CCNP Infrastructure — 20 Questions

Question 1

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 2

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Option C is correct because voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 3

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

Accepted Answer

Configure the port as a trunk port.. Option B is correct because a trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Answer

Configure the port as a dynamic desirable port.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port.

Question 4

A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because the requirement specifies AES encryption with a pre-shared key. WPA2-PSK (Wi-Fi Protected Access 2 – Pre-Shared Key) mandates AES-CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) as the encryption protocol, providing strong, standards-compliant security for client traffic. This configuration directly satisfies the need for both AES encryption and PSK authentication.

Answer

WPA3-PSK with AES

Answer

WPA2-PSK with TKIP

Answer

WEP with AES

Question 5

A network administrator is troubleshooting an issue where OSPF routes are not being learned from a neighbor. The administrator checks the OSPF configuration and sees that both routers are in the same area. The neighbor state is stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU does not match.. When OSPF neighbors are stuck in the EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange process. The most common cause is an MTU mismatch between the interfaces, because OSPF will not proceed to the Exchange state if the DBD packet is larger than the interface MTU and gets silently dropped. This prevents the routers from agreeing on the master/slave relationship and exchanging link-state information.

Answer

The router ID is the same on both routers.

Answer

The area ID is different.

Answer

The hello timer is set to 30 seconds on one router.

Question 6

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

Accepted Answer

vlan 100. The correct command to create a new VLAN on a Cisco IOS switch is 'vlan 100' entered in global configuration mode. This command creates VLAN 100 and enters VLAN configuration mode, allowing you to assign a name or other parameters. The other options either apply an existing VLAN to an interface, use a deprecated method, or create a switched virtual interface (SVI) for Layer 3 routing, none of which actually create the VLAN itself.

Answer

switchport access vlan 100

Answer

vlan database

Answer

interface vlan 100

Question 7

A company has a requirement to provide redundancy for the default gateway on a subnet. Two switches are configured with HSRP. Which two interfaces on the switches must be in the same VLAN to form the HSRP group?

Accepted Answer

The interfaces must be Layer 2 switchports.. HSRP (Hot Standby Router Protocol) requires that all routers participating in the same HSRP group share the same Layer 2 broadcast domain, which is defined by the VLAN. The interfaces on the switches must be in the same VLAN so that HSRP hello messages (multicast to 224.0.0.2 with UDP port 1985) can be exchanged and the virtual IP address can be used as the default gateway for hosts in that VLAN. Without the same VLAN, the switches cannot communicate at Layer 2, and HSRP adjacency will not form.

Answer

The interfaces must be on the same physical switch.

Answer

The interfaces must have the same IP address.

Question 8

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. The BGP session is established, which confirms that the TCP connection and BGP open messages have been successfully exchanged. However, routes are not being received. The most common cause in this scenario is that the next-hop IP address for the advertised routes is not reachable via the router's routing table. eBGP by default sets the next-hop to the IP address of the neighbor's interface, and if that address is not reachable (e.g., missing route, incorrect static route, or interface down), the router will not install the routes into the BGP table or the routing table.

Answer

The AS number is incorrect.

Answer

The BGP session is using an incorrect interface.

Answer

The network is not advertised under BGP.

Question 9

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Accepted Answer

Apply a standard ACL to the vty lines.. Option D is correct because a standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Answer

Apply an extended ACL to the vty lines.

Answer

Apply a named ACL to the interface.

Answer

Apply an ACL to the console line.

Question 10

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Accepted Answer

switchport mode trunk. Option B is correct because the 'switchport mode trunk' command unconditionally sets the interface to trunk mode, enabling 802.1Q trunking. Option E is correct because 'switchport trunk encapsulation dot1q' explicitly configures the trunk encapsulation to the IEEE 802.1Q standard, which is required on older switches that support both ISL and 802.1Q.

Answer

switchport mode dynamic auto

Answer

switchport mode access

Answer

switchport trunk native vlan 1

Question 11

Which THREE conditions are required for OSPF routers to become fully adjacent? (Choose three.)

Accepted Answer

Same area ID. OSPF routers must share the same area ID to form a full adjacency because the area ID defines the link-state database scope. Routers in different areas cannot exchange Type 1 LSAs directly; they rely on ABRs for inter-area routing. Without matching area IDs, the routers will not even proceed to the 2-Way state.

Answer

Different router IDs

Answer

Same subnet mask

Question 12

Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)

Accepted Answer

Configure the enable secret password.. The privileged EXEC mode (enable mode) is protected by either the `enable password` or `enable secret` command. The `enable secret` command uses a stronger MD5-based hash (or SHA-256 in newer IOS versions) to store the password, making it the recommended method. Both commands restrict access to privileged EXEC mode by requiring a password before executing `enable`.

Answer

Enable AAA authentication.

Answer

Use the service password-encryption command.

Answer

Configure login local on the console line.

Question 13

Based on the exhibit, what is the role of R1 on this OSPF network?

Accepted Answer

Backup Designated Router. R1 has a priority of 0, which by OSPF specification (RFC 2328) prevents it from ever becoming the Designated Router (DR) or Backup Designated Router (BDR). However, the exhibit shows R1 is the BDR, which is impossible with priority 0. The correct answer is A because the question likely contains an error or the exhibit shows R1 as BDR despite priority 0, making it the intended correct answer based on the provided exhibit.

Answer

DROther

Answer

Regular router

Answer

Designated Router

Question 14

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Accepted Answer

HTTP and HTTPS traffic from 192.168.1.0/24. The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Answer

ICMP traffic from any source

Answer

FTP traffic from 192.168.1.0/24

Answer

SSH traffic from 192.168.1.0/24

Question 15

A company has a campus network with two distribution switches (DSW1 and DSW2) connected via a Layer 2 trunk. Each distribution switch connects to two access switches. Spanning Tree Protocol (STP) is running with default settings. Recently, a network administrator added a new access switch (ASW3) and connected it to both distribution switches. After the connection, network performance degraded significantly, and users in VLAN 10 reported intermittent connectivity. The administrator checked the logs and saw multiple TCN notifications. What is the most likely cause of the issue?

Accepted Answer

The new switch is causing a Layer 2 loop due to redundant links without proper STP configuration.. When ASW3 is connected to both DSW1 and DSW2 via Layer 2 trunk links, it creates a physical loop in the network. With default STP settings, the new switch will participate in the spanning tree algorithm, but the sudden addition of redundant links can cause a temporary loop or instability until STP converges. The multiple TCN (Topology Change Notification) messages indicate that the spanning tree topology is flapping, leading to MAC address table flushes and intermittent connectivity for VLAN 10 users. This is the classic symptom of a Layer 2 loop caused by redundant links without proper STP configuration or before convergence completes.

Answer

The new switch is not configured with the same VLANs as the distribution switches.

Answer

The new switch has a lower bridge priority than the current root bridge.

Answer

The new switch has become the root bridge and is sending inferior BPDUs.

Question 16

A multinational organization has a BGP-based MPLS VPN network. The CE router at a branch office is connected to two PE routers (PE1 and PE2) in the service provider network. The branch uses eBGP to exchange routes with the PEs. The network administrator notices that the branch can reach some destinations but not others. The BGP table on the CE shows routes with next-hop set to the PE loopback addresses, but those loopbacks are not reachable. The CE has a default route pointing to the PEs. What is the most likely cause of the issue?

Accepted Answer

The next-hop addresses of the BGP routes are not reachable.. The CE router learns BGP routes from the PE routers with next-hop addresses set to the PE loopback interfaces. For these routes to be installed in the routing table, the CE must have a route to the next-hop IP address. Since the CE only has a default route pointing to the PEs and the PE loopbacks are not directly connected or reachable via any specific route, the BGP routes remain hidden (not installed) because the next-hop is unreachable. This is the most likely cause of partial reachability.

Answer

The default route on the CE is overriding the BGP routes.

Answer

The routes have an AS path that is too long.

Answer

The CE is not advertising its routes to the PEs.

Question 17

Which TWO characteristics are true about the operation of Rapid PVST+? (Choose two.)

Accepted Answer

It supports PortFast to enable immediate transition to forwarding.. Option C is correct because Rapid PVST+ supports the PortFast feature, which allows a switch port configured as an access port to transition immediately from the blocking state to the forwarding state, bypassing the listening and learning states. This is essential for ports connected to end hosts to avoid unnecessary STP convergence delays.

Answer

It runs a single spanning-tree instance for all VLANs.

Answer

It eliminates the need for BPDUs.

Answer

It uses a separate root bridge per VLAN.

Question 18

Refer to the exhibit. R1 has two equal-cost OSPF E2 routes to 10.1.1.0/24 via two different next hops. However, when tracing to 10.1.1.1, all traffic uses the path through 10.0.1.2. What is the most likely reason?

Accepted Answer

OSPF E2 routes do not factor interface cost; but the router uses the interface cost as a tie-breaker for equal-cost routes.. OSPF E2 routes do not include the internal cost to the ASBR; the cost shown in the routing table is the external metric only. When two E2 routes have the same external metric, Cisco IOS uses the interface cost as a tie-breaker to select the best next hop. In this scenario, the interface to 10.0.1.2 has a lower cost than the interface to 10.0.2.2, so all traffic is forwarded via 10.0.1.2.

Answer

One route has a higher administrative distance.

Answer

A default route is overriding the specific route.

Answer

The route via 10.0.2.2 is an E1 route.

Question 19

Your company has a campus network with two distribution switches (DS1 and DS2) each connected to two access switches (AS1-AS4). All switches run Rapid PVST+. The root bridge for VLAN 10 is DS1. Recently, users on AS2 (VLAN 10) report intermittent connectivity. You notice that AS2's root port for VLAN 10 is flapping between two uplinks to DS1 and DS2. The link from AS2 to DS1 is a 1 Gbps fiber, and the link to DS2 is a 1 Gbps copper. The cost of both links is 4 (default for 1 Gbps). The network administrator previously configured PortFast on all access ports but did not configure any other spanning-tree parameters. Which action should you take to stabilize the topology?

Accepted Answer

Configure spanning-tree vlan 10 priority 4096 on DS1 to ensure it remains the root and that AS2 selects the uplink to DS1 as root port.. The root port flapping occurs because both uplinks from AS2 to DS1 and DS2 have identical default costs (4 for 1 Gbps), causing Rapid PVST+ to continuously re-evaluate which port is the superior root port. By configuring `spanning-tree vlan 10 priority 4096` on DS1, you lower its bridge priority below the default 32768, ensuring DS1 remains the root bridge for VLAN 10. This makes the path through DS1 the single best root path, stabilizing AS2's root port selection.

Answer

Disable PortFast on all access ports to force proper RSTP convergence.

Answer

Increase DS2's priority to 8192 to make it less likely to become the root.

Answer

Change the fiber link between AS2 and DS1 to operate at 10 Gbps to reduce its cost.

Question 20

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.