CCNP Mock Exam 90 — 25 Questions

Question 1

A network administrator is troubleshooting a connectivity issue between two switches connected via a trunk link. The trunk is configured with 802.1Q encapsulation. The administrator suspects that the native VLAN is mismatched. Which command displays the native VLAN configuration on a Cisco Catalyst switch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show interfaces trunk. The show interfaces trunk command is specifically designed to display trunk interface details, including the native VLAN. It provides a concise summary that makes it easy to compare native VLAN settings between switches. While the running configuration also contains the native VLAN setting, show interfaces trunk is the most direct and efficient command for this purpose, especially when checking multiple trunks.

Answer

show running-config interface GigabitEthernet0/1

Answer

show vlan brief

Answer

show spanning-tree interface GigabitEthernet0/1

Question 2

A network team is evaluating automation tools to manage a large Cisco IOS XE environment. They need a tool that uses a declarative, agentless approach and can be run from a central server without installing software on managed devices. Which tool best fits this requirement?

Accepted Answer

Ansible. Ansible is agentless, using SSH or NETCONF to connect to devices, and uses declarative YAML playbooks. It runs from a central control node without installing agents on managed devices. Puppet, Chef, and SaltStack typically require agents, making them less suitable for this specific requirement.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 3

A network administrator is configuring a Cisco Catalyst switch and needs to assign a port to VLAN 20 as an access port. The port is currently in VLAN 1. Which command sequence correctly configures the interface?

Accepted Answer

interface GigabitEthernet0/1, then switchport mode access, then switchport access vlan 20. To configure a switch port as an access port in VLAN 20, you enter interface configuration mode, set the mode to access with switchport mode access, and then assign the VLAN with switchport access vlan 20. This ensures the port operates as a static access port and carries untagged traffic for VLAN 20.

Answer

interface GigabitEthernet0/1, then switchport access vlan 20, then switchport mode access

Answer

interface GigabitEthernet0/1, then switchport trunk allowed vlan 20, then switchport mode trunk

Answer

interface GigabitEthernet0/1, then switchport mode dynamic auto, then switchport access vlan 20

Question 4

An enterprise campus uses Cisco Catalyst 9000 switches in a StackWise Virtual configuration at the distribution layer. The network team wants dual-homed access switches to use all uplinks simultaneously while avoiding spanning-tree blocking, and they want the distribution pair to appear as a single logical device to routing peers. Which statement describes how StackWise Virtual supports this design?

Accepted Answer

The pair presents one control plane and a single management IP, and Multichassis EtherChannel allows access switches to use all uplinks without STP blocking.. StackWise Virtual combines two Catalyst 9000 chassis into one logical switch with a shared control plane, one management IP, and one configuration. Multichassis EtherChannel lets downstream switches bundle uplinks to both chassis into a single port-channel, so all links actively forward while spanning tree sees one logical device, and routing peers see a single next hop.

Answer

The two chassis elect an active and standby supervisor, and only the active chassis forwards traffic at any time.

Answer

The pair requires VSS with a virtual switch domain and PAgP to form the virtual switch link between the two chassis.

Answer

The pair operates as two independent Layer 3 gateways that share a virtual IP using HSRP on each VLAN interface.

Question 5

A network administrator is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The router must use key 1 with the password 'Cisco123' on interface GigabitEthernet0/0. Which configuration is correct?

Accepted Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123. To enable OSPF MD5 authentication on a specific interface, you must enter interface configuration mode, enable MD5 authentication with 'ip ospf authentication message-digest', and define the key with 'ip ospf message-digest-key 1 md5 Cisco123'. This ensures that OSPF packets on that interface are authenticated using MD5, meeting the security requirement.

Answer

interface GigabitEthernet0/0
 ip ospf authentication-key Cisco123
 ip ospf authentication

Answer

router ospf 1
 area 0 authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123

Answer

router ospf 1
 authentication message-digest
 message-digest-key 1 md5 Cisco123

Question 6

A network automation engineer is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The engineer writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script receives an HTTP 403 Forbidden response. The engineer has verified that the username and password are correct and that the user has the SUPER-ADMIN-ROLE. What is the most likely cause of the issue?

Accepted Answer

The API endpoint requires a valid X-Auth-Token header, which the script did not include.. Cisco DNA Center's Intent API requires token-based authentication. The script must first obtain a token from the authentication endpoint and then include it in the X-Auth-Token header for all subsequent API calls. Without this header, the server returns 403 Forbidden, indicating the request lacks proper authorization. Correct credentials alone are insufficient; the token is mandatory.

Answer

The script must use HTTPS instead of HTTP to access the API.

Answer

The user account is locked due to multiple failed login attempts.

Answer

The API endpoint URL is incorrect and should be /dna/intent/api/v1/network-device/count.

Question 7

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote access. The requirement is to use IKEv2 with certificate-based authentication. The administrator has installed a valid identity certificate on the router and configured the IKEv2 profile. However, remote clients are unable to establish the VPN tunnel, and the router logs show 'IKEv2 certificate authentication failed'. What is the most likely cause?

Accepted Answer

The IKEv2 profile is not referencing the correct trustpoint for certificate authentication.. For IKEv2 certificate-based authentication, the IKEv2 profile must reference a trustpoint that contains the router's identity certificate and the CA certificate to validate peer certificates. If the trustpoint is missing or incorrect, the router cannot authenticate the client's certificate, resulting in failure. Ensuring the correct trustpoint is referenced and that the CA chain is complete resolves the issue.

Answer

The pre-shared key is not configured on the IKEv2 profile.

Answer

The remote clients are using IKEv1 instead of IKEv2.

Answer

The router's certificate has expired.

Question 8

A network administrator is configuring a Cisco CSR 1000v router in a virtualized environment. The administrator needs to ensure that the virtual router can forward traffic between virtual machines on different VLANs. Which feature must be enabled on the CSR 1000v to support this?

Accepted Answer

IP routing. To forward traffic between different VLANs, a Cisco CSR 1000v must have IP routing enabled. This allows the router to route packets between subnets configured on different interfaces or subinterfaces. Without IP routing, the router will not forward traffic between VLANs, regardless of other features.

Answer

VRF Lite

Answer

IPsec VPN

Answer

NAT

Question 9

A network engineer is implementing VXLAN on Cisco Nexus 9000 switches. The engineer needs to verify the configuration of the VXLAN data plane. Which two statements are true regarding VXLAN operation? (Choose two.)

Accepted Answer

VXLAN encapsulates original Ethernet frames in UDP packets with destination port 4789.. VXLAN uses a 24-bit VNI to identify overlay segments, enabling massive scalability. It encapsulates original Ethernet frames in UDP packets with destination port 4789. These two facts are fundamental to VXLAN operation and are correct. The other statements are false: VXLAN does not require OSPF, does not use a 12-bit VLAN ID, and does not inherently use LISP for tunnel establishment.

Answer

VXLAN requires the underlay network to run OSPF for route distribution.

Answer

VXLAN tunnels are established between VTEPs using a control protocol such as LISP.

Answer

VXLAN uses a 12-bit VLAN ID to identify the overlay network.

Question 10

A network engineer deploys Cisco HyperFlex with ESXi hosts and a vSwitch. The requirement is that storage traffic for the HyperFlex distributed data platform be isolated from management and VM traffic, and that jumbo frames be used end to end. Which configuration on the ESXi host satisfies this requirement?

Accepted Answer

Create a dedicated vSwitch with an MTU of 9000, attach the storage VMkernel adapter to it, and place the physical uplinks connected to the storage VLAN on that vSwitch.. HyperFlex storage traffic should run on a dedicated vSwitch with jumbo frames enabled and its own physical uplinks on the storage VLAN. This isolates the distributed data platform traffic from management and VM flows and allows the 9000 MTU to be applied end to end. Sharing a vSwitch, using a 1500 MTU, or merging storage into a common uplink team all fail the isolation and jumbo frame requirements.

Answer

Create a VMkernel adapter on the VM traffic vSwitch with an MTU of 1500 and tag it with the storage VLAN.

Answer

Add the storage VMkernel adapter to the existing management vSwitch and set the MTU to 9000 on that vSwitch.

Answer

Configure a distributed vSwitch with an MTU of 9000 and attach all VMkernel adapters, including storage, to a single uplink team.

Question 11

A network administrator is planning a new Cisco Catalyst switch stack and wants to verify that the stacking cables provide redundancy so that the loss of a single stacking link does not split the stack. The switches support StackWise-480. Which cabling practice should the administrator follow to achieve a resilient stack ring?

Accepted Answer

Connect each switch to the next and the last switch back to the first to form a ring.. A StackWise-480 stack should be cabled as a ring, with each switch connected to the next and the last switch connected back to the first. This loop gives the stack two paths for stacking traffic, so a single link failure does not split the stack, which is exactly what the administrator needs.

Answer

Connect only the first and last switches in the stack and leave the middle switches unconnected.

Answer

Connect the switches in a full mesh using a separate cable between every pair of switches.

Answer

Connect the switches in a single daisy chain using one cable between each pair of switches.

Question 12

A network architect is designing a Cisco SD-Access fabric and must ensure that the control plane and data plane are properly separated. Which two statements accurately describe the roles of fabric nodes in Cisco SD-Access? (Choose two.)

Accepted Answer

Fabric edge nodes encapsulate traffic in VXLAN and provide anycast gateway functionality for endpoints.. In Cisco SD-Access, fabric edge nodes provide VXLAN encapsulation and anycast gateway for endpoints, while control plane nodes run LISP map-server and map-resolver to track endpoint locations. Border nodes connect to external networks, and intermediate nodes provide underlay transport. Edge nodes do not maintain the LISP map-server database; that is the control plane node's function.

Answer

Fabric intermediate nodes perform LISP map-cache resolution for endpoints on behalf of edge nodes.

Answer

Fabric border nodes are responsible for VXLAN encapsulation of traffic between edge nodes within the same fabric site.

Answer

Fabric edge nodes maintain the LISP map-server database for all endpoints in the fabric site.

Question 13

A company uses Cisco TrustSec in its campus network. Security policy requires that a user authenticated by 802.1X be assigned a Security Group Tag (SGT) based on the user's Active Directory group, and that the SGT be carried to downstream switches for enforcement. The access switch is configured for 802.1X with Cisco ISE. Which combination of features must be enabled to meet the requirement?

Accepted Answer

SGT assignment via ISE authorization policy and inline tagging or SXP propagation on the switch uplinks. Cisco TrustSec assigns SGTs through ISE authorization rules that can reference Active Directory group membership. For the tag to reach downstream switches, the network must propagate it using inline tagging on capable links or SXP where inline tagging is not supported. This enables consistent group-based enforcement across the campus.

Answer

SGT assignment via ISE and enabling MACsec on all inter-switch links

Answer

SGT assignment via ISE and enabling 802.1X on all downstream switch ports

Answer

SGT assignment via ISE and configuring dynamic ARP inspection on all switches

Question 14

A network designer is planning a Cisco SD-WAN solution. The customer requires that control plane and data plane traffic be separated, and that the control plane uses a protocol that provides secure, scalable, and resilient overlay topology. Which component of Cisco SD-WAN architecture should the designer use for the control plane?

Accepted Answer

vSmart. vSmart controllers provide the control plane in Cisco SD-WAN, using OMP to distribute routing and policy information to vEdge routers. They establish secure control connections and maintain the overlay topology, separate from the data plane. vManage handles management, vBond handles orchestration, and vEdge routers forward data.

Answer

vBond

Answer

vManage

Answer

vEdge

Question 15

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer wants to ensure that the switch uses the loopback0 interface as the source for VXLAN tunnels and that it can dynamically learn remote VTEPs via BGP EVPN. Which command set is required under the NVE interface?

Accepted Answer

interface nve1; source-interface loopback0; host-reachability protocol bgp. For a Cisco Nexus 9000 VTEP in an EVPN fabric, the NVE interface must be configured with source-interface loopback0 to set the tunnel source IP and host-reachability protocol bgp to enable dynamic learning of remote VTEPs and MAC addresses via BGP EVPN. Other commands like no shutdown are necessary but insufficient, and static peer-ip or IP address under NVE is incorrect.

Answer

interface nve1; source-interface loopback0; vni 10000; ip address 10.0.0.1/32

Answer

interface nve1; source-interface loopback0; no shutdown

Answer

interface nve1; source-interface loopback0; peer-ip 10.0.0.2

Question 16

A network administrator is using Cisco DNA Center Assurance to monitor the health of wireless clients. The administrator notices that some clients are experiencing poor performance, but the Assurance dashboard shows them as 'Good'. Which action should the administrator take to troubleshoot the issue?

Accepted Answer

Review the client's detailed health metrics, including RSSI, SNR, and retry rates.. Cisco DNA Center Assurance client health scores are composite metrics that may not reflect all RF issues. When clients report poor performance but show 'Good' health, the administrator should examine detailed client metrics such as RSSI, SNR, and retry rates to uncover hidden problems. The other options are either too broad or unnecessary.

Answer

Verify that the wireless controller is registered with Cisco DNA Center.

Answer

Check the overall network health dashboard for any global alerts.

Answer

Restart the Cisco DNA Center Assurance service.

Question 17

A network engineer is troubleshooting a connectivity issue and wants to verify the path that packets take from a Cisco IOS XE router to a remote destination. Which command provides a hop-by-hop listing of the path, including latency information for each hop?

Accepted Answer

traceroute. Traceroute is designed to discover the path to a destination by leveraging the TTL field in IP packets. Each router that decrements the TTL to zero sends an ICMP Time Exceeded message, allowing the source to build a list of hops. It also records round-trip times, making it ideal for diagnosing latency and path issues.

Answer

show ip interface brief

Answer

ping

Answer

show ip route

Question 18

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator wants to receive alerts when the onboarding time for wireless clients exceeds a defined threshold. Which Cisco DNA Center Assurance feature should be configured to accomplish this?

Accepted Answer

Assurance Health Rules. Cisco DNA Center Assurance Health Rules enable the creation of custom thresholds for a wide range of metrics, including client onboarding time. When the defined threshold is breached, an alert is triggered. Other dashboards and issue lists are either passive or based on predefined logic and do not support user-defined thresholds for this purpose.

Answer

Assurance Issues

Answer

Network Health Dashboard

Answer

Issues and Alerts

Question 19

A network security engineer is deploying MACsec on a Cisco Catalyst 9000 switch. The switch is connected to a Cisco IP phone that does not support MACsec, and a PC is connected to the phone. The engineer wants to encrypt traffic between the switch and the phone, but the phone does not support MACsec. What should the engineer do to secure the link?

Accepted Answer

Replace the phone with a MACsec-capable model or use a different encryption method such as IPsec for the traffic.. MACsec is a link-layer encryption protocol that requires both endpoints to support it. If the IP phone does not support MACsec, the switch cannot encrypt traffic to the phone at Layer 2. The engineer must either replace the phone with a MACsec-capable model or use a higher-layer encryption method such as IPsec to secure the traffic.

Answer

Use a MACsec-capable switch port and enable `macsec` with `fallback` to allow unencrypted traffic if the phone does not support it.

Answer

Configure the switch port to use MACsec for the PC traffic and leave the phone traffic unencrypted.

Answer

Enable MACsec on the switch port with `macsec` and configure the phone to use 802.1X with MAB.

Question 20

An engineer is implementing a VXLAN overlay network using Cisco Nexus switches. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) can dynamically learn the mapping of remote VTEP IP addresses to MAC addresses. Which protocol should be used to achieve this dynamic learning?

Accepted Answer

MP-BGP EVPN. MP-BGP EVPN is the control plane protocol used in VXLAN overlays to dynamically exchange MAC address and IP address reachability information between VTEPs. It replaces flood-and-learn with a scalable, efficient control plane, enabling optimal forwarding and reducing flooding. This is the correct protocol for dynamic VTEP mapping learning.

Answer

OSPF

Answer

IS-IS

Answer

PIM sparse mode