CCNP Infrastructure Practice Test 15 — 15 Questions

Question 1

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a RADIUS server on the WLC and set the WLAN security to 802.1X with the RADIUS server selected.. To support 802.1X with EAP-TLS, the WLC must be configured with an external RADIUS server and the WLAN must use 802.1X security referencing that server. The WLC then relays EAP messages between the client and the RADIUS server, which performs certificate-based authentication. This is the standard deployment for enterprise wireless with EAP-TLS.

Answer

Enable PSK on the WLAN and configure a pre-shared key.

Answer

Set the WLAN security to 802.1X and enable the local EAP server on the WLC.

Answer

Configure the WLAN with Web Policy authentication and a local net user.

Question 2

A network engineer is configuring a new Cisco IOS router for OSPFv2 in a multi-area OSPF domain. The router will be an Area Border Router (ABR) connecting Area 0 and Area 10. The engineer must ensure that the router correctly summarizes routes from Area 10 into Area 0 and that it does not become a designated router (DR) on any broadcast network. Which two configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Set the OSPF interface priority to 0 on all interfaces that participate in OSPF.. To summarize routes from Area 10 into Area 0, the ABR must use the 'area 10 range' command. To prevent the router from becoming a DR, the OSPF interface priority must be set to 0 on all participating interfaces. These two steps directly satisfy the requirements. The other options either configure stub areas, alter cost calculations, or suppress OSPF on interfaces, none of which meet the stated goals.

Answer

Configure the router with the 'area 10 stub' command under the OSPF routing process.

Answer

Configure the router with the 'auto-cost reference-bandwidth 100000' command under the OSPF routing process.

Answer

Configure the router with the 'passive-interface default' command under the OSPF routing process.

Question 3

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. The engineer must ensure that the control plane and data plane are secure and that routers can authenticate to the controllers. Which two statements are true regarding the Cisco SD-WAN controller components? (Choose two.)

Accepted Answer

vSmart distributes control plane policies and routes to vEdge routers using OMP.. In Cisco SD-WAN, vBond orchestrates initial authentication and helps routers find other controllers. vSmart distributes control plane policies and routes using OMP. These two components are essential for establishing the secure overlay and enabling centralized control. The management plane (vManage) and data plane (vEdge routers) have different roles.

Answer

vSmart stores the full configuration and acts as the CA for certificate management.

Answer

vManage is responsible for forwarding data plane traffic between branches.

Answer

vBond establishes IPsec tunnels for data plane traffic between vEdge routers.

Question 4

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the WLAN with WPA2 Enterprise security and specify the RADIUS server IP address and shared secret.. 802.1X authentication on a Cisco WLC requires the WLAN to be configured with WPA2 Enterprise security. This setting enables the use of EAP, which relays authentication to a RADIUS server. The RADIUS server IP address and shared secret must be configured so the WLC can communicate with the server. This ensures that only users with valid credentials, as verified by the RADIUS server, can access the wireless network.

Answer

Enable MAC filtering on the WLC and add the MAC addresses of authorized users.

Answer

Configure the WLAN with WPA2 Personal security and specify a pre-shared key.

Answer

Configure the WLAN with Open security and enable web authentication using the RADIUS server.

Question 5

A network administrator is configuring a new Cisco IOS switch. The administrator needs to assign switch port GigabitEthernet0/1 to VLAN 20 and ensure that the port is in access mode. Which command sequence is correct?

Accepted Answer

interface GigabitEthernet0/1; switchport mode access; switchport access vlan 20. To assign a switch port to a VLAN and set it as an access port, the correct commands are 'switchport mode access' followed by 'switchport access vlan 20'. This ensures the port operates in access mode and carries traffic for VLAN 20. The other options either configure trunking or dynamic negotiation, which do not meet the access mode requirement.

Answer

interface GigabitEthernet0/1; switchport mode trunk; switchport trunk allowed vlan 20

Answer

interface GigabitEthernet0/1; switchport mode dynamic auto; switchport access vlan 20

Answer

interface GigabitEthernet0/1; switchport access vlan 20; switchport mode access

Question 6

A network administrator is deploying a Cisco SD-Access fabric and needs to ensure that the underlay network is properly configured. Which two statements about the underlay network in SD-Access are true? (Choose two.)

Accepted Answer

The underlay must support MTU sizes large enough to accommodate VXLAN encapsulation overhead.. The underlay in SD-Access provides IP connectivity between fabric nodes using a routing protocol like IS-IS or OSPF, and it must support a larger MTU to accommodate VXLAN encapsulation overhead. The underlay does not carry endpoint subnet information; that is the role of the overlay. It is a Layer 3 network, not Layer 2, and it does not use VXLAN for encapsulation.

Answer

The underlay can be configured as a Layer 2 network with VLANs to simplify deployment.

Answer

The underlay network carries endpoint subnet information and is used for endpoint-to-endpoint communication.

Answer

The underlay uses VXLAN to encapsulate traffic between fabric nodes.

Question 7

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet. The engineer wants to exclude a range of addresses from being assigned dynamically. Which command should be used?

Accepted Answer

ip dhcp excluded-address. The 'ip dhcp excluded-address' command is specifically designed to prevent the DHCP server from assigning certain IP addresses. The other commands serve different purposes: creating a pool, enabling snooping, or configuring relay information. Thus, 'ip dhcp excluded-address' is the correct choice.

Answer

ip dhcp pool

Answer

ip dhcp snooping

Answer

ip dhcp relay information

Question 8

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload, with an access list permitting 10.1.1.0/24, and interfaces marked as inside and outside.. The correct configuration uses ip nat inside source list with the interface keyword and overload to translate internal addresses to the outside interface IP. This enables PAT, allowing multiple internal hosts to share the single public IP. The access list must permit the internal subnet, and interfaces must be correctly marked as inside and outside for NAT to operate.

Answer

ip nat inside source static 10.1.1.1 203.0.113.1, with interfaces marked as inside and outside.

Answer

ip nat inside source list 1 pool MYPOOL overload, with a pool of public addresses, and interfaces marked as inside and outside.

Answer

ip nat outside source list 1 interface GigabitEthernet0/0 overload, with an access list permitting 10.1.1.0/24, and interfaces marked as inside and outside.

Question 9

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The correct configuration uses an access list that permits IP traffic from the local subnet to the remote subnet and references it in the crypto map with 'match address'. This defines the interesting traffic that triggers the IPsec tunnel. The other options either deny the traffic, permit all traffic, or reverse the source and destination, which do not precisely meet the requirement.

Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 permit ip any any

Answer

crypto map MYMAP 10 ipsec-isakmp; set peer 203.0.113.2; set transform-set MYSET; match address 101; access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Question 10

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 on an interface, you use the interface configuration command 'ipv6 ospf area '. This command activates OSPFv3 on the interface and assigns it to the specified area. The process ID must match the one configured globally with 'ipv6 router ospf '. The other options are invalid commands or incorrect syntax.

Answer

ospf ipv6 1 area 0

Answer

router ospfv3 1 area 0

Answer

ipv6 router ospf 1 area 0

Question 11

A network engineer is deploying a new Cisco SD-WAN fabric using Cisco vManage, vSmart, and vBond controllers. The engineer must ensure that the control plane is secure and resilient. Which two statements are true regarding the roles of these controllers? (Choose two.)

Accepted Answer

vSmart distributes control plane policies and routing information to WAN edge devices using OMP.. In Cisco SD-WAN, vBond orchestrates the control plane by authenticating and validating controllers and WAN edge devices, facilitating NAT traversal. vSmart distributes control plane policies and routing information using OMP. vManage is the management plane for configuration and monitoring. These roles are distinct and critical for a secure and resilient fabric.

Answer

vBond maintains the routing table and makes path selection decisions for the overlay.

Answer

vSmart is responsible for the initial device authentication and NAT traversal.

Answer

vManage is responsible for authenticating WAN edge devices and distributing encryption keys.

Question 12

A network administrator is configuring a Cisco IOS router to use VRRP. The router should be the master for the virtual IP 192.168.1.1 on interface GigabitEthernet0/0. The administrator wants to ensure that if this router fails, another router takes over with minimal delay. Which command should be used to set the priority to 150?

Accepted Answer

vrrp 1 priority 150. The command vrrp 1 priority 150 correctly sets the VRRP priority to 150 for group 1. A higher priority increases the chance of becoming the master. The default priority is 100, and the range is 1–254. Preemption is enabled by default, so no additional command is needed. This ensures the router becomes master and takes over quickly if needed.

Answer

vrrp 1 priority 150 preempt

Answer

vrrp 1 preempt priority 150

Answer

standby 1 priority 150

Question 13

A network administrator is configuring a Cisco Catalyst switch to assign a voice VLAN to IP phones. The phones will tag voice traffic with VLAN 200, and data traffic from attached PCs should be untagged in VLAN 10. Which interface configuration correctly implements this?

Accepted Answer

Switchport mode access, switchport access vlan 10, switchport voice vlan 200. The correct configuration uses an access port for data VLAN 10 and the switchport voice vlan command for voice VLAN 200. This enables the switch to send CDP/LLDP-MED instructions to the phone to tag voice traffic in VLAN 200 while data remains untagged in VLAN 10. It is the standard Cisco IP telephony deployment.

Answer

Switchport mode trunk, switchport trunk native vlan 10, switchport trunk allowed vlan 200

Answer

Switchport mode trunk, switchport trunk encapsulation dot1q, switchport trunk native vlan 200

Answer

Switchport mode access, switchport access vlan 200, switchport voice vlan 10

Question 14

A network engineer is implementing VXLAN with an EVPN control plane. The underlay is a routed Layer 3 network. Which statement describes the role of the VXLAN Tunnel Endpoint (VTEP)?

Accepted Answer

The VTEP encapsulates Layer 2 frames into VXLAN packets and forwards them over the IP underlay.. The VTEP encapsulates Layer 2 frames into VXLAN packets and forwards them over the IP underlay. It is the device that provides the overlay encapsulation and decapsulation, enabling Layer 2 connectivity across a Layer 3 network.

Answer

The VTEP acts as a Layer 3 gateway for inter-subnet routing.

Answer

The VTEP is responsible for advertising MAC addresses to the EVPN control plane.

Answer

The VTEP maps VLAN IDs to VXLAN Network Identifiers (VNIs).

Question 15

A network engineer at a large enterprise is deploying a new branch office. The branch has two Cisco Catalyst switches, SW1 and SW2, that must participate in the same Layer 2 domain. SW1 is configured as the VTP server with domain 'CORP' and version 2. SW2 is a new switch with a higher VTP revision number and the same domain and password, but it has an empty VLAN database. The engineer connects SW2 to SW1 via a trunk link. What will happen to the VLAN database on SW1?

Accepted Answer

SW1 will synchronize its VLAN database to SW2's database, potentially deleting VLANs.. VTP uses the configuration revision number to determine which switch has the most recent VLAN database. When SW2 with a higher revision number connects, SW1 accepts SW2's advertisement and replaces its own VLAN database, even though SW1 is the server. This can cause VLANs to be deleted, so it is critical to reset the revision number on new switches before connecting them to the production network.

Answer

SW1 will not synchronize because VTP version 2 requires the same configuration revision number.

Answer

SW1 will overwrite SW2's VLAN database because SW1 is the VTP server.

Answer

SW1 will reject SW2's advertisement because SW2 is not a VTP server.