CCNP Mock Exam 82 — 25 Questions

Question 1

A network engineer is comparing the characteristics of agent-based and agentless automation tools for managing Cisco IOS XE devices. Which two statements accurately describe agentless automation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Agentless tools often rely on APIs or CLI scraping to push configuration changes.. Agentless automation tools, such as Ansible, do not require software on the managed devices. They communicate over standard protocols like SSH or HTTPS and use APIs or CLI to push changes. This makes them easy to deploy and suitable for multi-vendor environments. The other statements incorrectly attribute agent-based characteristics or overstate capabilities. The correct answers are the ones that accurately reflect how agentless tools operate.

Answer

Agentless tools provide real-time telemetry streaming from devices without additional configuration.

Answer

Agentless tools are unable to manage devices from multiple vendors.

Answer

Agentless tools require a persistent agent to be installed on each managed device.

Question 2

A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch router (vEdge) is not forming a control connection with the vSmart controller. The engineer verifies that the vEdge has IP reachability to the vSmart controller's public IP address on port 12346. Which additional step is required for the control connection to be established?

Accepted Answer

The vEdge must have a valid certificate installed and be authenticated by the vBond orchestrator.. For a vEdge to establish a control connection with a vSmart controller, it must first authenticate with the vBond orchestrator using its certificate. This process provides the vEdge with the necessary information, including the vSmart's IP address and credentials to establish the DTLS control connection. IP reachability alone is insufficient.

Answer

The vEdge must have OSPF configured to advertise its loopback interface to the vSmart controller.

Answer

The vEdge must be configured with a static route to the vSmart controller's private IP address.

Answer

The vEdge must be configured with the vSmart controller's IP address as its default gateway.

Question 3

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote users. The requirement is to use a protocol that supports both IKEv2 and native IPv6 transport, and that can provide per-user policy enforcement. Which technology should the administrator implement?

Accepted Answer

FlexVPN with IKEv2 and per-user attributes.. FlexVPN is the correct choice because it is built on IKEv2 and supports IPv6 transport. It also provides per-user policy enforcement through authorization attributes, making it ideal for a remote access VPN headend. Other options either do not support IKEv2, are designed for site-to-site topologies, or lack per-user policy enforcement.

Answer

Dynamic Multipoint VPN (DMVPN) with mGRE and NHRP.

Answer

GET VPN with Group Domain of Interpretation (GDOI).

Answer

SSL VPN with Cisco AnyConnect.

Question 4

A network engineer is implementing a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate using basic authentication over HTTPS and retrieve the configured hostname. Which Python code snippet correctly performs this task using the requests library?

Accepted Answer

import requests
url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)
hostname = response.json()['Cisco-IOS-XE-native:hostname']. The correct RESTCONF request must use the proper URL for the hostname leaf, set the Accept header to 'application/yang-data+json', provide basic authentication, and parse the response using the fully qualified key 'Cisco-IOS-XE-native:hostname'. The other options use the wrong URL, wrong header, wrong JSON key, or omit authentication.

Answer

import requests
url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)
hostname = response.json()['name']

Answer

import requests
url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, verify=False)
hostname = response.json()['Cisco-IOS-XE-native:hostname']

Answer

import requests
url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Content-Type': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)
hostname = response.json()['hostname']

Question 5

A network engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 switches. Hosts in VLAN 100 on different leaf switches cannot communicate, even though the EVPN control plane shows the MAC addresses. The engineer suspects a problem with the VXLAN data plane. Which command should be used to verify the VXLAN tunnel endpoints (VTEPs) and their status?

Accepted Answer

show nve peers. The 'show nve peers' command is used to verify the status of VXLAN tunnel endpoints and their peering relationships. It provides details such as the remote VTEP IP, VNI, and tunnel state. If the tunnel is down, this command helps identify the issue, which is critical when EVPN control plane information is present but data plane connectivity is failing.

Answer

show vxlan interface

Answer

show bgp l2vpn evpn

Answer

show ip arp vrf all

Question 6

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. The engineer needs to ensure that the data plane is secure and that tunnels are established between WAN edge devices. Which component is responsible for orchestrating the control plane and distributing policies to WAN edge devices?

Accepted Answer

vSmart controller. In Cisco SD-WAN, the vSmart controller is the control plane component. It uses the Overlay Management Protocol (OMP) to distribute routing information and policies to WAN edge devices. The vBond orchestrator handles authentication and discovery, while vManage provides management. The vSmart controller is specifically responsible for orchestrating the control plane and policy distribution.

Answer

vManage

Answer

vBond orchestrator

Answer

WAN edge device

Question 7

A network engineer is new to automation and wants to start by writing a simple Python script to interact with a Cisco IOS XE device using RESTCONF. Which Python library is specifically designed to simplify sending HTTP requests to RESTCONF APIs?

Accepted Answer

Requests. The Requests library is designed for making HTTP requests in Python, which is exactly what RESTCONF uses. It abstracts the complexities of HTTP and allows easy interaction with RESTCONF APIs, including authentication and data formatting. Other libraries like Netmiko and Ncclient are for SSH and NETCONF, respectively, and are not suited for RESTCONF. Paramiko is for SSH and not HTTP.

Answer

Netmiko

Answer

Ncclient

Answer

Paramiko

Question 8

A network engineer is writing a Python script to retrieve the operational state of a GigabitEthernet interface from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 but receives a 406 Not Acceptable response. The device supports RESTCONF and the interface exists. Which HTTP header should the engineer add to the request to resolve this error?

Accepted Answer

Accept: application/yang-data+json. The 406 Not Acceptable status code indicates that the server cannot produce a response matching the Accept header. In RESTCONF, the client must specify the desired media type, such as application/yang-data+json, to retrieve data in JSON. Without it, the server may reject the request. Adding the correct Accept header resolves the negotiation issue.

Answer

Accept: application/xml

Answer

Authorization: Basic YWRtaW46YWRtaW4=

Answer

Content-Type: application/yang-data+json

Question 9

A network administrator is configuring a Cisco IOS router to protect the control plane from excessive CPU utilization caused by malicious traffic. The administrator wants to rate-limit specific types of traffic destined to the route processor while allowing all other traffic to pass without restriction. Which feature should be configured?

Accepted Answer

Control Plane Policing. Control Plane Policing applies a QoS policy to the control plane interface, allowing administrators to classify and rate-limit specific traffic types destined to the route processor while permitting other traffic. This directly addresses CPU protection from malicious floods without affecting transit traffic.

Answer

Policy-Based Routing

Answer

Management Plane Protection

Answer

Control Plane Protection

Question 10

A network engineer needs to verify the performance of a WAN link between two Cisco routers. The engineer configures an IP SLA operation on Router A that sends ICMP echo requests to Router B every 60 seconds and stores the results. After a week, the engineer checks the results and finds that the operation has been running successfully, but no history data is available. What is the most likely reason for the lack of history data?

Accepted Answer

The IP SLA operation was not configured to collect history statistics.. IP SLA operations only collect history statistics when explicitly configured with the 'history statistics' command. Without this, only the most recent results are available. The engineer saw successful results, indicating the operation ran, but no history was stored because the history collection was not enabled. Enabling history statistics allows the router to maintain a record of past operations for analysis.

Answer

The IP SLA responder was not enabled on Router B.

Answer

The IP SLA operation was not configured with a schedule.

Answer

The IP SLA operation was configured with the wrong frequency.

Question 11

A network engineer is designing a QoS policy for a WAN edge router. The router must prioritize voice traffic with a strict priority queue and ensure that call signaling traffic is not starved. Which queuing mechanism should the engineer configure to meet these requirements?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is designed to provide strict priority queuing for delay-sensitive traffic like voice, while still offering bandwidth guarantees for other classes such as call signaling. The priority queue is policed to prevent starvation of other queues, ensuring that signaling traffic gets its share of bandwidth.

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO) queuing

Answer

Weighted Random Early Detection (WRED)

Question 12

A network engineer is deploying a new Cisco Catalyst switch and needs to implement a loop prevention mechanism that allows rapid convergence and supports multiple VLANs. The engineer decides to use Rapid PVST+. Which statement accurately describes a characteristic of Rapid PVST+ operation?

Accepted Answer

It provides separate spanning-tree instances for each VLAN and uses Rapid Spanning Tree Protocol (RSTP) enhancements for faster convergence.. Rapid PVST+ is a Cisco enhancement that runs a separate RSTP instance per VLAN. It uses RSTP's rapid convergence features like edge ports and proposal/agreement, while maintaining per-VLAN topology. This allows for fast failover and load balancing across VLANs. The other options mischaracterize its operation, such as claiming a single instance or lack of interoperability.

Answer

It requires all switches in the network to be configured with the same bridge priority to ensure consistent root election.

Answer

It uses a single spanning-tree instance for all VLANs, which simplifies configuration but reduces flexibility.

Answer

It is compatible only with switches running IEEE 802.1D STP and cannot interoperate with RSTP devices.

Question 13

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against excessive ARP traffic. The engineer applies the following policy:

policy-map COPP-POLICY
 class ARP-CLASS
  police 8000 conform-action transmit exceed-action drop

After applying the service-policy to the control-plane, the engineer notices that legitimate ARP requests are being dropped during peak hours. Which action should the engineer take to resolve this issue while maintaining protection?

Accepted Answer

Increase the police rate to a higher value that accommodates peak ARP traffic while still limiting excessive bursts.. CoPP police rates must be tuned to allow legitimate control-plane traffic while blocking excess. A rate of 8000 bps is insufficient for ARP during peak hours, so increasing the rate to a realistic peak value resolves drops while preserving protection. Changing exceed-action to transmit removes protection, moving the policy to the data plane is ineffective, and splitting classes without raising the rate does not fix the underlying issue.

Answer

Add a class-map that matches ARP replies and apply a separate police rate to that class.

Answer

Remove the service-policy from the control-plane and apply it to the data plane instead.

Answer

Change the exceed-action to transmit so that all ARP packets are allowed through.

Question 14

A network engineer is configuring QoS on a Cisco IOS switch. The engineer needs to mark packets coming from a specific server with DSCP EF (46) and ensure that this marking is trusted throughout the network. Which command should be used to trust the DSCP markings on the interface connected to the server?

Accepted Answer

mls qos trust dscp. To trust DSCP markings on an interface, the correct command is 'mls qos trust dscp'. This tells the switch to accept the DSCP value in incoming packets and use it for QoS processing. Since the server is already marking its traffic with DSCP EF, this command ensures that the marking is preserved and honored throughout the network, preventing the switch from re-marking the packets.

Answer

mls qos trust cos

Answer

mls qos trust ip-precedence

Answer

mls qos map cos-dscp 0 8 16 24 32 40 48 56

Question 15

A network architect is designing a Cisco SD-Access fabric. The customer requires that the fabric support both IPv4 and IPv6 traffic natively without the use of any translation mechanisms. Which statement describes the correct configuration approach?

Accepted Answer

The fabric overlay can be configured as dual-stack, supporting both IPv4 and IPv6, while the underlay remains IPv4.. Cisco SD-Access supports a dual-stack overlay, allowing both IPv4 and IPv6 to be carried natively over an IPv4 underlay. The VXLAN data plane encapsulates Layer 2 frames, which can carry either IPv4 or IPv6 packets. The underlay can remain IPv4, as it only needs to route the VXLAN tunnel endpoints. This design meets the requirement for native IPv6 without translation. No translation mechanisms like NAT64 are needed.

Answer

The fabric underlay must be configured with IPv6 only, and the overlay can be dual-stack.

Answer

IPv6 is not supported in SD-Access; only IPv4 is supported in the overlay.

Answer

IPv6 traffic must be translated to IPv4 at the fabric edge using NAT64.

Question 16

A network engineer is configuring a switch stack with two Catalyst 9300 switches. The engineer wants to ensure that if the active switch fails, the standby switch takes over with minimal disruption. Which statement accurately describes the stack MAC address behavior during a failover?

Accepted Answer

The stack MAC address remains the same as the original active switch's MAC address unless the stack MAC persistence timer expires.. The stack MAC persistence feature keeps the original active switch's MAC address for a configurable timer (default 4 minutes). During a failover, the standby switch becomes active and continues using that MAC address if the timer has not expired. This minimizes network disruption by avoiding MAC address table updates on neighboring devices.

Answer

The stack MAC address is a virtual MAC address generated by the stack protocol and never changes.

Answer

The stack MAC address immediately changes to the new active switch's MAC address upon failover.

Answer

The stack MAC address is always the MAC address of the switch with the highest priority, regardless of failover.

Question 17

An engineer is configuring an IPsec site-to-site VPN between two Cisco IOS XE routers. Phase 1 completes successfully, but Phase 2 fails and no interesting traffic is encrypted. The engineer confirms that the ACLs on both peers mirror each other correctly. Which configuration element should be verified next to resolve the Phase 2 failure?

Accepted Answer

Verify that the transform set on both peers specifies matching encryption and integrity algorithms for Phase 2.. IPsec Phase 2 negotiation, also called quick mode, relies on matching transform sets that define the encryption and integrity algorithms for the data SA. When Phase 1 succeeds but Phase 2 fails, mismatched transform sets are a common cause. Verifying that both peers use identical transform set definitions resolves the negotiation failure.

Answer

Verify that the Diffie-Hellman group in the ISAKMP policy matches the group used in the transform set.

Answer

Verify that the crypto map sequence number is higher on the responding peer than on the initiating peer.

Answer

Verify that the ISAKMP policy on both peers uses the same pre-shared key for Phase 1 authentication.

Question 18

A network engineer is troubleshooting a Cisco SD-WAN deployment. The engineer notices that a branch site's vEdge router is not establishing control connections to the vSmart controller. The vEdge has the correct system IP and organization name. Which action should the engineer take first to verify connectivity?

Accepted Answer

Check the vEdge's configuration for the correct vBond IP address and ensure UDP port 12346 is open.. In Cisco SD-WAN, a vEdge router must first establish a control connection to the vBond orchestrator. This requires the vBond IP address to be configured and UDP port 12346 to be open. Once the vEdge authenticates with vBond, it receives the list of vSmart controllers and can then establish control connections to them. Therefore, the first troubleshooting step is to verify vBond reachability.

Answer

Ensure that the vEdge's WAN interface has a public IP address and can reach the internet.

Answer

Verify that the vSmart controller has the correct certificate and is in the whitelist.

Answer

Check the vManage GUI for the vEdge's serial number and ensure it is listed in the authorized devices.

Question 19

A network engineer is implementing VXLAN with an EVPN control plane in a Cisco Nexus data center. The requirement is to provide Layer 2 extension over a Layer 3 underlay while maintaining optimal forwarding and avoiding unknown unicast flooding. Which statement describes the role of the EVPN control plane in this VXLAN fabric?

Accepted Answer

EVPN uses MP-BGP to distribute MAC and IP reachability information, enabling the VTEPs to learn remote MAC addresses and suppress unknown unicast flooding.. EVPN with MP-BGP provides a scalable control plane for VXLAN by advertising MAC and IP reachability, which enables remote MAC learning and eliminates unknown unicast flooding. This improves efficiency and allows for optimal forwarding. The other options misattribute the control protocol or describe mechanisms that do not provide EVPN's benefits.

Answer

EVPN uses PIM-SM to build multicast trees for BUM traffic, and MAC addresses are learned only through data plane flooding.

Answer

EVPN uses a centralized SDN controller to distribute MAC addresses, and VTEPs must query the controller for every unknown destination.

Answer

EVPN relies on OSPF to flood MAC address updates to all VTEPs, ensuring that unknown unicast traffic is replicated across the fabric.

Question 20

A network engineer is using a Python script to retrieve the operational status of all interfaces on a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state but receives an HTTP 401 Unauthorized response. The engineer can successfully ping the device and has verified that the RESTCONF feature is enabled with 'restconf' in global configuration. Which action will resolve the issue?

Accepted Answer

Configure a local username with privilege level 15 and ensure the script includes valid Basic Authentication credentials.. The 401 Unauthorized response indicates that the HTTP request lacks valid authentication credentials. RESTCONF on Cisco IOS XE uses HTTP Basic Authentication by default when no AAA is configured. The engineer must create a local user with appropriate privileges and include the credentials in the request. Enabling HTTPS or adjusting ACLs does not address authentication.

Answer

Configure an ACL to permit TCP port 830 on the device to allow RESTCONF traffic.

Answer

Enable the 'ip http secure-server' command to allow HTTPS access to the RESTCONF API.

Answer

Add the 'restconf' command under the interface configuration mode for the management interface.