CCNP Mock Exam 94 — 25 Questions

Question 1

A network engineer has configured a Cisco IOS IP SLA operation using ICMP echo to monitor reachability to a remote branch router. The engineer wants to correlate the results with syslog messages and SNMP traps to detect when the branch becomes unreachable. Which IP SLA configuration step is required to generate these notifications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an IP SLA reaction with a threshold and an action such as logging or SNMP trap.. To generate syslog messages and SNMP traps based on IP SLA results, you must configure a reaction that specifies a threshold and an action. The reaction monitors the operation's return code or metrics and triggers the defined action when the condition is met. Without a reaction, the operation collects data silently, and no notifications are sent.

Answer

Configure the ip sla monitor operation with the tag command to enable logging.

Answer

Enable IP SLA responder on the remote branch router and configure the operation to use the responder.

Answer

Configure the ip sla schedule command with the life forever option to ensure continuous monitoring.

Question 2

A network engineer is deploying a Cisco Wireless LAN Controller (WLC) in a large campus with 500 access points. The engineer must ensure that the WLC can handle the expected client load and that APs can join the controller securely. Which protocol does the AP use to discover and join the WLC, and what is the default secure management protocol for the WLC GUI?

Accepted Answer

CAPWAP for AP join; HTTPS for WLC GUI. Access points use CAPWAP to discover and join a WLC, establishing both control and data tunnels. The control channel is secured with DTLS, while the data channel may also be encrypted. The WLC GUI is accessed via HTTPS by default, ensuring secure management. This pairing is standard for Cisco wireless deployments and satisfies the need for secure AP join and management.

Answer

LWAPP for AP join; HTTP for WLC GUI

Answer

DTLS for AP join; HTTPS for WLC GUI

Answer

CAPWAP for AP join; HTTP for WLC GUI

Question 3

A network engineer is deploying a new branch office switch and needs to configure a switched virtual interface (SVI) to act as the default gateway for VLAN 10. The VLAN has been created and ports have been assigned. Which additional step is required for the SVI to become operational and pass traffic?

Accepted Answer

Assign an IP address to the SVI with the interface vlan 10 command, then issue no shutdown.. An SVI requires an IP address and must be enabled with no shutdown. The VLAN must exist and have at least one active access port for the SVI to come up. Global IP routing is needed for inter-VLAN routing but does not affect the SVI's operational state. Trunking or port-channels are unrelated to bringing up an SVI for a single VLAN.

Answer

Configure a physical port as a trunk and allow VLAN 10 on it.

Answer

Enable IP routing globally with the ip routing command.

Answer

Assign the SVI to a port-channel for redundancy.

Question 4

An engineer is implementing a QoS policy on a Cisco IOS XE router. The requirement is to prioritize voice traffic (marked DSCP EF) and ensure that it receives strict priority scheduling with a guaranteed bandwidth of 30% of the interface capacity. Which queuing mechanism should be configured on the interface?

Accepted Answer

Low Latency Queuing (LLQ) with a priority statement for the voice class.. Low Latency Queuing (LLQ) combines the bandwidth guarantees of CBWFQ with a strict priority queue. By configuring a priority statement for the voice class, packets marked DSCP EF are placed in a low-latency queue that is serviced before other queues, ensuring minimal delay and jitter. The priority bandwidth allocation of 30% guarantees that voice traffic receives the necessary bandwidth even during congestion.

Answer

First-In, First-Out (FIFO) queuing with a rate limit for voice traffic.

Answer

Weighted Random Early Detection (WRED) with a precedence-based drop policy for voice.

Answer

Class-Based Weighted Fair Queuing (CBWFQ) with a bandwidth guarantee for the voice class.

Question 5

A network administrator must protect the control plane of a Cisco IOS XE router that peers BGP with an ISP. The requirement is to rate-limit specifically ARP and IPv4 TTL-expired packets destined to the route processor while allowing all other transit traffic to be forwarded normally. Which CoPP implementation step is required to achieve this?

Accepted Answer

Create an ACL matching ARP and TTL-expired traffic, reference it in a class-map of type control-plane, define a policy-map with police actions, and attach it with service-policy type control-plane in global configuration.. CoPP uses MQC with a class-map of type control-plane to identify traffic punted to the route processor, a policy-map to police that class, and a global service-policy type control-plane attachment. Matching ARP and TTL-expired packets with an ACL inside the class-map isolates exactly the traffic to be rate-limited, while transit traffic continues to be forwarded in hardware and is never inspected by CoPP.

Answer

Enable Control Plane Protection with a port-filter policy that drops ARP and TTL-expired packets before they reach the route processor.

Answer

Apply an ACL directly to the BGP peer interface inbound to deny ARP and TTL-expired packets, then rely on uRPF to drop remaining control-plane traffic.

Answer

Configure an MQC service policy with service-policy type control-plane on the BGP-facing interface to rate-limit ARP and TTL-expired packets.

Question 6

A network engineer is implementing QoS on a Cisco IOS router. The requirement is to classify traffic based on the DSCP value in the IP header and then mark it with a new DSCP value. Which QoS mechanism should be used to accomplish this?

Accepted Answer

Modular QoS CLI (MQC). The Modular QoS CLI (MQC) is the correct framework for classifying traffic based on DSCP and marking it with a new DSCP value. It involves creating a class-map to match the desired DSCP, a policy-map to set the new DSCP, and applying the service-policy to an interface. This provides a flexible and standardized way to implement QoS policies.

Answer

Class-based weighted fair queueing (CBWFQ)

Answer

Policy-based routing (PBR)

Answer

Low latency queueing (LLQ)

Question 7

A network engineer is new to automation and wants to use a Python script to configure a Cisco IOS XE device. The engineer prefers a protocol that uses HTTP methods and JSON for data encoding, as it is easier to read and debug. Which protocol should the engineer choose?

Accepted Answer

RESTCONF. RESTCONF is the protocol that uses HTTP methods and supports JSON encoding, making it ideal for engineers who prefer a RESTful API. It leverages YANG models to structure data, providing a modern and readable way to automate Cisco IOS XE devices. The other protocols either use different encodings or are not based on HTTP.

Answer

NETCONF

Answer

SNMP

Answer

SSH with CLI commands

Question 8

A network engineer is deploying a new branch office with a single Cisco Catalyst switch. The branch requires that all access ports automatically authenticate devices using 802.1X with RADIUS, but also allow unauthenticated devices to be placed into a guest VLAN. Which feature must be configured on the switch to meet this requirement?

Accepted Answer

Configure 802.1X authentication with a guest VLAN on the access ports.. The requirement is to authenticate devices using 802.1X with RADIUS and also provide a guest VLAN for unauthenticated devices. The 802.1X with guest VLAN feature on Cisco switches accomplishes this by assigning authenticated users to a VLAN and unauthenticated users to a guest VLAN. This is a standard implementation for branch offices needing both secure and guest access.

Answer

Configure Web Authentication (WebAuth) with a guest VLAN on the access ports.

Answer

Configure MAC authentication bypass (MAB) with a guest VLAN on the access ports.

Answer

Configure port security with a guest VLAN on the access ports.

Question 9

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, BGP, SSH management, and SNMP polling. After applying a CoPP policy, the administrator notices that OSPF adjacencies flap intermittently while BGP and SSH remain stable. Which action should the administrator take to resolve the flapping while maintaining control plane protection?

Accepted Answer

Increase the committed information rate (CIR) for the OSPF class in the CoPP policy.. OSPF adjacency flapping after applying CoPP indicates that the policer for the OSPF control plane class is dropping legitimate hello or LSA packets. Increasing the CIR for that class allows the required OSPF traffic to be punted to the route processor. This preserves control plane protection for other protocols while resolving the flapping, which is a common tuning step in CoPP deployments.

Answer

Remove the CoPP policy entirely and rely on interface ACLs for control plane protection.

Answer

Apply the CoPP policy only to the BGP and SSH classes, leaving OSPF unpoliced.

Answer

Configure OSPF authentication to reduce the number of OSPF packets processed by the route processor.

Question 10

A network engineer is using a Python script with the requests library to retrieve interface information from a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://192.168.1.1/restconf/data/ietf-interfaces:interfaces but receives a 401 Unauthorized error. The engineer has verified that the device has RESTCONF enabled and the URL is correct. Which action should the engineer take to resolve the error?

Accepted Answer

Include a valid username and password in the request using HTTP Basic Authentication.. A 401 Unauthorized error means the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires HTTP Basic Authentication. The engineer must include a valid username and password in the request headers. This is the correct and secure way to authenticate RESTCONF requests.

Answer

Enable the RESTCONF-YANG feature on the device using the restconf-yang command in global configuration mode.

Answer

Change the request method from GET to POST to retrieve the interface information.

Answer

Configure the device to allow unauthenticated access by adding the 'restconf no-auth' command.

Question 11

A company is migrating its branch WAN to a Cisco SD-WAN solution. The design team wants to use a single overlay that supports both point-to-point and multipoint traffic, and they want to avoid running separate tunnels for unicast and multicast. Which Cisco SD-WAN technology should they enable on the overlay?

Accepted Answer

Cisco SD-WAN multicast with replication using a rendezvous point. Multicast support in Cisco SD-WAN uses overlay replication coordinated by a rendezvous point, letting the same fabric carry unicast and multicast without parallel tunnel types. Application-Aware Routing, TLOC extension, and Direct Internet Access serve different purposes and do not deliver multipoint transport across the overlay.

Answer

Cisco SD-WAN Direct Internet Access with NAT

Answer

Cisco SD-WAN Application-Aware Routing with BFD probes

Answer

Cisco SD-WAN TLOC extension between two transports

Question 12

A network engineer is deploying Cisco DNA Center Assurance to monitor a campus network. The engineer wants to leverage machine learning to baseline normal behavior and detect anomalies without manually defining thresholds. Which capability should be enabled?

Accepted Answer

AI Network Analytics. AI Network Analytics is the Cisco DNA Center Assurance feature that applies machine learning to create baselines and detect anomalies without manual thresholds. It continuously analyzes telemetry to identify deviations, which aligns with the engineer's goal of automated, threshold-free monitoring.

Answer

Network Time Travel

Answer

Path Trace

Answer

Sensor-driven tests

Question 13

A network engineer is using Cisco DNA Center Assurance to monitor a network with Cisco SD-Access fabric. The engineer notices that the fabric health score is consistently low, but individual device health scores are high. Which component of the fabric should the engineer investigate first?

Accepted Answer

Fabric control plane nodes. In Cisco SD-Access, the fabric health score reflects the health of the overlay and control plane. If individual device health scores are high but fabric health is low, the issue is likely with fabric control plane nodes (LISP map-server/map-resolver) or overlay tunnels. These components are critical for fabric operation but may not affect individual device health scores. Investigating control plane nodes first is the logical step to identify misconfigurations or failures in the fabric overlay.

Answer

Underlay network devices

Answer

Wireless LAN controllers

Answer

Fabric edge nodes

Question 14

A network engineer is configuring a Cisco ASA firewall with a site-to-site VPN to a remote peer. The engineer wants to ensure that only specific subnets are encrypted and that traffic from other subnets is not sent through the tunnel. Which configuration element defines the traffic that will be protected by the VPN?

Accepted Answer

The crypto ACL (access list) referenced in the crypto map.. In a site-to-site VPN on Cisco ASA, the crypto ACL (also called the interesting traffic ACL) defines which source and destination subnets are encrypted and sent through the tunnel. Only traffic matching this ACL is protected; other traffic is sent in clear text or dropped based on interface ACLs. The tunnel-group, group-policy, and IKEv2 proposals handle peer authentication and encryption parameters, but not traffic selection.

Answer

The IKEv2 proposal and policy settings.

Answer

The tunnel-group configuration for the remote peer.

Answer

The group-policy applied to the VPN connection.

Question 15

A network architect is designing a campus fabric using Cisco SD-Access to centralize policy enforcement and simplify segmentation. The design must support endpoint groups for IoT devices and employees, with traffic policy applied consistently across wired and wireless. Which control plane component is responsible for maintaining the mapping between endpoint identifiers and their location in the fabric?

Accepted Answer

LISP map-server and map-resolver. In Cisco SD-Access, the LISP control plane maintains the endpoint identifier to routing locator mappings. The map-server registers these mappings from fabric edge nodes, while the map-resolver responds to queries from ingress tunnel routers. This separation of control and data plane allows scalable endpoint mobility and consistent policy enforcement across wired and wireless fabric devices.

Answer

VXLAN tunnel endpoints

Answer

Cisco Identity Services Engine

Answer

Cisco DNA Center fabric controller

Question 16

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device is experiencing frequent disconnects. Which Assurance feature should be used to view a chronological list of events related to that specific client, including association, authentication, and roaming events?

Accepted Answer

Client 360. Client 360 in Cisco DNA Center Assurance offers a detailed, per-client view that includes a timeline of events such as association, authentication, and roaming. This feature allows the administrator to pinpoint when and why a client disconnected. Other Assurance features like the Network Health Dashboard or Application Health provide aggregate or application-level views, not the granular client event history required. Therefore, Client 360 is the correct choice for troubleshooting a specific client's disconnects.

Answer

Sensor Test

Answer

Network Health Dashboard

Answer

Application Health

Question 17

A network engineer is implementing a Zone-Based Firewall (ZBFW) on a Cisco IOS XE router. The router has three interfaces: inside (GigabitEthernet0/0), outside (GigabitEthernet0/1), and DMZ (GigabitEthernet0/2). The security policy requires that traffic from the inside zone to the outside zone be inspected, traffic from the outside zone to the DMZ be allowed only for HTTP and HTTPS, and all other traffic between zones be denied by default. Which configuration step is essential to achieve this policy?

Accepted Answer

Assign interfaces to zones and create zone pairs with inspect policies for inside-to-outside and outside-to-DMZ.. Zone-Based Firewall requires interfaces to be assigned to zones, and traffic between zones is controlled by zone pairs. Each zone pair has a policy that defines actions like inspect, pass, or drop. By default, inter-zone traffic is dropped, so explicit policies are needed for allowed traffic. The correct configuration involves creating zones, assigning interfaces, and defining zone pairs with appropriate inspect policies for inside-to-outside and outside-to-DMZ, ensuring the default deny posture.

Answer

Configure a single zone pair from inside to outside with an inspect policy and rely on implicit permit for other traffic.

Answer

Create a class map that matches HTTP and HTTPS traffic and apply it as a policy to the outside interface.

Answer

Apply an ACL to the outside interface to permit HTTP and HTTPS to the DMZ and deny all other traffic.

Question 18

A security architect is designing a network where endpoint identity and group membership must follow users and devices across both wired and wireless networks, and policy enforcement must be consistent regardless of VLAN or IP subnet. Which Cisco solution provides this identity-based, group-based access control?

Accepted Answer

Cisco TrustSec with Security Group Tags and Cisco ISE. Cisco TrustSec uses Security Group Tags derived from identity and group information, typically populated by Cisco ISE, to enforce policy independent of IP addresses and VLANs. Because the tags travel with the traffic, consistent access control is maintained across wired and wireless networks, which matches the architect's requirements.

Answer

Cisco AnyConnect with posture assessment only

Answer

Cisco Umbrella with DNS-layer security and SIG

Answer

Cisco Stealthwatch with NetFlow analytics

Question 19

A network administrator is troubleshooting a Cisco Catalyst switch and suspects a Layer 2 loop. The administrator wants to verify the Spanning Tree Protocol (STP) topology and identify the root bridge. Which command should be used?

Accepted Answer

show spanning-tree. To verify STP topology and identify the root bridge, the 'show spanning-tree' command is the correct choice. It provides detailed output for each VLAN, including the root bridge ID, root path cost, and port roles. This allows the administrator to confirm the expected topology and detect any loops or misconfigurations.

Answer

show mac address-table

Answer

show interfaces trunk

Answer

show cdp neighbors

Question 20

A network engineer is configuring a Cisco Catalyst switch port that connects to an IP phone. The phone must place voice traffic in VLAN 200 and data traffic from a daisy-chained PC in VLAN 100. The switch port is currently configured as a static access port in VLAN 100. Which configuration must the engineer apply to meet these requirements?

Accepted Answer

Configure the interface with the switchport voice vlan 200 command while leaving the access VLAN as 100.. The voice VLAN feature on a Cisco access port allows a phone to send tagged voice frames while data frames from a daisy-chained PC remain untagged in the access VLAN. Configuring the port with switchport voice vlan 200 and leaving it as an access port in VLAN 100 provides the required separation without manual trunk configuration.

Answer

Configure the interface as a dynamic auto trunk and set the voice VLAN to 200 with the switchport voice vlan command.

Answer

Configure the interface as a trunk, set the native VLAN to 200, and allow VLANs 100 and 200 on the trunk.

Answer

Configure the interface as a trunk, set the native VLAN to 100, and allow only VLAN 200 on the trunk.