CCNP Infrastructure — 100 Questions

Question 1

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The next-hop IP address is not reachable.. The BGP session is established, which confirms that the TCP connection and BGP open messages have been successfully exchanged. However, routes are not being received. The most common cause in this scenario is that the next-hop IP address for the advertised routes is not reachable via the router's routing table. eBGP by default sets the next-hop to the IP address of the neighbor's interface, and if that address is not reachable (e.g., missing route, incorrect static route, or interface down), the router will not install the routes into the BGP table or the routing table.

Answer

The AS number is incorrect.

Answer

The BGP session is using an incorrect interface.

Answer

The network is not advertised under BGP.

Question 2

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Accepted Answer

Apply a standard ACL to the vty lines.. A standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Answer

Apply an extended ACL to the vty lines.

Answer

Apply a named ACL to the interface.

Answer

Apply an ACL to the console line.

Question 3

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Accepted Answer

switchport mode dynamic auto. 'switchport mode dynamic auto', is valid because it enables DTP negotiation to establish an 802.1Q trunk when the remote switch is configured as desirable or trunk. Option E, 'switchport trunk encapsulation dot1q', explicitly sets the trunking encapsulation to 802.1Q, directly configuring 802.1Q trunking. Option B, 'switchport mode trunk', is incorrect because it enables trunking but does not guarantee 802.1Q encapsulation; on older switches it may default to ISL. Therefore, it is not a complete command for configuring 802.1Q trunking.

Answer

switchport mode trunk

Answer

switchport mode access

Answer

switchport trunk native vlan 1

Question 4

Which THREE conditions are required for OSPF routers to become fully adjacent? (Choose three.)

Accepted Answer

Same area ID. For OSPF routers to become fully adjacent, three key conditions must be met: (1) same area ID, because the area defines the link-state database scope; (2) matching hello and dead intervals, as these control the neighbor discovery and failure detection; (3) different router IDs, because router IDs must be unique on the network for proper LSA identification. Matching authentication is required only if authentication is configured, so it is not a universally required condition. The same subnet mask is not required; routers on the same segment need only the same network number.

Answer

Matching authentication (if configured)

Answer

Same subnet mask

Question 5

Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)

Accepted Answer

Configure the enable secret password.. The privileged EXEC mode (enable mode) is protected by either the `enable password` or `enable secret` command. The `enable secret` command uses a stronger MD5-based hash (or SHA-256 in newer IOS versions) to store the password, making it the recommended method. Both commands restrict access to privileged EXEC mode by requiring a password before executing `enable`.

Answer

Enable AAA authentication.

Answer

Use the service password-encryption command.

Answer

Configure login local on the console line.

Question 6

R1 has an OSPF priority of 0. What is its role on the OSPF network?

Accepted Answer

DROther. In OSPF, a router with priority 0 cannot be elected as Designated Router (DR) or Backup Designated Router (BDR). Such a router is always a DROther.

Answer

Backup Designated Router

Answer

Regular router

Answer

Designated Router

Question 7

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Accepted Answer

HTTP and HTTPS traffic from 192.168.1.0/24. The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Answer

ICMP traffic from any source

Answer

FTP traffic from 192.168.1.0/24

Answer

SSH traffic from 192.168.1.0/24

Question 8

Which TWO characteristics are true about the operation of Rapid PVST+? (Choose two.)

Accepted Answer

It uses a separate root bridge per VLAN.. Rapid PVST+ provides faster convergence than PVST+ due to its use of enhanced BPDU exchanges and rapid transition mechanisms. Additionally, it maintains the per-VLAN spanning-tree model of PVST+, so each VLAN can have a separate root bridge. While Rapid PVST+ does support PortFast, this is an optional feature for access ports and not a defining characteristic of its operation; the question asks for characteristics that are true about the operation, and PortFast is not inherent to Rapid PVST+ itself.

Answer

It runs a single spanning-tree instance for all VLANs.

Answer

It eliminates the need for BPDUs.

Answer

It supports PortFast to enable immediate transition to forwarding.

Question 9

Your company has a campus network with two distribution switches (DS1 and DS2) each connected to two access switches (AS1-AS4). All switches run Rapid PVST+. The root bridge for VLAN 10 is DS1. Recently, users on AS2 (VLAN 10) report intermittent connectivity. You notice that AS2's root port for VLAN 10 is flapping between two uplinks to DS1 and DS2. The link from AS2 to DS1 is a 1 Gbps fiber, and the link to DS2 is a 1 Gbps copper. The cost of both links is 4 (default for 1 Gbps). The network administrator previously configured PortFast on all access ports but did not configure any other spanning-tree parameters. Which action should you take to stabilize the topology?

Accepted Answer

Change the fiber link between AS2 and DS1 to operate at 10 Gbps to reduce its cost.. The root port flapping occurs because both uplinks from AS2 to DS1 and DS2 have identical default costs (4 for 1 Gbps), causing Rapid PVST+ to continuously re-evaluate which port is the superior root port. Changing the fiber link between AS2 and DS1 to 10 Gbps reduces its port cost to 2 (default cost for 10 Gbps), breaking the tie and making the path via DS1 the clear best path. This stabilizes AS2's root port selection.

Answer

Disable PortFast on all access ports to force proper RSTP convergence.

Answer

Configure spanning-tree vlan 10 priority 4096 on DS1 to ensure it remains the root and that AS2 selects the uplink to DS1 as root port.

Answer

Increase DS2's priority to 8192 to make it less likely to become the root.

Question 10

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Accepted Answer

Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status. VTP requires setting mode and domain before trunking works; verification confirms operation.

Answer

Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Answer

Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status

Answer

Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Question 11

Drag and drop the steps for the EIGRP neighbor discovery process in the correct order.

Accepted Answer

Step 1: Send Hello packets. Step 2: Discover neighbors. Step 3: Exchange routing updates. Step 4: Maintain neighbor state.. EIGRP uses Hello packets to discover neighbors, then exchanges routes and maintains state.

Answer

Step 1: Exchange routing updates. Step 2: Send Hello packets. Step 3: Discover neighbors. Step 4: Maintain neighbor state.

Answer

Step 1: Discover neighbors. Step 2: Send Hello packets. Step 3: Exchange routing updates. Step 4: Maintain neighbor state.

Answer

Step 1: Send Hello packets. Step 2: Exchange routing updates. Step 3: Discover neighbors. Step 4: Maintain neighbor state.

Question 12

Match each Cisco IOS command to its function.

Accepted Answer

show ip route: Displays the IP routing table. The correct matches are: show ip route displays the routing table, show ip interface brief summarizes interface status, ping tests connectivity, and traceroute traces the path. Common confusions arise from swapping the functions of show ip route and ping.

Answer

show ip route: Tests network connectivity

Answer

ping: Displays the IP routing table

Question 13

Match each EIGRP term to its definition.

Accepted Answer

Feasible Distance: The total metric from the local router to the destination network.. EIGRP uses Feasible Distance (FD) as the best metric to a destination, Reported Distance (RD) as a neighbor's metric, and the Feasible Condition (RD < FD) to ensure loop-free paths. Successor is the next-hop router with the lowest FD.

Answer

Feasible Distance: The metric advertised by a neighboring router for a specific route.

Answer

Reported Distance: The total metric from the local router to the destination network.

Question 14

A network engineer is implementing VXLAN with BGP EVPN on Cisco Nexus switches. The engineer must ensure that the underlay network provides the necessary transport and that the overlay control plane distributes MAC and IP address reachability information. Which two statements about the operation of BGP EVPN in a VXLAN environment are true? (Choose two.)

Accepted Answer

BGP EVPN uses Route Type 3 to advertise VTEP IP addresses for multicast replication.. BGP EVPN uses Route Type 2 to distribute MAC and IP bindings for hosts, enabling control-plane learning and ARP suppression. Route Type 3 advertises VTEP IP addresses and multicast replication information for BUM traffic. These two types are fundamental for VXLAN overlay operation. The underlay routing protocol is not restricted, and VTEPs can span multiple ASes.

Answer

BGP EVPN requires that all VTEPs be in the same autonomous system.

Answer

BGP EVPN uses Route Type 5 to advertise IP prefixes for external connectivity.

Answer

BGP EVPN requires that the underlay network use OSPF for unicast routing between VTEPs.

Question 15

A network administrator is configuring a Cisco IOS switch and needs to ensure that the management VLAN interface is reachable from a remote subnet. The switch currently has no IP address configured on any interface. Which command must be applied to assign an IP address to the management VLAN?

Accepted Answer

interface vlan 1 then ip address 192.168.10.2 255.255.255.0. The correct command sequence is to enter interface vlan 1 and assign an IP address. This creates an SVI that provides management access to the switch. A default gateway must also be configured for remote subnet reachability, but the IP address assignment is the first step.

Answer

ip default-gateway 192.168.10.1 on the switch

Answer

ip address 192.168.10.2 255.255.255.0 on the console port

Answer

ip address 192.168.10.2 255.255.255.0 on the physical interface GigabitEthernet0/1

Question 16

A network engineer is configuring a pair of Cisco Catalyst 9300 switches in a StackWise stack. The engineer wants to ensure that a single switch failure does not cause the entire stack to lose its control plane. Which StackWise cabling topology should be used?

Accepted Answer

Connect the switches in a full-ring topology using two StackWise cables between each adjacent switch.. The correct answer is to connect the switches in a full-ring topology using two StackWise cables between each adjacent switch. This provides redundant paths for stack control and data traffic, ensuring that a single cable or switch failure does not cause the entire stack to lose its control plane. Other topologies either do not provide redundancy or are not supported by StackWise.

Answer

Connect all switches to a central master switch using one cable per switch in a star topology.

Answer

Daisy-chain the stack ports in a single ring using only one cable between each switch.

Answer

Use a single StackWise cable to connect the first switch to the last switch, and leave the middle switches unconnected.

Question 17

A network engineer is configuring a pair of Cisco Catalyst 9300 switches to operate as a single logical switch using StackWise Virtual technology. The engineer has already configured the domain ID and priority on both switches and physically connected them with the appropriate cables. After reloading both switches, the engineer notices that the stack is not forming and both switches remain in standalone mode. Which action should the engineer take next?

Accepted Answer

Ensure that the switches are running the same Cisco IOS XE software version and have matching licenses.. StackWise Virtual requires both switches to run identical Cisco IOS XE software versions and have compatible licenses. Even with correct domain ID and physical connections, a software mismatch will prevent the stack from forming. Ensuring software parity is a fundamental prerequisite for a successful StackWise Virtual configuration.

Answer

Verify that the SVL link is using fiber optic cables and not copper cables.

Answer

Confirm that the StackWise Virtual domain ID is unique and does not conflict with any other stack in the network.

Answer

Verify that the StackWise Virtual link is configured as a trunk carrying all VLANs.

Question 18

A network engineer is configuring a new Cisco IOS router that will run OSPFv2. The router must be able to form adjacencies with its directly connected neighbors and must also allow remote networks to be reachable through it. The engineer issues the following commands: router ospf 1, network 10.0.0.0 0.0.0.255 area 0, and network 192.168.1.0 0.0.0.255 area 1. However, the router is not forming an adjacency with a neighbor on the 10.0.0.0/24 interface. Which action is the most likely cause of the problem?

Accepted Answer

The interface on the 10.0.0.0/24 network is passive, preventing OSPF hello packets.. OSPF adjacency formation requires that interfaces are not passive and that hello packets can be exchanged. The network commands are correctly configured with wildcard masks, and the process ID and router ID do not need to match or be explicitly set. The most likely cause is that the interface facing the neighbor is passive, which stops OSPF hellos and prevents the adjacency from forming.

Answer

The OSPF router ID is not explicitly configured, so the router cannot form adjacencies.

Answer

The OSPF process ID is set to 1, but the neighbor is using process ID 2.

Answer

The network commands are using wildcard masks, but OSPF requires subnet masks.

Question 19

A network engineer is implementing OSPFv3 in an IPv6 network. The engineer wants to enable OSPFv3 on an interface and ensure that the interface participates in OSPF area 0. Which command is required to enable OSPFv3 on an interface in Cisco IOS?

Accepted Answer

ipv6 ospf 1 area 0. The correct command to enable OSPFv3 on an interface is ipv6 ospf process-id area area-id. This command is entered in interface configuration mode and activates OSPFv3 for that interface. It is a key difference from OSPFv2, which uses network statements under router configuration.

Answer

ospfv3 1 ipv6 area 0

Answer

router ospfv3 1 then address-family ipv6 unicast

Answer

ipv6 router ospf 1 then network 2001:db8::/64 area 0

Question 20

A network engineer is implementing a first-hop redundancy protocol on a pair of switches. The requirement is to have one switch actively forward traffic for the virtual IP while the other switch stands by, and to allow the standby switch to take over if the active switch fails. Which protocol should be used to meet these requirements?

Accepted Answer

VRRPv3. VRRPv3 is an open-standard first-hop redundancy protocol that supports active/standby operation, making it suitable for multi-vendor environments. It allows a virtual IP to be shared, with one master forwarding traffic and backups ready to take over. HSRPv2 is Cisco-proprietary, and GLBP provides load balancing rather than strict active/standby.

Answer

STP

Answer

HSRPv2

Answer

GLBP