CCNP Architecture — Timed 50 Questions

Question 1

A network engineer is designing a campus network with high availability for critical services. Which Cisco technology enables traffic to be forwarded to an alternate next hop in the event of a first-hop router failure, without requiring any configuration changes on the hosts?

50 minute time limit — choose an answer to begin.

Accepted Answer

HSRP. HSRP (Hot Standby Router Protocol) is a Cisco-proprietary FHRP that allows multiple routers to share a virtual IP and MAC address, providing transparent failover. Hosts are configured with the virtual IP as their default gateway, so when the active router fails, the standby router takes over without any host configuration changes. This directly meets the requirement for high availability without host reconfiguration.

Answer

Static default route with a floating static

Answer

GLBP

Answer

VRRP

Question 2

Which TWO characteristics are true about Cisco StackWise virtual technology? (Choose two.)

Accepted Answer

It allows multiple physical switches to operate as a single logical switch.. Option A is correct because Cisco StackWise Virtual (VSS) combines two physical switches into one logical entity that presents a single control plane and forwarding plane to the network. Option C is correct because, as a single logical switch, the StackWise Virtual domain is managed through one management IP address rather than per-chassis addresses. Option B is not required, since StackWise Virtual supports mixing certain Catalyst 9000 series models (e.g., C9500 with C9500) as long as they meet platform and license compatibility, not strictly identical hardware. Option D is incorrect because StackWise Virtual typically uses standard Ethernet ports (10G/40G/100G) with StackWise Virtual Link (SVL) cabling rather than proprietary dedicated stacking cables. Option E is incorrect because StackWise Virtual supports only two member switches, whereas the 9-member limit applies to traditional StackWise (non-virtual) stacking.

Answer

Each member switch must have the same hardware model.

Answer

It requires dedicated stacking cables for interconnectivity.

Answer

It supports up to 9 member switches in a stack.

Question 3

Drag and drop the steps for the Spanning Tree Protocol (STP) convergence process in the correct order.

Accepted Answer

Step 1: Root bridge election, Step 2: Root port selection, Step 3: Designated port selection, Step 4: Blocking of alternate ports. STP elects a root bridge, then selects root and designated ports, blocking others to prevent loops.

Answer

Step 1: Root port selection, Step 2: Root bridge election, Step 3: Designated port selection, Step 4: Blocking of alternate ports

Answer

Step 1: Root bridge election, Step 2: Designated port selection, Step 3: Root port selection, Step 4: Blocking of alternate ports

Answer

Step 1: Blocking of alternate ports, Step 2: Root bridge election, Step 3: Root port selection, Step 4: Designated port selection

Question 4

Match each routing protocol to its administrative distance.

Accepted Answer

OSPF: 110. Administrative distances are used to select the best route when multiple routing protocols provide routes to the same destination.

Answer

OSPF: 90

Answer

RIP: 110

Question 5

A campus network designer is evaluating a Cisco SD-Access fabric. The design requires that the fabric be able to route traffic between endpoints in different virtual networks without the traffic leaving the fabric, while maintaining isolation. Which fabric component is responsible for this inter-VN routing?

Accepted Answer

Fabric intermediate node. In Cisco SD-Access, inter-VN routing is performed by the fabric border node when it is configured as a fusion router. The border node provides connectivity between the fabric and external networks and can also route between virtual networks, maintaining isolation. Edge nodes connect endpoints, control plane nodes handle LISP mappings, and intermediate nodes forward VXLAN traffic in the underlay.

Answer

Fabric edge node

Answer

Fabric border node

Answer

Fabric control plane node

Question 6

A network engineer is designing a Cisco SD-WAN solution for a company with multiple branches. The engineer must ensure that the SD-WAN fabric provides secure, scalable connectivity and application-aware routing. Which two components are part of the Cisco SD-WAN architecture? (Choose two.)

Accepted Answer

vManage. The core components of Cisco SD-WAN architecture include vManage for management, vSmart for control plane, vBond for orchestration, and vEdge/cEdge for data plane. Among the options, vManage and vSmart are correct. vManage provides centralized management and policy provisioning, while vSmart distributes routing and policy information using OMP. Together, they enable secure, scalable, and application-aware routing across the SD-WAN fabric.

Answer

Cisco Identity Services Engine (ISE)

Answer

vBond

Answer

Cisco DNA Center

Question 7

A network engineer is configuring a Cisco Catalyst 9000 switch with StackWise Virtual technology. The engineer wants to ensure that the control plane remains active on both switches in the stack. Which command should be used to verify the StackWise Virtual configuration and confirm that both switches are in the active-active state?

Accepted Answer

show stackwise-virtual. The 'show stackwise-virtual' command is the dedicated command to verify StackWise Virtual configuration. It shows the domain ID, switch roles, and the status of the virtual link, confirming that both switches are active and the control plane is operational in active-active mode. Other commands like 'show switch' or 'show redundancy' do not provide the full StackWise Virtual specific details.

Answer

show redundancy

Answer

show switch

Answer

show vrrp

Question 8

A network engineer is deploying Cisco SD-Access and needs to understand the roles of fabric nodes. Which two node types are responsible for connecting external networks to the fabric? (Choose two.)

Accepted Answer

Fabric border node. Fabric border nodes are responsible for connecting the SD-Access fabric to external networks. They can be internal (connecting to other fabric sites) or external (connecting to non-fabric networks). They translate VXLAN to traditional protocols and enforce policy at the boundary. Control plane nodes, edge nodes, and intermediate nodes do not provide external connectivity.

Answer

Fabric edge node

Answer

Control plane node

Answer

Fabric intermediate node

Question 9

A network engineer is deploying Cisco SD-Access and needs to ensure that the fabric supports both wired and wireless clients with consistent policy enforcement. Which two components are required to achieve this integration? (Choose two.)

Accepted Answer

Fabric edge nodes. To integrate wired and wireless clients with consistent policy in Cisco SD-Access, fabric edge nodes and Cisco ISE are essential. Fabric edge nodes encapsulate traffic and enforce SGT-based policies, while ISE dynamically assigns SGTs to endpoints. Together, they ensure that policy is applied uniformly regardless of the access medium.

Answer

Fabric intermediate nodes

Answer

Cisco DNA Center appliance

Answer

Wireless LAN Controller (WLC)

Question 10

A network architect is designing a new campus network using Cisco SD-Access. The architect must ensure that the fabric supports both wired and wireless endpoints with consistent policy enforcement. Which two components are required to integrate wireless access into the SD-Access fabric? (Choose two.)

Accepted Answer

Fabric-enabled wireless controller. To integrate wireless into Cisco SD-Access, a fabric-enabled wireless controller and a fabric control plane node with LISP mapping for wireless clients are required. The wireless controller registers wireless clients with the control plane node, which maintains the mapping. This allows consistent policy enforcement across wired and wireless. Edge nodes, border nodes, and intermediate nodes do not perform these specific functions.

Answer

Fabric intermediate node with wireless bridging

Answer

Fabric border node with wireless gateway

Answer

Fabric edge node with wireless termination

Question 11

A network engineer is designing a high-availability solution for a data center. The requirement is to provide loop-free Layer 2 multipathing with active-active forwarding and no Spanning Tree Protocol blocking. Which technology should be used?

Accepted Answer

VXLAN with EVPN. VXLAN with EVPN is the correct answer because it provides a loop-free Layer 2 overlay with active-active multipathing, eliminating STP blocking. It uses a BGP EVPN control plane for MAC learning and supports scalable, multi-tenant data center designs. This technology is widely adopted and meets the high-availability and performance requirements of modern data centers.

Answer

Virtual Port Channel (vPC)

Answer

Spanning Tree Protocol (STP)

Answer

Cisco FabricPath

Question 12

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoints in the same virtual network can communicate with each other even when they are attached to different fabric edge nodes. Which component is responsible for this?

Accepted Answer

Fabric control plane node. In Cisco SD-Access, the fabric control plane node runs LISP and maintains the mapping database of endpoint identifiers to routing locators. When an endpoint in one virtual network needs to reach another endpoint in the same virtual network, the fabric edge node queries the control plane node to resolve the destination. This enables VXLAN encapsulation and delivery across the fabric, independent of the border or intermediate nodes.

Answer

Fabric intermediate node

Answer

Cisco DNA Center appliance

Answer

Fabric border node

Question 13

A Cisco Catalyst 9000 switch stack in a distribution layer has been running Cisco StackWise-480 for several months. A network engineer notices that when the active switch reloads, the standby switch takes over, but the uplink ports on the newly active switch remain in a blocking state for approximately 30 seconds before forwarding traffic. The engineer wants to reduce this convergence time. Which Cisco StackWise feature should be configured to allow the standby switch to pre-build its forwarding information and take over faster?

Accepted Answer

StackWise Fast Failover. StackWise Fast Failover enables the standby switch in a StackWise stack to pre-build forwarding tables and take over traffic forwarding rapidly when the active switch fails. This directly reduces the time uplink ports remain in a blocking state after a switchover. The other options address different high-availability scenarios or link-level timers, not the internal stack failover data plane readiness.

Answer

StackWise Virtual

Answer

Nonstop Forwarding (NSF) with Stateful Switchover (SSO)

Answer

Link Aggregation Control Protocol (LACP) fast timers

Question 14

A network administrator is configuring a new Cisco Catalyst switch and needs to ensure that the management VLAN is configured with an IP address and is reachable from a remote subnet. Which command should be used to assign an IP address to the management VLAN interface?

Accepted Answer

interface vlan 10 then ip address 192.168.1.1 255.255.255.0. The correct answer involves entering the VLAN interface configuration mode and then assigning an IP address. This two-step process is necessary to configure the management VLAN interface on a Cisco switch. Without both steps, the management IP will not be set, and remote reachability will fail.

Answer

interface vlan 1

Answer

ip address 192.168.1.1 255.255.255.0

Answer

interface vlan 10

Question 15

An enterprise campus uses a Cisco Catalyst 9800 Series Wireless Controller running IOS-XE with a single C9800-L appliance that must serve 5,000 access points and 40,000 clients. The network architect needs to design the wireless architecture so that the controller handles only control-plane traffic while client data is forwarded directly from the access points. Which Cisco wireless architecture should be deployed?

Accepted Answer

Fabric-enabled wireless with SD-Access and VXLAN data forwarding. The fabric-enabled wireless design is the only option that keeps the C9800 in a control-plane-only role while client data is forwarded natively through the fabric using VXLAN. This architecture is purpose-built for large-scale campus deployments where a single controller must manage thousands of APs without becoming a data forwarding bottleneck.

Answer

Mobility Express with the controller function embedded in each access point

Answer

FlexConnect mode with local switching enabled on the access point

Answer

Local mode with all client traffic tunneled to the controller using CAPWAP data tunnels

Question 16

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a branch subnet. The requirement is to exclude a range of addresses that are statically assigned to printers and servers. Which command should the engineer use inside the DHCP pool configuration?

Accepted Answer

ip dhcp excluded-address 10.1.1.10 10.1.1.20. The ip dhcp excluded-address command is entered globally and prevents the DHCP server from offering specific addresses or ranges. It is the standard method to protect statically assigned devices such as printers and servers. Creating another pool, setting a lease time, or defining the network does not reserve addresses and would allow the server to lease them.

Answer

network 10.1.1.0 255.255.255.0

Answer

ip dhcp pool EXCLUDE

Answer

lease 0 8 0

Question 17

A network architect is designing a new branch office that requires a lightweight, programmable underlay with native VXLAN support and centralized control plane via an external SDN controller. The switches must support open APIs and be manageable through a single pane of glass. Which Cisco platform best meets these requirements?

Accepted Answer

Cisco Nexus 9000 Series switches running Cisco NX-OS with Cisco DNA Center. The Nexus 9000 Series switches running NX-OS provide native VXLAN support and can be centrally managed by Cisco DNA Center, which offers automation, assurance, and open APIs. This platform is purpose-built for programmable fabrics and meets the requirement for a lightweight underlay with external SDN control. The other options are either legacy switches or routers that do not support the required VXLAN and programmability features.

Answer

Cisco Catalyst 6500 Series switches running Cisco IOS

Answer

Cisco ASR 1000 Series routers running Cisco IOS XE

Answer

Cisco Catalyst 2960-X Series switches running Cisco IOS software

Question 18

A network administrator is configuring a new Cisco Wireless LAN Controller (WLC) running AireOS. The administrator wants to ensure that the management interface is reachable from the wired network and that the WLC can communicate with access points. Which interface on the WLC must be configured with an IP address and be connected to a switch port that supports trunking?

Accepted Answer

Management interface. The management interface on a Cisco AireOS WLC is the primary interface for management access, AP registration, and communication with the wired network. It requires an IP address and must be connected to a trunk port to support multiple VLANs. Dynamic interfaces handle client traffic, the service port is for out-of-band management, and the virtual interface is for internal functions.

Answer

Virtual interface

Answer

Dynamic interface

Answer

Service port

Question 19

A network administrator is configuring a new Cisco Catalyst 9000 switch for a branch office. The administrator wants to ensure that the switch can be managed remotely via SSH and that only secure protocols are used for management. Which configuration step is necessary to enable SSH access?

Accepted Answer

Configure a username and password, and generate RSA keys.. SSH requires a local username and password for authentication and RSA keys for encryption. The 'crypto key generate rsa' command generates the keys, and 'transport input ssh' on the VTY lines restricts access to SSH. Telnet and HTTP are insecure and do not meet the requirement for secure management. Therefore, configuring a username, password, and RSA keys is the necessary step.

Answer

Enable the HTTP server and configure a local user.

Answer

Set the transport input to telnet on the VTY lines.

Answer

Configure an ACL to permit TCP port 23 and apply it to the VTY lines.

Question 20

A network architect is designing a campus network using Cisco StackWise Virtual technology. The design requires that the two switches appear as a single logical entity to the access layer and that traffic is forwarded efficiently. Which statement is true about StackWise Virtual?

Accepted Answer

It supports Multichassis EtherChannel (MEC) to provide active-active forwarding.. Cisco StackWise Virtual combines two physical switches into one logical switch, allowing Multichassis EtherChannel (MEC) to provide active-active forwarding. This means an access switch can form an EtherChannel to both switches, utilizing bandwidth from both and providing redundancy. The control plane is active-standby, but both switches forward data traffic.

Answer

It requires a dedicated stack cable between the switches for control plane traffic.

Answer

It requires that both switches run different IOS versions to ensure compatibility.

Answer

It uses a single control plane and a single data plane, with one switch acting as standby.