role": "ACCESS"
    }
  ],
  "version": "1.0"
}

What does this response indicate?

Accepted Answer

The response contains a single device with management IP 10.10.10.1 and role ACCESS.. The response is a valid JSON object from Cisco DNA Center's REST API. The 'response' array contains one device object with fields 'id', 'managementIpAddress', 'platformId', and 'role'. The 'version' field is informational and correctly present. Therefore, option A correctly interprets the response as containing a single device with management IP 10.10.10.1 and role ACCESS.

Answer

The response indicates an error because the 'version' field is missing a value.

Answer

The response contains multiple devices, but only one is shown due to pagination.

Answer

The response requires authentication because the token is missing.

Question 15

Given the following BGP configuration on a Cisco IOS-XE device:

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.0.0.2 remote-as 65002
 neighbor 10.0.0.2 update-source Loopback0
 neighbor 10.0.0.2 ebgp-multihop 2
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.252

What is the purpose of the 'ebgp-multihop 2' command?

Accepted Answer

It allows the BGP session to be established even if the neighbor is not directly connected, with a maximum of 2 hops.. EBGP multihop allows the BGP session to be established between non-directly connected peers. The number specifies the maximum TTL for the BGP packets. Here, TTL=2 allows one intermediate hop.

Answer

It sets the BGP session to use two TCP connections for redundancy.

Answer

It enables BGP to use two different paths to reach the neighbor.

Answer

It is required because the neighbor is configured with a loopback interface as the update source.

Question 16

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

Accepted Answer

Configure 'monitor session 1 type erspan-source' and then 'source vlan 100' and 'destination ip 192.168.1.100'.. ERSPAN (Encapsulated Remote SPAN) is used to send mirrored traffic across a routed network by encapsulating the mirrored packets in GRE (Generic Routing Encapsulation) and sending them to a destination IP address. Option A correctly configures an ERSPAN source session with 'monitor session 1 type erspan-source', specifies the source VLAN 100, and sets the destination IP address of the monitoring station (192.168.1.100), which allows the traffic to traverse Layer 3 boundaries.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination remote vlan 999'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24' and then 'monitor session 1 encapsulation replicate'.

Question 17

Consider the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 2 source interface GigabitEthernet1/0/3 rx
monitor session 2 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.. The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.

Answer

Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.

Answer

The configuration is invalid because the destination interface must be in trunk mode.

Question 18

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network broadcast
 ip ospf priority 0
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of setting the OSPF priority to 0 on this interface?

Accepted Answer

The router will never become the DR or BDR on this segment.. Setting the OSPF priority to 0 on an interface prevents the router from participating in the Designated Router (DR) and Backup Designated Router (BDR) election process. This means the router will never become the DR or BDR on that broadcast segment, as per RFC 2328. It will instead remain a DROTHER and only form full adjacencies with the DR and BDR, not with other DROTHER routers.

Answer

The router will have a higher chance of becoming the DR.

Answer

The router will only form adjacencies with other routers that have priority 0.

Answer

The router will use a longer hello interval.

Question 19

What is the default STP hello timer value in seconds?

Accepted Answer

2 seconds. The default STP hello timer is 2 seconds, as defined by IEEE 802.1D. This timer controls how often a root bridge sends configuration BPDUs to maintain the spanning-tree topology. The hello timer value is used in conjunction with the forward delay and max age timers to ensure loop-free convergence.

Answer

1 second

Answer

5 seconds

Answer

10 seconds

Question 20

Examine this OSPF configuration on router R4:

interface GigabitEthernet0/0
 ip address 172.16.1.4 255.255.255.0
 ip ospf 1 area 0
 ip ospf cost 50
!
router ospf 1
 router-id 4.4.4.4
 network 172.16.0.0 0.0.255.255 area 0

What is the OSPF cost of the GigabitEthernet0/0 interface?

Accepted Answer

50. The OSPF cost of an interface is determined by the `ip ospf cost` command, which explicitly overrides the default cost calculation based on reference bandwidth. Since R4's GigabitEthernet0/0 interface has `ip ospf cost 50` configured under it, the cost is set to 50 regardless of the interface bandwidth or reference bandwidth settings.

Answer

1 (default for GigabitEthernet)

Answer

100 (derived from reference bandwidth 100 Mbps / 1 Gbps)

Answer

10 (derived from reference bandwidth 1000 Mbps / 100 Mbps)