CCNP Mock Exam 88 — 25 Questions

Question 1

Drag and drop each authentication mode on the left to its matching behavior on the right.

Accepted Answer

Open: Port allows traffic even before successful authentication. Open mode allows traffic before authentication, closed mode blocks all until authenticated, and monitor mode logs but does not block.

Question 2

A financial company runs a critical trading application in a virtualized environment on VMware vSphere. The application consists of two VMs: App-1 (web server) and App-2 (database server). Both VMs are on the same ESXi host. Recently, users report intermittent slowness during peak trading hours. Monitoring shows that App-1 experiences high CPU ready time (up to 15%) and App-2 has high disk latency (average 50 ms). The ESXi host has 16 vCPUs total (2 sockets, 8 cores each) and 128 GB RAM. The host runs 10 VMs total. App-1 has 4 vCPUs and 16 GB RAM; App-2 has 8 vCPUs and 32 GB RAM. The storage is a shared NFS datastore connected via 1 Gbps Ethernet. The network is 10 Gbps. What is the MOST effective course of action to resolve the performance issues?

Accepted Answer

Reduce the number of vCPUs assigned to App-2 from 8 to 4, and configure Storage I/O Control on the datastore.. App-2's 8 vCPUs exceed the number of physical cores per socket (8), causing CPU scheduling contention and high ready time on App-1, while reducing vCPUs to 4 aligns with the host's core-per-socket count and reduces co-scheduling overhead. Additionally, Storage I/O Control (SIOC) on the NFS datastore can prioritize disk access and mitigate the high disk latency (50 ms) by enforcing shares and limits during congestion, addressing both performance issues without requiring hardware upgrades.

Answer

Enable vNUMA for both VMs to improve memory access, and set CPU affinity to dedicate specific cores.

Answer

Increase the RAM for both VMs to reduce disk swapping, and enable Hyperthreading on the ESXi host.

Answer

Migrate the VMs to another ESXi host with faster CPUs, and upgrade the storage network to 10 Gbps.

Question 3

Which two statements about SNMPv3 security features are true? (Choose two.)

Accepted Answer

The authNoPriv security level provides authentication using MD5 or SHA, but no encryption.. SNMPv3 provides both authentication and encryption. The authNoPriv level uses MD5 or SHA for authentication without encryption; noAuthNoPriv uses no security; authPriv provides both authentication and encryption. The engine ID is required for SNMPv3 user configuration and is used to generate the localized key.

Answer

The noAuthNoPriv security level provides both authentication and encryption.

Answer

SNMPv3 users are identified solely by the community string, similar to SNMPv2c.

Answer

The SNMP engine ID is optional and only used for debugging purposes.

Question 4

Drag and drop the steps of CoPP class-map match criteria and rate-limit application into the correct order, from first to last.

Accepted Answer

Define class-map with match statements. CoPP configuration requires defining match criteria in a class-map, then creating a policy-map with police commands, and finally applying the policy to the control plane. The order follows standard MQC (Modular QoS CLI) process.

Question 5

A network engineer runs the following command on Switch SW9:

SW9# show spanning-tree vlan 90

VLAN0090
  Spanning tree enabled protocol ieee
  Root ID    Priority    24666
             Address     aabb.cc00.1000
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    24666  (priority 24576 sys-id-ext 90)
             Address     aabb.cc00.1000
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p
Gi0/4               Desg FWD 4         128.4    P2p

Based on this output, what is the base priority of the root bridge?

Accepted Answer

24576. The root bridge's base priority is derived from the bridge priority shown in the output: 24666. In PVST+, the bridge priority is composed of a base priority (in multiples of 4096) plus the VLAN ID. Since the VLAN ID is 90, the base priority is 24666 - 90 = 24576. The output confirms this by showing 'priority 24576 sys-id-ext 90' in the Bridge ID line.

Answer

24666

Answer

32768

Answer

32858

Question 6

A network engineer runs the following command on a Cisco WLC:

WLC# show ap rf-profile summary

RF-Profile Name: default-rf-profile
Description: Default RF Profile
Band: 2.4 GHz
Channel Width: 20 MHz
Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps
Power Level: 1 (max)

RF-Profile Name: low-power
Description: Low Power Profile
Band: 2.4 GHz
Channel Width: 20 MHz
Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps
Power Level: 5

Based on this output, what can be concluded?

Accepted Answer

The low-power profile reduces the transmit power of the AP.. The 'Power Level: 5' in the low-power profile indicates a lower transmit power setting compared to 'Power Level: 1 (max)' in the default profile. On Cisco WLCs, power levels are numbered inversely to actual transmit power, with higher numbers representing lower power output. Therefore, the low-power profile reduces the AP's transmit power.

Answer

The default profile uses 40 MHz channels.

Answer

The low-power profile disables all data rates below 12 Mbps.

Answer

The low-power profile is for 5 GHz band.

Question 7

A mid-size enterprise is deploying a new branch office with 50 users. The branch will have its own router, switch, and wireless AP. The WAN link is a 50 Mbps MPLS circuit. The company uses VoIP and requires Quality of Service. The network administrator has configured the router with a QoS policy that marks VoIP traffic with DSCP EF and all other traffic with DSCP 0. The policy also shapes traffic to 50 Mbps. After deployment, users report that voice quality is poor during peak hours. The administrator checks the router and sees that the output queue on the WAN interface is often full and drops are occurring. Which action should the administrator take to improve voice quality?

Accepted Answer

Configure a priority queue for DSCP EF traffic within the shaper.. The shaper is limiting traffic to 50 Mbps, but during peak hours, the aggregate traffic exceeds this rate, causing the output queue to fill and drop packets indiscriminately. By configuring a priority queue for DSCP EF (VoIP) traffic within the shaper, the router will service VoIP packets before other traffic, ensuring low latency and jitter even when the link is congested. This is the standard Cisco approach for voice quality on shaped links, as priority queuing bypasses the normal FIFO or CBWFQ behavior for marked traffic.

Answer

Increase the shaping rate to 60 Mbps to allow for burst.

Answer

Replace shaping with policing to drop non-voice traffic.

Answer

Change the marking to use CoS instead of DSCP for better QoS.

Question 8

Which three statements about model-driven telemetry are true? (Choose three.)

Accepted Answer

Model-driven telemetry uses YANG data models to define the data to be streamed.. Model-driven telemetry uses YANG data models and can push data via gRPC or gNMI. It supports both periodic and on-change subscriptions. It reduces polling overhead compared to SNMP. It does not require SSH for transport (gRPC uses HTTP/2).

Answer

Model-driven telemetry requires SSH for secure data transport.

Answer

Model-driven telemetry increases the polling overhead compared to SNMP.

Question 9

Which three statements about model-driven telemetry are true? (Choose three.)

Accepted Answer

Telemetry subscriptions can be configured to report data on a periodic interval or when a value changes.. Model-driven telemetry (MDT) uses YANG data models and supports both periodic and on-change subscriptions. It uses a push model, reducing polling overhead. gRPC and gNMI are common transport protocols. Telemetry data can be encoded in JSON or GPB.

Answer

Model-driven telemetry uses a pull model where the collector requests data from network devices.

Answer

Model-driven telemetry requires the use of SNMP for data encoding.

Question 10

Which three statements about telemetry data collection methods are true? (Choose three.)

Accepted Answer

Syslog messages can be used as a form of telemetry to report events and state changes.. Telemetry can be collected via SNMP (pull), Syslog (push), and model-driven telemetry (push). SNMP polling is a classic pull method, while Syslog and MDT are push-based. MDT offers higher scale and flexibility compared to SNMP.

Answer

SNMP is a push-based telemetry method where agents send traps to the NMS.

Answer

Telemetry data can only be encoded in XML format.

Question 11

Drag and drop each BGP path selection criterion on the left to its order of preference (1 = highest priority) on the right.

Accepted Answer

Weight: 1. Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH (shortest), then ORIGIN (IGP < EGP < incomplete).

Question 12

Which two statements about BGP path attributes are true? (Choose two.)

Accepted Answer

The AS_PATH attribute is well-known mandatory.. The AS_PATH attribute is well-known mandatory and is used for loop prevention and path selection. The LOCAL_PREF attribute is well-known discretionary and is used to influence outbound traffic from an AS. The MED attribute is optional non-transitive, not well-known. The ORIGIN attribute is well-known mandatory. The COMMUNITY attribute is optional transitive.

Answer

The MED attribute is well-known mandatory.

Answer

The ORIGIN attribute is optional transitive.

Answer

The COMMUNITY attribute is well-known mandatory.

Question 13

Drag and drop the steps of IGMP v3 SSM membership report process into the correct order, from first to last.

Accepted Answer

Host sends IGMPv3 Membership Report with (S,G). IGMPv3 SSM membership reports are sent by hosts to request traffic from specific sources. The host first sends a Membership Report listing desired (S,G) pairs. The router processes the report, updates its multicast routing table, and then sends PIM (S,G) Joins toward the source. The source forwards traffic, which is then delivered to the host.

Question 14

Drag and drop each IGMP version on the left to its matching feature on the right.

Accepted Answer

IGMPv1: No leave message; querier elected by lowest IP address on subnet. IGMPv1 has no leave message and uses a querier election based on IP address; IGMPv2 adds explicit leave and querier election using lowest IP; IGMPv3 adds source filtering (include/exclude) and supports SSM.

Question 15

An architect is designing an SD-Access fabric for a large campus network. The design must support wireless clients that roam across different access switches without requiring a centralized wireless LAN controller. Which fabric component and protocol combination should the architect use to enable this mobility?

Accepted Answer

Fabric edge switches with VXLAN and LISP; APs in fabric mode (SD-Access enabled).. SD-Access fabric uses fabric edge switches with VXLAN (data plane) and LISP (control plane) to create a distributed overlay that supports seamless wireless client roaming. APs in fabric mode (SD-Access enabled) integrate directly with the fabric, allowing the fabric edge to handle mobility without a centralized WLC, as the client's context is maintained across the VXLAN overlay.

Answer

Fabric edge switches with VXLAN and LISP; APs in local mode with a centralized WLC.

Answer

Fabric border nodes with VXLAN and LISP; APs in flexconnect mode with a local switch.

Answer

Fabric control plane nodes with VXLAN and LISP; APs in monitor mode.

Question 16

A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because the requirement specifies AES encryption with a pre-shared key. WPA2-PSK (Wi-Fi Protected Access 2 – Pre-Shared Key) mandates AES-CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) as the encryption protocol, providing strong, standards-compliant security for client traffic. This configuration directly satisfies the need for both AES encryption and PSK authentication.

Answer

WPA3-PSK with AES

Answer

WPA2-PSK with TKIP

Answer

WEP with AES

Question 17

What is the default OSPF hello interval on an Ethernet link in Cisco IOS?

Accepted Answer

10 seconds. In Cisco IOS, the default OSPF hello interval for broadcast multi-access networks such as Ethernet is 10 seconds. This value is defined in RFC 2328 and is used to maintain neighbor adjacencies; if a hello is not received within the dead interval (default 40 seconds, or 4 times the hello interval), the neighbor is declared down.

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 18

An Ansible playbook is written to configure a VLAN on a Cisco IOS-XE device via Cisco DNA Center's intent API:

- name: Configure VLAN via DNA Center
  hosts: localhost
  gather_facts: no
  tasks:
    - name: Create VLAN 100
      cisco.dnac.vlan:
        host: "{{ dnac_host }}"
        username: "{{ dnac_username }}"
        password: "{{ dnac_password }}"
        validate_certs: no
        state: present
        vlan_name: "Engineering"
        vlan_id: 100
        site_id: "{{ site_id }}"
      register: result

- debug: var=result

What is a potential issue with this playbook?

Accepted Answer

The 'site_id' parameter is mandatory for creating a VLAN in DNA Center; if missing, the task will fail.. The cisco.dnac.vlan module requires the 'site_id' parameter to associate the VLAN with a specific site. If the site_id is not provided or is incorrect, the task will fail or create the VLAN in the wrong location. Additionally, the playbook assumes the DNA Center credentials are correctly set.

Answer

The module name is incorrect; it should be cisco.dnac.network_vlan.

Answer

The playbook does not include a task to obtain an authentication token, which is required by DNA Center API.

Answer

The 'state: present' is invalid; it should be 'state: create'.

Question 19

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Accepted Answer

Create the EtherChannel (port-channel) interface. When using EtherChannel, the SPAN source must be the port-channel interface, not individual members, to capture all traffic.

Question 20

Drag and drop each SPAN type on the left to its correct scope description on the right.

Accepted Answer

Local SPAN: Mirrors traffic only on the source switch. Local SPAN mirrors traffic on the same switch; RSPAN uses a dedicated VLAN to transport mirrored traffic across switches; ERSPAN encapsulates mirrored packets in GRE and routes them over Layer 3.