CCNP Infrastructure Practice Test 21 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS switch to use 802.1X authentication for endpoints connected to interface GigabitEthernet1/0/1. The engineer wants to ensure that if the RADIUS server is unreachable, the port will be placed in a restricted VLAN. Which command should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

authentication event server dead action authorize vlan 10. The command 'authentication event server dead action authorize vlan 10' is specifically designed to handle the case where the RADIUS server is unreachable, placing the port into VLAN 10 as a fallback. This ensures that endpoints can still access limited network resources according to policy when the authentication server is down.

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 10

Answer

authentication event no-response action authorize vlan 10

Question 2

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The design requires that the virtual IP address be the same as one of the physical interface addresses, and that the standby group use a virtual MAC address of 0000.0c07.acXX. Which protocol meets these requirements?

Accepted Answer

HSRP. HSRP is a Cisco-proprietary first-hop redundancy protocol that uses the virtual MAC address 0000.0c07.acXX and permits the virtual IP to be the same as a physical interface IP. VRRP and GLBP use different MAC address formats. Therefore, HSRP uniquely satisfies both conditions in the scenario.

Answer

VRRP

Answer

SLB

Answer

GLBP

Question 3

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The design requires that the standby router take over if the active router fails, and that the virtual MAC address be 0000.0c07.ac0a. Which protocol and group number are being used?

Accepted Answer

HSRP group 10. The virtual MAC address 0000.0c07.ac0a indicates HSRP with group 10 because the last two hex digits (0a) represent the group number in hexadecimal. HSRP uses this MAC format, while VRRP and GLBP use different formats.

Answer

HSRP group 170

Answer

VRRP group 10

Answer

GLBP group 10

Question 4

A network engineer is configuring QoS on a Cisco IOS router. The engineer needs to ensure that packets marked with DSCP AF31 are placed into a queue that guarantees at least 30% of the interface bandwidth during congestion, while allowing other traffic to use any remaining bandwidth. Which configuration should be used?

Accepted Answer

policy-map QOS
 class AF31
  bandwidth percent 30. The 'bandwidth percent 30' command in a policy map class guarantees that the class receives at least 30% of the interface bandwidth during congestion. This is part of CBWFQ and provides a minimum bandwidth guarantee, meeting the requirement while allowing other traffic to utilize remaining bandwidth.

Answer

policy-map QOS
 class AF31
  shape average percent 30

Answer

policy-map QOS
 class AF31
  bandwidth remaining percent 30

Answer

policy-map QOS
 class AF31
  priority percent 30

Question 5

A network architect is designing a data center fabric that must support Layer 2 extension over a Layer 3 underlay while using a control-plane protocol that advertises MAC reachability. The design requires the use of a protocol that encapsulates Layer 2 frames in IP packets and uses an EVPN address family for MAC/IP advertisement. Which technology best meets these requirements?

Accepted Answer

VXLAN with BGP EVPN control plane. VXLAN with BGP EVPN is the correct choice because it encapsulates Layer 2 frames in UDP/IP and uses BGP EVPN as the control plane to advertise MAC and IP reachability. This provides a scalable and efficient solution for Layer 2 extension over a Layer 3 underlay, meeting the design requirements for a data center fabric.

Answer

OTV with IS-IS as the control plane

Answer

LISP with a Map-Server/Map-Resolver

Answer

MPLS L2VPN with BGP for label distribution

Question 6

A network engineer is implementing a Cisco TrustSec solution. The engineer needs to classify traffic based on user identity and apply security policies accordingly. Which component is responsible for tagging packets with a Security Group Tag (SGT) at the ingress point?

Accepted Answer

Ingress Policy Enforcement Point (Ingress PEP). In Cisco TrustSec, the Ingress Policy Enforcement Point (Ingress PEP) is the device that first receives traffic into the TrustSec domain. It classifies the traffic, determines the source Security Group Tag (SGT), and inserts the SGT into the packet. This tag is then used by other enforcement points to apply security policies. The PDP (ISE) provides the policy, but the Ingress PEP performs the tagging.

Answer

Policy Enforcement Point (PEP)

Answer

Policy Decision Point (PDP)

Answer

Network Device Admission Control (NDAC)

Question 7

A network engineer is configuring a Cisco IOS switch to use 802.1X authentication for endpoints connected to interface GigabitEthernet1/0/1. The engineer wants to ensure that if the RADIUS server is unreachable, the port will be placed in a restricted VLAN. Which command should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-Domain Authentication (MDA). Multi-Domain Authentication (MDA) is designed for scenarios where an IP phone and a PC are connected to the same switch port. It allows the phone to authenticate in the voice domain and the PC in the data domain, each with its own authentication method. This provides the necessary separation of traffic and authentication.

Answer

MAC Authentication Bypass (MAB)

Answer

Multi-Auth

Answer

Web Authentication (WebAuth)

Question 8

A network engineer at a branch office needs to configure a Cisco IOS router to obtain its WAN interface IPv4 address dynamically from the ISP using DHCP while also ensuring the ISP can reach a web server hosted on the internal LAN at 10.10.10.50. Which single command on the router's WAN interface accomplishes the address acquisition requirement?

Accepted Answer

ip address dhcp. The requirement is for the router to dynamically obtain an IPv4 address from the ISP. The ip address dhcp interface command enables DHCP client functionality, which is the correct method for Ethernet WAN interfaces. Other options either configure the router as a DHCP server, forward DHCP requests, or use PPP-based negotiation, none of which meet the scenario's need for standard DHCP client behavior on an Ethernet WAN link.

Answer

ip dhcp pool WAN_POOL

Answer

ip helper-address 203.0.113.1

Answer

ip address negotiated

Question 9

A network administrator is configuring a Cisco Catalyst switch to assign a voice VLAN to IP phones and a data VLAN to connected PCs on the same port. The phones are Cisco and use CDP to communicate VLAN information. Which configuration should be applied to the switch port?

Accepted Answer

Configure the port as an access port in the data VLAN and enable the voice VLAN with the 'switchport voice vlan' command.. The correct configuration is to set the port as an access port in the data VLAN and then specify the voice VLAN using the 'switchport voice vlan' command. This allows the switch to use CDP to inform the IP phone of the voice VLAN, so the phone tags its voice traffic with the appropriate VLAN ID while the PC's data traffic remains untagged in the access VLAN. This is the Cisco best practice for connecting IP phones and PCs to the same switch port.

Answer

Configure the port as a dynamic auto port and set the voice VLAN to be negotiated via DTP.

Answer

Configure the port as a private VLAN host port and map the voice VLAN as a secondary VLAN.

Answer

Configure the port as a trunk with native VLAN for data and allow the voice VLAN.

Question 10

A network administrator is configuring a Cisco switch port that connects to an IP phone and a PC. The phone must tag voice traffic with VLAN 200, and the PC must send untagged traffic on VLAN 100. Which configuration is required on the switch port?

Accepted Answer

switchport mode access; switchport access vlan 100; switchport voice vlan 200. The correct configuration uses an access port with a data VLAN and a voice VLAN. The voice VLAN feature allows the switch to instruct the IP phone to tag voice traffic with the specified VLAN, while the PC's untagged traffic is placed in the access VLAN. This provides separation of voice and data traffic and is the typical deployment for Cisco IP phones.

Answer

switchport mode access; switchport access vlan 200; switchport voice vlan 100

Answer

switchport mode trunk; switchport trunk encapsulation dot1q; switchport trunk allowed vlan 100,200

Answer

switchport mode trunk; switchport trunk native vlan 100; switchport trunk allowed vlan 200

Question 11

A network engineer is configuring OSPF on a multiaccess segment. The design requires that the DR/BDR election be deterministic, with Router A always becoming the DR and Router B always becoming the BDR. Both routers are Cisco IOS devices. Which configuration on Router A ensures it wins the DR election?

Accepted Answer

Set the OSPF priority to 255 on Router A's interface.. To ensure a router becomes DR, its OSPF interface priority must be higher than all other routers on the segment. Priority 255 is the maximum and guarantees victory unless another router also has 255 and a higher Router ID. Setting priority to 0 makes a router ineligible, a higher Router ID on another router would favor that router, and point-to-point network type removes DR/BDR election altogether.

Answer

Set the OSPF priority to 0 on Router A's interface.

Answer

Configure a higher Router ID on Router B.

Answer

Set the OSPF network type to point-to-point on Router A's interface.

Question 12

An engineer configures a VXLAN tunnel between two Nexus switches acting as VTEPs. The underlay is a routed Layer 3 network using OSPF, and the loopback interfaces of the VTEPs are reachable. However, hosts in the same VXLAN VNI on different VTEPs cannot communicate. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the NVE interface with the correct source-interface and ensure the VNI is mapped to the VLAN.. The NVE interface on a Cisco Nexus VTEP must have a source-interface configured, usually a loopback, and each VNI must be mapped to a VLAN. Without these, VXLAN encapsulation and decapsulation fail, so hosts in the same VNI on different VTEPs cannot communicate. The underlay is already operational, so the fix is to correct the NVE and VNI configuration.

Answer

Configure static VXLAN tunnels between the VTEPs using the destination-udp-port command.

Answer

Enable OSPF on the loopback interfaces and advertise them into the underlay.

Answer

Enable PIM sparse mode on the underlay and configure a rendezvous point for multicast replication.

Question 13

A network engineer is deploying a Cisco SD-Access fabric and needs to ensure that endpoints can communicate with devices outside the fabric. The engineer configures a fabric border node. Which functionality does the border node provide in this architecture?

Accepted Answer

It provides connectivity between the fabric and external networks, such as data centers or the internet.. In Cisco SD-Access, the fabric border node serves as the gateway between the fabric and external networks. It performs VXLAN-to-traditional network translation, allowing fabric endpoints to communicate with external destinations. It also advertises external routes into the fabric and fabric prefixes to external networks. The border node does not handle endpoint authentication, mapping database services, or control plane functions; those are handled by edge nodes and control plane nodes respectively.

Answer

It authenticates endpoints and assigns them to fabric VNs based on policy.

Answer

It acts as the mapping database system that stores endpoint location information.

Answer

It encapsulates fabric traffic into VXLAN and forwards it to the control plane node.

Question 14

A network engineer is configuring a Cisco IOS switch to use 802.1X authentication for endpoints connected to interface GigabitEthernet1/0/1. The engineer wants to ensure that if the RADIUS server is unreachable, the port will be placed in a restricted VLAN. Which command should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the interface with the switchport voice vlan 200 command while leaving the access VLAN as 100.. The voice VLAN feature on a Cisco access port allows a phone to send tagged voice frames while data frames from a daisy-chained PC remain untagged in the access VLAN. Configuring the port with switchport voice vlan 200 and leaving it as an access port in VLAN 100 provides the required separation without manual trunk configuration.

Answer

Configure the interface as a dynamic auto trunk and set the voice VLAN to 200 with the switchport voice vlan command.

Answer

Configure the interface as a trunk, set the native VLAN to 200, and allow VLANs 100 and 200 on the trunk.

Answer

Configure the interface as a trunk, set the native VLAN to 100, and allow only VLAN 200 on the trunk.

Question 15

A network engineer is deploying a new branch office and needs to assign IPv6 addresses to hosts on the LAN segment. The engineer wants hosts to automatically configure their own addresses using the MAC address and the network prefix, without relying on a DHCPv6 server. Which IPv6 address assignment method should be configured on the router interface?

Accepted Answer

SLAAC. SLAAC enables hosts to automatically generate IPv6 addresses using the prefix from Router Advertisements and their interface identifier, without needing a DHCPv6 server. This matches the requirement for self-configuration. Stateful DHCPv6 requires a server, static addressing is manual, and prefix delegation is for router-to-router prefix assignment, not host addressing.

Answer

Static IPv6 addressing

Answer

DHCPv6 prefix delegation

Answer

Stateful DHCPv6