CCNP Mock Exam 84 — 25 Questions

Question 1

A network engineer is using Python with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script connects successfully but receives an RPC error when trying to apply a candidate configuration. The engineer inspects the device capabilities and sees 'urn:ietf:params:netconf:capability:candidate:1.0' is NOT listed. What is the most likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device does not support the NETCONF candidate datastore, so candidate configuration operations cannot be used.. The NETCONF capabilities exchange advertises supported features. The candidate datastore capability indicates whether the device supports a candidate configuration that can be edited and committed. Without it, operations targeting the candidate datastore will fail. The engineer should verify capabilities before attempting candidate-based workflows and use the running datastore instead.

Answer

The device requires a YANG model to be loaded before candidate configuration can be used.

Answer

The NETCONF session must use SSH version 2, but the device is using SSH version 1.

Answer

The ncclient library version is incompatible with the IOS XE NETCONF implementation.

Question 2

A network administrator is configuring a Cisco switch port that connects to an IP phone and a PC. The phone must tag voice traffic with VLAN 200, and the PC must send untagged traffic on VLAN 100. Which configuration is required on the switch port?

Accepted Answer

switchport mode access; switchport access vlan 100; switchport voice vlan 200. The correct configuration uses an access port with a data VLAN and a voice VLAN. The voice VLAN feature allows the switch to instruct the IP phone to tag voice traffic with the specified VLAN, while the PC's untagged traffic is placed in the access VLAN. This provides separation of voice and data traffic and is the typical deployment for Cisco IP phones.

Answer

switchport mode access; switchport access vlan 200; switchport voice vlan 100

Answer

switchport mode trunk; switchport trunk encapsulation dot1q; switchport trunk allowed vlan 100,200

Answer

switchport mode trunk; switchport trunk native vlan 100; switchport trunk allowed vlan 200

Question 3

A security architect is evaluating MACsec on a Cisco Catalyst switch uplink between two buildings. The requirement is to encrypt all Layer 2 traffic on the link with minimal configuration and use a standards-based key agreement. Which statement correctly describes how MACsec should be deployed on this link?

Accepted Answer

MACsec must be configured with a pre-shared CAK/CKN pair on both switches, and MKA uses this pair to derive session keys.. MACsec secures point-to-point Ethernet links using MKA to negotiate encryption keys. A static CAK and CKN configured on both ends lets MKA derive the SAK that encrypts each frame, requiring no external authentication server. This is the standard, minimal-configuration approach for a switch uplink, and MACsec encrypts the full Ethernet frame, not just IP payloads.

Answer

MACsec can be enabled only on routed ports and is incompatible with switch-to-switch trunk links carrying multiple VLANs.

Answer

MACsec encrypts only the payload of IP packets, leaving the Ethernet header visible for switching.

Answer

MACsec requires 802.1X EAP-TLS authentication of both switches before any frame encryption can occur.

Question 4

A network administrator is configuring a Cisco IOS router to act as a DHCP server for a subnet. The administrator wants to ensure that the router assigns IP addresses to clients and also provides them with the IP address of a TFTP server for configuration files. Which DHCP option should the administrator configure to provide the TFTP server address?

Accepted Answer

Option 66. DHCP option 66 is the standard option for specifying the TFTP server name or IP address. Configuring this option in the DHCP pool allows clients to learn the TFTP server address, which they can use to download configuration files. This is the correct choice for providing the TFTP server address to DHCP clients.

Answer

Option 67

Answer

Option 43

Answer

Option 150

Question 5

A network administrator is using Cisco SD-WAN to manage a large enterprise network. They want to automate the deployment of a new branch site using a template. Which component of Cisco SD-WAN is responsible for pushing the configuration to the WAN edge devices?

Accepted Answer

vManage. In Cisco SD-WAN, vManage is the management plane component that centralizes configuration and policy. It stores templates and orchestrates their deployment to WAN edge devices. The other components have different roles: vBond handles orchestration and NAT traversal, vSmart manages control plane policies, and vAnalytics provides reporting. Only vManage is responsible for pushing configurations.

Answer

vSmart

Answer

vAnalytics

Answer

vBond

Question 6

A network architect is designing a Cisco SD-WAN fabric using vManage, vSmart, and vBond controllers. Which two statements accurately describe the control plane and onboarding behavior in this architecture? (Choose two.)

Accepted Answer

The vBond controller authenticates and orchestrates initial connectivity between WAN Edge devices and the controllers.. In Cisco SD-WAN, vBond handles authentication and orchestration of initial control connections, while vSmart is the control plane that uses OMP to distribute routing and policy information. vManage is management plane only, OSPF is not the overlay routing protocol, and vBond generally needs public reachability for discovery.

Answer

The vBond controller must be deployed behind a NAT device and cannot have a public IP address.

Answer

WAN Edge devices must run OSPF in the overlay to exchange routes with each other.

Answer

The vManage controller forwards user data traffic between WAN Edge devices in the data plane.

Question 7

A network automation team is evaluating configuration management tools. They need a tool that uses a declarative, agentless architecture and communicates over SSH to push configuration to Cisco IOS XE devices. Which tool best fits these requirements?

Accepted Answer

Ansible with the ios_config module. Ansible is designed as an agentless automation tool that connects over SSH and uses declarative YAML playbooks. The ios_config module is purpose-built for Cisco IOS configuration management. This combination meets all stated requirements: declarative, agentless, and SSH-based. Other tools either require agents or add architectural complexity that makes them less suitable for this scenario.

Answer

Puppet with the Cisco IOS module

Answer

SaltStack with the napalm proxy minion

Answer

Chef Infra with the Cisco IOS cookbook

Question 8

A Cisco Catalyst 9500 switch in a data center is configured with IP Source Guard on an access port where a server is connected. The server has a static IP address of 10.10.10.50 and MAC address 00:11:22:33:44:55. The network administrator has configured a static IP source binding using the command 'ip source binding 0011.2233.4455 vlan 10 10.10.10.50 interface GigabitEthernet1/0/1'. However, the server cannot communicate through the switch. What is the most likely cause?

Accepted Answer

IP Source Guard requires DHCP snooping to be enabled on the VLAN even when static bindings are used.. IP Source Guard uses the DHCP snooping binding table to validate source IP and MAC addresses on a port. Static bindings can be added manually, but DHCP snooping must still be enabled on the VLAN to activate the binding table and allow IP Source Guard to filter traffic. Without DHCP snooping, the static binding is not effective, and the switch may drop legitimate traffic.

Answer

IP Source Guard only works on trunk ports, not access ports.

Answer

The static IP source binding must be configured with the MAC address in the format xx:xx:xx:xx:xx:xx.

Answer

The server must use DHCP to obtain its IP address for IP Source Guard to permit traffic.

Question 9

A network architect is designing a new branch office that must run Cisco SD-WAN with a single WAN transport and requires all control-plane and data-plane traffic to be encrypted by default using DTLS/TLS tunnels managed by the controller. Which SD-WAN component is responsible for establishing the secure control connections and distributing route and policy information to the branch edge devices?

Accepted Answer

vSmart controller. In Cisco SD-WAN, the control plane is handled by the vSmart controller, which peers with each edge device over DTLS/TLS and uses OMP to advertise TLOCs, routes, and centralized policy. The branch edge in this design needs those control connections, so the vSmart controller is the component that satisfies the requirement.

Answer

vAnalytics engine

Answer

vManage NMS

Answer

vBond orchestrator

Question 10

A network engineer is deploying a new Cisco SD-WAN fabric using Cisco vManage, vSmart, and vBond controllers. The engineer must ensure that the control plane is secure and resilient. Which two statements are true regarding the roles of these controllers? (Choose two.)

Accepted Answer

vSmart distributes control plane policies and routing information to WAN edge devices using OMP.. In Cisco SD-WAN, vBond orchestrates the control plane by authenticating and validating controllers and WAN edge devices, facilitating NAT traversal. vSmart distributes control plane policies and routing information using OMP. vManage is the management plane for configuration and monitoring. These roles are distinct and critical for a secure and resilient fabric.

Answer

vBond maintains the routing table and makes path selection decisions for the overlay.

Answer

vSmart is responsible for the initial device authentication and NAT traversal.

Answer

vManage is responsible for authenticating WAN edge devices and distributing encryption keys.

Question 11

A network architect is evaluating Cisco SD-WAN for a company with 50 branch sites and two data centers. The design must provide application-aware routing, direct internet access at branches, and centralized policy management. Which Cisco SD-WAN component is responsible for distributing policies and reachability information to the branch devices?

Accepted Answer

vSmart. The vSmart controller is the control plane component of Cisco SD-WAN, responsible for distributing policies and reachability information using OMP. It enables centralized policy management and application-aware routing by sharing routing and policy data with all SD-WAN devices in the overlay.

Answer

vBond

Answer

vManage

Answer

vEdge or cEdge router

Question 12

A network engineer is deploying MACsec on a Cisco Catalyst switch to secure point-to-point links between the access and distribution layers. The design must ensure data confidentiality and integrity on the wire, and must use a key agreement mechanism that supports dynamic key exchange. Which TWO of the following are required to meet these requirements? (Choose two.)

Accepted Answer

Configure MACsec (802.1AE) on the point-to-point interfaces to provide data confidentiality and integrity.. MACsec (802.1AE) supplies Layer 2 encryption and integrity, while MKA provides the dynamic key agreement, peer discovery, and key rotation. Both must be configured on the point-to-point links to meet the confidentiality, integrity, and dynamic key exchange requirements. IPsec, 802.1X, and private VLANs do not deliver Layer 2 link encryption with MKA.

Answer

Configure a private VLAN between the access and distribution switches to isolate traffic.

Answer

Configure 802.1X with EAP-TLS on the inter-switch links to establish the encryption keys.

Answer

Configure IPsec transport mode between the switches to encrypt all Layer 2 traffic.

Question 13

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) and needs to ensure that the management interface is reachable from the wired network. Which interface on the WLC is used for out-of-band management and is typically assigned an IP address on the management VLAN?

Accepted Answer

Management interface. The management interface on a Cisco WLC is used for out-of-band management, providing administrative access via GUI, CLI, and RADIUS. It is assigned an IP address on the management VLAN and is critical for controller reachability. Dynamic, AP-manager, and virtual interfaces serve different purposes.

Answer

Virtual interface

Answer

Dynamic interface

Answer

AP-manager interface

Question 14

A network engineer is using the Python 'requests' library to interact with a Cisco DNA Center controller. The engineer wants to retrieve a list of all network devices. Which HTTP method and URL should be used?

Accepted Answer

GET https://<dnac-ip>/dna/intent/api/v1/network-device. Cisco DNA Center's Intent API provides RESTful endpoints for managing network devices. To retrieve a list of devices, a GET request to '/dna/intent/api/v1/network-device' is used. This returns JSON data with device details. Other HTTP methods like POST, PUT, or DELETE are for creating, updating, or deleting resources. The correct base path is essential; omitting '/dna/intent' leads to failure.

Answer

POST https://<dnac-ip>/dna/intent/api/v1/network-device

Answer

GET https://<dnac-ip>/api/v1/network-device

Answer

PUT https://<dnac-ip>/dna/intent/api/v1/network-device

Question 15

A network engineer is implementing VXLAN with Cisco SD-Access. The engineer needs to ensure that the fabric supports Layer 2 and Layer 3 traffic between endpoints in different subnets. Which two components are required in the VXLAN data plane to achieve this? (Choose two.)

Accepted Answer

VXLAN Network Identifier (VNI). In VXLAN, the data plane relies on VTEPs to encapsulate and decapsulate traffic, and VNIs to identify the overlay segments. These two components are essential for forwarding Layer 2 and Layer 3 traffic across the underlay. LISP is a control plane protocol, IS-IS is an underlay routing protocol, and SGT is for policy enforcement. Therefore, VTEP and VNI are the correct choices for the data plane.

Answer

Locator/ID Separation Protocol (LISP)

Answer

Cisco TrustSec Security Group Tag (SGT)

Answer

Intermediate System to Intermediate System (IS-IS)

Question 16

A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints in the same virtual network can communicate with each other even when they attach to different fabric edge nodes, while endpoints in different virtual networks remain isolated. Which control-plane component is responsible for registering endpoint IP-to-location mappings and answering fabric edge node queries?

Accepted Answer

Fabric control-plane node. In Cisco SD-Access, the fabric control-plane node provides the LISP-based mapping database that stores endpoint ID-to-RLOC associations. Edge nodes register local endpoints and query this node to learn where remote endpoints reside, which enables communication between endpoints in the same virtual network across different edge nodes while preserving isolation between virtual networks.

Answer

Fabric intermediate node

Answer

Cisco DNA Center appliance

Answer

Fabric edge node

Question 17

A network technician is troubleshooting a switch that is experiencing high CPU utilization. The technician runs the command 'show processes cpu sorted' and notices that the process 'ARP Input' is consuming a large percentage of CPU. Which action should the technician take to mitigate this issue?

Accepted Answer

Implement ARP rate limiting or ARP policing on the affected interfaces.. High CPU utilization from the ARP Input process is typically caused by a large number of ARP packets being sent to the switch's CPU. Implementing ARP rate limiting or policing on interfaces can control the rate at which ARP packets are processed, preventing the CPU from being overwhelmed. Other options like static ARP entries or increasing cache timeout do not address the volume of ARP traffic. Enabling DAI can worsen the CPU load. Therefore, ARP rate limiting is the most effective mitigation.

Answer

Enable Dynamic ARP Inspection (DAI) on all VLANs.

Answer

Configure a static ARP entry for the affected hosts.

Answer

Increase the ARP cache timeout to reduce ARP requests.

Question 18

An engineer is deploying a new branch office that must run multiple isolated routing domains on a single Cisco IOS-XE router. Each department requires its own routing table and overlapping IP addressing. The engineer plans to use VRF-Lite. Which configuration step is required to ensure that routes from one VRF do not leak into another?

Accepted Answer

Assign the VRF to the appropriate interfaces and configure a separate routing protocol instance within each VRF.. VRF-Lite achieves isolation by binding interfaces to a VRF and running a separate routing protocol instance inside each VRF. This creates independent routing and forwarding tables, allowing overlapping IP addresses and preventing route leakage. RDs, RTs, and MPLS are not needed on a single device; they are relevant only when extending VRFs across a provider core.

Answer

Enable MPLS LDP on all interfaces and redistribute the global routing table into each VRF.

Answer

Configure a single OSPF process and use different area IDs for each department.

Answer

Associate each VRF with a unique route distinguisher (RD) and route target (RT) in the BGP configuration.

Question 19

A network engineer is deploying a new branch office that requires a WAN connection with built-in encryption and dynamic multipoint VPN capabilities. The engineer wants to use a Cisco technology that supports spoke-to-spoke communication without requiring traffic to traverse the hub. Which technology should be implemented?

Accepted Answer

DMVPN. DMVPN is designed to provide dynamic multipoint VPN connectivity, allowing spokes to establish direct tunnels with each other as needed. It combines mGRE, NHRP, and IPsec to deliver scalable, encrypted, and dynamic branch connectivity. This eliminates the need to route spoke-to-spoke traffic through the hub, improving latency and reducing hub bandwidth consumption.

Answer

IPsec VPN

Answer

GRE tunnel

Answer

MPLS L3VPN

Question 20

A network administrator is configuring a Cisco Catalyst 9300 switch stack using StackWise-480 technology. The administrator wants to ensure that if the active switch fails, the standby switch takes over with minimal disruption. Which statement describes the behavior of the stack during a failover?

Accepted Answer

The standby switch becomes active, and the stack retains its configuration and forwarding state.. StackWise-480 provides high availability by maintaining a standby switch that is ready to take over if the active switch fails. The stack retains its configuration and forwarding state, allowing for minimal disruption. The standby switch becomes active, and the member switches continue to operate without a full reload.

Answer

The stack splits into multiple independent switches, each with its own configuration.

Answer

The master switch is elected based on the highest MAC address, and all other switches reload.

Answer

All switches in the stack reload and then elect a new active switch.