CCNP Architecture Practice Test 10 — 15 Questions

Question 1

A network architect is designing a Cisco SD-Access fabric for a large campus. The architect needs to ensure that the fabric can scale to support thousands of endpoints and that the control plane uses a dedicated protocol for endpoint registration and location. Which component of the SD-Access architecture provides this control plane function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LISP map server and map resolver. The SD-Access fabric uses LISP as its control plane protocol. The map server and map resolver maintain the endpoint ID-to-routing locator mappings, allowing fabric edge nodes to register endpoints and query for their locations. This design eliminates the need for flooding and supports large-scale deployments. DNA Center, VXLAN VTEPs, and ISE serve different roles: management, data forwarding, and policy/identity, respectively.

Answer

Cisco Identity Services Engine

Answer

Cisco DNA Center

Answer

VXLAN tunnel endpoints

Question 2

A network engineer is implementing Cisco TrustSec in a campus network. Which two components are required to enable Security Group Tagging (SGT) and enforcement? (Choose two.)

Accepted Answer

Cisco Identity Services Engine (ISE). To implement Cisco TrustSec with SGT tagging and enforcement, Cisco ISE is required to assign SGTs and define policies, and SXP is needed to propagate SGT mappings to non-TrustSec-capable devices. Together, they enable scalable group-based access control across the network.

Answer

Spanning Tree Protocol (STP) root guard

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Access Control List (ACL) for each user

Question 3

A network architect is designing a Cisco SD-Access fabric for a large campus. The architect needs to ensure that the fabric can scale to support thousands of endpoints and that the control plane uses a dedicated protocol for endpoint registration and location. Which component of the SD-Access architecture provides this control plane function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fabric control plane node. In Cisco SD-Access, the control plane node is the LISP map-server and map-resolver that stores endpoint identifiers (EIDs) and their routing locators (RLOCs). Fabric edge nodes register endpoints with the control plane node and query it for location resolution. This design centralizes endpoint reachability information, ensuring that every edge node has a consistent view of where endpoints are attached.

Answer

Fabric intermediate node

Answer

Fabric border node

Answer

Cisco DNA Center

Question 4

A network architect is designing a Cisco SD-Access fabric for a large campus. The architect needs to ensure that the fabric can scale to support thousands of endpoints and that the control plane uses a dedicated protocol for endpoint registration and location. Which component of the SD-Access architecture provides this control plane function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Control plane node. The control plane node hosts the LISP map-server and map-resolver, which together maintain the EID-to-RLOC mappings that tell fabric edge nodes where each endpoint is located. This mapping is essential for directing traffic to the correct edge node within the SD-Access fabric.

Answer

Fabric intermediate node

Answer

Fabric border node

Answer

Fabric wireless controller

Question 5

A network engineer is designing a high-availability campus network using Cisco StackWise Virtual technology on two Cisco Catalyst 9000 switches. The engineer wants to ensure that the control plane remains operational if one switch fails, and that the data plane can continue forwarding traffic with minimal disruption. Which statement accurately describes the operation of StackWise Virtual in this scenario?

Accepted Answer

One switch is active for control plane and management, while the other is standby; both switches forward data traffic using a unified data plane.. Cisco StackWise Virtual merges two physical switches into one logical switch. The active switch runs the control plane and management, while the standby switch is ready to take over. Both switches forward data traffic, providing active/active forwarding. This design ensures high availability: if the active switch fails, the standby becomes active, and data forwarding continues on the remaining switch with minimal disruption.

Answer

StackWise Virtual requires a dedicated Layer 3 link for control plane synchronization, and data traffic is forwarded only by the active switch.

Answer

The two switches load-balance control plane functions, with each switch managing a subset of VLANs and routing protocols independently.

Answer

Both switches run independent control planes and synchronize routing tables via a dedicated link, with each switch forwarding traffic independently.

Question 6

A network engineer is designing a new branch office that must support wired and wireless users with unified policy enforcement and automation. The company wants to minimize manual configuration and ensure consistent security policies across all access ports. Which Cisco architecture should the engineer recommend?

Accepted Answer

Cisco SD-Access. Cisco SD-Access is a campus fabric architecture that integrates wired and wireless access with centralized policy using Cisco ISE and VXLAN. It automates fabric provisioning and enforces consistent security policies across all access ports, directly addressing the need for unified policy and minimal manual configuration in a branch office.

Answer

Cisco SD-WAN

Answer

Cisco ACI

Answer

Cisco TrustSec

Question 7

A network architect at a large university is designing a new campus network that must support seamless roaming for thousands of wireless clients across multiple buildings. The design requires a centralized control plane with a distributed data plane to avoid traffic tromboning. Which Cisco architecture should the architect implement?

Accepted Answer

Cisco SD-Access with fabric-enabled switches and a fabric controller. Cisco SD-Access fabric provides a centralized control plane using LISP and a distributed data plane using VXLAN, which enables seamless roaming and avoids traffic tromboning by allowing edge nodes to forward traffic directly. This architecture is specifically designed for campus networks requiring mobility and scalability.

Answer

Cisco Digital Network Architecture (DNA) Center with traditional campus switching

Answer

Cisco Application Centric Infrastructure (ACI) with spine-leaf topology

Answer

Cisco Software-Defined WAN (SD-WAN) with vManage and vSmart controllers

Question 8

A network administrator is deploying a new Cisco Catalyst switch and wants to enable a feature that provides per-port MAC address limiting to prevent MAC flooding attacks. The administrator also wants to ensure that when the limit is exceeded, the port is err-disabled. Which command set accomplishes this?

Accepted Answer

switchport port-security, switchport port-security maximum 5, switchport port-security violation shutdown. To limit MAC addresses per port and err-disable the port on violation, the administrator must enable port security, set the maximum, and configure the shutdown violation mode. The shutdown mode places the port into an err-disabled state when the limit is exceeded, which is exactly what the scenario requires.

Answer

switchport port-security maximum 5, switchport port-security violation shutdown

Answer

switchport port-security, switchport port-security maximum 5, switchport port-security violation restrict

Answer

switchport port-security, switchport port-security maximum 5, switchport port-security violation protect

Question 9

A network engineer is deploying a new branch office that requires a WAN connection with built-in encryption and dynamic multipoint VPN capabilities. The engineer wants to use a Cisco technology that supports spoke-to-spoke communication without requiring traffic to traverse the hub. Which technology should be implemented?

Accepted Answer

DMVPN. DMVPN is designed to provide dynamic multipoint VPN connectivity, allowing spokes to establish direct tunnels with each other as needed. It combines mGRE, NHRP, and IPsec to deliver scalable, encrypted, and dynamic branch connectivity. This eliminates the need to route spoke-to-spoke traffic through the hub, improving latency and reducing hub bandwidth consumption.

Answer

IPsec VPN

Answer

GRE tunnel

Answer

MPLS L3VPN

Question 10

A network architect is evaluating Cisco SD-WAN for a company with 50 branch sites and two data centers. The design must provide application-aware routing, direct internet access at branches, and centralized policy management. Which Cisco SD-WAN component is responsible for distributing policies and reachability information to the branch devices?

Accepted Answer

vSmart. The vSmart controller is the control plane component of Cisco SD-WAN, responsible for distributing policies and reachability information using OMP. It enables centralized policy management and application-aware routing by sharing routing and policy data with all SD-WAN devices in the overlay.

Answer

vBond

Answer

vManage

Answer

vEdge or cEdge router

Question 11

A network architect is designing a new branch office that requires a switch to be managed centrally without a dedicated physical controller appliance on-site. The switch must support fabric capabilities and be onboarded using Plug and Play. Which Cisco Catalyst switch platform should be selected?

Accepted Answer

Cisco Catalyst 9200. The Catalyst 9200 is a fixed access switch that supports SD-Access fabric edge and can be discovered and onboarded by Cisco DNA Center using Plug and Play, eliminating the need for a local controller. The other platforms either lack fabric support or are designed for different roles.

Answer

Cisco Nexus 9000

Answer

Cisco Catalyst 2960-X

Answer

Cisco ASR 1000

Question 12

A network administrator is implementing Cisco TrustSec in a data center. The security team wants to enforce segmentation based on user roles rather than IP addresses. The administrator has configured security group tags (SGTs) on the access layer switches and now needs to propagate this information across the network. Which protocol should be used to carry SGT information between Cisco TrustSec-capable devices?

Accepted Answer

SXP. SXP (SGT Exchange Protocol) is designed to propagate SGT-to-IP mappings between Cisco TrustSec domains, particularly when devices cannot natively tag packets with SGTs. It enables policy enforcement across network boundaries by sharing the mapping of IP addresses to security groups. This allows consistent role-based segmentation even in mixed environments.

Answer

RADIUS

Answer

TACACS+

Answer

802.1X

Question 13

A network engineer is designing a Cisco SD-WAN fabric with two data centers and 200 branch sites. The requirement is that branch sites use direct internet access for SaaS applications while business-critical traffic to the data centers traverses a secure IPsec tunnel. Which Cisco SD-WAN feature should the engineer use to define and enforce these traffic steering policies?

Accepted Answer

Application-aware routing with centralized data policy. Cisco SD-WAN centralized data policy is the mechanism for defining traffic steering rules based on application and other match criteria. Combined with application-aware routing, which measures path performance, the engineer can direct SaaS traffic out the local internet connection and force business-critical traffic through IPsec tunnels to the data centers. This combination directly addresses the stated requirement.

Answer

TLOC extension between WAN edge routers at each branch

Answer

BFD-based path selection with static routes

Answer

Control plane and data plane separation with OMP

Question 14

A network architect is designing a new branch office that must support a single physical link carrying traffic for multiple tenants while keeping each tenant's routing and forwarding isolated. The design requires that the branch device maintain separate routing tables and forwarding instances per tenant, all on the same physical interface using 802.1Q encapsulation. Which architecture component should be implemented on the branch router to meet these requirements?

Accepted Answer

Virtual Routing and Forwarding (VRF) with 802.1Q subinterfaces. VRF is the Cisco IOS XE feature that creates separate routing and forwarding tables on one device. When paired with 802.1Q subinterfaces, each tenant's VLAN tag maps to a specific VRF, allowing a single physical link to carry isolated tenant traffic. This directly fulfills the requirement for per-tenant routing isolation on a shared branch link.

Answer

Multiprotocol Label Switching (MPLS) L3VPN on the branch router

Answer

Policy-Based Routing (PBR) with route maps

Answer

Generic Routing Encapsulation (GRE) tunnels per tenant

Question 15

A network architect is designing a new branch office that must support wired and wireless users on the same Layer 2 segment while enforcing consistent security policy regardless of where a user connects. The design must minimize the number of VLANs and IP subnets that must be provisioned as users move between floors. Which Cisco architecture feature should be used to meet these requirements?

Accepted Answer

Cisco SD-Access fabric with VXLAN overlay and policy-based segmentation. The requirement is location-independent identity with consistent policy and minimal VLAN/subnet provisioning across wired and wireless. SD-Access uses a VXLAN overlay with a LISP control plane and Cisco TrustSec group tags, allowing users to retain the same subnet and policy anywhere in the fabric. StackWise Virtual, standalone TrustSec, and VLAN trunking to a WLC all remain tied to physical VLAN boundaries and cannot deliver the same outcome.

Answer

Cisco StackWise Virtual on the distribution switches

Answer

Cisco Software-Defined Access with traditional VLAN trunking to the WLC

Answer

Cisco TrustSec with static SGACL enforcement on access ports