CCNP Infrastructure Practice Test 11 — 15 Questions

Question 1

A network engineer is designing a QoS policy for a Cisco Catalyst switch. The engineer needs to ensure that voice traffic is marked with DSCP EF and that the switch trusts the markings from an IP phone. Which two actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the switch port to trust DSCP using the mls qos trust dscp command.. To trust DSCP markings from an IP phone, the switch must have QoS enabled globally with the mls qos command. Then, the interface connected to the phone must be configured to trust DSCP using mls qos trust dscp. These two actions ensure that voice packets marked EF by the phone are not remarked and are prioritized appropriately through the switch.

Answer

Configure a class map to match DSCP EF and a policy map to set the DSCP to EF.

Answer

Configure a policy map to police voice traffic to a specific rate and mark down excess traffic.

Answer

Configure the switch port to trust CoS using the mls qos trust cos command.

Question 2

A network administrator needs to configure a Cisco IOS switch port as a trunk that only allows VLANs 10, 20, and 30, and uses 802.1Q encapsulation. Which command sequence correctly achieves this?

Accepted Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20,30. To configure a trunk with 802.1Q encapsulation and restrict allowed VLANs, the correct order on Cisco IOS is to set the encapsulation, then mode trunk, then allowed VLANs. The correct option does this and does not alter the native VLAN or disable negotiation. The other options either use access mode, omit encapsulation, or change the native VLAN unnecessarily.

Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20,30

Answer

interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 10

Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate

Question 3

A network engineer is configuring a new Cisco Catalyst 9300 switch that will act as a distribution switch in a large campus. The switch must support a routing protocol that provides fast convergence and uses a topology table separate from the routing table. The engineer also wants to minimize configuration complexity. Which routing protocol should be configured?

Accepted Answer

EIGRP. EIGRP is the correct choice because it maintains a topology table separate from the routing table, uses DUAL for fast convergence, and is simpler to configure than OSPF or BGP in a campus environment. It provides the required features without unnecessary complexity.

Answer

OSPF

Answer

RIPng

Answer

BGP

Question 4

A network engineer is deploying a new branch office with a Cisco Catalyst 9000 switch. The switch will connect to the ISP via a Layer 3 link and must dynamically learn the ISP's routes using BGP. The engineer wants to ensure that the switch does not advertise any internal routes to the ISP. Which BGP configuration should be applied?

Accepted Answer

Configure an outbound prefix list that denies all internal prefixes and apply it to the ISP neighbor.. To prevent advertising internal routes to an ISP, the engineer must filter outbound advertisements. An outbound prefix list that denies internal prefixes and permits others (or denies all) applied to the ISP neighbor will ensure no internal routes are sent. This is a standard BGP filtering technique. Other options like communities or maximum-prefix do not achieve the desired filtering of outbound advertisements.

Answer

Configure the 'neighbor <ISP> send-community' command to prevent communities from being sent.

Answer

Configure the 'neighbor <ISP> maximum-prefix' command to limit the number of prefixes received.

Answer

Configure a route map with the 'set community no-export' command and apply it outbound to the ISP.

Question 5

A network engineer is implementing a Cisco SD-Access fabric and needs to configure the underlay network. Which two protocols are typically used in the underlay for a Cisco SD-Access fabric? (Choose two.)

Accepted Answer

LISP. The typical underlay protocols for Cisco SD-Access are IS-IS and OSPF, with IS-IS being the most common in Cisco validated designs. LISP is used in the overlay for control plane, not the underlay. BGP and EIGRP are not standard underlay choices for SD-Access.

Answer

BGP

Answer

EIGRP

Answer

OSPF

Question 6

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a guest VLAN 50 (192.168.50.0/24). The requirement is that guest clients must receive an IP address and default gateway, but must NOT be able to reach any other subnet in the corporate network. Which DHCP configuration accomplishes this?

Accepted Answer

ip dhcp pool GUEST
 network 192.168.50.0 255.255.255.0
 default-router 192.168.50.1
ip access-list extended GUEST_ISOLATE
 permit udp any any eq bootps
 permit udp any any eq bootpc
 deny ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255
 deny ip 192.168.50.0 0.0.0.255 172.16.0.0 0.15.255.255
 permit ip any any
interface Vlan50
 ip access-group GUEST_ISOLATE in. Guest isolation requires two things: functional DHCP parameters (address pool, default router) and a policy that blocks access to internal subnets while allowing DHCP and permitted traffic. Applying an inbound ACL on the guest SVI with explicit DHCP permits, denies for corporate RFC1918 ranges, and a final permit achieves the stated goal without breaking address assignment.

Answer

ip dhcp pool GUEST
 network 192.168.50.0 255.255.255.0
 default-router 192.168.50.1
ip access-list extended GUEST_ISOLATE
 deny ip 192.168.50.0 0.0.0.255 any
 permit ip any any
interface GigabitEthernet0/1
 ip access-group GUEST_ISOLATE in

Answer

ip dhcp excluded-address 192.168.50.1 192.168.50.254
ip dhcp pool GUEST
 network 192.168.50.0 255.255.255.0
 default-router 192.168.50.1
ip route 0.0.0.0 0.0.0.0 192.168.50.1

Answer

ip dhcp pool GUEST
 network 192.168.50.0 255.255.255.0
 default-router 192.168.50.1
 no dns-server

Question 7

A network engineer is implementing a Cisco SD-Access fabric. The engineer needs to ensure that endpoints in the same virtual network (VN) can communicate with each other, while endpoints in different VNs are isolated. Which component of the SD-Access architecture is responsible for providing this isolation?

Accepted Answer

VXLAN VNI assignment. Isolation between virtual networks in Cisco SD-Access is achieved by assigning each VN a unique VXLAN VNI. Fabric Edge Nodes encapsulate endpoint traffic with the VNI of the VN to which the endpoint belongs. Since forwarding decisions are based on the VNI, traffic from different VNs is kept separate. This segmentation is fundamental to SD-Access and is enforced in the data plane.

Answer

Edge Node

Answer

Control Plane Node

Answer

Fabric Border Node

Question 8

A network engineer is implementing a GRE tunnel between two Cisco IOS routers over an IP network. The tunnel interfaces are configured with IP addresses and the tunnel source and destination are reachable. However, OSPF adjacencies over the tunnel are not forming. Which action should the engineer take?

Accepted Answer

Adjust the IP MTU on the tunnel interfaces to account for GRE overhead.. GRE encapsulation adds 24 bytes of overhead, so the default 1500-byte MTU on the tunnel interface can cause OSPF hello packets to be dropped if the underlying path MTU is 1500. Lowering the IP MTU on the tunnel interface to 1476 or less ensures OSPF packets are not fragmented or discarded. This allows OSPF adjacencies to form over the tunnel. Other options either do not address the root cause or would create new problems.

Answer

Configure the tunnel interfaces as OSPF point-to-point network type.

Answer

Configure the same OSPF router ID on both routers.

Answer

Enable OSPF on the physical interfaces carrying the tunnel traffic.

Question 9

A network administrator is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using SHA-256 HMAC. The administrator wants to apply the authentication on a per-interface basis. Which command sequence is correct?

Accepted Answer

interface GigabitEthernet0/0
 ip ospf authentication key-chain OSPF-KEY
 key chain OSPF-KEY
  key 1
   cryptographic-algorithm hmac-sha-256
   key-string <key>. To enable SHA-256 HMAC authentication for OSPFv2 on a per-interface basis, you must configure a key chain with the hmac-sha-256 algorithm and then apply it to the interface using ip ospf authentication key-chain. The other options misuse commands or apply incompatible syntax.

Answer

interface GigabitEthernet0/0
 ip ospf authentication null
 key chain OSPF-KEY
  key 1
   cryptographic-algorithm hmac-sha-256
   key-string <key>

Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 sha256 <key>

Answer

router ospf 1
 area 0 authentication message-digest
 area 0 authentication key-chain OSPF-KEY
 key chain OSPF-KEY
  key 1
   cryptographic-algorithm hmac-sha-256
   key-string <key>

Question 10

A network engineer is implementing a VXLAN overlay network using Cisco Nexus switches. The underlay network is running OSPF, and the engineer needs to ensure that the VXLAN tunnel endpoints (VTEPs) can communicate. The engineer has configured the NVE interface and mapped VLANs to VNIs. However, traffic between hosts in the same VXLAN segment on different VTEPs is not passing. Which action should the engineer take to troubleshoot the issue?

Accepted Answer

Verify that the loopback interfaces used as VTEP source addresses are reachable via the underlay routing protocol.. VXLAN tunnels are established between VTEP loopback addresses. These loopbacks must be reachable via the underlay routing protocol, such as OSPF. If the loopbacks are not advertised or there is a routing black hole, the VXLAN tunnels will not form, and traffic will not traverse the overlay. Therefore, verifying underlay reachability to the VTEP loopbacks is the essential troubleshooting step.

Answer

Verify that the NVE interface is configured with the correct source-interface command.

Answer

Ensure that the VLAN-to-VNI mapping is consistent across all VTEPs in the same VXLAN segment.

Answer

Check that the MTU on the underlay interfaces is large enough to accommodate the VXLAN encapsulation overhead.

Question 11

A network engineer is configuring a Cisco IOS router to authenticate users via TACACS+ for administrative access. The engineer wants to ensure that if the TACACS+ server is unreachable, the router falls back to using the local username database. Which command should be configured on the VTY lines to achieve this?

Accepted Answer

aaa authentication login default group tacacs+ local. To configure TACACS+ authentication with local fallback, the engineer must define an AAA authentication method list using 'aaa authentication login default group tacacs+ local'. This list specifies that TACACS+ is tried first, and if it fails or is unreachable, the local username database is used. The method list is then applied to the VTY lines with 'login authentication default'. The other options either use invalid syntax, omit the local fallback, or allow unauthenticated access.

Answer

login authentication default

Answer

aaa authentication login default group tacacs+ none

Answer

login authentication TACACS+ local

Question 12

A network administrator is deploying a new Cisco Catalyst switch and wants to protect the control plane from being overwhelmed by excessive ARP and IP broadcast traffic arriving on access ports. The administrator wants a feature that rate-limits these packets in hardware before they reach the CPU. Which feature should be configured?

Accepted Answer

Control Plane Protection with CoPP and per-protocol rate limiters, or the platform's control plane policing feature. Protecting the control plane from ARP and IP broadcast floods requires a feature that classifies those specific protocols and rate-limits them in hardware. Control plane protection mechanisms on Catalyst switches, often configured as control plane policing or protocol-specific rate limiters, do exactly this. Storm control and DAI address different problems, and generic CoPP is not the per-protocol access-port hardware limiter described.

Answer

Control Plane Policing

Answer

Storm control

Answer

Dynamic ARP Inspection

Question 13

A network administrator is configuring a Cisco IOS router for SNMPv3. The requirement is to authenticate users with HMAC-SHA and encrypt SNMP traffic using AES-128. Which SNMPv3 configuration mode command should be used to create a user with these security features?

Accepted Answer

snmp-server user admin group authGroup v3 auth sha authpass priv aes 128 privpass. The correct SNMPv3 user configuration must include both authentication and privacy. The command syntax requires 'auth' followed by the algorithm (sha) and password, then 'priv' followed by the encryption algorithm (aes 128) and password. Only the command that includes both 'auth sha' and 'priv aes 128' meets the requirement. Other options either use incorrect algorithms or omit one of the security features.

Answer

snmp-server user admin group authGroup v3 priv aes 128 privpass

Answer

snmp-server user admin group authGroup v3 auth sha authpass

Answer

snmp-server user admin group authGroup v3 auth md5 authpass priv des privpass

Question 14

A network engineer is configuring a Cisco IOS router to support QoS for VoIP traffic. The engineer needs to ensure that voice packets are marked with DSCP EF and placed in the priority queue. Which command should be used to mark voice packets with DSCP EF?

Accepted Answer

set ip dscp ef. The command 'set ip dscp ef' is used within a policy map class to mark packets with the Expedited Forwarding DSCP value (46). This marking is critical for VoIP traffic to receive priority treatment across the network. Other options either have incorrect syntax, combine marking with policing, or perform queuing without marking. Proper QoS configuration requires both marking and queuing to ensure voice quality.

Answer

set dscp ef

Answer

priority 1000

Answer

police 1000000 conform-action set-dscp-transmit ef

Question 15

A network engineer is designing a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer wants to ensure that the underlay network provides load balancing across multiple equal-cost paths and supports multicast for BUM traffic. Which underlay routing protocol should be used?

Accepted Answer

PIM-SM. PIM-SM is the correct choice because it provides multicast routing in the underlay, which is necessary for VXLAN BUM traffic when using multicast replication. The other options are unicast routing protocols that do not natively support multicast.

Answer

IS-IS

Answer

BGP

Answer

OSPFv2