CCNP Infrastructure Practice Test 16 — 15 Questions

Question 1

A network engineer is configuring a switch stack with two Catalyst 9300 switches. The engineer wants to ensure that if the active switch fails, the standby switch takes over with minimal disruption. Which statement accurately describes the stack MAC address behavior during a failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The stack MAC address remains the same as the original active switch's MAC address unless the stack MAC persistence timer expires.. The stack MAC persistence feature keeps the original active switch's MAC address for a configurable timer (default 4 minutes). During a failover, the standby switch becomes active and continues using that MAC address if the timer has not expired. This minimizes network disruption by avoiding MAC address table updates on neighboring devices.

Answer

The stack MAC address is a virtual MAC address generated by the stack protocol and never changes.

Answer

The stack MAC address immediately changes to the new active switch's MAC address upon failover.

Answer

The stack MAC address is always the MAC address of the switch with the highest priority, regardless of failover.

Question 2

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent for a remote subnet 10.10.10.0/24. The DHCP server is located at 172.16.1.100. The engineer issues the command 'ip helper-address 172.16.1.100' on interface GigabitEthernet0/0, which is the gateway for that subnet. However, clients on the subnet are not receiving IP addresses. What is the most likely cause?

Accepted Answer

The DHCP server is not reachable from the router because a route to 172.16.1.100 is missing.. The 'ip helper-address' command relays DHCP broadcasts to a specified server, but the router must have a route to that server. Without a route to 172.16.1.100, the relayed packets are dropped, and clients cannot obtain addresses. Ensuring IP reachability to the DHCP server is essential for successful relay operation.

Answer

The 'service dhcp' command is disabled globally on the router.

Answer

The 'ip helper-address' command must be configured on the interface facing the DHCP server, not the client-facing interface.

Answer

The DHCP server is configured to use a different subnet mask than the clients require.

Question 3

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent for a subnet that has no local DHCP server. The DHCP server is at 10.10.10.5, and the router interface facing the clients is GigabitEthernet0/1 with IP address 10.20.20.1. Which command must be applied to the interface so that client DHCP broadcasts are forwarded to the server?

Accepted Answer

ip helper-address 10.10.10.5. DHCP relay is enabled by placing ip helper-address on the interface receiving client broadcasts. The router then converts those broadcasts into unicast packets toward the specified server and populates the giaddr field so the server can identify the correct subnet. The other commands either do not exist, do not specify a server, or configure the router as a server rather than a relay, so they do not meet the requirement.

Answer

ip dhcp relay 10.10.10.5

Answer

ip forward-protocol udp 67

Answer

ip dhcp pool CLIENT relay 10.10.10.5

Question 4

A network engineer is deploying a new Cisco Catalyst 9000 switch stack. The engineer wants to ensure that the stack uses the most efficient use of stack ports and provides the highest possible bandwidth between stack members. Which stacking technology and topology should be used?

Accepted Answer

Cisco StackWise with a ring topology. Cisco StackWise uses a ring topology to connect stack members, providing high bandwidth and redundancy. If a cable fails, the ring can still function. StackWise-480 and StackWise-1T are used on Catalyst 9000 switches, offering up to 480 Gbps or 1 Tbps of stacking bandwidth. StackPower is for power sharing, not data stacking.

Answer

Cisco StackWise with a star topology

Answer

Cisco StackPower with a ring topology

Answer

Cisco StackWise with a full mesh topology

Question 5

A network administrator is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. The fabric has two border nodes and four edge nodes. The administrator wants to ensure that traffic from a wired endpoint in VLAN 10 can reach a wireless endpoint in the same VLAN that is roaming between access points. Which component is responsible for mapping the endpoint's IP address to its location in the fabric?

Accepted Answer

The fabric control plane node maintains the mapping in its LISP map-server database.. In Cisco SD-Access, the control plane node hosts the LISP map-server and map-resolver, maintaining the database of endpoint-to-RLOC mappings. Edge nodes register endpoints and query the control plane to resolve destinations. This centralized mapping enables seamless mobility and policy enforcement across the fabric.

Answer

The fabric intermediate node acts as a LISP proxy ETR to provide the mapping.

Answer

The fabric edge node caches the mapping and shares it directly with other edge nodes via LISP pub-sub.

Answer

The fabric border node performs the mapping using the LISP map-server function.

Question 6

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The requirement is to allow fallback to the local database if all TACACS+ servers are unreachable. Which AAA configuration achieves this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the default method list with TACACS+ first and local fallback. The 'group tacacs+' keyword specifies TACACS+ servers, and 'local' ensures the router's local username database is used if all TACACS+ servers are unreachable. This provides centralized authentication with a resilient backup.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ enable

Question 7

A network administrator is configuring a Cisco Catalyst switch and needs to assign a port to VLAN 20 as an access port. The port is currently in VLAN 1. Which command sequence correctly configures the interface?

Accepted Answer

interface GigabitEthernet0/1, then switchport mode access, then switchport access vlan 20. To configure a switch port as an access port in VLAN 20, you enter interface configuration mode, set the mode to access with switchport mode access, and then assign the VLAN with switchport access vlan 20. This ensures the port operates as a static access port and carries untagged traffic for VLAN 20.

Answer

interface GigabitEthernet0/1, then switchport access vlan 20, then switchport mode access

Answer

interface GigabitEthernet0/1, then switchport trunk allowed vlan 20, then switchport mode trunk

Answer

interface GigabitEthernet0/1, then switchport mode dynamic auto, then switchport access vlan 20

Question 8

A network engineer is deploying VXLAN with an EVPN control plane in a data center. The underlay is a routed Layer 3 network using OSPF. The engineer must ensure that the VXLAN data plane and EVPN control plane operate correctly. Which two statements about this deployment are true? (Choose two.)

Accepted Answer

EVPN uses BGP as its control plane to distribute MAC and IP address reachability information among VTEPs.. In a VXLAN-EVPN deployment, each VTEP needs a unique underlay IP address used as the source for encapsulated traffic, and EVPN relies on MP-BGP to distribute MAC and IP reachability. Multicast is optional and typically replaced by ingress replication, anycast VTEP is a design choice, and the underlay must be Layer 3 for scalability. These two statements accurately describe the core requirements.

Answer

EVPN requires the underlay to be a Layer 2 network so that BGP peering can be established without routing.

Answer

The VTEP must be configured with the same IP address on all leaf switches to allow anycast tunneling.

Answer

VXLAN requires the underlay network to run a multicast routing protocol such as PIM to replicate broadcast, unknown unicast, and multicast traffic.

Question 9

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The underlay network is OSPF, and the overlay uses BGP EVPN. The engineer notices that VM traffic between two hosts on different VTEPs is not being encapsulated. Which action should be taken to ensure VXLAN traffic is properly encapsulated and forwarded?

Accepted Answer

Enable VXLAN feature and configure the NVE interface with a source interface and a VNI mapping to the VLAN.. VXLAN encapsulation requires the NVE interface to be configured with a source interface and VNI-to-VLAN mapping. Enabling the VXLAN features and configuring the NVE interface are essential steps. Without these, the switch will not encapsulate traffic, even if the underlay and overlay routing are correct.

Answer

Ensure that the underlay OSPF cost is equal on all links to allow ECMP for VXLAN traffic.

Answer

Configure a VRF for the overlay and redistribute the VRF routes into OSPF.

Answer

Configure a VXLAN tunnel interface with the source interface as the loopback0 and the destination as the remote VTEP's loopback0.

Question 10

A network engineer is implementing a VXLAN overlay over an existing Layer 3 campus network. The requirement is to carry Layer 2 frames across the Layer 3 underlay. Which protocol is used to encapsulate the original Layer 2 frame for transport across the IP network?

Accepted Answer

VXLAN with a UDP header. VXLAN encapsulates the original Layer 2 frame in a MAC-in-UDP format. The outer IP and UDP headers allow the encapsulated frame to be routed across a Layer 3 underlay, which is exactly what the scenario requires. Other encapsulation methods either need a different underlay or do not provide the VXLAN VNI and VTEP behavior.

Answer

802.1Q tagging on the underlay

Answer

MPLS label stack with a Layer 2 VPN

Answer

GRE with a protocol type of 0x6558

Question 11

A network engineer is troubleshooting a Cisco Wireless LAN Controller (WLC) deployment where clients cannot associate to an SSID. The SSID is configured with WPA2-Enterprise and uses a RADIUS server for authentication. The engineer verifies that the RADIUS server is reachable and the shared secret is correct. Which additional configuration on the WLC is required for clients to successfully authenticate?

Accepted Answer

Enable 802.1X on the WLAN and specify the RADIUS server.. For WPA2-Enterprise authentication, the WLAN on the WLC must be configured to use 802.1X and reference the RADIUS server. Even if the RADIUS server is reachable and the shared secret is correct, the WLAN will not trigger authentication unless 802.1X is enabled and the server is specified in the WLAN's security settings.

Answer

Configure the WLC management interface with a static IP address.

Answer

Set the WLAN to use PSK instead of Enterprise.

Answer

Configure the WLC as a RADIUS client on the RADIUS server.

Question 12

A network engineer is implementing VXLAN with a Layer 2 gateway on a Cisco Nexus 9000 series switch. The design uses a distributed anycast gateway to provide optimal forwarding for hosts in the same subnet across different leaf switches. The engineer needs to ensure that all leaf switches use the same virtual MAC address for the gateway. Which feature must be configured to achieve this?

Accepted Answer

Anycast gateway. The anycast gateway feature in Cisco VXLAN allows all leaf switches to share the same virtual IP and MAC address for a subnet's default gateway. This provides active-active gateway functionality, ensuring that hosts always use the optimal path and avoiding traffic tromboning. Configuring the same virtual MAC on all leaf switches is part of the anycast gateway configuration.

Answer

HSRP

Answer

VRRP

Answer

GLBP

Question 13

A network engineer is implementing VXLAN with Cisco SD-Access. The engineer must ensure that the underlay network provides the necessary transport for VXLAN traffic. Which two statements about VXLAN and its underlay are true? (Choose two.)

Accepted Answer

VXLAN uses a 24-bit VNID, allowing over 16 million unique segments.. VXLAN uses a 24-bit VNID for large-scale segmentation and relies on VTEPs to encapsulate traffic. The underlay is typically Layer 3, not Layer 2, and BUM traffic can be handled via multicast or unicast control-plane replication. The two correct statements are the 24-bit VNID and the role of VTEPs.

Answer

VXLAN requires the underlay to be a Layer 2 network with STP.

Answer

VXLAN uses a 12-bit VNID, similar to VLAN IDs.

Answer

VXLAN requires a multicast-enabled underlay for BUM traffic replication.

Question 14

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using MD5. The engineer wants to ensure that only routers with the correct key can form adjacencies, and that the key is not sent in clear text. Which command sequence correctly enables MD5 authentication on an interface?

Accepted Answer

ip ospf authentication message-digest and ip ospf message-digest-key 1 md5 <key>. To enable MD5 authentication on a specific OSPF interface, you use the interface command ip ospf authentication message-digest and then define the key with ip ospf message-digest-key. This ensures that OSPF packets are authenticated with MD5 and the key is not transmitted in clear text, meeting the scenario's security requirement.

Answer

ip ospf authentication-key <key> and ip ospf authentication

Answer

area 0 authentication message-digest and ip ospf message-digest-key 1 md5 <key>

Answer

ip ospf authentication null and ip ospf message-digest-key 1 md5 <key>

Question 15

A network administrator is configuring a Cisco IOS switch to support a new voice VLAN. The administrator wants to ensure that voice traffic is tagged with CoS 5 and data traffic is untagged. Which command should be applied to the interface connected to an IP phone?

Accepted Answer

switchport voice vlan 10. The switchport voice vlan command enables the voice VLAN on an access port, allowing the switch to advertise the voice VLAN to the IP phone via CDP or LLDP. The phone then tags voice frames with the voice VLAN and CoS, while data from the attached PC remains untagged. Other commands like trunk encapsulation or access mode do not provide voice VLAN functionality. QoS trust may be needed but is not the primary configuration.

Answer

switchport trunk encapsulation dot1q

Answer

mls qos trust cos

Answer

switchport mode access