CCNP Infrastructure Practice Test 17 — 15 Questions

Question 1

A network administrator is deploying a new Cisco Catalyst switch and wants to restrict management access to the switch. The requirement is that only hosts on the 10.10.10.0/24 subnet can access the switch via SSH, and all other SSH attempts must be denied. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

access-list 10 permit 10.10.10.0 0.0.0.255; line vty 0 4; access-class 10 in. Using a standard ACL that permits the 10.10.10.0/24 subnet and applying it inbound on the VTY lines with access-class restricts SSH and Telnet access to only that subnet. The implicit deny at the end blocks all other sources, satisfying the requirement without affecting other traffic.

Answer

access-list 10 permit 10.10.10.0 0.0.0.255; interface vlan 1; ip access-group 10 in

Answer

access-list 10 deny 10.10.10.0 0.0.0.255; line vty 0 4; access-class 10 in

Answer

access-list 110 permit tcp 10.10.10.0 0.0.0.255 any eq 22; line vty 0 4; access-class 110 in

Question 2

A network engineer is configuring a Cisco Catalyst switch to support a new wireless access point that will use 802.1X authentication with EAP-TLS. The switch port must be configured to allow multiple hosts, but only one host should be authenticated. Which command should be used to enable this behavior?

Accepted Answer

authentication host-mode multi-host. The requirement is to allow multiple hosts on a switch port while authenticating only one host. This is exactly the behavior of multi-host mode, where the first host authenticates and subsequent hosts are allowed without authentication. Multi-auth would authenticate each host individually, multi-domain is for voice and data domains, and single-host denies additional hosts. Thus, multi-host mode is the correct choice.

Answer

authentication host-mode multi-auth

Answer

authentication host-mode single-host

Answer

authentication host-mode multi-domain

Question 3

A network administrator is configuring a Cisco IOS switch and needs to verify the current VLAN configuration, including VLAN IDs, names, and status. Which command should be used?

Accepted Answer

show vlan brief. The show vlan brief command is the standard way to display all VLANs on a switch, including their IDs, names, status, and associated ports. It gives a comprehensive overview that allows an administrator to quickly verify the VLAN configuration. Other commands either filter to a single VLAN or provide only summary counts.

Answer

show interfaces switchport

Answer

show vlan id 1

Answer

show vlan summary

Question 4

A network engineer is deploying Cisco SD-Access and needs to provide fabric edge nodes with a mapping database for endpoint locations. The fabric uses LISP for control plane and VXLAN for data plane encapsulation. Which component is responsible for maintaining the endpoint-to-edge-node mapping and responding to map requests?

Accepted Answer

Control Plane Node. In Cisco SD-Access, the Control Plane Node runs the LISP map server and map resolver, maintaining the endpoint-to-RLOC mapping database. Fabric edge nodes query this node to resolve endpoint locations. The Control Plane Node is the central authority for the LISP control plane, enabling scalable endpoint mobility and policy enforcement.

Answer

Fabric Edge Node

Answer

Fabric Border Node

Answer

Fabric Intermediate Node

Question 5

A network engineer is deploying a new Cisco Catalyst 9000 switch stack and wants to protect the control plane from excessive ARP traffic that could overwhelm the CPU during a broadcast storm. The engineer needs to limit the rate of ARP packets sent to the CPU to 500 packets per second and drop the excess. Which feature should be configured on the switch?

Accepted Answer

Control Plane Policing (CoPP) with a class-map matching ARP. Control Plane Policing (CoPP) is designed to protect the CPU by rate-limiting traffic destined to the control plane. In this scenario, the engineer needs to limit ARP packets to 500 pps, which is exactly what CoPP can do by matching ARP in a class-map and applying a policer. Other features like storm control or DAI do not provide this granular control-plane protection.

Answer

Dynamic ARP Inspection (DAI) on all VLANs

Answer

IP Source Guard on all access ports

Answer

Storm control configured on all access ports

Question 6

A network engineer is configuring a GRE tunnel between two Cisco IOS routers to transport multicast traffic and routing protocols across an IP network. Which two statements about GRE tunnel configuration and operation are true? (Choose two.)

Accepted Answer

GRE tunnels support multicast and broadcast traffic by default.. GRE tunnels support multicast and broadcast traffic, making them suitable for carrying routing protocol hellos and other multicast applications. Additionally, the tunnel source and destination must be reachable via the underlay network for the tunnel to come up. GRE does not provide encryption, and tunnel interfaces are typically assigned IP addresses from a separate subnet, not the same as physical interfaces.

Answer

GRE tunnel interfaces must be assigned an IP address from the same subnet as the physical interfaces.

Answer

GRE tunnels can only carry unicast IP traffic.

Answer

GRE tunnels automatically encrypt all traffic passing through them.

Question 7

A network architect is designing a controller-based wireless deployment for a large campus. The requirement is to provide seamless roaming for voice clients across Layer 3 boundaries while keeping the client IP address unchanged. Which Cisco SD-Access fabric feature should be used to meet this requirement?

Accepted Answer

Enable IP mobility on the fabric edge nodes and configure the fabric control plane to track client locations.. In Cisco SD-Access, IP mobility is the feature that enables seamless roaming across Layer 3 boundaries while preserving the client IP address. The fabric control plane node tracks endpoint locations, and edge nodes use VXLAN encapsulation to forward traffic to the correct edge. This is essential for voice clients that require uninterrupted connectivity during roaming.

Answer

Configure the fabric to use VXLAN with Layer 2 flooding and enable ARP proxy on the edge nodes.

Answer

Deploy a dedicated WLC in each building and configure inter-controller roaming with mobility groups.

Answer

Configure the fabric edge nodes to run HSRP on the anycast gateway and enable preemption for fast failover.

Question 8

A network engineer is configuring QoS on a Cisco IOS XE router. The router must mark all ingress traffic from a specific subnet with DSCP AF31 and ensure that this marking is trusted throughout the network. Which configuration step is required to achieve this?

Accepted Answer

Create a class map matching the subnet, then a policy map that sets DSCP AF31, and apply it as a service policy on the ingress interface.. To mark traffic from a specific subnet with DSCP AF31, you need a class map to identify the traffic, a policy map to set the DSCP, and the policy applied as an ingress service policy. This ensures packets are marked before any queuing or forwarding decisions, allowing downstream devices to trust and act on the marking.

Answer

Apply a policy map that sets DSCP AF31 as an output service policy on the router's uplink interface.

Answer

Configure 'mls qos trust dscp' on the ingress interface and rely on the subnet's existing markings.

Answer

Use a route map to set DSCP AF31 for all routes matching the subnet and redistribute into OSPF.

Question 9

A network engineer is implementing VXLAN with an Ethernet VPN (EVPN) control plane in a data center. The underlay is a Layer 3 IP network. The engineer wants to ensure that the VXLAN tunnel endpoints (VTEPs) can discover each other and that the fabric supports multihoming with all-active forwarding. Which technology should be used?

Accepted Answer

VXLAN with EVPN as the control plane. EVPN is the correct choice because it provides a scalable control plane for VXLAN, enabling automatic VTEP discovery and MAC learning via BGP. It also supports multihoming with all-active forwarding through Ethernet Segment configurations, which allows a device to connect to multiple VTEPs simultaneously. Other options either lack a control plane or do not support the required multihoming capabilities.

Answer

VXLAN with static unicast flooding and no control plane

Answer

VXLAN with PIM-SM multicast underlay

Answer

VXLAN with OSPF as the underlay routing protocol

Question 10

An engineer is configuring a new switch stack using Cisco StackWise technology. The stack must be resilient to the failure of the active switch, and the engineer wants to ensure that the standby switch takes over with minimal disruption. The engineer has four switches in the stack. Which statement describes the role of the standby switch in a StackWise stack?

Accepted Answer

The standby switch takes over as the active switch if the active switch fails, and it is kept synchronized with the active switch's configuration and state.. The standby switch in a StackWise stack is a hot-standby that maintains a synchronized copy of the active switch's configuration and state. Upon failure of the active switch, the standby switch assumes the active role, providing redundancy and minimal downtime. This mechanism is critical for stack resilience, allowing the stack to continue operating seamlessly.

Answer

The standby switch is responsible for managing the stack and is the primary switch for forwarding traffic.

Answer

The standby switch is elected based on the highest priority value, and it only becomes active if the current active switch fails.

Answer

The standby switch actively forwards traffic and maintains a synchronized copy of the active switch's configuration and state.

Question 11

A network engineer is configuring a Cisco IOS XE router to support NETCONF over SSH. The requirement is to allow a remote management station to retrieve and modify the router's configuration using NETCONF. Which command must be used to enable the NETCONF subsystem on the router?

Accepted Answer

netconf-yang. To enable NETCONF over SSH on a Cisco IOS XE router, the 'netconf-yang' command must be configured. This command starts the NETCONF server and allows the router to be managed using NETCONF. It is a prerequisite for establishing NETCONF sessions and is essential for automated configuration and monitoring.

Answer

restconf

Answer

ip http server

Answer

ssh server netconf

Question 12

A network engineer is implementing QoS on a Cisco IOS router. The engineer wants to ensure that VoIP traffic is marked with DSCP EF and that the router prioritizes this traffic during congestion. Which mechanism should be used to provide priority queuing for VoIP?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is the QoS mechanism that provides strict priority queuing, ensuring that VoIP traffic marked with DSCP EF is serviced before other traffic during congestion. This minimizes latency and jitter, which are critical for voice quality. LLQ is configured using the 'priority' command within a policy map.

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

Weighted Random Early Detection (WRED)

Answer

Traffic Shaping

Question 13

A network engineer is implementing VXLAN on Cisco Nexus 9000 switches. The engineer needs to verify the configuration of the VXLAN data plane. Which two statements are true regarding VXLAN operation? (Choose two.)

Accepted Answer

VXLAN encapsulates original Ethernet frames in UDP packets with destination port 4789.. VXLAN uses a 24-bit VNI to identify overlay segments, enabling massive scalability. It encapsulates original Ethernet frames in UDP packets with destination port 4789. These two facts are fundamental to VXLAN operation and are correct. The other statements are false: VXLAN does not require OSPF, does not use a 12-bit VLAN ID, and does not inherently use LISP for tunnel establishment.

Answer

VXLAN requires the underlay network to run OSPF for route distribution.

Answer

VXLAN tunnels are established between VTEPs using a control protocol such as LISP.

Answer

VXLAN uses a 12-bit VLAN ID to identify the overlay network.

Question 14

A network engineer is deploying a new branch office that must use dynamic ARP inspection (DAI) on its access switches. The engineer wants to minimize manual configuration while ensuring that only valid IP-to-MAC bindings are permitted. Which feature should be enabled on the switches to provide the required binding information to DAI?

Accepted Answer

DHCP snooping. Dynamic ARP inspection relies on the DHCP snooping binding table to validate ARP packets on untrusted ports. Without a source of legitimate IP-to-MAC bindings, DAI cannot distinguish spoofed ARP replies from valid ones. Enabling DHCP snooping on the access switches automatically populates that table as clients obtain leases, which satisfies the requirement to minimize manual configuration while protecting the branch office from ARP poisoning.

Answer

802.1X

Answer

IP Source Guard

Answer

Port security

Question 15

A network engineer is configuring a new Cisco Catalyst 9300 switch stack. The company requires that the native VLAN for all 802.1Q trunk ports be changed from the default to VLAN 99. The engineer enters the global configuration command vlan dot1q tag native and then configures the trunk ports with switchport trunk native vlan 99. After applying the configuration, the engineer notices that untagged frames received on the trunk are being dropped. What is the most likely cause?

Accepted Answer

The vlan dot1q tag native command causes all native VLAN frames to be tagged, so untagged frames are dropped.. Enabling vlan dot1q tag native globally causes the switch to tag all frames on the native VLAN for 802.1Q trunks. As a result, any untagged frames received on those trunks are dropped because they are not expected. This behavior is by design and explains the observed frame drops.

Answer

The vlan dot1q tag native command must be configured on all switches in the topology, not just the local switch.

Answer

The native VLAN must be the same on both ends of the trunk; otherwise, untagged frames are dropped.

Answer

The switchport trunk native vlan 99 command is only valid if the native VLAN is VLAN 1.