CCNP Hard Questions — 25 Difficult Questions

Question 1

Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)

Accepted Answer

A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.. The correct answers describe practical uses of Python for inventory management and data handling. The incorrect options either misattribute YAML's features (it does not support comments natively in all parsers) or incorrectly state that JSON is always more human-readable than YAML (YAML is often considered more readable).

Answer

YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.

Answer

JSON is always more human-readable than YAML for complex inventory structures.

Question 2

A network engineer runs the following command on Switch SW1:

SW1# show vlan id 10

VLAN ID: 10
VLAN Name: Sales
VLAN Type: Ethernet
VLAN State: active
MTU: 1500

Remote SPAN VLAN: No

Primary VLAN ID: 10

Private VLAN Type: Primary

Associated Secondary VLAN IDs: 100, 200

Based on this output, what can be concluded?

Accepted Answer

VLAN 10 is a primary private VLAN.. The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Answer

VLAN 10 is a community VLAN.

Answer

VLAN 10 is an isolated VLAN.

Answer

VLAN 10 is a normal data VLAN with no private VLAN features.

Question 3

A company is deploying a virtualized firewall on a VMware ESXi host. The firewall VM requires high network throughput and low latency. The engineer decides to use SR-IOV to assign a virtual function (VF) from a physical NIC to the VM. After configuration, the VM can communicate, but the host's management network becomes unreachable. What is the most likely cause?

Accepted Answer

The physical NIC's PF is also used for the host management network, and SR-IOV configuration disrupted it.. When SR-IOV is enabled on a physical NIC, the Physical Function (PF) is shared between the host management network and the Virtual Functions (VFs). If the PF is used for the host management network, enabling SR-IOV can disrupt the PF's driver or configuration, causing the management network to become unreachable. This is a common misconfiguration where the same NIC is used for both management and SR-IOV VFs.

Answer

The VM's VF is using the same MAC address as the host management interface.

Answer

The ESXi host requires a dedicated physical NIC for management when using SR-IOV.

Answer

The VM's VF is consuming all available bandwidth on the NIC.

Question 4

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

Accepted Answer

The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 '.. The engineer's configuration includes both 'ip default-network 0.0.0.0' (which is an IGRP command, not EIGRP) and redistribution of a static default route. The appearance of the default route in the EIGRP topology table with metric 1 indicates that redistribution occurred, but the route is not being advertised to internal routers. The most likely reason is that the static default route itself is not correctly configured. For EIGRP redistribution to succeed, the static route must point to a valid next-hop IP address using the syntax 'ip route 0.0.0.0 0.0.0.0 '. If the engineer used an interface instead of a next-hop, or the next-hop is unreachable, the static route may be invalid or not installed in the routing table, preventing its advertisement to EIGRP neighbors.

Answer

The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.

Answer

The internal routers have a route to the default network with a better metric from another source.

Answer

The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.

Question 5

Which three statements about gRPC and gNMI in the context of model-driven telemetry are true? (Choose three.)

Accepted Answer

gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.. gRPC uses HTTP/2 for transport and Protocol Buffers for serialization. gNMI is a gRPC-based protocol specifically for network management and telemetry. gNMI supports both telemetry subscriptions (Subscribe RPC) and configuration operations (Set, Get). It uses YANG models to define data paths. gNMI does not require NETCONF; it operates independently over gRPC.

Answer

gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.

Answer

gNMI relies on NETCONF for session establishment and data encoding.

Question 6

A network engineer issues the following command on Router R2:

R2# show ip ospf interface GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.2/24, Area 0
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 192.168.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 2, Adjacent neighbor count is 2
    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)
    Adjacent with neighbor 3.3.3.3

Based on this output, what can be concluded?

Accepted Answer

R2 has a full OSPF adjacency with all neighbors on this segment.. The output shows that R2 is the Designated Router (DR) on this broadcast segment, with two neighbors listed: 1.1.1.1 (BDR) and 3.3.3.3. The 'Adjacent neighbor count is 2' and both neighbors are listed as 'Adjacent with neighbor', confirming that R2 has formed full OSPF adjacencies with all neighbors on this segment. In OSPF broadcast networks, only the DR and BDR form full adjacencies with all routers, while non-DR/BDR routers only form full adjacencies with the DR and BDR.

Answer

R2 is the Backup Designated Router on this segment.

Answer

The OSPF cost to reach the network 192.168.1.0/24 is 20.

Answer

R2 will send hello packets every 40 seconds.

Question 7

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Accepted Answer

The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.. 802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator. Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.

Answer

The supplicant is the device that provides authentication services, such as a RADIUS server.

Answer

802.1X is only supported on wireless networks and cannot be used on wired switches.

Question 8

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1
Gi0/2      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005
Gi0/2       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20
Gi0/2       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20
Gi0/2       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active on the trunk.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Answer

The trunk is using ISL encapsulation.

Answer

VLAN 1 is pruned from the trunk.

Answer

Only VLANs 10 and 20 are forwarding traffic.

Question 9

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 10

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to define data models for NETCONF and RESTCONF.. The correct answers are A, C, and E. A is correct because YANG is used to model configuration and operational data in NETCONF and RESTCONF. C is correct because YANG uses a tree-like hierarchical structure with containers and lists. E is correct because YANG supports data types such as string, int32, and enumeration. B is incorrect because YANG models are not written in XML; they use a custom syntax similar to SMIv2. D is incorrect because YANG modules are not compiled into MIB files; MIBs are for SNMP.

Answer

YANG models are written in XML syntax.

Answer

YANG modules are compiled into MIB files for SNMP.

Question 11

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to model both configuration and operational state data.. YANG is a data modeling language used to model configuration and state data for network devices. It can define both configuration data (which is writable) and operational state data (which is read-only). YANG models can be augmented using the 'augment' statement to add nodes to an existing model without modifying it. YANG does not define transport protocols; it is used with protocols like NETCONF and RESTCONF. The 'leaf' statement defines a single, scalar data node, not a list.

Answer

YANG defines the transport protocol for data exchange.

Answer

The 'leaf' statement in YANG defines a list of key-value pairs.

Question 12

Drag and drop each RESTCONF method on the left to its equivalent NETCONF operation on the right.

Accepted Answer

GET: get-config (retrieves data). Correct pairings: GET retrieves data (like get-config); POST creates a resource (like edit-config with operation create); PUT replaces a resource (like edit-config with operation replace); PATCH partially updates (like edit-config with operation merge); DELETE removes a resource (like edit-config with operation delete).

Question 13

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 14

Which two statements about DMVPN Phase 3 are true? (Choose two.)

Accepted Answer

NHRP redirect messages are sent by the hub to inform a spoke that a better path exists directly to another spoke.. In DMVPN Phase 3, the hub sends NHRP redirect messages to inform spokes of a direct path, and spokes dynamically establish mGRE tunnels using NHRP. Option B is incorrect because spokes register their NBMA (physical) addresses, not 'non-NBMA' addresses; the term 'non-NBMA' is contradictory as NBMA is the physical address in this context. Options A and D are false: hub is not always in the data path after redirect, and spoke-to-spoke tunnels use mGRE, not p2p GRE.

Answer

In DMVPN Phase 3, the hub router must always be in the data path for all traffic between spokes.

Answer

Spokes register their physical (non-NBMA) addresses with the NHRP server (hub) to enable dynamic tunnel establishment.

Answer

DMVPN Phase 3 uses point-to-point GRE tunnels for spoke-to-spoke connections.

Question 15

A network engineer runs the following command on switch SW6:

SW6# show cts role-based counters

Role-based counters:

Source Group   Dest Group   Packets Sent   Bytes Sent   Packets Denied   Bytes Denied
10             20           1500           120000       0                0
10             30           0              0            500              40000

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 10 to SGT 20 is being permitted, and traffic from SGT 10 to SGT 30 is being denied.. The output shows that for the source group (SGT) 10 to destination group (SGT) 20, packets sent and bytes sent are non-zero (1500 and 120000 respectively), while packets denied and bytes denied are zero. This indicates traffic is being permitted. For SGT 10 to SGT 30, packets sent and bytes sent are zero, but packets denied and bytes denied are non-zero (500 and 40000), indicating traffic is being denied. Therefore, option C is correct.

Answer

Traffic from SGT 10 to SGT 20 is being denied.

Answer

Traffic from SGT 10 to SGT 30 is being permitted.

Answer

No traffic has been sent between any SGTs.

Question 16

An engineer configures VXLAN EVPN on a Nexus 9000 switch. The configuration is shown. The switch does not advertise any EVPN routes for VNI 10100. Which configuration change is required to fix this issue?

Accepted Answer

Configure "evpn" and "vni 10100 l2" under the BGP address-family l2vpn evpn.. For VXLAN EVPN on a Nexus 9000, the BGP address-family l2vpn evpn must explicitly contain the 'evpn' keyword and the 'vni 10100 l2' command to advertise Layer 2 VNI routes. Without this configuration, BGP does not know to inject the VNI's MAC/VTEP information into the EVPN route table, so no EVPN routes are advertised for VNI 10100.

Answer

Remove the mcast-group from the NVE member, because EVPN uses BGP for control plane.

Answer

Change the source-interface to a physical interface.

Answer

Add an IP address to the VLAN 100 interface in the default VRF.

Question 17

A network engineer uses the Requests library to query a Cisco IOS-XE device via RESTCONF for interface statistics:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface=GigabitEthernet1/0/1/statistics'
headers = {'Accept': 'application/yang-data+json'}
auth = HTTPBasicAuth('admin', 'cisco123')
response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the most likely issue with this code?

Accepted Answer

The interface name 'GigabitEthernet1/0/1' in the URL must be URL-encoded as 'GigabitEthernet1%2F0%2F1'.. The code contains an unencoded slash in the interface name 'GigabitEthernet1/0/1', which is a special character in RESTCONF URIs. It must be URL-encoded as 'GigabitEthernet1%2F0%2F1' to be correctly interpreted as a list key value. Therefore, option B correctly identifies the issue. Option A is false because the URL already includes '/restconf/data/'. Option C is incorrect because 'application/yang-data+json' is the proper Accept header for RESTCONF YANG data. Option D is false because GET is the correct HTTP method for data retrieval.

Answer

The URL is missing the '/data' segment; it should be '/restconf/data/...'

Answer

The Accept header should be 'application/json' instead of 'application/yang-data+json'.

Answer

The HTTP method should be POST instead of GET.

Question 18

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Accepted Answer

Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).. In an SD-Access fabric, the underlay network must provide IP connectivity between all fabric devices (edge, control plane, border nodes) using a routed access layer with a link-state routing protocol like IS-IS or OSPF. This ensures fast convergence, loop-free topology, and support for the overlay's VXLAN tunnels. A routed access layer eliminates spanning-tree dependencies and aligns with the fabric's requirement for a simple, scalable IP-based transport.

Answer

Implement PIM-SM for multicast routing in the underlay.

Answer

Preserve existing VLANs across the fabric to minimize changes.

Answer

Deploy VRF-lite on all edge nodes to isolate tenants.

Question 19

A network engineer runs the following command on Router R6:

R6# show ip pim neighbor

PIM Neighbor Table
Mode: B - Bidir Capable, DR - Designated Router, N - Default DR Priority,
      S - State Refresh Capable, G - GenID Capable, L - DR Load Balancing Capable
Neighbor Address     Interface          Uptime    Expires    Mode
10.0.0.2             GigabitEthernet0/0 02:15:30  00:01:25   DR (DR)
10.0.0.3             GigabitEthernet0/0 02:15:28  00:01:27   B S

Based on this output, what can be concluded?

Accepted Answer

The neighbor 10.0.0.2 is the PIM Designated Router.. The output shows that neighbor 10.0.0.2 has the 'DR' flag in the Mode column, indicating it is the PIM Designated Router on the GigabitEthernet0/0 segment. The DR is responsible for forwarding multicast traffic onto the shared segment, and the 'DR (DR)' notation confirms this role. Router R6 itself is not listed as DR, so it is not the DR on this segment.

Answer

Router R6 is the PIM Designated Router on this segment.

Answer

The neighbor 10.0.0.3 supports bidirectional PIM.

Answer

Both neighbors are capable of state refresh.

Question 20

A network engineer runs the following debug on a router:

R1# debug aaa authentication

*Mar  1 00:01:23.456: AAA/BIND(00000001): Bind iplist
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pick method list 'default'
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Method=RADIUS
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): RADIUS server 10.1.1.10:1812, timeout 5, retransmit 2
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Sent username 'admin', password ****
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Received PASS response
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pass

Based on this output, what can be concluded?

Accepted Answer

The RADIUS server 10.1.1.10 authenticated the user successfully.. The debug output shows a successful AAA authentication process: the router binds to an IP list, selects the default method list, attempts RADIUS authentication against server 10.1.1.10:1812, sends the username 'admin' with a masked password, and receives a 'PASS response' followed by 'Pass'. This confirms that the RADIUS server authenticated the user successfully, making option C correct.

Answer

Authentication failed due to incorrect password.

Answer

The router used TACACS+ for authentication.

Answer

The user 'admin' was authenticated using local database.