CCNP Infrastructure Practice Test 5 — 15 Questions

Question 1

A network engineer is designing a campus network that must support seamless roaming for wireless clients across Layer 3 boundaries without changing IP addresses. The clients are in a centralized subnet managed by a WLC. Which Cisco feature should be implemented to allow the WLC to advertise the client subnet into the wired network and attract traffic for wireless clients?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic Anchor. The requirement is to advertise the client subnet from the WLC into the wired network so that return traffic is directed to the WLC. Dynamic Anchor provides this by injecting routes or responding to ARP for client addresses. This enables Layer 3 roaming without changing client IP addresses, which is essential for seamless mobility in a centralized subnet design.

Answer

Mobility tunneling

Answer

Mobility Express

Answer

Dynamic VLAN assignment

Question 2

A network engineer is deploying a new branch office that requires a first-hop redundancy protocol supporting IPv6, per-VLAN load sharing, and millisecond failover. The design must interoperate with a third-party router that only supports the open standard. Which protocol should be selected?

Accepted Answer

VRRP version 3. VRRPv3 is the only listed protocol that is both an open standard and supports IPv6, per-VLAN load sharing, and millisecond failover. HSRPv2 and GLBP are Cisco-proprietary and cannot interoperate with a third-party router. IRDP provides only basic default gateway discovery and lacks the redundancy and load-sharing capabilities required.

Answer

IRDP

Answer

HSRP version 2

Answer

GLBP

Question 3

A network engineer is configuring a Cisco IOS router to support a site-to-site VPN using GRE over IPsec. The engineer wants to ensure that the GRE tunnel interface is protected by IPsec. Which configuration element is required to match the GRE traffic in the IPsec crypto ACL?

Accepted Answer

permit gre host 203.0.113.1 host 203.0.113.2. For GRE over IPsec, the crypto ACL must match the GRE protocol (IP protocol 47) between the tunnel source and destination IP addresses. This ensures that the GRE-encapsulated packets are encrypted by IPsec. The ACL should permit GRE traffic from the local public IP to the remote public IP, not the private tunnel IPs or the ESP protocol itself.

Answer

permit tcp any any eq 47

Answer

permit esp host 203.0.113.1 host 203.0.113.2

Answer

permit ip host 10.1.1.1 host 10.2.2.2

Question 4

A network engineer is implementing a QoS policy on a Cisco IOS router. The requirement is to classify packets based on the DSCP value in the IP header and mark them with a new DSCP value. Which MQC configuration accomplishes this?

Accepted Answer

class-map match-all MY-CLASS
 match dscp af31
policy-map MY-POLICY
 class MY-CLASS
  set dscp af41. The correct MQC configuration uses match dscp in a class-map to identify traffic and set dscp in a policy-map to re-mark it. This is the standard method for DSCP-based classification and marking on Cisco IOS routers. The other options contain invalid commands or incorrect logic.

Answer

class-map match-any MY-CLASS
 match ip dscp af31
policy-map MY-POLICY
 class MY-CLASS
  set ip dscp af41

Answer

policy-map MY-POLICY
 class class-default
  set dscp af41
class-map match-all MY-CLASS
 match dscp af31

Answer

class-map match-all MY-CLASS
 match dscp af31
policy-map MY-POLICY
 class MY-CLASS
  police dscp af41

Question 5

An engineer is configuring a Cisco Catalyst switch to authenticate end hosts using 802.1X. The RADIUS server is reachable, and the switch is configured with the command `aaa authentication dot1x default group radius`. However, when a host connects, it is placed into the guest VLAN instead of being authenticated. Which additional configuration is required on the switch to allow 802.1X authentication?

Accepted Answer

Enable 802.1X globally with the `dot1x system-auth-control` command.. The switch must have 802.1X globally enabled with `dot1x system-auth-control`. Without this command, the switch does not attempt 802.1X authentication and will apply the guest VLAN as a fallback. The other options are either interface-level commands that require global enablement first or are already satisfied in the scenario.

Answer

Add the `authentication port-control auto` command under the interface.

Answer

Configure the RADIUS server with the switch's IP address as a client.

Answer

Configure `dot1x pae authenticator` on the switch port.

Question 6

A network engineer is deploying Cisco SD-Access and needs to ensure that the fabric underlay uses an IGP that supports fast convergence and is specifically designed for routed fabric deployments. The underlay must run on all fabric nodes and provide reachability between loopback interfaces. Which routing protocol should be configured as the underlay?

Accepted Answer

BGP. Cisco SD-Access fabric underlay is designed to use BGP as the routing protocol. BGP provides reachability between loopback interfaces of fabric nodes, supports fast convergence when tuned, and scales for large fabrics. While OSPF can be used in some designs, BGP is the recommended and most scalable choice for SD-Access underlay.

Answer

EIGRP

Answer

IS-IS

Answer

OSPF

Question 7

A network engineer is designing a campus network that must support seamless roaming for wireless clients across Layer 3 boundaries without changing IP addresses. The clients are in a centralized subnet managed by a WLC. Which Cisco feature should be implemented to allow the WLC to advertise the client subnet into the wired network and attract traffic for wireless clients?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HSRP version 2. HSRP version 2 is the correct choice because it adds IPv6 support to HSRP. It allows hosts to automatically learn the virtual MAC address through IPv6 Neighbor Discovery and uses the active router's link-local address as the virtual link-local address. HSRPv1, VRRPv2, and GLBP do not support IPv6, so they cannot fulfill the design requirements.

Answer

GLBP

Answer

HSRP version 1

Answer

VRRP version 2

Question 8

A network administrator is implementing a Cisco SD-Access fabric. The administrator needs to ensure that endpoints in a virtual network can communicate with each other across different fabric edge nodes. Which component of the SD-Access architecture is responsible for providing the Layer 3 gateway and enforcing group-based policies for the endpoints?

Accepted Answer

Fabric border node. In Cisco SD-Access, the fabric border node acts as the Layer 3 gateway for the virtual network and enforces group-based policies using Scalable Group Tags (SGTs). It connects the fabric to external networks and handles anycast gateway services. The control plane node maintains the endpoint database, while edge nodes provide Layer 2 access.

Answer

Fabric control plane node

Answer

Fabric intermediate node

Answer

Fabric edge node

Question 9

A network engineer is deploying a new branch office with a Cisco Catalyst 9300 switch stack. The design requires that if the active switch in the stack fails, the standby switch takes over with minimal disruption. The engineer wants to verify the current stack role and priority of each member before finalizing the configuration. Which command should be used to display the stack member roles and priorities?

Accepted Answer

show switch. The 'show switch' command is the standard way to verify stack member roles, priorities, and states on Cisco Catalyst switches. It gives a concise table of each switch's role (Active, Standby, Member), priority, and status. This allows the engineer to confirm that the standby switch is correctly elected and that priorities are set as intended for failover.

Answer

show stack-port

Answer

show switch detail

Answer

show redundancy

Question 10

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The requirement is that the virtual IP address must be the same as the physical IP address of one of the switches, and the protocol must support object tracking to decrement the priority when a tracked object fails. Which protocol should be configured?

Accepted Answer

VRRPv3. The requirement to use the physical interface IP as the virtual IP is unique to VRRP, where the address owner can be the master. HSRP and GLBP require a distinct virtual address. VRRP also supports object tracking to modify priority, so it meets both conditions without additional configuration. This makes VRRP the correct protocol for the described scenario.

Answer

GLBP

Answer

HSRPv2

Answer

IRDP

Question 11

A network engineer is troubleshooting a Cisco SD-Access fabric. Endpoints in a virtual network are unable to communicate with endpoints in a different virtual network, even though the fabric control plane is operational. Which component is responsible for allowing inter-VN communication?

Accepted Answer

The fusion router, which provides inter-VN routing by leaking routes between VRFs.. In Cisco SD-Access, inter-VN communication is not enabled by default. A fusion router (or a border node with VRF leaking) is required to route traffic between VRFs. The fusion router exchanges routes between the VRFs, allowing endpoints in different virtual networks to communicate. Without this, traffic is isolated.

Answer

The fabric edge node, which performs inter-VN routing when configured with the ip routing command.

Answer

The fabric border node, which connects to external networks and performs VRF leaking.

Answer

The fabric control plane node, which maintains the location mapping database and enables inter-VN routing.

Question 12

A network engineer is configuring OSPF on a Cisco IOS router. The router's interface GigabitEthernet0/1 is assigned to OSPF area 0 with a network statement. The engineer wants to ensure that the interface becomes a designated router (DR) on the broadcast segment. Which OSPF interface priority value should be configured on GigabitEthernet0/1?

Accepted Answer

255. The OSPF interface priority determines DR election; the highest priority wins. Setting priority to 255, the maximum, ensures this router becomes DR unless another router also has 255, in which case router ID breaks the tie. Priority 0 excludes the router from election, and lower values may not win. Thus, 255 is the correct choice to guarantee DR status.

Answer

1

Answer

0

Answer

100

Question 13

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using MD5. The router must accept only MD5 authentication and must use key ID 1 with the password 'C1sco123'. Which configuration sequence accomplishes this?

Accepted Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 C1sco123. To enable MD5 authentication for OSPF on a specific interface, you must enter interface configuration mode and issue the ip ospf authentication message-digest command to enforce MD5, then define the key with ip ospf message-digest-key. The key ID and password must match on both neighbors. Enabling authentication at the area level is also possible, but the key must still be configured on the interface.

Answer

router ospf 1
 area 0 authentication
 ip ospf authentication-key 1 md5 C1sco123

Answer

router ospf 1
 area 0 authentication message-digest
 ip ospf message-digest-key 1 md5 C1sco123

Answer

interface GigabitEthernet0/0
 ip ospf authentication-key C1sco123
 ip ospf authentication

Question 14

A network engineer is configuring a Cisco IOS router to support OSPFv3 for IPv6. The engineer wants to enable OSPFv3 on interface GigabitEthernet0/0 and ensure that the router participates in OSPFv3 area 0. Which two commands are required to accomplish this? (Choose two.)

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 for IPv6 on a Cisco IOS router, you must first enable the OSPFv3 routing process with 'ipv6 router ospf', then enable OSPFv3 on the interface with 'ipv6 ospf area '. These two commands are essential to start the process and assign the interface to an area.

Answer

ipv6 ospf area 0

Answer

network 2001:db8::/64 area 0

Answer

router ospf 1

Question 15

A network administrator is configuring a Cisco switch and needs to assign a port to VLAN 20 as an access port. The port is currently in VLAN 1 and is configured as a trunk. Which set of commands should be applied to the interface to meet this requirement?

Accepted Answer

switchport mode access
switchport access vlan 20. To configure an interface as an access port in VLAN 20, the administrator must set the switchport mode to access and then assign the VLAN. The correct sequence ensures the port operates as an access port and carries only VLAN 20 traffic. The other options either leave the port in trunk mode, use dynamic mode, or present an ambiguous order that may not be accepted in strict exam contexts.

Answer

switchport access vlan 20
switchport mode access

Answer

switchport mode trunk
switchport trunk native vlan 20

Answer

switchport mode dynamic auto
switchport access vlan 20