CCNP Drag & Drop — 50 Questions

Question 1

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Accepted Answer

Client initiates TLS handshake with ASA. AnyConnect session establishment begins with the client establishing a TLS tunnel to the ASA headend. The ASA presents its digital certificate for authentication. The client then authenticates the user, and the ASA assigns an IP address from a pool. Finally, the client installs the virtual adapter and the session is established.

Question 2

Drag and drop the steps of deploying a CoPP policy on a Cisco IOS-XE router into the correct order, from first to last.

Accepted Answer

Create access-lists for traffic classification. Deploying CoPP requires first defining ACLs to classify traffic, then creating class maps, then a policy map, then applying it to the control plane, and finally verifying the policy.

Question 3

Drag and drop the steps of OSPF summarization at ABR configuration steps into the correct order, from first to last.

Accepted Answer

Identify subnets to summarize. First, identify the subnets to summarize into a single prefix. Then, configure the area range command on the ABR under the OSPF process, specifying the area and the summary prefix. Optionally, set the 'not-advertise' keyword to suppress the summary. Verify the summary route in the OSPF database using 'show ip ospf summary-address'. Finally, check that the summary route appears in the routing table of other routers.

Question 4

Drag and drop the steps of Cisco IOS-XE mdt subscription via CLI configuration into the correct order, from first to last.

Accepted Answer

Enter telemetry configuration mode. The CLI configuration order follows Cisco IOS-XE syntax: enter telemetry mode, define subscription, set receiver, specify stream, and apply sensor path.

Question 5

Drag and drop the steps of DHCP snooping operation on a Cisco switch into the correct order, from first to last.

Accepted Answer

Enable DHCP snooping globally. DHCP snooping begins by enabling the feature globally with 'ip dhcp snooping'. Then, the feature is enabled on specific VLANs. Trusted interfaces (typically uplinks to DHCP servers) are configured with 'ip dhcp snooping trust'. The switch then intercepts DHCP messages, building the DHCP snooping binding database from valid server responses. Finally, any DHCP server messages received on untrusted interfaces are dropped to prevent rogue server attacks.

Question 6

Drag and drop the steps of SD-WAN zero-touch provisioning (ZTP) flow into the correct order, from first to last.

Accepted Answer

Device boots and obtains IP via DHCP. The ZTP flow begins with the device obtaining an IP address via DHCP, then contacting the cloud portal to authenticate and receive the vManage list, followed by establishing a DTLS connection to vManage, downloading the full configuration, and finally joining the control plane.

Question 7

Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.

Accepted Answer

Identify YANG module for interface statistics. The process starts with identifying the YANG module, then navigating the tree to the interface container, retrieving statistics, and optionally filtering or using NETCONF/RESTCONF.

Question 8

Drag and drop the steps of using a Python REST API call to retrieve device configuration via Cisco DNA Center into the correct order, from first to last.

Accepted Answer

Authenticate to DNA Center API and get token. The process begins with authenticating to the DNA Center API to obtain a token. Then, the device UUID is retrieved using a GET request to the device list endpoint. Next, a GET request is sent to fetch the running configuration for that device. The JSON response is parsed to extract the configuration text. Finally, the configuration is saved to a local file.

Question 9

Drag and drop the steps of gRPC dial-in telemetry session from collector into the correct order, from first to last.

Accepted Answer

Collector opens gRPC channel to device. The collector initiates the connection, authenticates, requests data, and the device streams telemetry back until the session ends.

Question 10

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Accepted Answer

Create SPAN session number. First specify the session, then add source ports and direction, apply VLAN filter, set destination, and activate the session.

Question 11

Drag and drop the steps of NAPALM get_facts() retrieval from IOS-XE device into the correct order, from first to last.

Accepted Answer

Import napalm and get_network_driver. The correct order starts with importing the NAPALM library and driver, then creating a driver object with device credentials, calling the open() method to establish the connection, invoking get_facts() to retrieve device facts, and finally closing the connection.

Question 12

Drag and drop the steps of Netconf/Yang-based device monitoring subscription into the correct order, from first to last.

Accepted Answer

Establish NETCONF over SSH. First establish a NETCONF session, then subscribe to a YANG data stream, and finally receive periodic push updates.

Question 13

Drag and drop the steps of Private VLAN (PVLAN) configuration steps into the correct order, from first to last.

Accepted Answer

Create the primary VLAN with vlan <id>. PVLAN configuration requires first creating the primary VLAN, then the secondary VLANs (community or isolated), associating them, and finally configuring host ports as PVLAN ports. The order ensures proper VLAN hierarchy and port assignment.

Question 14

Drag and drop the steps of QoS policing with two-rate three-color marker (RFC 2698) into the correct order, from first to last.

Accepted Answer

Define class-maps to match traffic. First, configure the police command with cir, pir, and conform, exceed, violate actions. Then, apply the policy to the interface. The marker uses CIR and PIR to assign colors.

Question 15

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Accepted Answer

Configure underlay network with IS-IS or OSPF. SD-Access deployment begins with underlay configuration for physical connectivity, then overlay setup with LISP/VXLAN, followed by policy definition and integration with DNA Center for automation and assurance.

Question 16

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Accepted Answer

View current ACL with 'show access-list'. Sequence numbers allow editing named ACLs without re-entering all entries. The correct order is: view current entries, insert a new entry at a specific sequence, then verify the updated ACL.

Question 17

Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.

Accepted Answer

Ingress switch classifies endpoint and assigns SGT. Inline tagging embeds SGT in the Ethernet frame header; the ingress switch classifies the endpoint, adds the SGT tag, forwards the frame across the fabric, and the egress switch enforces policy based on the tag.

Question 18

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Accepted Answer

Create job template with playbook and inventory. In Ansible Tower/AWX, a job template execution starts with creating the template, launching it, which triggers inventory and credential resolution, then the playbook runs, and finally the job output is displayed for review.

Question 19

Drag and drop the steps of LACP active/passive mode negotiation into the correct order, from first to last.

Accepted Answer

Active mode ports transmit LACPDUs. LACP negotiation starts with active ports sending LACPDUs, passive ports listening, then exchanging system/port priorities, selecting aggregator, and finally forming the bundle.

Question 20

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Accepted Answer

Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status. VTP requires setting mode and domain before trunking works; verification confirms operation.

Answer

Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Answer

Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status

Answer

Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status