CCNP Architecture Practice Test 3 — 15 Questions

Question 1

A network architect is designing a highly available campus network using Cisco StackWise Virtual technology. The architect must ensure that the solution provides redundancy and simplifies the topology. Which two statements are correct about StackWise Virtual? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It requires a dedicated StackWise Virtual Link (SVL) between the two switches.. StackWise Virtual combines two switches into one logical switch with a single management IP and configuration, simplifying operations and improving availability. It requires a dedicated StackWise Virtual Link using supported high-bandwidth ports. Both switches must run the same software version, and dual-active detection is a recommended configuration to handle split-brain scenarios, though not an inherent property.

Answer

It supports dual-active detection to prevent split-brain scenarios.

Answer

It allows the two switches to run different software versions for flexibility.

Answer

It uses the same dedicated stacking cables as traditional StackWise technology.

Question 2

A network engineer is implementing Cisco TrustSec in a campus network. The engineer wants to enforce segmentation based on user role without relying on IP addresses or VLANs. Which Cisco TrustSec component assigns a Security Group Tag (SGT) to a user's traffic at the access layer?

Accepted Answer

Cisco Identity Services Engine (ISE). In Cisco TrustSec, the Cisco Identity Services Engine (ISE) is the policy server that authenticates users and assigns Security Group Tags (SGTs) based on identity and context. The access layer switch then applies the SGT to the user's traffic. Enforcement is done by network devices using SGACLs. SXP is only for propagating mappings, and DNA Center is for management.

Answer

Cisco DNA Center

Answer

Cisco TrustSec Exchange Protocol (SXP)

Answer

Security Group Access (SGA) switch

Question 3

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) for a new office. The administrator needs to ensure that guest users can access the internet but are isolated from the internal corporate network. The guest traffic must be tunneled back to the WLC and then forwarded to the internet from the WLC's management interface. Which interface should be configured on the WLC to support this requirement?

Accepted Answer

Dynamic interface. To tunnel guest traffic back to the WLC and forward it to the internet, a dynamic interface must be configured and mapped to the guest WLAN. The dynamic interface defines the VLAN and IP subnet for the guest traffic. The WLC then forwards the traffic onto that VLAN, which can be routed to the internet. This isolates guest traffic from the corporate network.

Answer

Management interface

Answer

Virtual interface

Answer

Service port

Question 4

A network engineer is designing a highly available campus network. The engineer wants to ensure that if the primary route processor fails, the standby route processor takes over with minimal disruption to routing protocols. Which Cisco StackWise Virtual feature supports this requirement?

Accepted Answer

Stateful Switchover (SSO). Stateful Switchover (SSO) is the Cisco StackWise Virtual feature that maintains state for routing protocols and other control plane protocols, allowing the standby route processor to take over with minimal disruption. While NSF and MEC are related, SSO is the core mechanism that preserves routing protocol adjacencies during a switchover. The SVL is the interconnect, not the high-availability feature itself.

Answer

StackWise Virtual Link (SVL)

Answer

Multichassis EtherChannel (MEC)

Answer

Nonstop Forwarding (NSF)

Question 5

A network engineer is deploying a Cisco SD-Access fabric and needs to ensure that endpoints in the same virtual network (VN) can communicate with each other while endpoints in different VNs are isolated. Which component of the SD-Access architecture is responsible for enforcing this segmentation policy?

Accepted Answer

Fabric edge nodes by enforcing group-based policies using SGTs. Fabric edge nodes enforce segmentation by examining the Security Group Tag (SGT) in VXLAN headers and applying group-based policies. This allows granular control over traffic between endpoints, ensuring isolation between virtual networks and within them according to defined policies. The control plane and management platforms do not enforce policies in the data plane.

Answer

Cisco DNA Center by pushing ACLs to fabric edge nodes

Answer

Cisco Identity Services Engine (ISE) by assigning SGTs to endpoints

Answer

Fabric control plane node by maintaining endpoint-to-VN mappings

Question 6

A network architect is designing a new branch office WLAN that must support seamless roaming for VoWLAN handsets. The handsets require fast, secure Layer 2 roaming between access points on the same subnet without terminating the EAP session at every AP. Which Cisco wireless architecture feature should the architect implement?

Accepted Answer

802.11r Fast Transition with an over-the-air FT key hierarchy. Fast secure roaming for VoWLAN requires 802.11r Fast Transition, which establishes a key hierarchy (PMK-R0 and PMK-R1) so a handset can reassociate to a new AP and complete the 4-way handshake in milliseconds without redoing 802.1X. The other wireless features improve key caching, branch traffic forwarding, or RF performance, but none delivers the fast BSS transition needed to keep voice calls alive across APs.

Answer

Cisco FlexConnect local switching with local authentication

Answer

Cisco ClientLink 4.0 beamforming on all access points

Answer

Cisco Centralized Key Management (CKM) with 802.11r Fast Transition

Question 7

A network designer is implementing a VXLAN EVPN fabric in a data center. The designer wants to ensure that broadcast, unknown unicast, and multicast (BUM) traffic is efficiently delivered to all VTEPs in the same bridge domain. Which control plane mechanism should be used?

Accepted Answer

EVPN with multicast underlay using PIM-SM. In a VXLAN EVPN fabric, BUM traffic can be delivered using multicast in the underlay. EVPN signals the multicast group to VTEPs, and PIM-SM builds a shared tree. This is more efficient than ingress replication because packets are replicated only at branch points in the multicast tree, reducing bandwidth consumption.

Answer

Static VXLAN tunnels with head-end replication

Answer

EVPN with ingress replication and ARP suppression

Answer

Ingress replication with a multicast underlay

Question 8

A network architect is designing a QoS policy for a Cisco Catalyst 9000 switch at the access layer. The requirement is to mark voice traffic from IP phones with DSCP EF and ensure that, if a PC connected to the phone sends bulk data, the voice traffic is not delayed. Which mechanism should the architect configure on the switch port to trust and enforce the phone's markings while protecting voice?

Accepted Answer

Configure a policy map with priority queueing and apply it to the voice VLAN, and enable trust DSCP on the phone port. To protect voice from PC-generated bulk data, the switch must trust the DSCP EF marking from the phone and place voice traffic into a strict priority queue on the voice VLAN. A policy map with priority queueing provides that low-latency treatment, while trust DSCP ensures the phone's marking is honored. This combination directly satisfies the requirement.

Answer

Configure a policer on the phone port to limit voice traffic to a fixed rate and enable trust DSCP

Answer

Enable trust CoS on the phone port and configure weighted random early detection on the voice VLAN

Answer

Configure a policy map with class-based weighted fair queueing and apply it to the PC VLAN

Question 9

A network architect is designing a Cisco SD-WAN fabric for a company with 50 branch sites. The design requires a centralized control plane that maintains a full mesh of secure tunnels between all WAN Edge devices, while data traffic is forwarded directly between branches based on application policies. Which SD-WAN component is responsible for establishing and maintaining these secure tunnels?

Accepted Answer

WAN Edge devices. In Cisco SD-WAN, the WAN Edge devices are responsible for establishing and maintaining the secure tunnels that form the data plane fabric. The controllers (vManage, vBond, vSmart) handle management, orchestration, and control plane functions, but they do not carry or terminate the actual data tunnels. The WAN Edge devices use overlay management protocol (OMP) information from vSmart to build a full mesh and forward traffic directly based on policies.

Answer

vSmart

Answer

vManage

Answer

vBond

Question 10

A network architect is designing a Fabric Enabled Wireless deployment with Cisco SD-Access. The wireless clients must be authenticated by Cisco ISE using 802.1X and assigned to a specific virtual network based on their user identity. Which component is responsible for mapping the client to the correct virtual network after authentication?

Accepted Answer

Cisco Identity Services Engine (ISE). In Cisco SD-Access, Cisco ISE acts as the policy decision point. During 802.1X authentication, ISE evaluates the client's identity and returns authorization attributes, including the virtual network and Scalable Group Tag. The fabric edge node then enforces these attributes, placing the client into the correct VN. The control plane and border nodes do not make these identity-based decisions.

Answer

Fabric control plane node

Answer

Fabric border node

Answer

Fabric edge node

Question 11

A network engineer is designing a highly available campus network using Cisco StackWise Virtual technology on Catalyst 9000 switches. The engineer needs to ensure that the solution provides both control plane and data plane redundancy. Which two statements are true about Cisco StackWise Virtual? (Choose two.)

Accepted Answer

It supports Multichassis EtherChannel (MEC) across the two switches for link redundancy.. Cisco StackWise Virtual combines two Catalyst 9000 switches into a single logical entity with one control plane and one management plane. It supports Multichassis EtherChannel (MEC) to provide link redundancy and active-active forwarding. The StackWise Virtual Link (SVL) carries control and data traffic between the switches, typically using multiple high-speed links for redundancy.

Answer

It requires a dedicated stack cable for control plane traffic and uses the same cable for data plane traffic.

Answer

It requires both switches to be of the same model and have identical hardware configurations.

Answer

It uses VSS (Virtual Switching System) technology to combine the switches.

Question 12

A network architect is evaluating Cisco SD-WAN for a multinational enterprise. The architect must ensure that the solution provides application-aware routing and direct internet access for branch offices. Which two components are responsible for these capabilities? (Choose two.)

Accepted Answer

vEdge. In Cisco SD-WAN, vSmart is the control plane component that distributes application-aware routing policies via OMP, enabling the network to make forwarding decisions based on applications. vEdge routers are the data plane devices that enforce these policies and can send traffic directly to the internet from branch sites, providing direct internet access. Together, they deliver the required capabilities.

Answer

vManage

Answer

vBond

Answer

Cisco DNA Center

Question 13

A network engineer is implementing Cisco StackWise Virtual on a pair of Cisco Catalyst 9000 switches to provide high availability. Which two statements are true about Cisco StackWise Virtual technology? (Choose two.)

Accepted Answer

It combines two physical switches into a single logical switch with a single control plane.. Cisco StackWise Virtual combines two physical switches into a single logical switch with a single control plane, and it requires a dedicated StackWise Virtual Link (SVL) using 10G or higher speed interfaces. These two statements accurately describe the technology's core characteristics for high availability.

Answer

It supports up to four switches in a single logical domain.

Answer

It allows both switches to actively forward traffic simultaneously in active-active mode.

Answer

It uses a dedicated stacking cable that carries both control and data traffic.

Question 14

A network architect is designing a new branch office that will have a single WAN uplink to the internet and must provide direct secure access to cloud applications for local users. The design requires on-box stateful firewall, IPS, and application-aware routing without backhauling traffic to headquarters. Which Cisco IOS XE SD-WAN feature set should the architect enable on the branch router?

Accepted Answer

Enable the Cisco SD-WAN Security feature set (UTD) with Snort IPS and URL filtering on the IOS XE SD-WAN router.. The requirement is for on-box stateful firewall, IPS, and application-aware routing at a branch with a single WAN uplink. Cisco IOS XE SD-WAN Unified Threat Defense (UTD) provides these security functions directly on the router, enabling local internet breakout for cloud applications. This avoids backhauling to headquarters while maintaining security enforcement, which matches the architect's design goals precisely.

Answer

Deploy a standalone Cisco Firepower appliance at the branch and route all cloud traffic through it in a hairpin.

Answer

Enable Cisco SD-WAN Application-Aware Routing policy with a centralized data policy applied from vManage.

Answer

Configure Zone-Based Firewall (ZBFW) with a VPN Routing and Forwarding (VRF) per department and no IPS module.

Question 15

A network engineer is deploying Cisco TrustSec in a campus network. The security policy requires that traffic from user access ports be tagged with a Security Group Tag (SGT) based on the user's identity, and that enforcement be performed at the egress switch port. Which Cisco TrustSec feature should be enabled on the access switch to classify traffic with an SGT?

Accepted Answer

802.1X with SGT propagation. To classify traffic with an SGT based on user identity, the access switch must use 802.1X authentication with SGT propagation. During 802.1X, the switch communicates with Cisco ISE, which returns the user's SGT. The switch then inserts the SGT into the frame or packet. Enforcement at the egress switch port is then performed using Security Group ACLs (SGACLs) or other TrustSec enforcement mechanisms.

Answer

Static SGT assignment on the switch port

Answer

Dynamic ARP Inspection (DAI) with SGT

Answer

MACsec encryption on the access port