CCNP Architecture Practice Test 2 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a branch subnet. The requirement is to exclude a range of addresses that are statically assigned to printers and servers. Which command should the engineer use inside the DHCP pool configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip dhcp excluded-address 10.1.1.10 10.1.1.20. The ip dhcp excluded-address command is entered globally and prevents the DHCP server from offering specific addresses or ranges. It is the standard method to protect statically assigned devices such as printers and servers. Creating another pool, setting a lease time, or defining the network does not reserve addresses and would allow the server to lease them.

Answer

network 10.1.1.0 255.255.255.0

Answer

ip dhcp pool EXCLUDE

Answer

lease 0 8 0

Question 2

A network architect is designing a new branch office that requires a lightweight, programmable underlay with native VXLAN support and centralized control plane via an external SDN controller. The switches must support open APIs and be manageable through a single pane of glass. Which Cisco platform best meets these requirements?

Accepted Answer

Cisco Nexus 9000 Series switches running Cisco NX-OS with Cisco DNA Center. The Nexus 9000 Series switches running NX-OS provide native VXLAN support and can be centrally managed by Cisco DNA Center, which offers automation, assurance, and open APIs. This platform is purpose-built for programmable fabrics and meets the requirement for a lightweight underlay with external SDN control. The other options are either legacy switches or routers that do not support the required VXLAN and programmability features.

Answer

Cisco Catalyst 6500 Series switches running Cisco IOS

Answer

Cisco ASR 1000 Series routers running Cisco IOS XE

Answer

Cisco Catalyst 2960-X Series switches running Cisco IOS software

Question 3

A network administrator is configuring a new Cisco Wireless LAN Controller (WLC) running AireOS. The administrator wants to ensure that the management interface is reachable from the wired network and that the WLC can communicate with access points. Which interface on the WLC must be configured with an IP address and be connected to a switch port that supports trunking?

Accepted Answer

Management interface. The management interface on a Cisco AireOS WLC is the primary interface for management access, AP registration, and communication with the wired network. It requires an IP address and must be connected to a trunk port to support multiple VLANs. Dynamic interfaces handle client traffic, the service port is for out-of-band management, and the virtual interface is for internal functions.

Answer

Virtual interface

Answer

Dynamic interface

Answer

Service port

Question 4

A network administrator is configuring a new Cisco Catalyst 9000 switch for a branch office. The administrator wants to ensure that the switch can be managed remotely via SSH and that only secure protocols are used for management. Which configuration step is necessary to enable SSH access?

Accepted Answer

Configure a username and password, and generate RSA keys.. SSH requires a local username and password for authentication and RSA keys for encryption. The 'crypto key generate rsa' command generates the keys, and 'transport input ssh' on the VTY lines restricts access to SSH. Telnet and HTTP are insecure and do not meet the requirement for secure management. Therefore, configuring a username, password, and RSA keys is the necessary step.

Answer

Enable the HTTP server and configure a local user.

Answer

Set the transport input to telnet on the VTY lines.

Answer

Configure an ACL to permit TCP port 23 and apply it to the VTY lines.

Question 5

A network architect is designing a campus network using Cisco StackWise Virtual technology. The design requires that the two switches appear as a single logical entity to the access layer and that traffic is forwarded efficiently. Which statement is true about StackWise Virtual?

Accepted Answer

It supports Multichassis EtherChannel (MEC) to provide active-active forwarding.. Cisco StackWise Virtual combines two physical switches into one logical switch, allowing Multichassis EtherChannel (MEC) to provide active-active forwarding. This means an access switch can form an EtherChannel to both switches, utilizing bandwidth from both and providing redundancy. The control plane is active-standby, but both switches forward data traffic.

Answer

It requires a dedicated stack cable between the switches for control plane traffic.

Answer

It requires that both switches run different IOS versions to ensure compatibility.

Answer

It uses a single control plane and a single data plane, with one switch acting as standby.

Question 6

A network designer is planning a campus network that must provide first-hop redundancy for IPv6 hosts. The design requires that hosts automatically learn the virtual MAC address and that the active router be selected based on interface priority and the highest IPv6 address. Which protocol should be used?

Accepted Answer

VRRP version 3. VRRP version 3 is the standards-based first-hop redundancy protocol that supports IPv6 and elects the master by priority, with the highest IP address as the tiebreaker. Hosts receive the virtual MAC address through VRRP advertisements, satisfying the design requirements for automatic learning and deterministic election.

Answer

GLBP with IPv6

Answer

HSRP version 2 with IPv6 support

Answer

ICMPv6 Router Advertisement with default router preference

Question 7

A network engineer is designing a Cisco SD-Access fabric and needs to ensure that the underlay network supports the overlay. Which two statements are correct about the underlay network in Cisco SD-Access? (Choose two.)

Accepted Answer

The underlay uses a spine-leaf topology.. The underlay in Cisco SD-Access uses IS-IS as the routing protocol and a spine-leaf topology. These two characteristics ensure a scalable, resilient, and automated foundation for the overlay. IS-IS provides fast convergence, while the spine-leaf design offers high bandwidth and redundancy. Other options are incorrect because VXLAN is overlay, manual configuration is not required, and BGP is not the default underlay routing protocol.

Answer

The underlay provides VXLAN encapsulation.

Answer

The underlay uses BGP for routing between fabric nodes.

Answer

The underlay requires manual configuration of all fabric nodes.

Question 8

A network engineer is designing a new branch office topology that must provide redundant default gateway services for hosts on VLAN 10. The design requires that both routers actively forward traffic for the same virtual IP address, without any standby state, and that the hosts be configured with a single default gateway IP. Which First Hop Redundancy Protocol should be used?

Accepted Answer

Gateway Load Balancing Protocol (GLBP). GLBP is the only FHRP that supports active-active forwarding for a single virtual IP by using multiple virtual MAC addresses. The Active Virtual Gateway distributes these MAC addresses among the group members, so hosts see one gateway IP while traffic is load-balanced across all routers.

Answer

Hot Standby Router Protocol (HSRP)

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Intermediate System to Intermediate System (IS-IS)

Question 9

A network architect at a university is selecting a controller-based wireless solution for a campus with 800 access points. The requirement is that all AP management, client authentication, and policy enforcement be handled by a single logical controller appliance that can be clustered for scale. Which Cisco architecture should the architect choose?

Accepted Answer

Cisco Catalyst 9800 Series Wireless Controller running in a centralized deployment. The scenario requires a controller-based architecture with centralized AP management, client authentication, and policy enforcement at a scale of 800 APs. The Catalyst 9800 Series is Cisco's current controller platform and supports centralized deployment with clustering for scale and redundancy, making it the only option that meets every stated requirement without exceeding platform limits.

Answer

Cisco Embedded Wireless Controller on Catalyst 9000 switches

Answer

Cisco Mobility Express software running on a single access point

Answer

Cisco Aironet 4800 access points running in autonomous mode

Question 10

A network architect is evaluating Cisco SD-WAN for a multinational enterprise. The architect must ensure that the solution provides application-aware routing, centralized policy management, and secure connectivity across multiple transports. Which two components are essential for achieving these requirements? (Choose two.)

Accepted Answer

vManage for centralized management and policy configuration. vManage provides centralized management and policy configuration, while vBond handles orchestration and authentication. Together, they enable application-aware routing, centralized policy management, and secure connectivity across multiple transports. The other components have different roles: vSmart distributes control plane information, vEdge routers forward data, and DNA Center is not part of the core SD-WAN architecture.

Answer

vSmart for data plane forwarding and encryption

Answer

vEdge routers for centralized policy management

Answer

Cisco DNA Center for SD-WAN policy orchestration

Question 11

A network engineer is evaluating Cisco StackWise Virtual technology for a new data center access switch pair. The engineer needs to understand which statements are true about this technology. (Choose two.)

Accepted Answer

It combines two physical switches into a single logical switch using a StackWise Virtual Link.. StackWise Virtual combines two physical switches into a single logical switch using a StackWise Virtual Link, which must be a high-speed connection such as 10G or higher. These two characteristics define the technology and are the correct statements among the options.

Answer

It uses the same cabling as traditional StackWise and can reuse StackWise cables.

Answer

It requires both switches to be the same model and run the same software version.

Answer

It supports up to four switches in a single logical domain.

Question 12

A network architect is evaluating Cisco SD-Access for a new campus fabric deployment. The architect must explain the roles of the fabric border node and the fabric control plane node to the operations team. Which two statements correctly describe these roles? (Choose two.)

Accepted Answer

The fabric control plane node maintains the mapping database of endpoint IP addresses to fabric locators and resolves endpoint locations for fabric edge nodes.. The fabric border node provides connectivity to external networks, translating VXLAN to external protocols. The fabric control plane node maintains the endpoint-to-locator mapping database and resolves endpoint locations for edge nodes. These two roles are fundamental to SD-Access operation. The other statements incorrectly assign control plane functions to the border node or data forwarding to the control plane node.

Answer

The fabric control plane node forwards VXLAN-encapsulated data traffic between fabric edge nodes.

Answer

The fabric border node is responsible for registering endpoints and maintaining the mapping database for the fabric.

Answer

The fabric border node can be configured to connect to multiple external networks and can also provide access to shared services.

Question 13

A network architect is evaluating Cisco SD-Access for a campus network. The architect must ensure that the fabric provides segmentation and policy enforcement for IoT devices, guests, and employees. Which two components are responsible for these functions? (Choose two.)

Accepted Answer

Cisco DNA Center. In Cisco SD-Access, segmentation and policy enforcement are driven by Cisco Identity Services Engine (ISE) and Cisco DNA Center. ISE provides identity-based policy and assigns scalable group tags, while DNA Center orchestrates the fabric and deploys policies. Together, they enable micro-segmentation for IoT, guest, and employee traffic. The other options are either security analytics tools or fabric nodes that enforce but do not define policies.

Answer

Cisco Fabric Edge nodes

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Question 14

A network architect is designing a Cisco SD-Access fabric and needs to select the appropriate underlay network. The architect wants to ensure that the underlay is scalable, supports fast convergence, and can carry VXLAN-encapsulated traffic. Which two routing protocols are valid underlay options for a Cisco SD-Access fabric? (Choose two.)

Accepted Answer

IS-IS. Cisco SD-Access underlay supports link-state routing protocols IS-IS and OSPF. Both provide fast convergence and scalability, and can carry VXLAN-encapsulated traffic. IS-IS is often recommended for very large fabrics due to its efficiency, while OSPF is a widely deployed alternative. BGP, EIGRP, and RIP are not validated underlay options for SD-Access.

Answer

BGP

Answer

EIGRP

Answer

RIP

Question 15

A financial services company is deploying a Cisco SD-Access fabric. The security team requires that endpoint traffic be inspected by a physical firewall appliance before being allowed into the data center segment, while still benefiting from fabric encapsulation. Which SD-Access component should the architect use to meet this requirement?

Accepted Answer

Fabric edge node configured with a service node for firewall insertion. Cisco SD-Access supports service insertion through the service node concept, which connects external appliances such as firewalls to the fabric. Edge nodes use policy-based redirect to steer selected endpoint traffic to the service node, where the physical firewall inspects it before it continues to its destination. This preserves fabric encapsulation and meets the inline inspection requirement.

Answer

Fabric edge node with static VXLAN tunnels

Answer

Fabric border node with a fusion router

Answer

Fabric intermediate node with PIM sparse mode