CCNP Mock Exam 85 — 25 Questions

Question 1

A network engineer is configuring a Cisco IOS router for NAT overload (PAT) to allow internal hosts on the 10.1.1.0/24 network to access the internet using the router's outside interface IP address. The engineer wants to ensure that all internal hosts can initiate connections and that return traffic is correctly translated. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload, with an access list permitting 10.1.1.0/24, and interfaces marked as inside and outside.. The correct configuration uses ip nat inside source list with the interface keyword and overload to translate internal addresses to the outside interface IP. This enables PAT, allowing multiple internal hosts to share the single public IP. The access list must permit the internal subnet, and interfaces must be correctly marked as inside and outside for NAT to operate.

Answer

ip nat inside source static 10.1.1.1 203.0.113.1, with interfaces marked as inside and outside.

Answer

ip nat inside source list 1 pool MYPOOL overload, with a pool of public addresses, and interfaces marked as inside and outside.

Answer

ip nat outside source list 1 interface GigabitEthernet0/0 overload, with an access list permitting 10.1.1.0/24, and interfaces marked as inside and outside.

Question 2

A network engineer is configuring a Cisco IOS router to support PIM Sparse Mode (PIM-SM) for multicast traffic. The engineer needs to ensure that the router can dynamically discover Rendezvous Points (RPs). Which two mechanisms can be used to achieve this? (Choose two.)

Accepted Answer

Bootstrap Router (BSR). Auto-RP and Bootstrap Router (BSR) are the two primary mechanisms for dynamic RP discovery in PIM-SM. Auto-RP is Cisco proprietary and uses a mapping agent, while BSR is an open standard. Both allow routers to automatically learn which RP to use for multicast groups, eliminating the need for manual configuration on every router. These methods enhance scalability and simplify multicast network management.

Answer

MSDP

Answer

Anycast RP

Answer

Static RP configuration

Question 3

A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tags (SGTs) and enforce policies using a Cisco Catalyst switch as an enforcement point. Which two statements are true regarding SGT propagation and enforcement in this scenario? (Choose two.)

Accepted Answer

SGTs can be propagated through a Layer 2 trunk using Cisco Metadata (CMD) or inline tagging.. SGTs can be propagated through Layer 2 trunks using Cisco Metadata (CMD) or inline tagging, and SGACLs are downloaded from Cisco ISE to enforcement devices to define permitted traffic between SGTs. These two statements are true. Not all switches need to support TrustSec for enforcement, SGTs are not carried in the IP header as DSCP, and 'cts manual' is not the primary command for trunk propagation.

Answer

SGTs are always carried in the IP header as a DSCP value to ensure end-to-end propagation.

Answer

Enforcement devices must be configured with the 'cts manual' command on trunk interfaces to enable SGT propagation.

Answer

SGT enforcement requires that all switches in the path support Cisco TrustSec and have SGT propagation enabled.

Question 4

A network administrator is analyzing syslog messages from a Cisco Catalyst switch and notices the message %SW_MATM-4-MACFLAP_NOTIF: Host 0000.1111.2222 in vlan 10 is flapping between port Gi1/0/1 and port Gi1/0/2. What is the most likely cause of this message?

Accepted Answer

A device with MAC address 0000.1111.2222 is connected to both Gi1/0/1 and Gi1/0/2, possibly via a loop or a dual-homed connection.. The %SW_MATM-4-MACFLAP_NOTIF message indicates that the switch has detected the same MAC address being learned on two different ports within a short period. This is most commonly caused by a loop or a device connected to multiple ports, leading to inconsistent MAC address table entries. The administrator should investigate the physical connections and spanning tree topology.

Answer

A loop exists in VLAN 10 due to a misconfigured spanning tree.

Answer

The switch has a software bug causing incorrect MAC address learning.

Answer

The MAC address 0000.1111.2222 is configured as a static MAC address on two different ports.

Question 5

A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints be authenticated and assigned to a VLAN and VRF based on their identity before any traffic is forwarded. Which Cisco SD-Access component is responsible for this function?

Accepted Answer

Cisco Identity Services Engine. Cisco ISE is the identity services component that authenticates endpoints and returns the VLAN and VRF assignment to the fabric edge node. The edge node then places the endpoint into the correct virtual network and applies group-based policy. Neither the control plane nor border nodes perform authentication or endpoint classification.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Fabric edge node

Question 6

A network engineer is deploying a Cisco SD-WAN solution with two data center sites and 40 branch sites. The design must ensure that traffic from a branch to a critical application in Data Center A always prefers the MPLS transport while using the internet transport only when MPLS latency exceeds a defined threshold. Which Cisco SD-WAN component and feature combination accomplishes this?

Accepted Answer

vSmart controller with application-aware routing policy using SLA classes and preferred transport. Cisco SD-WAN implements application-aware routing policy on the vSmart controller. The policy defines SLA classes with latency, jitter, and loss thresholds and maps applications to preferred transports. When a preferred transport such as MPLS meets the SLA, traffic stays there; when the SLA is violated, the policy permits failover to the internet transport. The vBond orchestrator, CLI templates, and OSPF cost tuning do not provide this conditional, application-specific behavior.

Answer

vManage with CLI templates that set static routes for the application subnet

Answer

vSmart controller with OSPF cost manipulation on the MPLS transport

Answer

vBond orchestrator with BFD echo and OMP route redistribution

Question 7

A network administrator is troubleshooting a network performance issue and suspects a duplex mismatch on a switch port. Which command should be used to verify the duplex settings on a Cisco switch interface?

Accepted Answer

show interfaces GigabitEthernet0/1. The show interfaces command provides comprehensive details about an interface, including duplex mode, speed, and error statistics. It shows both the configured duplex and the operational duplex, which is essential for detecting a mismatch. When a duplex mismatch occurs, the interface may show late collisions and other errors. The other commands either lack detail or do not show operational duplex.

Answer

show running-config interface GigabitEthernet0/1

Answer

show interfaces status

Answer

show controllers GigabitEthernet0/1

Question 8

A network engineer is configuring a Cisco IOS router for NAT overload (PAT) to allow internal hosts on the 10.1.1.0/24 network to access the internet using the router's outside interface IP address. The engineer wants to ensure that all internal hosts can initiate connections and that return traffic is correctly translated. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255. To configure NAT overload (PAT) using the outside interface address, two commands are needed: an access list to define the inside local addresses, and the 'ip nat inside source list' command with the 'overload' keyword referencing that list and the outside interface. The access list permits the 192.168.1.0/24 subnet, and the NAT command translates all permitted addresses to the outside interface's IP. The other options either use a pool, configure the wrong direction, or create a static translation, none of which meet the requirement.

Answer

ip nat outside source list 1 interface GigabitEthernet0/1 overload

Answer

ip nat inside source static 192.168.1.10 203.0.113.5

Answer

ip nat inside source list 1 pool MYPOOL overload

Question 9

A network administrator is configuring a zone-based firewall on a Cisco IOS XE router. The requirement is to allow HTTP traffic from the INSIDE zone to the OUTSIDE zone while blocking all other traffic initiated from INSIDE. Which action must be taken to define the traffic that is permitted?

Accepted Answer

Create a class-map that matches HTTP, then reference it in a policy-map and apply the policy-map to the zone pair.. Zone-based firewall policy is built with class-maps for traffic identification and policy-maps for action. The policy-map is attached to a zone pair, and traffic not explicitly permitted is dropped by default, which matches the requirement to allow only HTTP from INSIDE to OUTSIDE.

Answer

Configure a route-map that matches HTTP and apply it to the zone pair.

Answer

Apply an ACL directly to the INSIDE zone interface with the ip access-group command.

Answer

Enable NAT with an overload statement matching HTTP on the OUTSIDE interface.

Question 10

A healthcare provider runs a Python script that issues a RESTCONF PATCH to a Cisco IOS XE switch to modify an interface description. The device returns HTTP 400 with an error-tag of 'invalid-value'. The JSON body is syntactically valid and the URI targets the correct interface. Which action most directly resolves this error?

Accepted Answer

Correct the payload so the description node matches the YANG model's expected type and namespace, then resend the PATCH.. RESTCONF error-tags are diagnostic: 'invalid-value' points to a data value that violates the YANG model's constraints, such as a wrong type, an out-of-range number, or a leaf placed under the wrong namespace. Since the URI and method are correct and the JSON is syntactically valid, the remaining cause is the payload content. Correcting the value and its model placement makes the PATCH succeed.

Answer

Increase the RESTCONF request timeout on the client because the switch is slow to apply configuration changes.

Answer

Change the HTTP method from PATCH to GET and re-read the interface container before writing.

Answer

Add a Content-Type header of application/yang-data+xml while keeping the existing JSON body unchanged.

Question 11

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from the EVPN control plane. The underlay is OSPF, and BGP EVPN peering is established with the spine switches. Which command should the engineer use to verify that the switch is receiving EVPN Type-2 routes?

Accepted Answer

show bgp l2vpn evpn. To verify that the switch is receiving EVPN Type-2 routes, the engineer should use 'show bgp l2vpn evpn'. This command displays the BGP EVPN table, where Type-2 routes appear as '[2]:[MAC/IP]' entries. If these routes are missing, the switch will not learn remote MAC addresses via EVPN. Checking the BGP EVPN table is the first step in troubleshooting control-plane learning issues.

Answer

show ip route vrf all

Answer

show l2route evpn mac all

Answer

show nve peers

Question 12

A network engineer is deploying a new Cisco Catalyst 9000 switch stack. The engineer wants to ensure that the stack uses the most efficient use of stack ports and provides the highest possible bandwidth between stack members. Which stacking technology and topology should be used?

Accepted Answer

Cisco StackWise with a ring topology. Cisco StackWise uses a ring topology to connect stack members, providing high bandwidth and redundancy. If a cable fails, the ring can still function. StackWise-480 and StackWise-1T are used on Catalyst 9000 switches, offering up to 480 Gbps or 1 Tbps of stacking bandwidth. StackPower is for power sharing, not data stacking.

Answer

Cisco StackWise with a star topology

Answer

Cisco StackPower with a ring topology

Answer

Cisco StackWise with a full mesh topology

Question 13

A network administrator is configuring a new Cisco Catalyst switch and needs to assign a management IP address to VLAN 1. Which command is used to enter the interface configuration mode for VLAN 1?

Accepted Answer

interface vlan 1. To assign a management IP address to VLAN 1 on a Cisco switch, you must configure the switched virtual interface (SVI) for VLAN 1. The command 'interface vlan 1' enters interface configuration mode for that SVI, where you can then use the 'ip address' command to assign an IP address and enable the interface with 'no shutdown'.

Answer

interface fastethernet 0/1

Answer

interface range vlan 1

Answer

vlan 1

Question 14

A campus switch connects to an IP phone that has a PC daisy-chained behind it. The engineer wants the phone to reside in VLAN 100 and the PC in VLAN 200, with the phone tagging its own voice traffic. Which interface configuration accomplishes this?

Accepted Answer

switchport mode access, switchport access vlan 200, switchport voice vlan 100. Cisco's voice VLAN feature allows a single access port to serve two devices in different VLANs. The PC, which sends untagged frames, is placed in the access VLAN, while the IP phone, which tags its traffic with 802.1Q, is placed in the voice VLAN. Setting the access VLAN to 200 for the PC and the voice VLAN to 100 for the phone matches the requirement exactly.

Answer

switchport mode access, switchport access vlan 100, switchport voice vlan 200

Answer

switchport mode access, switchport access vlan 200, switchport trunk encapsulation dot1q

Answer

switchport mode trunk, switchport trunk native vlan 200, switchport trunk allowed vlan 100,200

Question 15

A network administrator is configuring a Cisco IOS zone-based firewall (ZBFW) on a router that connects a LAN zone to an Internet zone. The administrator wants to allow outbound HTTP and HTTPS from the LAN to the Internet while blocking all other outbound traffic, and to allow return traffic for established sessions. Which two configuration elements are required to accomplish this? (Choose two.)

Accepted Answer

A class map that matches HTTP and HTTPS traffic and a policy map that applies an inspect action.. Zone-based firewall on Cisco IOS requires class maps to identify traffic and policy maps to apply actions like inspect. The policy map must be applied to a zone pair that defines the direction of traffic, in this case LAN to Internet. The inspect action allows return traffic for established sessions, and any traffic not explicitly permitted is implicitly denied by the zone pair policy.

Answer

A NAT configuration that translates LAN addresses to the Internet-facing interface address.

Answer

A parameter map that defines inspection parameters for HTTP and HTTPS.

Answer

An extended ACL applied inbound on the LAN interface to permit HTTP and HTTPS.

Question 16

A network engineer is configuring a VXLAN overlay. The underlay is an IP-routed network, and the engineer needs to ensure that the VXLAN tunnel endpoints can discover each other's VTEP IP addresses dynamically. Which technology should be used?

Accepted Answer

MP-BGP EVPN. MP-BGP EVPN acts as the VXLAN control plane, allowing VTEPs to exchange reachability information for MAC and IP addresses. This enables dynamic discovery of remote VTEPs and their endpoints, avoiding the inefficiencies of flood-and-learn. PIM, OSPFv3, and LISP do not provide the required EVPN address family for VXLAN tunnel endpoint discovery.

Answer

PIM sparse mode

Answer

OSPFv3

Answer

LISP

Question 17

A network administrator is deploying a virtual switch on a Cisco UCS B-Series blade server. The administrator wants the virtual switch to be managed by Cisco UCS Manager and to support Cisco VM-FEX so that virtual machine traffic is visible to the upstream fabric interconnects. Which virtual switch technology meets these requirements?

Accepted Answer

Cisco Virtual Machine Fabric Extender in UCS Manager. VM-FEX integrated with Cisco UCS Manager is the virtual switching technology that lets the fabric interconnect manage virtual interfaces and expose virtual machine traffic to upstream ports. It is administered from UCS Manager, which the administrator requires. Nexus 1000V, vSphere Standard Switch, and Open vSwitch do not provide UCS Manager-managed VM-FEX capability in this scenario.

Answer

Cisco Nexus 1000V Virtual Supervisor Module

Answer

VMware vSphere Standard Switch

Answer

Open vSwitch with Cisco ACI integration

Question 18

A network automation team is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The team writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script includes a valid authentication token in the headers, but the response returns a 403 Forbidden error. The token was obtained successfully using the /dna/system/api/v1/auth/token endpoint. What is the most likely reason for the 403 error?

Accepted Answer

The user account associated with the token does not have the necessary RBAC permissions to access the network device API.. In Cisco DNA Center, authentication tokens are obtained via the /dna/system/api/v1/auth/token endpoint. However, possessing a valid token does not guarantee access to all APIs. Each API endpoint requires specific RBAC permissions. A 403 Forbidden error indicates that the authenticated user does not have the required role or permission to access the network-device API. The team should verify the user's role and adjust RBAC settings accordingly.

Answer

The API endpoint requires a different HTTP method, such as POST.

Answer

The API request is missing the required 'X-Auth-Token' header.

Answer

The authentication token has expired and must be refreshed.

Question 19

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. The engineer must ensure that BGP keepalives are never dropped even during a control-plane flood, while SSH and SNMP traffic should be rate-limited. Which CoPP configuration element accomplishes this requirement?

Accepted Answer

Create a class-map matching BGP traffic and reference it in the control-plane policy-map without applying any police action.. CoPP works by classifying control-plane traffic and applying actions, most commonly 'police'. Any class that has no police action is effectively passed without rate limiting, which is exactly what is needed for BGP keepalives that must never be dropped. SSH and SNMP classes can then receive 'police' actions with appropriate conform/exceed handling. This design isolates critical routing protocol traffic from the effects of a control-plane flood.

Answer

Create a class-map matching BGP traffic with a 'police' action and assign it to the control-plane policy-map.

Answer

Create a class-map matching BGP traffic and apply a 'police' action with a conform-action of 'transmit' and an exceed-action of 'transmit'.

Answer

Create a class-map matching BGP traffic and apply a 'police' action with a very high committed information rate (CIR).

Question 20

A network engineer is configuring a new Cisco Wireless LAN Controller (WLC) and needs to ensure that the WLC can be managed remotely from a different subnet. The WLC is connected to a switch port that is configured as a trunk. Which interface on the WLC must be configured with an IP address to allow remote management?

Accepted Answer

Management interface. The management interface on a Cisco WLC is the correct interface for remote management. It is configured with an IP address and default gateway, allowing access from different subnets. It is also used for AP communication and other services. The service port is for out-of-band management, the virtual interface is for internal functions, and dynamic interfaces are for user traffic.

Answer

Virtual interface

Answer

Dynamic interface

Answer

Service port