CCNP Infrastructure — 15 Questions

Question 1

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CoS 5, DSCP EF. Voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 2

A company has a requirement to provide redundancy for the default gateway on a subnet. Two switches are configured with HSRP. Which requirement must be met for the interfaces on the switches to form the HSRP group?

Accepted Answer

The interfaces must be in the same VLAN.. HSRP is a First Hop Redundancy Protocol that provides a virtual gateway for hosts. To form an HSRP group, the participating interfaces must be Layer 3 interfaces (either SVIs on switches or routed ports on multilayer switches) that are configured with IP addresses and belong to the same VLAN. Option B is incorrect because HSRP does not run on Layer 2 switchports; those ports do not have IP addresses and cannot send HSRP messages. Option D is correct because being in the same VLAN ensures the switches share the same broadcast domain, allowing HSRP multicast hello messages to reach each other.

Answer

The interfaces must be on the same physical switch.

Answer

The interfaces must be Layer 2 switchports.

Answer

The interfaces must have the same IP address.

Question 3

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. The BGP session is established, which confirms that the TCP connection and BGP open messages have been successfully exchanged. However, routes are not being received. The most common cause in this scenario is that the next-hop IP address for the advertised routes is not reachable via the router's routing table. eBGP by default sets the next-hop to the IP address of the neighbor's interface, and if that address is not reachable (e.g., missing route, incorrect static route, or interface down), the router will not install the routes into the BGP table or the routing table.

Answer

The AS number is incorrect.

Answer

The BGP session is using an incorrect interface.

Answer

The network is not advertised under BGP.

Question 4

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Accepted Answer

switchport mode dynamic auto. 'switchport mode dynamic auto', is valid because it enables DTP negotiation to establish an 802.1Q trunk when the remote switch is configured as desirable or trunk. Option E, 'switchport trunk encapsulation dot1q', explicitly sets the trunking encapsulation to 802.1Q, directly configuring 802.1Q trunking. Option B, 'switchport mode trunk', is incorrect because it enables trunking but does not guarantee 802.1Q encapsulation; on older switches it may default to ISL. Therefore, it is not a complete command for configuring 802.1Q trunking.

Answer

switchport mode trunk

Answer

switchport mode access

Answer

switchport trunk native vlan 1

Question 5

Which THREE conditions are required for OSPF routers to become fully adjacent? (Choose three.)

Accepted Answer

Same area ID. For OSPF routers to become fully adjacent, three key conditions must be met: (1) same area ID, because the area defines the link-state database scope; (2) matching hello and dead intervals, as these control the neighbor discovery and failure detection; (3) different router IDs, because router IDs must be unique on the network for proper LSA identification. Matching authentication is required only if authentication is configured, so it is not a universally required condition. The same subnet mask is not required; routers on the same segment need only the same network number.

Answer

Matching authentication (if configured)

Answer

Same subnet mask

Question 6

A company has a campus network with two distribution switches (DSW1 and DSW2) connected via a Layer 2 trunk. Each distribution switch connects to two access switches. Spanning Tree Protocol (STP) is running with default settings. Recently, a network administrator added a new access switch (ASW3) and connected it to both distribution switches. After the connection, network performance degraded significantly, and users in VLAN 10 reported intermittent connectivity. The administrator checked the logs and saw multiple TCN notifications. What is the most likely cause of the issue?

Accepted Answer

The new switch is causing a Layer 2 loop due to redundant links without proper STP configuration.. When ASW3 is connected to both DSW1 and DSW2 via Layer 2 trunk links, it creates a physical loop in the network. With default STP settings, the new switch will participate in the spanning tree algorithm, but the sudden addition of redundant links can cause a temporary loop or instability until STP converges. The multiple TCN (Topology Change Notification) messages indicate that the spanning tree topology is flapping, leading to MAC address table flushes and intermittent connectivity for VLAN 10 users. This is the classic symptom of a Layer 2 loop caused by redundant links without proper STP configuration or before convergence completes.

Answer

The new switch is not configured with the same VLANs as the distribution switches.

Answer

The new switch has a lower bridge priority than the current root bridge.

Answer

The new switch has become the root bridge and is sending inferior BPDUs.

Question 7

A multinational organization has a BGP-based MPLS VPN network. The CE router at a branch office is connected to two PE routers (PE1 and PE2) in the service provider network. The branch uses eBGP to exchange routes with the PEs. The network administrator notices that the branch can reach some destinations but not others. The BGP table on the CE shows routes with next-hop set to the PE loopback addresses, but those loopbacks are not reachable. The CE has a default route pointing to the PEs. What is the most likely cause of the issue?

Accepted Answer

The next-hop addresses of the BGP routes are not reachable.. The CE router learns BGP routes from the PE routers with next-hop addresses set to the PE loopback interfaces. For these routes to be installed in the routing table, the CE must have a route to the next-hop IP address. Since the CE only has a default route pointing to the PEs and the PE loopbacks are not directly connected or reachable via any specific route, the BGP routes remain hidden (not installed) because the next-hop is unreachable. This is the most likely cause of partial reachability.

Answer

The default route on the CE is overriding the BGP routes.

Answer

The routes have an AS path that is too long.

Answer

The CE is not advertising its routes to the PEs.

Question 8

Your company has a campus network with two distribution switches (DS1 and DS2) each connected to two access switches (AS1-AS4). All switches run Rapid PVST+. The root bridge for VLAN 10 is DS1. Recently, users on AS2 (VLAN 10) report intermittent connectivity. You notice that AS2's root port for VLAN 10 is flapping between two uplinks to DS1 and DS2. The link from AS2 to DS1 is a 1 Gbps fiber, and the link to DS2 is a 1 Gbps copper. The cost of both links is 4 (default for 1 Gbps). The network administrator previously configured PortFast on all access ports but did not configure any other spanning-tree parameters. Which action should you take to stabilize the topology?

Accepted Answer

Change the fiber link between AS2 and DS1 to operate at 10 Gbps to reduce its cost.. The root port flapping occurs because both uplinks from AS2 to DS1 and DS2 have identical default costs (4 for 1 Gbps), causing Rapid PVST+ to continuously re-evaluate which port is the superior root port. Changing the fiber link between AS2 and DS1 to 10 Gbps reduces its port cost to 2 (default cost for 10 Gbps), breaking the tie and making the path via DS1 the clear best path. This stabilizes AS2's root port selection.

Answer

Disable PortFast on all access ports to force proper RSTP convergence.

Answer

Configure spanning-tree vlan 10 priority 4096 on DS1 to ensure it remains the root and that AS2 selects the uplink to DS1 as root port.

Answer

Increase DS2's priority to 8192 to make it less likely to become the root.

Question 9

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 10

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

Accepted Answer

Configure the port as a trunk port.. A trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Answer

Configure the port as a dynamic desirable port.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port.

Question 11

A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because the requirement specifies AES encryption with a pre-shared key. WPA2-PSK (Wi-Fi Protected Access 2 – Pre-Shared Key) mandates AES-CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) as the encryption protocol, providing strong, standards-compliant security for client traffic. This configuration directly satisfies the need for both AES encryption and PSK authentication.

Answer

WPA3-PSK with AES

Answer

WPA2-PSK with TKIP

Answer

WEP with AES

Question 12

A network administrator is troubleshooting an issue where OSPF routes are not being learned from a neighbor. The administrator checks the OSPF configuration and sees that both routers are in the same area. The neighbor state is stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU does not match.. When OSPF neighbors are stuck in the EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange process. The most common cause is an MTU mismatch between the interfaces, because OSPF will not proceed to the Exchange state if the DBD packet is larger than the interface MTU and gets silently dropped. This prevents the routers from agreeing on the master/slave relationship and exchanging link-state information.

Answer

The router ID is the same on both routers.

Answer

The area ID is different.

Answer

The hello timer is set to 30 seconds on one router.

Question 13

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

Accepted Answer

vlan 100. The correct command to create a new VLAN on a Cisco IOS switch is 'vlan 100' entered in global configuration mode. This command creates VLAN 100 and enters VLAN configuration mode, allowing you to assign a name or other parameters. The other options either apply an existing VLAN to an interface, use a deprecated method, or create a switched virtual interface (SVI) for Layer 3 routing, none of which actually create the VLAN itself.

Answer

switchport access vlan 100

Answer

vlan database

Answer

interface vlan 100

Question 14

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Accepted Answer

Apply a standard ACL to the vty lines.. A standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Answer

Apply an extended ACL to the vty lines.

Answer

Apply a named ACL to the interface.

Answer

Apply an ACL to the console line.

Question 15

Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)

Accepted Answer

Configure the enable secret password.. The privileged EXEC mode (enable mode) is protected by either the `enable password` or `enable secret` command. The `enable secret` command uses a stronger MD5-based hash (or SHA-256 in newer IOS versions) to store the password, making it the recommended method. Both commands restrict access to privileged EXEC mode by requiring a password before executing `enable`.

Answer

Enable AAA authentication.

Answer

Use the service password-encryption command.

Answer

Configure login local on the console line.