CCNP Infrastructure Practice Test 20 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS router to support PIM Sparse Mode (PIM-SM) for multicast traffic. The engineer needs to ensure that the router can dynamically discover Rendezvous Points (RPs). Which two mechanisms can be used to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bootstrap Router (BSR). Auto-RP and Bootstrap Router (BSR) are the two primary mechanisms for dynamic RP discovery in PIM-SM. Auto-RP is Cisco proprietary and uses a mapping agent, while BSR is an open standard. Both allow routers to automatically learn which RP to use for multicast groups, eliminating the need for manual configuration on every router. These methods enhance scalability and simplify multicast network management.

Answer

MSDP

Answer

Anycast RP

Answer

Static RP configuration

Question 2

A network administrator is configuring a Cisco IOS router to act as a DHCP server for the 10.10.10.0/24 subnet. The router interface GigabitEthernet0/0 is configured with IP address 10.10.10.1/24. Which command is required to specify the DNS server address that will be provided to DHCP clients?

Accepted Answer

dns-server 8.8.8.8. The correct command to specify DNS servers for DHCP clients is 'dns-server' within the DHCP pool configuration mode. This command directly populates the DNS option in DHCP offers. The other options are either global router DNS settings or invalid commands. Proper configuration ensures that clients receive the necessary DNS information to resolve hostnames, which is critical for network functionality.

Answer

domain-name-server 8.8.8.8

Answer

ip name-server 8.8.8.8

Answer

ip dhcp dns 8.8.8.8

Question 3

A network engineer is implementing VXLAN in a data center to support a large number of tenants. The engineer must ensure that the VXLAN overlay supports Layer 2 connectivity over a Layer 3 underlay. Which two statements are true about VXLAN? (Choose two.)

Accepted Answer

VXLAN encapsulates Layer 2 frames in UDP packets for transport over a Layer 3 network.. VXLAN uses a 24-bit VNI, allowing up to 16 million segments, and encapsulates Layer 2 frames in UDP packets for transport over a Layer 3 underlay. These two characteristics enable scalable multi-tenancy and Layer 2 extension across routed networks. The other statements are false: multicast is not mandatory, VTEPs require unique IPs, and VXLAN does not use 12-bit VLAN IDs.

Answer

VXLAN uses a 12-bit VLAN ID to identify segments.

Answer

VXLAN requires a multicast underlay for all broadcast, unknown unicast, and multicast traffic.

Answer

VXLAN tunnel endpoints (VTEPs) must be configured with the same IP address on all devices.

Question 4

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Accepted Answer

switchport mode trunk. To configure a switch port as a trunk, the command 'switchport mode trunk' must be used. This enables the port to carry traffic for multiple VLANs using 802.1Q encapsulation. While other commands like 'switchport trunk encapsulation dot1q' may be required on some platforms, the essential command to set the mode is 'switchport mode trunk'. This is a fundamental configuration for connecting devices that need multiple VLANs, such as a WLC.

Answer

switchport nonegotiate

Answer

switchport trunk encapsulation dot1q

Answer

switchport mode access

Question 5

A network engineer is designing a new data center network using Cisco ACI. The engineer needs to ensure that traffic between two endpoints in different EPGs is allowed only if a contract permits it. Which ACI construct is used to define the rules that permit or deny traffic between EPGs?

Accepted Answer

Contract. In Cisco ACI, contracts are the constructs that define the rules for permitting or denying traffic between EPGs. A contract contains subjects and filters that specify the allowed protocols and ports. EPGs can be providers or consumers of contracts, and traffic is only allowed if a contract is in place. This policy-based approach ensures that communication between endpoints is explicitly permitted, aligning with a zero-trust security model.

Answer

Tenant

Answer

Application Profile

Answer

Bridge Domain

Question 6

A network engineer is deploying Cisco SD-Access and wants to ensure that traffic from employee endpoints is tunneled to a fabric border node for external connectivity. Which component is responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border?

Accepted Answer

Fabric edge node. Fabric edge nodes are the VTEPs that encapsulate endpoint traffic into VXLAN and forward it toward the border for external connectivity. They handle the mapping and tunneling of endpoint traffic, ensuring that employee endpoints can reach external networks through the fabric border. Control plane nodes manage mapping, border nodes decapsulate, and intermediate nodes only forward encapsulated packets.

Answer

Fabric border node

Answer

Fabric intermediate node

Answer

Fabric control plane node

Question 7

A network engineer is configuring a Cisco IOS router to support PIM Sparse Mode (PIM-SM) for multicast traffic. The engineer needs to ensure that the router can dynamically discover Rendezvous Points (RPs). Which two mechanisms can be used to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

switchport mode access
switchport access vlan 10
switchport voice vlan 200. The access-plus-voice configuration is the standard way to support an IP phone and a PC on one switch port. The access VLAN carries untagged PC traffic, and the voice VLAN carries 802.1Q-tagged phone traffic. This allows the phone to tag its own traffic while the PC sends untagged frames, and the switch classifies them into the correct VLANs without needing a trunk on the port.

Answer

switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 200

Answer

switchport mode access
switchport access vlan 200
switchport voice vlan 10

Answer

switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 200

Question 8

A network engineer is configuring a GRE tunnel between two sites to transport IPv6 traffic over an IPv4-only underlay. The engineer wants to ensure that the tunnel interface supports IPv6 and that traffic is encrypted. Which technology should be combined with GRE to provide encryption?

Accepted Answer

IPsec in tunnel mode. To encrypt a GRE tunnel, IPsec in tunnel mode is used. It encrypts the entire original packet, including the GRE header, and encapsulates it in a new IPsec packet. This provides confidentiality and integrity for the tunneled traffic. Transport mode does not encapsulate the original packet, MACsec is Layer 2 only, and TLS is application-layer, so they are not suitable for this scenario.

Answer

MACsec

Answer

TLS

Answer

IPsec in transport mode

Question 9

A network administrator is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The router must use key 1 with the password 'Cisco123' on interface GigabitEthernet0/0. Which configuration is correct?

Accepted Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123. To enable OSPF MD5 authentication on a specific interface, you must enter interface configuration mode, enable MD5 authentication with 'ip ospf authentication message-digest', and define the key with 'ip ospf message-digest-key 1 md5 Cisco123'. This ensures that OSPF packets on that interface are authenticated using MD5, meeting the security requirement.

Answer

interface GigabitEthernet0/0
 ip ospf authentication-key Cisco123
 ip ospf authentication

Answer

router ospf 1
 area 0 authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123

Answer

router ospf 1
 authentication message-digest
 message-digest-key 1 md5 Cisco123

Question 10

A network administrator is deploying a new Cisco Catalyst switch in a data center. The switch must support a protocol that allows multiple physical links to be bundled into a single logical link, providing increased bandwidth and redundancy. The administrator wants to ensure that the protocol can dynamically negotiate the bundle formation with the connected device. Which protocol should be configured?

Accepted Answer

Link Aggregation Control Protocol (LACP). LACP is the IEEE standard for dynamic link aggregation, allowing switches from different vendors to negotiate an EtherChannel. It bundles multiple physical links into one logical link for increased bandwidth and redundancy. PAgP is Cisco-proprietary, while UDLD and STP serve entirely different purposes.

Answer

UniDirectional Link Detection (UDLD)

Answer

Spanning Tree Protocol (STP)

Answer

Port Aggregation Protocol (PAgP)

Question 11

A network engineer is configuring a Cisco IOS router to support PIM Sparse Mode (PIM-SM) for multicast traffic. The engineer needs to ensure that the router can dynamically discover Rendezvous Points (RPs). Which two mechanisms can be used to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inaccessible Authentication Bypass. Inaccessible Authentication Bypass (IAB) is designed to handle the exact situation where the RADIUS server becomes unreachable. When enabled, the switch places the port into a critical VLAN, allowing devices to gain network access without authentication. This feature is essential for maintaining connectivity for critical devices during an authentication server outage.

Answer

Guest VLAN

Answer

Critical VLAN

Answer

MAC Authentication Bypass

Question 12

A network engineer is configuring OSPF on a Cisco router. The router is connected to a broadcast network with multiple OSPF neighbors. The engineer wants to ensure that this router does not become the Designated Router (DR) or Backup Designated Router (BDR) on this network. Which configuration achieves this goal?

Accepted Answer

Set the OSPF priority to 0 on the interface.. The OSPF priority is an 8-bit field in the Hello packet used in DR/BDR election. A router with priority 0 is never elected as DR or BDR. Setting the interface priority to 0 achieves the goal while allowing the router to remain a DROTHER and fully participate in OSPF. Other methods like changing network type or making the interface passive have side effects that are not desired.

Answer

Set the OSPF network type to point-to-point.

Answer

Configure the interface as passive.

Answer

Configure the router as a stub router.

Question 13

A network engineer is configuring a VXLAN overlay. The underlay is an IP-routed network, and the engineer needs to ensure that the VXLAN tunnel endpoints can discover each other's VTEP IP addresses dynamically. Which technology should be used?

Accepted Answer

MP-BGP EVPN. MP-BGP EVPN acts as the VXLAN control plane, allowing VTEPs to exchange reachability information for MAC and IP addresses. This enables dynamic discovery of remote VTEPs and their endpoints, avoiding the inefficiencies of flood-and-learn. PIM, OSPFv3, and LISP do not provide the required EVPN address family for VXLAN tunnel endpoint discovery.

Answer

PIM sparse mode

Answer

OSPFv3

Answer

LISP

Question 14

A network engineer is deploying Cisco TrustSec in a campus network. The engineer needs to implement Security Group Tag (SGT) propagation and enforcement. Which two methods can be used to propagate SGTs? (Choose two.)

Accepted Answer

SGT Exchange Protocol (SXP). SGTs can be propagated using inline tagging with Cisco Metadata (CMD), which embeds tags in the frame, or using SXP, which shares IP-to-SGT mappings with devices that cannot perform inline tagging. These two methods are standard in Cisco TrustSec deployments, enabling enforcement across diverse network devices.

Answer

802.1X supplicant tagging

Answer

RADIUS Change of Authorization (CoA) tagging

Answer

IPsec tunnel tagging

Question 15

A network engineer is deploying a new branch office router that must obtain its WAN interface IP address dynamically from the ISP while also advertising its LAN prefix into OSPF. The engineer configures the WAN interface with the ip address dhcp command. Which additional configuration is required on the router to ensure the LAN prefix is advertised into OSPF with the correct network statement when the WAN IP changes?

Accepted Answer

Use the network command with a wildcard mask that matches the LAN subnet under router ospf.. The network command under router ospf with a wildcard mask matching the LAN subnet is the correct way to advertise the LAN prefix into OSPF. It is independent of the WAN interface's DHCP-assigned IP address, so the advertisement remains stable even if the WAN IP changes. Other options either advertise the wrong prefix or introduce unnecessary complexity.

Answer

Enable OSPF on the WAN interface and rely on connected route redistribution.

Answer

Configure a static route to the ISP and redistribute it into OSPF.

Answer

Configure OSPF to use the interface's DHCP-assigned IP address as the router ID.