CCNP Mock Exam 93 — 25 Questions

Question 1

A network administrator is implementing NetFlow on a Cisco IOS XE router to monitor traffic. Which two statements about NetFlow are true? (Choose two.)

Accepted Answer

NetFlow can export flow data to a collector using UDP.. The two true statements are that NetFlow can export flow data using UDP and that it can be configured to export only ingress or egress traffic on an interface. NetFlow does not require SNMP, does not collect payload data, and does not use TCP port 2055 by default.

Answer

NetFlow requires SNMP to be enabled on the router.

Answer

NetFlow collects packet payload data for deep packet inspection.

Answer

NetFlow export uses TCP port 2055 by default.

Question 2

A network automation team is evaluating RESTCONF as a replacement for CLI scraping on Cisco IOS XE devices. They need to understand the operational characteristics of RESTCONF to design their tooling. Which two statements accurately describe RESTCONF behavior on Cisco IOS XE? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods such as GET, POST, PUT, PATCH, and DELETE to manipulate YANG-modeled data.. RESTCONF is a RESTful protocol that uses HTTP methods to manipulate YANG-modeled data and supports both XML and JSON encodings. On Cisco IOS XE, JSON is supported, which is advantageous for modern automation. The other statements are false: candidate datastore is not mandatory, SSH is not the transport, and there is no automatic YANG-to-MIB translation.

Answer

RESTCONF requires a candidate datastore to be enabled before any configuration changes can be made.

Answer

RESTCONF uses SSH as its transport protocol and does not support HTTPS.

Answer

RESTCONF automatically translates YANG models into SNMP MIBs for monitoring.

Question 3

A network engineer is configuring VXLAN on a Cisco Nexus 9000 switch. The engineer wants to ensure that the VXLAN tunnel interface uses the loopback 0 interface as the source for all VXLAN traffic. Which command should be entered under the NVE interface configuration?

Accepted Answer

source-interface loopback0. The correct command to set the source interface for VXLAN tunnels under the NVE interface is 'source-interface loopback0'. This ensures that the VTEP IP address is derived from a stable loopback interface, which is a best practice for VXLAN deployments. The other options are either invalid or apply to different technologies.

Answer

tunnel source loopback0

Answer

vxlan source-interface loopback0

Answer

interface loopback0

Question 4

A network security team is deploying Cisco TrustSec in a data center environment. They want to assign Security Group Tags (SGTs) to traffic based on user identity and device type without relying on IP addresses or VLANs. The team plans to use inline tagging on Cisco Nexus switches that support hardware-based SGACL enforcement. Which statement correctly describes how inline tagging propagates SGT information?

Accepted Answer

The SGT is inserted into the Layer 2 frame using Cisco Metadata (CMD) fields, allowing downstream devices to enforce SGACLs without reclassification.. Inline tagging in Cisco TrustSec inserts the SGT directly into the Ethernet frame using Cisco Metadata fields. This allows downstream devices to enforce SGACLs based on the original classification without needing to reclassify traffic, preserving security group integrity across the network path.

Answer

The SGT is encoded in the DSCP field of the IP header, enabling enforcement at any Layer 3 device along the path.

Answer

The SGT is stored in the ARP cache of each device, and devices query a central server to resolve SGTs for enforcement decisions.

Answer

The SGT is propagated through a proprietary GRE tunnel between all TrustSec-capable devices, encapsulating the original frame.

Question 5

An engineer is configuring a Cisco Nexus 9000 switch running VXLAN EVPN. Tenant traffic must be encapsulated with a VXLAN header that includes a 24-bit VNI, and the underlay must provide loopback-based VTEP addressing with ECMP. The engineer notices that the switch is not forming VXLAN tunnels to remote leaf switches. Which configuration issue is the most likely cause?

Accepted Answer

The NVE interface is missing the source-interface loopback and the VNI-to-VLAN mapping is incomplete. VXLAN tunnel formation on a Nexus 9000 requires the NVE interface to have a source-interface, usually a loopback, and correct VNI-to-VLAN mappings. Without a valid VTEP source address or with incomplete VNI mappings, the switch cannot establish tunnels to remote leaf VTEPs, which matches the observed failure.

Answer

The switch is using a 12-bit VLAN ID instead of the required 24-bit VNI in the VXLAN header

Answer

The underlay is running OSPF instead of BGP, which prevents VXLAN tunnel establishment

Answer

The switch is configured with VXLAN VNI 16777216, which exceeds the 24-bit range

Question 6

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN with a remote peer using IKEv2. The engineer wants to ensure that the router uses a pre-shared key for authentication and that the IKEv2 proposal uses AES-256 for encryption and SHA-256 for integrity. Which configuration sequence correctly sets up the IKEv2 proposal and keyring?

Accepted Answer

crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123. The correct configuration includes the proper IKEv2 proposal with encryption aes-cbc-256 and integrity sha256, and a keyring with both local and remote pre-shared keys. This ensures the router can authenticate with the remote peer using the correct cryptographic parameters.

Answer

crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123

Answer

crypto ikev2 policy POLICY1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123

Answer

crypto ikev2 proposal PROPOSAL1; encryption aes-256; integrity sha-256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key Cisco123

Question 7

A network administrator is analyzing the output of 'show ip sla statistics' on a Cisco router. Which two statements correctly describe the information provided by this command? (Choose two.)

Accepted Answer

It displays the number of successes and failures for the IP SLA operation.. The 'show ip sla statistics' command provides operational results such as success/failure counts and the latest RTT. It does not show packet captures, hop-by-hop details, or configuration parameters. Thus, the statements about successes/failures and RTT are correct.

Answer

It lists the IP addresses of all intermediate hops along the path.

Answer

It displays the configured threshold and timeout values for the operation.

Answer

It provides a detailed packet-by-packet capture of the probe traffic.

Question 8

A network administrator is implementing NetFlow on a Cisco IOS XE router to monitor traffic. Which two statements about NetFlow are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Type 2 - MAC/IP Advertisement route. In a VXLAN EVPN fabric, MAC address reachability is advertised using Type 2 EVPN routes, also known as MAC/IP Advertisement routes. These routes allow leaf switches to learn remote MAC addresses and provide Layer 2 connectivity across the fabric. Type 2 routes are fundamental for the operation of EVPN-based VXLAN networks.

Answer

Type 1 - Ethernet Auto-Discovery route

Answer

Type 3 - Inclusive Multicast Ethernet Tag route

Answer

Type 4 - Ethernet Segment route

Question 9

A network engineer is troubleshooting a Cisco IOS-XE router that hosts several virtual routing and forwarding instances. A route to 10.20.30.0/24 exists in both the global routing table and in VRF CUSTOMER_A. A packet arrives on an interface assigned to VRF CUSTOMER_A with destination 10.20.30.10. How does the router determine which routing table to consult?

Accepted Answer

It uses the VRF forwarding table associated with the ingress interface's VRF.. The VRF used for a forwarding lookup is determined by the VRF membership of the ingress interface, not by the destination address. Once the interface's VRF is identified, the router performs a longest prefix match inside that VRF's forwarding table, which keeps overlapping tenant and global addressing independent and isolated.

Answer

It always consults the global routing table first and falls back to the VRF table only if no match is found.

Answer

It uses the destination address to choose the VRF whose route has the longest prefix match.

Answer

It compares administrative distance between the global and VRF entries and selects the lower value.

Question 10

A network administrator is configuring a new Cisco IOS router and needs to enable OSPFv3 for IPv6 on an interface. The interface is already configured with an IPv6 address. Which command must be entered in interface configuration mode to enable OSPFv3 on that interface?

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 for IPv6 on an interface in Cisco IOS, the correct interface configuration command is 'ipv6 ospf area '. This command activates OSPFv3 on the interface and links it to the specified OSPFv3 process and area. The process ID must match the one defined in the global 'ipv6 router ospf' command. Without this command, the interface will not participate in OSPFv3 routing.

Answer

ospfv3 1 ipv6 area 0

Answer

ipv6 router ospf 1

Answer

ip ospf 1 area 0

Question 11

A network administrator is configuring a new Cisco IOS router and needs to enable OSPFv2 on an interface with the correct area and network type. The interface is a broadcast multi-access network. Which command should be used to enable OSPF on the interface and set the area to 0?

Accepted Answer

interface GigabitEthernet0/0: ip ospf 1 area 0. The interface-level command 'ip ospf 1 area 0' enables OSPF process 1 on the interface and assigns it to area 0. This method is preferred over network statements because it is explicit and avoids unintended OSPF activation on other interfaces. The other options are either invalid syntax or less precise methods.

Answer

router ospf 1: area 0 interface GigabitEthernet0/0

Answer

interface GigabitEthernet0/0: ip ospf area 0

Answer

router ospf 1: network 10.0.0.0 0.0.0.255 area 0

Question 12

A network automation team is designing a solution to manage configuration changes across a fleet of Cisco IOS XE devices. They want to use model-driven programmability with YANG data models. Which two protocols can be used to programmatically retrieve and modify configuration using YANG models on these devices? (Choose two.)

Accepted Answer

RESTCONF over HTTPS. NETCONF and RESTCONF are the two primary protocols for model-driven programmability using YANG models on Cisco IOS XE. NETCONF uses SSH and XML, while RESTCONF uses HTTPS and JSON/XML. Both allow structured configuration and state retrieval. SNMP, Telnet, and CLI-based SSH do not natively support YANG and are not considered model-driven.

Answer

SSH with CLI commands

Answer

CLI over Telnet

Answer

SNMPv3 with YANG models

Question 13

A network engineer is configuring a Cisco IOS router to support a site-to-site VPN using IPsec. The engineer wants to ensure that traffic from the local subnet 10.1.1.0/24 to the remote subnet 10.2.2.0/24 is encrypted. Which configuration is required to define the interesting traffic?

Accepted Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The correct configuration uses an access list that permits IP traffic from the local subnet to the remote subnet and references it in the crypto map with 'match address'. This defines the interesting traffic that triggers the IPsec tunnel. The other options either deny the traffic, permit all traffic, or reverse the source and destination, which do not precisely meet the requirement.

Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 permit ip any any

Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Question 14

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP). The switch has two loopback interfaces: Loopback0 (10.0.0.1/32) and Loopback1 (10.0.0.2/32). The engineer wants VXLAN traffic to use the loopback interface that is also used for BGP EVPN peering. Which command should be used to specify the source interface for the VXLAN tunnels?

Accepted Answer

interface nve1
  source-interface loopback1. The correct configuration is to specify the source interface under the NVE interface using 'source-interface loopback1'. This binds the VTEP to the same loopback used for BGP EVPN peering, ensuring that the tunnel source address is reachable and consistent with the control plane. Using a different loopback could cause routing inconsistencies and is not recommended when the same loopback is already used for EVPN peering.

Answer

interface loopback1
  vxlan source-interface

Answer

interface nve1
  source-interface loopback0

Answer

feature nv overlay
  source-interface loopback1

Question 15

A network engineer is configuring NTP authentication on a Cisco IOS-XE router. The goal is to ensure the router only synchronizes with a trusted NTP server and that the server's keys are validated. Which sequence of configuration steps correctly enforces authenticated NTP peering?

Accepted Answer

Enable `ntp authenticate`, define the key with `ntp authentication-key 1 md5 `, mark it trusted with `ntp trusted-key 1`, then add `ntp server key 1`.. Enforcing authenticated NTP requires four coordinated elements: the global `ntp authenticate` command, a defined authentication key with its MD5 value, a `ntp trusted-key` statement for that key number, and the key reference on the `ntp server` command. Missing any one element breaks the chain, either by leaving authentication disabled, by rejecting valid packets, or by failing to associate the key with the specific peer.

Answer

Define the key with `ntp authentication-key 1 md5 ` and add `ntp server key 1`, omitting `ntp authenticate` because the server command implies authentication.

Answer

Enable `ntp authenticate` and mark the key trusted with `ntp trusted-key 1`, but do not configure the key value itself, relying on the server to supply it.

Answer

Configure `ntp master 1` on the router and add `ntp server <ip>`, because a stratum 1 master enforces authentication automatically.

Question 16

A network engineer is configuring a VRF on a Cisco IOS-XE router to isolate a customer's traffic. The engineer creates VRF CUST_A, assigns the customer-facing interface to it, and runs the show ip route vrf CUST_A command, which returns no routes. The interface is up and the customer router is reachable. What is the most likely cause?

Accepted Answer

The interface was placed in the VRF, but no IP address or routing protocol was configured on that interface within the VRF.. A VRF routing table is populated by connected routes from interfaces that both belong to the VRF and have IP addresses, plus any static routes or dynamic routing configured inside the VRF address family. If the interface was moved into the VRF but never addressed, or if no routing protocol or static route was configured within the VRF, the table stays empty. Verifying the interface address and the VRF's routing configuration explains the symptom.

Answer

The ip vrf forwarding command must be applied to the VRF definition rather than to the interface.

Answer

The VRF was created but no route distinguisher or route target was configured, which is required for any VRF to install routes.

Answer

The global routing table must be cleared with the clear ip route * command before VRF routes will appear.

Question 17

A network engineer is configuring a Cisco Catalyst switch to mitigate VLAN hopping attacks. The switch has multiple access ports assigned to VLAN 10 and trunk ports connecting to other switches. The engineer wants to ensure that an attacker cannot send double-tagged frames to hop into another VLAN. Which action should the engineer take on all access ports?

Accepted Answer

Configure the access ports with the switchport mode access command and disable Dynamic Trunking Protocol (DTP) on them.. To mitigate VLAN hopping, access ports should be explicitly configured as access ports and DTP should be disabled to prevent trunk negotiation. Attackers can use DTP to negotiate a trunk and then send tagged frames to access other VLANs. Disabling DTP with 'switchport nonegotiate' on access ports prevents this. The other options either do not address the attack or are misconfigurations.

Answer

Configure the access ports with the switchport mode access command and enable BPDU Guard.

Answer

Configure the access ports with the switchport mode trunk command and set the native VLAN to an unused VLAN.

Answer

Configure the access ports with the switchport mode access command and assign them to the native VLAN.

Question 18

A network administrator is configuring a Cisco IOS-XE router to support Virtual Routing and Forwarding (VRF). The administrator wants to ensure that traffic from different VRFs can be routed between each other using a shared service VRF. Which VRF feature allows routes to be leaked between VRFs?

Accepted Answer

Route target export and import. Route targets are used to control the import and export of routes between VRFs. By configuring matching route targets on two VRFs, routes can be leaked from one VRF to another. This is the standard method for inter-VRF communication in MPLS L3VPN and VRF-lite environments. Route distinguishers make prefixes unique but do not control leaking.

Answer

VRF forwarding table

Answer

IP routing protocol redistribution

Answer

Route distinguisher

Question 19

A network architect is designing a Cisco SD-WAN fabric for a retail chain with 200 branch sites. The design must provide a single control-plane protocol that distributes routing and policy information between the SD-WAN controllers and the WAN Edge devices, while keeping data-plane traffic direct between branches. Which technology should the architect select for the control plane?

Accepted Answer

Cisco Overlay Management Protocol (OMP). Cisco SD-WAN uses OMP as the single control-plane protocol between the vSmart controller and WAN Edge devices. OMP carries TLOC, route, and policy information, allowing the controller to make forwarding decisions while data traffic flows directly between branches. BGP and IS-IS are underlay or service-side protocols, and LISP belongs to SD-Access, so they do not meet the stated design requirement.

Answer

Intermediate System-to-Intermediate System (IS-IS)

Answer

Locator/ID Separation Protocol (LISP)

Answer

Border Gateway Protocol (BGP) with route reflectors

Question 20

A network engineer is deploying a new branch office router that must obtain its WAN interface IP address dynamically from the ISP while also advertising its LAN prefix into OSPF. The engineer configures the WAN interface with the ip address dhcp command. Which additional configuration is required on the router to ensure the LAN prefix is advertised into OSPF with the correct network statement when the WAN IP changes?

Accepted Answer

Use the network command with a wildcard mask that matches the LAN subnet under router ospf.. The network command under router ospf with a wildcard mask matching the LAN subnet is the correct way to advertise the LAN prefix into OSPF. It is independent of the WAN interface's DHCP-assigned IP address, so the advertisement remains stable even if the WAN IP changes. Other options either advertise the wrong prefix or introduce unnecessary complexity.

Answer

Enable OSPF on the WAN interface and rely on connected route redistribution.

Answer

Configure a static route to the ISP and redistribute it into OSPF.

Answer

Configure OSPF to use the interface's DHCP-assigned IP address as the router ID.