CCNP Architecture Practice Test 11 — 15 Questions

Question 1

A network engineer is designing a wireless network for a large auditorium that must support high-density client access. The engineer plans to use Cisco Catalyst 9800 Series Wireless Controllers and Wi-Fi 6 access points. Which feature should be enabled to improve airtime efficiency and reduce overhead for many concurrent clients?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OFDMA. OFDMA is a Wi-Fi 6 feature that partitions a channel into smaller resource units, allowing simultaneous transmission to multiple clients. This reduces contention and overhead, making it ideal for high-density environments like auditoriums. By enabling OFDMA, the network can serve many clients more efficiently, improving overall throughput and user experience.

Answer

802.11r

Answer

MU-MIMO

Answer

Band steering

Question 2

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoint traffic is encapsulated and forwarded between fabric edge nodes. The design uses an overlay that carries Layer 2 and Layer 3 traffic over a Layer 3 underlay. Which protocol does Cisco SD-Access use for the data plane encapsulation in this fabric?

Accepted Answer

VXLAN with a Group Policy Option (GPO) header. Cisco SD-Access fabric data plane uses VXLAN encapsulation, enhanced with a Group Policy Option header. This header carries the source group tag, enabling scalable group-based policy enforcement. The control plane uses LISP for endpoint location mapping, but the actual packet encapsulation for endpoint traffic is VXLAN, making it the correct choice for the data plane.

Answer

LISP with a locator/ID separation header

Answer

OTV with an adjacency server

Answer

GRE with a fabric header

Question 3

A network engineer is deploying a Cisco SD-WAN solution with two data center sites and 40 branch sites. The design must ensure that traffic from a branch to a critical application in Data Center A always prefers the MPLS transport while using the internet transport only when MPLS latency exceeds a defined threshold. Which Cisco SD-WAN component and feature combination accomplishes this?

Accepted Answer

vSmart controller with application-aware routing policy using SLA classes and preferred transport. Cisco SD-WAN implements application-aware routing policy on the vSmart controller. The policy defines SLA classes with latency, jitter, and loss thresholds and maps applications to preferred transports. When a preferred transport such as MPLS meets the SLA, traffic stays there; when the SLA is violated, the policy permits failover to the internet transport. The vBond orchestrator, CLI templates, and OSPF cost tuning do not provide this conditional, application-specific behavior.

Answer

vManage with CLI templates that set static routes for the application subnet

Answer

vSmart controller with OSPF cost manipulation on the MPLS transport

Answer

vBond orchestrator with BFD echo and OMP route redistribution

Question 4

A network engineer is configuring a new Cisco Wireless LAN Controller (WLC) and needs to ensure that the WLC can be managed remotely from a different subnet. The WLC is connected to a switch port that is configured as a trunk. Which interface on the WLC must be configured with an IP address to allow remote management?

Accepted Answer

Management interface. The management interface on a Cisco WLC is the correct interface for remote management. It is configured with an IP address and default gateway, allowing access from different subnets. It is also used for AP communication and other services. The service port is for out-of-band management, the virtual interface is for internal functions, and dynamic interfaces are for user traffic.

Answer

Virtual interface

Answer

Dynamic interface

Answer

Service port

Question 5

A network architect is designing a new branch office that requires a lightweight, scalable solution for device onboarding and policy enforcement. The branch has minimal on-site IT staff and must integrate with the existing Cisco DNA Center deployment at headquarters. Which Cisco SD-Access fabric role is responsible for providing the layer 3 gateway and policy enforcement for wired and wireless endpoints in this branch?

Accepted Answer

Fabric edge node. The fabric edge node is the device that connects endpoints to the SD-Access fabric and serves as their default gateway. It enforces group-based policies and encapsulates traffic in VXLAN toward other fabric nodes. In a branch with limited IT staff, it enables zero-touch onboarding and centralized policy from Cisco DNA Center, satisfying both scalability and integration needs.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Fabric intermediate node

Question 6

A network architect is designing a campus network that must support seamless mobility for wireless clients across Layer 3 boundaries. The design requires that clients retain their IP address when roaming between different subnets. Which Cisco technology should be implemented to achieve this?

Accepted Answer

Cisco Locator/ID Separation Protocol (LISP) with mobility. LISP separates endpoint identity from location, enabling a wireless client to retain its IP address as it roams across Layer 3 boundaries. The client's endpoint identifier remains constant, while the mapping to its new routing locator is updated in the LISP mapping system. This makes LISP the appropriate technology for seamless mobility in a campus design.

Answer

Cisco Application Centric Infrastructure (ACI) with endpoint groups

Answer

Cisco Overlay Transport Virtualization (OTV) between campus buildings

Answer

Cisco FabricPath with Layer 3 forwarding

Question 7

A network administrator is designing a campus network that must support a single management IP address for a pair of Catalyst 9000 switches acting as a collapsed core. The design requires that both switches actively forward traffic, that the control plane operate as one logical device, and that a single configuration file be maintained. Which technology meets these requirements?

Accepted Answer

Cisco StackWise Virtual. StackWise Virtual merges two Catalyst 9000 switches into a single logical switch using a virtual switch link. It provides one management IP, one configuration file, and active-active forwarding, which is precisely what the collapsed core design requires. Classic StackWise is intended for different topologies, while vPC with HSRP and HSRP/GLBP keep separate control planes and configurations, so they do not meet the single logical device requirement.

Answer

Cisco IOS-XE with HSRP and GLBP

Answer

Cisco StackWise with a StackWise cable

Answer

Virtual Port Channel with HSRP

Question 8

A network architect is deploying a Cisco SD-WAN fabric with a single data center and 40 branch sites. The design requires that all branch sites use a single IPsec tunnel to reach the data center VPN concentrator, and that traffic between branches must transit the data center rather than form direct site-to-site tunnels. Which Cisco SD-WAN topology should the architect select?

Accepted Answer

Hub-and-spoke. The requirement that every branch hold one tunnel to the data center and that branch-to-branch traffic be hairpinned through the hub is the defining characteristic of a hub-and-spoke SD-WAN topology. Full and partial mesh topologies deliberately create direct spoke-to-spoke tunnels, which would bypass the VPN concentrator and contradict the stated design.

Answer

Point-to-point

Answer

Full mesh

Answer

Partial mesh

Question 9

A network administrator is deploying a Cisco SD-WAN solution. The administrator wants to ensure that control plane information is securely distributed between vSmart controllers and vEdge routers. Which protocol does Cisco SD-WAN use for this purpose?

Accepted Answer

OMP. Cisco SD-WAN uses Overlay Management Protocol (OMP) for control plane communication between vSmart controllers and vEdge routers. OMP distributes routing, policy, and service information, and it runs over secure TLS/DTLS sessions. While BGP, IPsec, and DTLS play roles in SD-WAN, OMP is the specific control plane protocol that enables the overlay network's dynamic routing and policy enforcement.

Answer

BGP

Answer

IPsec

Answer

DTLS

Question 10

A network engineer is deploying a Cisco Wireless LAN Controller (WLC) in a large campus with 500 access points. The engineer must ensure that the WLC can handle the expected client load and that APs can join the controller securely. Which protocol does the AP use to discover and join the WLC, and what is the default secure management protocol for the WLC GUI?

Accepted Answer

CAPWAP for AP join; HTTPS for WLC GUI. Access points use CAPWAP to discover and join a WLC, establishing both control and data tunnels. The control channel is secured with DTLS, while the data channel may also be encrypted. The WLC GUI is accessed via HTTPS by default, ensuring secure management. This pairing is standard for Cisco wireless deployments and satisfies the need for secure AP join and management.

Answer

LWAPP for AP join; HTTP for WLC GUI

Answer

DTLS for AP join; HTTPS for WLC GUI

Answer

CAPWAP for AP join; HTTP for WLC GUI

Question 11

A network architect is evaluating Cisco SD-Access for a large campus. The architect must ensure the fabric supports policy enforcement based on user identity and group membership, and that the fabric can scale to thousands of endpoints without flooding the underlay. Which two statements are correct about how SD-Access achieves these goals? (Choose two.)

Accepted Answer

The LISP control plane in SD-Access registers endpoint EID-to-RLOC mappings so fabric edge nodes can resolve destinations without flooding the underlay.. SD-Access scales by moving endpoint reachability into the LISP control plane, where EID-to-RLOC mappings are registered and resolved, avoiding underlay flooding. Policy is enforced with Cisco TrustSec group tags carried in the VXLAN Group Policy Option header, enabling group-based ACLs at fabric edge nodes. The underlay is a routed IS-IS fabric that does not carry endpoint host routes or rely on VXLAN flooding, and the overlay does not require a single stretched bridge domain.

Answer

The fabric uses a single shared bridge domain across all edge nodes to avoid VLAN proliferation.

Answer

The underlay uses VXLAN flooding to propagate endpoint reachability to all fabric edge nodes.

Answer

Fabric edge nodes use OSPF to advertise endpoint host routes into the underlay for reachability.

Question 12

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoints in the same virtual network (VN) can communicate across fabric sites while endpoints in different VNs remain isolated. Which control plane component is responsible for propagating endpoint reachability information between fabric sites?

Accepted Answer

Cisco DNA Center fabric control plane node. In Cisco SD-Access, the control plane node runs LISP and is responsible for registering endpoint EID-to-RLOC mappings and sharing them with control plane nodes in other fabric sites over the transit network. This allows endpoints in the same virtual network to be reached across sites while VN isolation is preserved through separate LISP instance IDs and VRFs. Border and intermediate nodes forward data plane traffic but do not propagate reachability.

Answer

Cisco DNA Center fabric site border node

Answer

Cisco DNA Center fabric intermediate node

Answer

Cisco Identity Services Engine policy node

Question 13

A network engineer is deploying Cisco SD-WAN in a hybrid cloud environment. The company requires secure segmentation between guest, employee, and IoT traffic across all branches. The engineer must ensure that traffic from each segment is isolated and that policies can be applied per segment. Which two components are used to achieve this segmentation? (Choose two.)

Accepted Answer

VPN segments in vManage. In Cisco SD-WAN, segmentation is achieved by creating VPN segments in vManage and mapping them to VRF instances on the WAN Edge devices. The VPN segments define the logical separation, and the VRFs enforce it by maintaining separate routing and forwarding tables. Together, they provide end-to-end isolation and allow policies to be applied per segment. Other options like VLANs or IPsec tunnels do not provide fabric-wide segmentation, and application-aware routing policies are for path selection, not isolation.

Answer

Application-aware routing policies

Answer

IPsec tunnels between branches

Answer

VLANs on the WAN Edge routers

Question 14

An engineer is deploying a Cisco SD-WAN solution using Cisco vManage. The company requires that the WAN edge devices authenticate to the controllers using certificates signed by an enterprise PKI rather than the default Cisco-signed certificates. Which component must be configured to issue and manage these certificates?

Accepted Answer

An external certificate authority (CA) server. Cisco SD-WAN supports two certificate options: the default Cisco-signed certificates or enterprise PKI. For enterprise PKI, an external CA must sign the device certificates. The vManage, vSmart, and vBond components do not issue certificates; they only validate them during control plane establishment. Therefore, an external CA server is required to meet the enterprise PKI requirement.

Answer

Cisco vBond orchestrator

Answer

Cisco vManage

Answer

Cisco vSmart controller

Question 15

A company is migrating its branch WAN to a Cisco SD-WAN solution. The design team wants to use a single overlay that supports both point-to-point and multipoint traffic, and they want to avoid running separate tunnels for unicast and multicast. Which Cisco SD-WAN technology should they enable on the overlay?

Accepted Answer

Cisco SD-WAN multicast with replication using a rendezvous point. Multicast support in Cisco SD-WAN uses overlay replication coordinated by a rendezvous point, letting the same fabric carry unicast and multicast without parallel tunnel types. Application-Aware Routing, TLOC extension, and Direct Internet Access serve different purposes and do not deliver multipoint transport across the overlay.

Answer

Cisco SD-WAN Direct Internet Access with NAT

Answer

Cisco SD-WAN Application-Aware Routing with BFD probes

Answer

Cisco SD-WAN TLOC extension between two transports