CCNP Mock Exam 96 — 25 Questions

Question 1

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

Accepted Answer

The device's SSH server is not fully initialized. The error 'ValueError: SSH session not active' indicates that Netmiko attempted to establish an SSH connection but the session was not fully active. The most likely cause is that the device's SSH server is not fully initialized, which can happen if the device is still booting or the SSH process has not completed startup. This is distinct from reachability or credential issues, as the device responds to pings but the SSH daemon is not ready to accept connections.

Answer

The connection timeout is set too low

Answer

The device has reached the maximum number of SSH sessions

Answer

The device requires an enable password but none was provided

Question 2

A data center uses Cisco Nexus 9000 switches with VXLAN EVPN to provide network virtualization. The operations team notices that VLAN 100 (mapped to VNI 10100) is not reachable across the fabric, although other VLANs work fine. The NVE interface is up, and the EVPN address-family is configured. Which two actions should the engineer take to isolate the issue?

Accepted Answer

Verify that VLAN 100 is mapped to VNI 10100 consistently on all VTEPs.. Option C is correct because VXLAN EVPN requires consistent VLAN-to-VNI mapping across all VTEPs in the fabric. If VLAN 100 is mapped to VNI 10100 on some switches but not others, traffic for that VNI will not be forwarded correctly, as the mapping is used to associate local VLANs with the VXLAN segment. Option D is correct because the VNI must be explicitly enabled under the NVE interface to participate in VXLAN tunnel termination; without it, the VTEP will not encapsulate or decapsulate traffic for VNI 10100.

Answer

Check if EVPN type-3 routes are being advertised for VNI 10100.

Answer

Confirm that multicast group 239.1.1.1 is reachable across the underlay.

Answer

Check if the MTU on the underlay is set to at least 1550 bytes.

Question 3

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Accepted Answer

Enables Layer 2 extension across Layer 3 boundaries.. VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Answer

Eliminates the need for STP by using a centralized controller.

Answer

Uses only multicast for control plane learning.

Answer

Provides native encryption for data in transit.

Question 4

A network engineer is troubleshooting a performance issue with a virtual firewall (vFW) running on a Cisco NFVIS host. The vFW is experiencing high packet loss during peak traffic. The engineer checks the NFVIS monitoring dashboard and sees that the vFW's CPU usage is low, but the host's memory usage is high. What is the most likely cause of the packet loss?

Accepted Answer

The host is under memory pressure, causing the hypervisor to swap or balloon memory from the vFW.. When the NFVIS host experiences high memory pressure, the hypervisor may reclaim memory from virtual machines (VMs) using mechanisms such as ballooning or swapping. This reduces the memory available to the vFW, causing it to drop packets because its packet buffers or operating system memory are forcibly reclaimed. The vFW's CPU remains low because the bottleneck is memory, not processing power.

Answer

The vFW is CPU-bound, but the monitoring is inaccurate.

Answer

The host's CPU is oversubscribed, causing vCPU starvation.

Answer

The vFW's packet buffer is exhausted, but the monitoring does not show it.

Question 5

Given the following configuration:

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip access-group 101 in
!
access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 101 deny ip any any

What is the effect of this configuration?

Accepted Answer

Incoming traffic from 192.168.1.0/24 to any destination on port 80 is permitted; all other incoming traffic is denied.. The configuration applies access-list 101 inbound on GigabitEthernet0/0. The first ACE permits TCP traffic from source network 192.168.1.0/24 to any destination on port 80 (HTTP). The second ACE denies all other IP traffic. Since the access list is applied in the inbound direction, it filters traffic entering the router through that interface. Therefore, only incoming traffic matching the permit statement is allowed; everything else is denied.

Answer

Outgoing traffic from the router to 192.168.1.0/24 on port 80 is permitted; all other outgoing traffic is denied.

Answer

Incoming traffic from any source to 192.168.1.0/24 on port 80 is permitted; all other incoming traffic is denied.

Answer

The access-list will permit all TCP traffic from 192.168.1.0/24, regardless of destination port.

Question 6

A network team must design a QoS policy for a WAN link that carries voice, video, and data. The policy must ensure that voice traffic is never dropped, even during congestion. Which queuing mechanism should be used for the voice class?

Accepted Answer

Low-latency queuing (LLQ).. Low-latency queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, allowing voice traffic to be placed in a strict priority queue that is serviced first before any other queues. This ensures that voice packets are never dropped due to congestion, as long as the configured policer rate is not exceeded, meeting the requirement that voice traffic is never dropped.

Answer

Class-based weighted fair queuing (CBWFQ).

Answer

Weighted random early detection (WRED).

Answer

First-in, first-out (FIFO) queuing.

Question 7

What is the default CoS-to-queue mapping on a Cisco switch that supports QoS?

Accepted Answer

CoS 0-1 to queue 1, CoS 2-3 to queue 2, CoS 4-5 to queue 3, CoS 6-7 to queue 4. On Cisco switches that support QoS, the default Class of Service (CoS) to queue mapping distributes CoS values across four egress queues. CoS 0 and 1 are mapped to queue 1 (best effort), CoS 2 and 3 to queue 2, CoS 4 and 5 to queue 3, and CoS 6 and 7 to queue 4 (highest priority). This mapping is defined by the default trust state and is used to prioritize traffic based on the 802.1p priority bits in the VLAN tag.

Answer

CoS 0-2 to queue 1, CoS 3-5 to queue 2, CoS 6-7 to queue 3

Answer

CoS 0 to queue 1, CoS 1 to queue 2, CoS 2 to queue 3, CoS 3 to queue 4

Answer

All CoS values are mapped to a single queue by default.

Question 8

A company is migrating its legacy firewall services to a virtualized environment using Cisco NFV. The network engineer deploys a virtual firewall (vFW) on an NFVIS-enabled UCS platform. After the deployment, traffic through the vFW is intermittent and performance monitoring shows high CPU usage on the host. Which action should the engineer take to improve performance?

Accepted Answer

Enable SR-IOV on the physical NICs and assign VFs to the vFW.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch and reducing CPU overhead for packet processing. In an NFVIS environment, high host CPU usage with intermittent traffic indicates that the vFW is consuming excessive CPU cycles due to software-based I/O. Assigning VFs to the vFW offloads packet handling to the NIC hardware, lowering host CPU utilization and stabilizing traffic.

Answer

Increase the number of vCPUs allocated to the vFW VM.

Answer

Configure QoS policies on the vFW to prioritize traffic.

Answer

Disable hyperthreading on the host CPU.

Question 9

An enterprise is deploying a virtual router (vRouter) as part of its NFV infrastructure. The engineer needs to ensure that the vRouter can handle a sudden spike in traffic without dropping packets. The vRouter is running on a KVM hypervisor. What should the engineer configure to guarantee CPU resources for the vRouter during peak demand?

Accepted Answer

Configure CPU pinning and CPU reservation for the vRouter VM.. CPU pinning binds the vRouter's virtual CPUs to specific physical cores, preventing other processes from using them, while CPU reservation guarantees a minimum amount of CPU capacity. Together, they ensure deterministic CPU availability during traffic spikes, preventing packet drops due to resource contention on the KVM hypervisor.

Answer

Enable memory ballooning on the vRouter VM.

Answer

Enable DPDK on the vRouter's virtual NICs.

Answer

Set the vRouter VM to use NUMA node pinning.

Question 10

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Accepted Answer

The bridges are all mapped to the same physical interface without subinterfaces, causing a conflict.. In Cisco NFVIS, bridges are Layer 2 forwarding constructs that must be mapped to a physical interface (or subinterface) to provide external connectivity. When multiple bridges are all mapped to the same physical interface without using subinterfaces (e.g., GigabitEthernet0/0), they share the same VLAN and MAC domain, causing traffic from the second, third, and fourth bridges to be dropped or misdirected. The VNF can only communicate on the first bridge because that bridge's vNIC is the only one that successfully establishes a valid forwarding path through the physical interface.

Answer

The VNF's operating system does not support multiple NICs.

Answer

The vNICs have duplicate MAC addresses.

Answer

The bridges were created in the wrong order.

Question 11

An enterprise is migrating its data center to a leaf-spine architecture. The design must provide high availability and support for east-west traffic patterns. Which design choice best meets these requirements?

Accepted Answer

Implement a leaf-spine topology with multiple spine switches and ECMP.. A leaf-spine topology with multiple spine switches and Equal-Cost Multi-Path (ECMP) routing provides high availability by eliminating single points of failure and supports east-west traffic patterns by ensuring that any leaf switch can reach any other leaf switch with a consistent number of hops (typically one hop via a spine). ECMP allows load balancing across all available spine links, maximizing bandwidth and redundancy for data center east-west flows.

Answer

Deploy a collapsed core with a single pair of core switches.

Answer

Use a three-tier hierarchical design with access, distribution, and core layers.

Answer

Use a ring topology connecting all switches in a loop.

Question 12

A network engineer is deploying a virtual WAN edge device using Cisco SD-WAN on an NFVIS platform. After powering on the VM, the device fails to boot and the NFVIS console shows 'ERROR: No bootable device found'. The engineer verified that the ISO image is correctly uploaded. What is the most likely cause?

Accepted Answer

The boot order in the VM configuration does not have the CD-ROM (ISO) as the first device.. Option C is correct because the error 'No bootable device found' indicates that the VM attempted to boot from a device that does not contain a bootable operating system. In NFVIS, when deploying a virtual WAN edge device from an ISO, the VM's boot order must be configured to prioritize the CD-ROM (ISO) device. If the boot order defaults to the virtual hard disk (which is empty before installation), the VM will fail to find a bootable medium and produce this exact error.

Answer

The VM's virtual disk size is too small for the WAN edge image.

Answer

The VM's CPU type is set to 'host-passthrough' instead of 'qemu64'.

Answer

The ISO image is corrupted and NFVIS cannot read it.

Question 13

A company uses Cisco NFVIS to host a virtual ASA (vASA) and a virtual router (vRouter). The engineer notices that the vASA cannot communicate with the vRouter even though both are on the same NFVIS host. The vASA is connected to a bridge network, and the vRouter is connected to a different bridge. What should the engineer do to enable communication between the two VNFs?

Accepted Answer

Create a new bridge that connects both VNFs, or use a virtual switch to route between the bridges.. In NFVIS, VNFs attached to different bridge networks are isolated at Layer 2. To enable communication between them, you must either create a new bridge that connects both VNFs or use a virtual switch (e.g., a Linux bridge with routing enabled) to forward traffic between the two bridges. This allows the VNFs to share a common Layer 2 domain or have a routed path through the hypervisor.

Answer

Connect a physical cable between two ports on the NFVIS host.

Answer

Configure VLAN tagging on both VNFs with the same VLAN ID.

Answer

Add a static route on each VNF pointing to the other VNF's IP address.

Question 14

An engineer is managing a Cisco NFVIS host running multiple virtual network functions (VNFs). The engineer needs to upgrade the NFVIS software to a new version that includes critical security patches. The upgrade process must minimize downtime. Which upgrade method should the engineer use?

Accepted Answer

Use the 'software install add' command to stage the image, then 'activate' and 'commit' with a single reboot.. Option B is correct because the 'software install add' command stages the new NFVIS image, followed by 'activate' and 'commit' with a single reboot, which minimizes downtime by performing the upgrade in a single reboot cycle. This method is the recommended approach for upgrading NFVIS while preserving existing VNF configurations and minimizing service disruption.

Answer

Use the 'patch install' command to apply the upgrade without rebooting.

Answer

Perform a clean installation of the new NFVIS version and redeploy all VNFs.

Answer

Migrate all VNFs to another NFVIS host, then upgrade the original host.

Question 15

A large enterprise is redesigning its campus network to support 5000 users across three buildings. The design must provide high availability and fast convergence in case of a link failure. The network engineer is considering using Spanning Tree Protocol (STP) in the access layer. What is the primary design concern with using STP in this scenario?

Accepted Answer

STP will cause slow convergence and inefficient use of redundant links.. STP (802.1D) converges slowly, typically taking 30-50 seconds (listening + learning states) after a topology change. In a large campus network with 5000 users, this delay causes unacceptable downtime. Additionally, STP blocks redundant links to prevent loops, wasting bandwidth that could be used for load balancing. Modern alternatives like Rapid PVST+ (802.1w) or MST (802.1s) offer sub-second convergence, making classic STP a poor choice for high-availability designs.

Answer

STP requires all switches to be in the same VLAN to function correctly.

Answer

STP cannot be used with 5000 users due to MAC address table limitations.

Answer

STP will cause broadcast storms in a three-building design.

Question 16

An enterprise network uses OSPF in the core and EIGRP in the campus distribution layer. The engineer needs to redistribute routes between the two protocols. Which design consideration is most important to prevent routing loops?

Accepted Answer

Set appropriate administrative distance values for redistributed routes.. Setting appropriate administrative distance values for redistributed routes is crucial to prevent routing loops when redistributing between OSPF and EIGRP. By default, EIGRP has an administrative distance of 170 for external routes and 90 for internal routes, while OSPF uses 110. If redistributed routes are not assigned a higher administrative distance, a router might prefer a redistributed route over a directly learned route, creating a feedback loop where routes are re-injected into the original protocol. Adjusting the administrative distance ensures that redistributed routes are less preferred than native routes, breaking the loop.

Answer

Use route maps to filter all redistributed routes.

Answer

Enable OSPF on all EIGRP interfaces.

Answer

Use a single routing protocol throughout the network.

Question 17

An enterprise network is experiencing high CPU utilization on the distribution layer switches. The design uses VLANs with SVIs for inter-VLAN routing, and HSRP for first-hop redundancy. The engineer notices that the standby switch is also experiencing high CPU. What is the most likely cause?

Accepted Answer

The standby switch is processing HSRP hellos for all VLANs, causing CPU spikes.. In an HSRP setup, both the active and standby routers process incoming Hello messages for every VLAN on which HSRP is configured. Even though the standby switch does not forward inter-VLAN traffic, it must still receive and process periodic HSRP hellos (default every 3 seconds) to maintain its role and detect active failures. With a large number of VLANs, the cumulative CPU overhead from processing these hellos can cause high utilization on both switches.

Answer

The standby switch is forwarding all broadcast traffic due to a misconfigured STP root.

Answer

The standby switch is performing routing for all VLANs because the active switch failed.

Answer

The standby switch is processing VTP updates from the distribution layer.

Question 18

A network engineer is designing a WAN connection for a branch office that requires high availability and bandwidth aggregation. The branch has two internet connections from different ISPs. The engineer wants to use both links actively for load balancing and failover. Which design approach should be used?

Accepted Answer

Deploy SD-WAN to actively use both links with policy-based load balancing.. SD-WAN is the correct design because it natively supports active/active utilization of multiple WAN links with policy-based load balancing, allowing traffic to be distributed across both ISP connections based on application policies, SLA metrics, or other criteria. It also provides seamless failover by dynamically rerouting traffic if one link fails, meeting the requirements for high availability and bandwidth aggregation without relying on a single active link.

Answer

Configure static routes with different metrics for each link and use HSRP for failover.

Answer

Use BGP with both ISPs and rely on BGP best path selection for load balancing.

Answer

Implement a VPN tunnel between the branch and headquarters using only one link.

Question 19

A company is deploying a new data center and needs to choose between a three-tier (core, aggregation, access) and a spine-leaf architecture. The network engineer is concerned about east-west traffic patterns for server virtualization. Which architecture is most suitable and why?

Accepted Answer

Spine-leaf, because it provides equal-cost multipath (ECMP) for all leaf-to-leaf traffic.. Spine-leaf architecture is most suitable for east-west traffic patterns because it provides a full mesh of connections between leaf switches and spine switches, enabling equal-cost multipath (ECMP) routing. This allows all leaf-to-leaf traffic to traverse multiple parallel paths with equal cost, maximizing bandwidth utilization and minimizing latency, which is critical for server virtualization traffic that often moves between hypervisors.

Answer

Three-tier, because it offers more redundancy with multiple aggregation layers.

Answer

Spine-leaf, because it supports legacy spanning tree protocols.

Answer

Three-tier, because it is easier to manage with traditional VLANs.

Question 20

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

Accepted Answer

Fabric Edge node. The Fabric Edge node is the correct answer because it is the SD-Access component that serves as the attachment point for both wired and wireless endpoints. In an SD-Access fabric, the Fabric Edge node terminates the VXLAN tunnels from the wireless LAN controller (WLC) and applies consistent policy (e.g., SGT-based ACLs) to traffic from both wired and wireless users, ensuring seamless integration of the existing wireless infrastructure.

Answer

Fabric Control node

Answer

Fabric Border node

Answer

Wireless LAN Controller (WLC)