CCNP Mock Exam 95 — 25 Questions

Question 1

A network engineer is writing a Python script to retrieve the list of interfaces from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces and receives a 401 Unauthorized response. The device is reachable, and RESTCONF is enabled. The engineer verifies that the username and password are correct. Which action should the engineer take to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the HTTP client to use basic authentication with the correct credentials.. A 401 Unauthorized response indicates that the request lacks valid authentication credentials. RESTCONF relies on HTTP authentication, so the client must include an Authorization header, typically using basic authentication. Even if the username and password are correct, they must be transmitted with the request. The other options address different issues: content negotiation, API enablement, or HTTP method, none of which cause a 401. Therefore, configuring basic authentication is the correct fix.

Answer

Enable the RESTCONF API using the 'restconf' command under global configuration.

Answer

Change the request method from GET to POST.

Answer

Add the header 'Accept: application/yang-data+json' to the request.

Question 2

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator wants to identify the root cause of poor wireless client experience. Which two actions can be taken within Cisco DNA Center Assurance to troubleshoot this issue? (Choose two.)

Accepted Answer

Use the Client Health dashboard to view detailed metrics for a specific wireless client.. To troubleshoot poor wireless client experience, the administrator should use the Client Health dashboard for detailed per-client metrics and Intelligent Capture for deep packet-level analysis. These tools together provide the necessary visibility into wireless-specific issues such as RF conditions and client onboarding problems.

Answer

Use the Path Trace tool to visualize the path between a client and a destination.

Answer

Use the Application Health dashboard to monitor application performance.

Answer

Use the Network Health dashboard to view overall network device health.

Question 3

A network engineer is troubleshooting a Cisco ACI environment where a tenant's application is experiencing intermittent connectivity issues. The engineer suspects that the issue is related to the ACI fabric's forwarding behavior. Which tool can be used to verify the end-to-end path and policy enforcement for a specific flow within the ACI fabric?

Accepted Answer

Cisco APIC Tenant Traceroute. The Cisco APIC Tenant Traceroute tool is designed to trace the end-to-end path of a specific flow within the ACI fabric. It simulates the flow and shows each hop, including policy enforcement and any drops. This makes it the best choice for troubleshooting intermittent connectivity issues. The Contract Viewer only shows policy configuration, the AVE CLI is limited to virtual edge troubleshooting, and Nexus Dashboard Insights is more for analytics than on-demand path tracing.

Answer

Cisco APIC Contract Viewer

Answer

Cisco ACI Virtual Edge (AVE) CLI

Answer

Cisco Nexus Dashboard Insights

Question 4

A network architect is designing a Cisco SD-Access fabric. The security team requires that endpoint traffic be segmented into separate virtual networks and that group-based policy be enforced without using traditional VLANs or ACLs between fabric edge nodes. Which two Cisco SD-Access fabric components or features support these requirements? (Choose two.)

Accepted Answer

Cisco TrustSec Security Group Tags (SGTs) enforced by the fabric. SD-Access uses VXLAN encapsulation with a fabric VNI per virtual network to provide data-plane segmentation, and it carries Security Group Tags so that group-based policy can be enforced consistently across fabric edge nodes. Together these deliver segmentation and policy without depending on VLANs or hop-by-hop ACLs between edge switches.

Answer

Private VLANs configured on every fabric edge switch port

Answer

Dynamic ARP Inspection on all fabric underlay links

Answer

Extended ACLs applied inbound on every fabric edge uplink

Question 5

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The requirement is to allow fallback to the local database if all TACACS+ servers are unreachable. Which AAA configuration achieves this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the default method list with TACACS+ first and local fallback. The 'group tacacs+' keyword specifies TACACS+ servers, and 'local' ensures the router's local username database is used if all TACACS+ servers are unreachable. This provides centralized authentication with a resilient backup.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ enable

Question 6

A network engineer is designing a Python script that uses the YANG models supported by a Cisco IOS XE device to configure interface descriptions via RESTCONF. The engineer wants to ensure the script uses the correct data model and avoids errors. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Verify the YANG module revision date to ensure compatibility with the IOS XE version running on the device.. To configure interfaces via RESTCONF using YANG models, the engineer must first discover which YANG modules are supported by the device. The ietf-yang-library provides this information, including module names, revisions, and features. Checking the revision date ensures the script uses the correct version for the device's software. These two actions prevent schema errors and ensure successful configuration.

Answer

Use the 'Content-Type: application/yang-data+xml' header for all RESTCONF requests to ensure compatibility with YANG models.

Answer

Use the Cisco IOS XE native YANG model 'Cisco-IOS-XE-native' for interface configuration, as it is always available and supports all features.

Answer

Assume that all YANG modules are available on all IOS XE devices, so no verification is needed.

Question 7

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet. The router must provide IP addresses, default gateway, and DNS server information to clients. Which configuration is required?

Accepted Answer

ip dhcp pool POOL1, network 192.168.1.0 255.255.255.0, default-router 192.168.1.1, dns-server 8.8.8.8. A Cisco IOS DHCP server requires a pool with network, default-router, and dns-server commands to provide IP addresses, gateway, and DNS information. The excluded-address command is optional but often used. The lease command is optional and not required for basic operation. Manual bindings are for specific hosts and do not serve a subnet. Therefore, the configuration that includes network, default-router, and dns-server is the correct choice.

Answer

ip dhcp pool POOL1, network 192.168.1.0 255.255.255.0, default-router 192.168.1.1, dns-server 8.8.8.8, lease 0 8

Answer

ip dhcp excluded-address 192.168.1.1 192.168.1.10, then ip dhcp pool POOL1 with network 192.168.1.0 255.255.255.0 and default-router 192.168.1.1

Answer

ip dhcp pool POOL1, host 192.168.1.100 255.255.255.0, hardware-address 0000.1111.2222

Question 8

A network administrator is configuring a Cisco IOS XE router to act as a VPN headend with IKEv2. The security policy requires that the router authenticate to peers using a certificate from a corporate PKI, and that peers authenticate using EAP-MSCHAPv2. Which IKEv2 authentication configuration on the headend meets these requirements?

Accepted Answer

Configure 'authentication local rsa-sig' and 'authentication remote eap query-identity' under the IKEv2 profile.. IKEv2 profiles separate local and remote authentication methods. To use a certificate for the headend, 'authentication local rsa-sig' is required. To authenticate peers with EAP-MSCHAPv2, 'authentication remote eap query-identity' is used, which triggers EAP negotiation and allows the peer to respond with EAP-MSCHAPv2 credentials.

Answer

Configure 'authentication local pre-share' and 'authentication remote pre-share' under the IKEv2 profile.

Answer

Configure 'authentication local eap query-identity' and 'authentication remote rsa-sig' under the IKEv2 profile.

Answer

Configure 'authentication local rsa-sig' and 'authentication remote rsa-sig' under the IKEv2 profile.

Question 9

A network engineer is troubleshooting a connectivity problem between two hosts on the same VLAN. The engineer suspects a duplex mismatch on the switch port. Which command should be used to verify the duplex settings on a Cisco Catalyst switch interface?

Accepted Answer

show interfaces gigabitEthernet 0/1. To verify duplex settings on a Cisco Catalyst switch interface, the show interfaces command with the specific interface is the most appropriate because it displays the operational duplex, speed, and error counters. This allows the engineer to quickly identify a duplex mismatch, which often results in late collisions and performance degradation.

Answer

show controllers ethernet-controller

Answer

show interfaces counters errors

Answer

show interfaces status

Question 10

A network administrator is configuring a Cisco Catalyst switch to allow management access only from the subnet 10.10.10.0/24. The administrator wants to apply an ACL to the VTY lines. Which command correctly applies the ACL named MGMT to the VTY lines?

Accepted Answer

access-class MGMT in. To restrict management access to a Cisco device, an ACL is defined globally and then applied to the VTY lines using the access-class command in line configuration mode. The in keyword filters incoming connections. This ensures that only hosts matching the ACL's permit statements can establish remote management sessions, effectively limiting access to the specified subnet.

Answer

ip access-group MGMT in

Answer

ip access-class MGMT in

Answer

access-list MGMT in

Question 11

A network engineer is designing a Python script that uses the YANG models supported by a Cisco IOS XE device to retrieve interface statistics via NETCONF. The engineer wants to ensure the script can parse the response and extract the operational data. Which two steps are necessary when using the ncclient library to retrieve and process the data? (Choose two.)

Accepted Answer

Parse the XML response using a library like xml.etree.ElementTree or lxml. To retrieve interface statistics via NETCONF, the script must send a RPC with a filter to target the specific data. The response is XML, so parsing it with an XML library is required to extract values. Other options like or :candidate are for configuration management, not data retrieval.

Answer

Enable the :candidate capability on the device to retrieve statistics

Answer

Convert the XML response to JSON using the ncclient library

Answer

Use the <edit-config> RPC to read the interface statistics

Question 12

A network administrator is configuring a Cisco Catalyst switch to prevent unauthorized devices from connecting to an access port. The administrator wants to ensure that only one MAC address is allowed on the port, and if a violation occurs, the port should be shut down and an SNMP trap sent. Which port security violation mode should be configured?

Accepted Answer

shutdown. The shutdown violation mode meets both requirements: it shuts down the port (error-disabled) and sends an SNMP trap. Protect mode only drops traffic, restrict mode drops and sends traps but does not shut down the port. Errdisable is a state, not a mode. Thus, shutdown is the correct configuration for this security policy.

Answer

protect

Answer

restrict

Answer

errdisable

Question 13

A network engineer is configuring a Cisco Catalyst switch port that connects to an IP phone and a PC. The phone must tag its voice traffic with VLAN 200, and the PC must send untagged traffic that the switch places into VLAN 10. Which interface configuration accomplishes this?

Accepted Answer

switchport mode access
switchport access vlan 10
switchport voice vlan 200. The access-plus-voice configuration is the standard way to support an IP phone and a PC on one switch port. The access VLAN carries untagged PC traffic, and the voice VLAN carries 802.1Q-tagged phone traffic. This allows the phone to tag its own traffic while the PC sends untagged frames, and the switch classifies them into the correct VLANs without needing a trunk on the port.

Answer

switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 200

Answer

switchport mode access
switchport access vlan 200
switchport voice vlan 10

Answer

switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 200

Question 14

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) for a new office. The office has a mix of corporate laptops and guest devices. The administrator wants to ensure that guest devices can only access the Internet and are isolated from the corporate network. Which WLC feature should be configured to achieve this?

Accepted Answer

Guest WLAN with a dedicated interface and ACL. To isolate guest traffic, the administrator should create a separate guest WLAN and map it to a dedicated interface, such as a DMZ VLAN. Then, an ACL can be applied to that WLAN to restrict traffic to only Internet-bound destinations. This prevents guests from accessing corporate resources. Other options like dynamic VLAN or FlexConnect do not inherently provide the required isolation.

Answer

FlexConnect local switching

Answer

Dynamic VLAN assignment

Answer

Access Control Lists (ACLs) on the WLC

Question 15

A network engineer is comparing first-hop redundancy options for a campus access layer. The requirement is to provide gateway redundancy for IPv6 hosts while also allowing load sharing between two routers, and the solution must use an open standard rather than a Cisco-proprietary protocol. Which FHRP should the engineer select?

Accepted Answer

Virtual Router Redundancy Protocol (VRRP) version 3. VRRPv3 is an IETF open standard that supports IPv6 and allows multiple routers to participate in gateway redundancy, with load sharing achievable through multiple virtual router groups. It is the only listed option that is both open standard and suited to IPv6 first-hop redundancy with load sharing.

Answer

Proxy Address Resolution Protocol (Proxy ARP)

Answer

Gateway Load Balancing Protocol (GLBP)

Answer

Hot Standby Router Protocol (HSRP) version 2

Question 16

A network engineer is building a Python script to configure a Cisco IOS XE device via RESTCONF. The script sends a POST request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces with the JSON payload shown. The device returns HTTP 415 Unsupported Media Type. Which change to the script will resolve the error?

Accepted Answer

Add the header 'Content-Type: application/yang-data+json' to the request.. RESTCONF uses HTTP and requires standard headers to indicate payload format. When sending JSON, the Content-Type header must be set to application/yang-data+json. The server uses this to select the correct parser. Without it, the device returns 415 Unsupported Media Type, indicating it cannot process the body.

Answer

Add the header 'Accept: application/yang-data+json' to the request.

Answer

Include authentication credentials in the request body.

Answer

Change the HTTP method from POST to PUT.

Question 17

A network engineer is configuring a GRE tunnel between two Cisco IOS routers to transport multicast traffic and routing protocols across an IP network. Which two statements about GRE tunnel configuration and operation are true? (Choose two.)

Accepted Answer

GRE tunnels support multicast and broadcast traffic by default.. GRE tunnels support multicast and broadcast traffic, making them suitable for carrying routing protocol hellos and other multicast applications. Additionally, the tunnel source and destination must be reachable via the underlay network for the tunnel to come up. GRE does not provide encryption, and tunnel interfaces are typically assigned IP addresses from a separate subnet, not the same as physical interfaces.

Answer

GRE tunnel interfaces must be assigned an IP address from the same subnet as the physical interfaces.

Answer

GRE tunnels can only carry unicast IP traffic.

Answer

GRE tunnels automatically encrypt all traffic passing through them.

Question 18

A network architect is evaluating Cisco SD-WAN to connect branch offices to data centers and public cloud workloads. The architect wants to understand which capabilities are provided by the Cisco SD-WAN solution. (Choose two.)

Accepted Answer

Centralized policy management through vManage with templates pushed to edge devices. Cisco SD-WAN delivers application-aware routing that continuously measures path quality and steers traffic per policy, and it centralizes configuration and policy in vManage for scalable provisioning. These two capabilities align with the architect's goal of optimizing and managing branch-to-data-center and cloud connectivity across multiple transports.

Answer

Replacement of all branch routing with static routes only

Answer

Elimination of all encryption on the overlay tunnels

Answer

Mandatory use of MPLS as the only WAN transport

Question 19

A network administrator is deploying a new Cisco Catalyst switch in a data center. The switch must support a protocol that allows multiple physical links to be bundled into a single logical link, providing increased bandwidth and redundancy. The administrator wants to ensure that the protocol can dynamically negotiate the bundle formation with the connected device. Which protocol should be configured?

Accepted Answer

Link Aggregation Control Protocol (LACP). LACP is the IEEE standard for dynamic link aggregation, allowing switches from different vendors to negotiate an EtherChannel. It bundles multiple physical links into one logical link for increased bandwidth and redundancy. PAgP is Cisco-proprietary, while UDLD and STP serve entirely different purposes.

Answer

UniDirectional Link Detection (UDLD)

Answer

Spanning Tree Protocol (STP)

Answer

Port Aggregation Protocol (PAgP)

Question 20

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer must configure the NVE interface and ensure proper VXLAN data plane operation. Which two statements about VXLAN EVPN configuration on Nexus 9000 are true? (Choose two.)

Accepted Answer

The EVPN control plane requires BGP to be configured with the EVPN address family on the spine and leaf switches.. The NVE interface requires a reachable source interface for VXLAN tunnels to form, and the EVPN control plane relies on BGP with the EVPN address family to exchange MAC and IP reachability information. These two statements are true for VXLAN EVPN configuration on Nexus 9000. The other options are either general VXLAN facts not specific to EVPN configuration, incorrect requirements, or applicable only to flood-and-learn VXLAN.

Answer

VXLAN uses a 24-bit VNI field, allowing for up to 16 million unique VNIs.

Answer

Each VNI must be mapped to a unique VLAN on every leaf switch in the fabric.

Answer

The NVE interface must be configured with a multicast group for broadcast, unknown unicast, and multicast (BUM) traffic.