CCNP Practice Test 9 — 10 Questions

Question 1

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

Accepted Answer

34. The Cisco Catalyst 9300 switch supports a maximum of 34 SPAN sessions. This includes local SPAN, RSPAN, and ERSPAN sessions combined, with the switch allocating internal resources to support up to 34 simultaneous monitoring sessions.

Answer

16

Answer

64

Answer

8

Question 2

Drag and drop the steps of 802.11r Fast BSS Transition (FT) roaming steps into the correct order, from first to last.

Accepted Answer

Client sends FT Authentication request. 802.11r FT roaming uses a fast handshake. The client sends an FT Authentication request to the new AP, which replies with an FT Authentication response. Then the client sends an FT Reassociation Request, the new AP confirms, and finally the client installs the PMK keys.

Question 3

Which two statements about IP SLA with object tracking are true? (Choose two.)

Accepted Answer

A tracking object can monitor the state of an IP SLA operation and change state when the operation fails.. Object tracking allows IP SLA operations to influence routing decisions. The 'track' command is used to create a tracking object that monitors the state of an IP SLA operation. When the IP SLA operation fails, the tracked object changes state, which can then be used to adjust routing, such as floating static routes. The tracking object can be referenced by multiple routing protocols or static routes. The tracking object does not directly modify the routing table; it provides a state that other features use. The IP SLA operation must be configured before the tracking object can reference it.

Answer

Object tracking can only be used with static routes, not with dynamic routing protocols like EIGRP or OSPF.

Answer

The tracking object automatically modifies the routing table when the IP SLA operation fails.

Answer

An IP SLA operation can be configured after the tracking object that references it.

Question 4

Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.

Accepted Answer

Create extended ACL to match traffic. The correct order starts with creating an extended ACL to match the traffic (A), then defining a route-map using the match ip and set vrf commands (B), applying the route-map to the incoming interface (C), after which the router evaluates the policy for each packet (D), and finally matching packets are forwarded into the specified VRF (E). Configuration steps must precede operational steps.

Question 5

Which two statements about NetFlow flow records and export are correct? (Choose two.)

Accepted Answer

NetFlow v9 uses a template-based export format.. NetFlow v5 has a fixed format with 7 key fields, while v9 is template-based and flexible. IPFIX is the IETF standard based on v9. NetFlow export uses UDP by default (port 2055 for v5, 4729 for IPFIX). TCP is not the default transport.

Answer

NetFlow v5 supports variable-length fields and custom flow keys.

Answer

NetFlow export uses TCP by default to ensure reliable delivery.

Answer

NetFlow v5 can export IPv6 flow information.

Question 6

Drag and drop the steps of Unicast Reverse Path Forwarding (uRPF) check process into the correct order, from first to last.

Accepted Answer

Router receives packet on an interface. uRPF first receives a packet on an interface, then looks up the source IP in the routing table, verifies that the incoming interface matches the best reverse path, and if it matches, forwards the packet; otherwise, it drops the packet.

Question 7

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

Accepted Answer

The IKEv2 profile is not attached to the crypto map or interface.. The IKEv2 profile must be attached to a crypto map or directly to an interface (using 'crypto ikev2 profile' under the crypto map or 'tunnel protection ipsec profile') to be used during IKEv2 negotiation. Without this attachment, the router does not know which profile (and thus which keyring and pre-shared key) to apply, so the IKEv2 SA never forms.

Answer

The IKEv2 proposal is not configured correctly.

Answer

The IPsec transform set is missing.

Answer

The pre-shared key is not defined in the keyring.

Question 8

A network engineer runs the following command on Switch SW2:

SW2# show monitor session 2
Session 2
---------
Type                   : Remote Source Session
Source Ports           :
    TX Only            : Gi1/0/5
    RX Only            : Gi1/0/6
Destination Ports     : Gi1/0/20
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

This is an RSPAN source session, sending mirrored traffic to a remote VLAN.. The output shows 'Type: Remote Source Session', which indicates this is an RSPAN source session. The source ports Gi1/0/5 and Gi1/0/6 are configured to send mirrored traffic (TX only and RX only, respectively) to a destination port Gi1/0/20 with encapsulation set to 'Replicate', meaning the traffic is replicated onto an RSPAN VLAN for transport to a remote switch. This matches the definition of an RSPAN source session, where mirrored traffic is sent to a remote VLAN rather than a local destination.

Answer

This is a local SPAN session with bidirectional capture.

Answer

The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.

Answer

Both source ports capture all traffic in both directions.

Question 9

Drag and drop the steps of VNF service chain instantiation into the correct order, from first to last.

Accepted Answer

Define service chain requirements. Service chain instantiation begins with defining the chain, then selecting VNFs, allocating resources, connecting VNFs via virtual links, and finally testing the chain to verify functionality.

Question 10

Drag and drop the steps of deploying a virtual router as a VNF into the correct order, from first to last.

Accepted Answer

Upload virtual router image to hypervisor. Deploying a virtual router VNF starts with uploading the image, then creating the VM, attaching virtual interfaces, configuring routing protocols, and finally verifying connectivity.