CCNP Mock Exam 87 — 25 Questions

Question 1

A network engineer runs the following command on Router R3:

R3# show ip nat statistics
Total active translations: 5 (0 static, 5 dynamic; 5 extended)
Outside interfaces: GigabitEthernet0/0
Inside interfaces: GigabitEthernet0/1
Hits: 1234  Misses: 5
CEF Translated packets: 1200, CEF Punted packets: 34
Expired translations: 10
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240
   refcount 5

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT).. The output shows 5 dynamic translations with an 'extended' type, which indicates that the router is using Port Address Translation (PAT) because extended translations include both IP address and port number. Additionally, the NAT pool POOL1 has a range of 203.0.113.1 to 203.0.113.10 (10 addresses), but there are 5 active translations, which would be impossible with basic NAT unless PAT is used to multiplex multiple inside hosts to the same outside IP via unique port numbers.

Answer

The NAT pool has exhausted all available addresses.

Answer

The NAT translations are all static.

Answer

The inside interface is GigabitEthernet0/0.

Question 2

Drag and drop the steps of AAA accounting for command logging setup into the correct order, from first to last.

Accepted Answer

Enable AAA globally with 'aaa new-model'. To log commands via AAA accounting, you first enable AAA globally, then configure the accounting method list for exec or commands, apply it to the desired lines, and finally verify that commands are being sent to the accounting server.

Question 3

Drag and drop the steps of YANG module import and augmentation resolution into the correct order, from first to last.

Accepted Answer

Import base YANG module. The correct order begins with importing the base YANG module, then importing the augmentation module, resolving dependencies, applying augmentations to the base schema tree, and finally validating the combined schema.

Question 4

A network engineer runs the following command on Switch SW2:

SW2# show interfaces port-channel 1 etherchannel
Port-channel1 :

Age of the Port-channel   = 0d:00h:10m:32s
Logical slot/port   = 16/1          Number of ports = 2
HotStandby port = null
Port state          = Port-channel Ag-Inuse
Protocol            =   LACP

Ports in the Port-channel:

Index   Load     Port     EC state        No of bits
------+------+------+----------------+----------
  0     00      Gi0/0    Active              4
  1     00      Gi0/1    Active              4

Time since last port bundled:    0d:00h:05m:23s    Gi0/1

Based on this output, what can be concluded?

Accepted Answer

Both member ports are in Active state, meaning they are participating in LACP negotiation.. The output shows both Gi0/0 and Gi0/1 in the 'Active' state under the LACP protocol. In LACP, the Active state means the ports are actively participating in LACP negotiation and have successfully formed the EtherChannel. The 'Port-channel Ag-Inuse' state confirms the port-channel is active and in use, forwarding traffic.

Answer

The EtherChannel is not operational because the load is zero.

Answer

The port-channel is in 'Ag-Inuse' state, which means it is not yet forwarding traffic.

Answer

Load balancing is set to source-destination IP, causing the zero load values.

Question 5

A network administrator issues the following command on a Cisco switch:

Switch# show aaa servers

RADIUS: id 1, priority 1, host 192.168.1.10, auth-port 1812, acct-port 1813
  State: current UP, duration 3600s, previous duration 0s
  Dead: total 0, retransmit 0
RADIUS: id 2, priority 2, host 192.168.1.20, auth-port 1812, acct-port 1813
  State: current UP, duration 100s, previous duration 300s
  Dead: total 3, retransmit 2

Based on this output, what can be concluded?

Accepted Answer

Server 192.168.1.20 has a history of failures.. The output shows that server 192.168.1.20 has a 'Dead: total 3' and 'retransmit 2', indicating it has been marked dead three times and two retransmissions occurred, confirming a history of failures. In contrast, server 192.168.1.10 shows 'Dead: total 0, retransmit 0', meaning it has no failure history. The 'current UP' state for both servers only reflects their present status, not their reliability history.

Answer

Both RADIUS servers are currently unreachable.

Answer

Server 192.168.1.10 is the backup server.

Answer

TACACS+ is also configured on these servers.

Question 6

A network engineer is planning to deploy model-driven telemetry in a brownfield network with a mix of Cisco IOS-XE and Nexus devices. The engineer wants to use a single collector that supports both gRPC and UDP-based telemetry. The engineer is concerned about the scalability of the solution, as the network has over 5000 devices. Which design consideration is most important to ensure the telemetry solution scales effectively?

Accepted Answer

Deploy a hierarchical collector architecture with load balancers to distribute telemetry streams across multiple collectors. To use a hierarchical collector architecture with load balancers to distribute the telemetry streams. With 5000 devices, a single collector can become overwhelmed, so multiple collectors or a load-balanced cluster is essential. The other options are incorrect because using only periodic subscriptions does not address scalability; using a single YANG model is not practical; and using a single transport protocol is not feasible for a mixed environment.

Answer

Use only periodic subscriptions with long sample intervals to reduce data volume

Answer

Configure all devices to use the same YANG model to simplify the collector configuration

Answer

Use a single transport protocol (gRPC) for all devices to reduce complexity

Question 7

Drag and drop each cisco.ios module on the left to its matching purpose on the right.

Accepted Answer

ios_config: Push configuration commands to Cisco IOS devices. ios_config pushes configuration commands, ios_command runs show commands, ios_facts gathers device facts, ios_vlans manages VLANs, and ios_l3_interfaces configures Layer 3 interfaces.

Question 8

Drag and drop the steps of NAT overload (PAT) packet translation process into the correct order, from first to last.

Accepted Answer

Host sends packet with private source IP and port. The PAT process begins with a host sending a packet with a private source IP and port. The router creates a NAT entry mapping the private address and port to the outside global address and a unique port. It then translates the source IP and port in the packet. When the reply arrives, the router looks up the NAT table to find the original mapping. Finally, it translates the destination back to the private IP and port and forwards the packet to the host.

Question 9

Which two statements about virtual machine migration (vMotion/VMware) or live migration (Hyper-V) are true? (Choose two.)

Accepted Answer

Live migration copies the memory state of the VM from the source host to the destination host while the VM continues to run.. Live migration moves a running VM between hosts with minimal downtime. Option B is correct because live migration typically copies memory pages iteratively while the VM runs. Option D is correct because both the source and destination hosts must have compatible CPU features (e.g., same CPU family or Enhanced vMotion Compatibility). Option A is incorrect because the VM must remain powered on during live migration. Option C is incorrect because shared storage is often used but not mandatory; storage vMotion can migrate without shared storage. Option E is incorrect because the VM retains its IP address and network state after migration.

Answer

During live migration, the virtual machine must be powered off to transfer memory contents.

Answer

Live migration requires that both source and destination hosts use the same shared storage for the VM's virtual disks.

Answer

After a live migration, the virtual machine's IP address changes to match the new network segment.

Question 10

Which three statements about encoding formats in model-driven telemetry are true? (Choose three.)

Accepted Answer

Google Protocol Buffers (GPB) provide a compact, binary encoding that reduces bandwidth usage.. GPB is compact and efficient, often used with gRPC. JSON is human-readable and widely supported. XML is verbose but used in NETCONF. YANG does not define encoding; it defines data models. CBOR is not commonly used in Cisco telemetry.

Answer

YANG defines the encoding format for telemetry data.

Answer

CBOR is a binary encoding format used exclusively in Cisco IOS-XE telemetry.

Question 11

A network engineer runs the following command on Router R5:

R5# show ip ospf border-routers

OSPF Process 1 internal Routing Table

Codes: i - Intra-area route, I - Inter-area route

i 1.1.1.1 [110/10] via 192.168.1.1, GigabitEthernet0/0, ABR, Area 0, SPF 5
i 2.2.2.2 [110/20] via 192.168.1.2, GigabitEthernet0/0, ASBR, Area 0, SPF 5

Based on this output, what can be concluded?

Accepted Answer

Router 1.1.1.1 connects area 0 to another OSPF area.. The output shows an entry for 1.1.1.1 with the label 'ABR' (Area Border Router) and a route type of 'i' (intra-area). An ABR connects two or more OSPF areas, so Router 1.1.1.1 must be connecting Area 0 to another OSPF area. The metric [110/10] and next-hop 192.168.1.1 confirm it is reachable within Area 0.

Answer

Router 2.2.2.2 is an Area Border Router.

Answer

Router 1.1.1.1 is redistributing external routes into OSPF.

Answer

The route to 2.2.2.2 is an inter-area route.

Question 12

Which three statements about STP convergence and timers are true? (Choose three.)

Accepted Answer

The default Max Age timer in classic STP is 20 seconds.. Classic STP convergence relies on timers: Hello (2 sec), Max Age (20 sec), Forward Delay (15 sec). Max Age defines how long a switch waits without receiving a BPDU before re-evaluating the root. Forward Delay is the time spent in listening and learning states (each 15 sec). The total convergence time can be up to 50 seconds (20 sec Max Age + 15 sec listening + 15 sec learning). RSTP improves convergence by using handshakes instead of timers. UplinkFast is a Cisco proprietary feature that reduces convergence time after a root port failure, not a standard STP timer.

Answer

The Hello timer in STP is used to determine how often a switch sends BPDUs, with a default value of 5 seconds.

Answer

UplinkFast is a standard IEEE 802.1D feature that reduces convergence time after a root port failure.

Question 13

Drag and drop the steps of IGMPv3 membership report processing into the correct order, from first to last.

Accepted Answer

Host sends IGMPv3 Membership Report with group and sources. IGMPv3 allows hosts to specify source filtering. The host sends a Membership Report with group and source list. The switch/router receives the report and updates its multicast forwarding table. It adds the group and includes the requested sources. It then forwards multicast traffic from those sources to the host's port. The router periodically sends General Queries to maintain membership.

Question 14

An engineer is troubleshooting an EIGRP issue where a router is not learning a specific route from a neighbor. The engineer runs 'show ip eigrp topology all-links' and sees the route in the topology table with a feasible distance of 100 and a reported distance of 120. The neighbor's advertised distance is 80. The router's own computed distance to the network is 150. The route is not in the routing table. What is the most likely cause?

Accepted Answer

The route is not installed because its metric (150) is not the best metric; the router has another route with a lower metric (100).. The route in the topology table has a computed distance of 150 via the neighbor, but the feasible distance (FD) for this destination is 100, which is the best metric from another neighbor. EIGRP installs only the route with the lowest metric (the successor) into the routing table. Since the computed distance of 150 is higher than the FD of 100, this route is not the best and is not installed. Option C correctly identifies that the route is not installed because there is another route with a lower metric.

Answer

The route is a feasible successor, but the successor route is not present.

Answer

The route is not installed because the reported distance (80) from the neighbor is less than the feasible distance (100), but the router's computed distance (150) is higher.

Answer

The route is not installed because EIGRP is configured for stub routing, which prevents learning routes.

Question 15

A network engineer is deploying Cisco DNA Center in a large campus network with 5000+ devices. After initial setup, the engineer notices that the Assurance module is not receiving telemetry data from many access switches. The switches are running IOS-XE 16.12 and are reachable via SNMP. What is the most likely cause of this issue?

Accepted Answer

The switches are not configured with NETCONF/YANG or telemetry streaming.. Cisco DNA Center Assurance relies on telemetry data collected via NETCONF/YANG or gRPC, not just SNMP. If the switches are not configured for telemetry, Assurance will not receive the necessary data. SNMP is used for inventory and basic monitoring, but not for the rich telemetry required by Assurance.

Answer

The DNA Center appliance is not licensed for the Assurance module.

Answer

The switches are not running the correct IOS-XE version for DNA Center compatibility.

Answer

The SNMP community string is incorrect on the switches.

Question 16

A network engineer runs the following command on Router R7:

R7# show ip ospf neighbor vrf CUSTOMER-E

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.8         1   FULL/DR         00:00:35    10.0.1.2        GigabitEthernet0/0.500
10.0.0.9         1   FULL/BDR        00:00:31    10.0.2.2        GigabitEthernet0/0.600

Based on this output, what can be concluded?

Accepted Answer

OSPF is operating within VRF CUSTOMER-E with two neighbors. The command `show ip ospf neighbor vrf CUSTOMER-E` explicitly queries OSPF neighbors within the VRF named CUSTOMER-E. The output shows two neighbors (10.0.0.8 and 10.0.0.9) with states FULL/DR and FULL/BDR, confirming that OSPF is actively operating inside that VRF. Therefore, option C is correct because it accurately states that OSPF is operating within VRF CUSTOMER-E with two neighbors.

Answer

OSPF is not configured for VRF CUSTOMER-E

Answer

There is only one OSPF neighbor in VRF CUSTOMER-E

Answer

The DR is 10.0.0.9

Question 17

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

Accepted Answer

Run ssh-add on the control node to add the private key to the SSH agent. The error 'Permission denied (publickey)' indicates that the SSH key is not being presented to the IOS device. Running ssh-add on the control node loads the private key into the SSH agent, which Ansible uses by default when connecting via SSH. This resolves the authentication failure without requiring a passphrase or changing the inventory.

Answer

Set ansible_ssh_private_key_file in the inventory but omit the passphrase

Answer

Set ansible_user to the correct username in the inventory

Answer

Enable keyboard-interactive authentication on the IOS devices

Question 18

A network engineer issues the following command on Router R9:

R9# show ip sla configuration 7

IP SLAs Infrastructure Engine-II
Entry number: 7
Owner:
Tag:
Type of operation to perform: icmp-echo
Target address: 192.168.9.10
Source address: 192.168.9.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 30
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): 3600
Entry Ageout (seconds): never
Recurring (Starting Everyday, Starting Time: 00:00:01)
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
Number of statistic hours kept: 2
Number of statistic distribution buckets kept: 1
Statistic distribution interval (milliseconds): 20
Enhanced History:

Based on this output, how long will this IP SLA operation run?

Accepted Answer

3600 seconds. The 'Life (seconds): 3600' field explicitly defines the duration for which the IP SLA operation remains active. This value overrides any other timing parameters, meaning the operation will run for 3600 seconds (1 hour) from its start time, regardless of the frequency or threshold settings.

Answer

Forever

Answer

30 seconds

Answer

5000 milliseconds

Question 19

Drag and drop each BGP attribute on the left to its matching type on the right.

Accepted Answer

AS_PATH: Well-known mandatory. AS_PATH and NEXT_HOP are well-known mandatory; LOCAL_PREF is well-known discretionary; MED is optional non-transitive; COMMUNITY is optional transitive.

Question 20

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-1

AP Statistics for AP-1
----------------------
Channel Utilization: 45%
Interference: 10%
Noise Floor: -95 dBm
Total Packets Received: 15000
Total Packets Sent: 12000
Total Errors: 200

Based on this output, what can be concluded?

Accepted Answer

The channel utilization is moderate and the noise floor is low.. The channel utilization of 45% is considered moderate (typically below 50% is acceptable), and the noise floor of -95 dBm is very low (excellent), indicating a clean RF environment. The interference value of 10% is also low, and the error count of 200 out of 15,000 received packets (1.33%) is not significant. This output shows a healthy AP with no major issues.

Answer

The channel is heavily congested with utilization above 80%.

Answer

The noise floor is high, indicating potential interference.

Answer

The AP is experiencing a significant number of errors relative to packets received.