CCNP Infrastructure Practice Test 9 — 15 Questions

Question 1

A network engineer is deploying Cisco TrustSec in a data center. The engineer needs to classify traffic based on user identity and apply security policies accordingly. Which component of Cisco TrustSec is responsible for assigning Security Group Tags (SGTs) to packets at the ingress point?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy Enforcement Point (PEP). The Policy Enforcement Point (PEP) is the network device that assigns Security Group Tags (SGTs) to packets at the ingress point. This tagging enables scalable policy enforcement throughout the network. The PEP downloads policies from the Policy Decision Point (PDP) and applies them based on the SGT. Other components like the PAP and ISE are involved in policy management but do not perform inline tagging. Understanding the role of each component is essential for deploying Cisco TrustSec correctly.

Answer

Policy Decision Point (PDP)

Answer

Policy Administration Point (PAP)

Answer

Identity Services Engine (ISE)

Question 2

A network engineer is implementing a first-hop redundancy protocol on a pair of Catalyst 9300 switches. The design requires that the virtual IP address and virtual MAC address remain consistent across the pair, and that the standby switch preempts the active role only after the active switch fails and recovers, without manual intervention. Which protocol and configuration meets these requirements?

Accepted Answer

Configure VRRP with the primary switch as master and the standby switch with a higher priority and preempt enabled.. VRRP is an open standard first-hop redundancy protocol that allows a group of routers to share a virtual IP and MAC address. By configuring the intended master with a higher priority and enabling preempt on the standby, the standby will assume the master role if the original master fails and will relinquish it when the original master recovers. This provides consistent virtual addresses and automatic failover without manual intervention, exactly as required.

Answer

Configure HSRP version 2 with a group number and a priority of 110 on the primary switch.

Answer

Configure HSRP with the standby switch set to a higher priority and preempt enabled on both switches.

Answer

Configure GLBP with the primary switch as active virtual gateway and the standby switch as active virtual forwarder.

Question 3

A network administrator is configuring a new router and needs to enable OSPF on an interface. The router is running Cisco IOS XE. Which command correctly enables OSPFv2 on an interface in area 0?

Accepted Answer

router ospf 1; network 10.0.0.0 0.0.0.255 area 0. To enable OSPFv2 on an interface in Cisco IOS XE, you can use the network command under the router ospf process, specifying the network and wildcard mask. The correct syntax uses a wildcard mask, not a subnet mask. The other options are either invalid syntax or incomplete. The network command remains a fundamental method for enabling OSPF on interfaces.

Answer

network 10.0.0.0 255.255.255.0 area 0

Answer

ip ospf 1 area 0

Answer

ospf enable area 0

Question 4

A network engineer is deploying a new branch office that must automatically receive its IP address, default gateway, and TFTP server address without manual configuration. The branch router is already configured with the ip helper-address command pointing to a centralized DHCP server. Which DHCP message type will the router send to the DHCP server on behalf of the client?

Accepted Answer

DHCPRELAY. The router acts as a DHCP relay agent. When it receives a broadcast DHCPDISCOVER from a client on an interface with ip helper-address configured, it encapsulates the request into a unicast DHCPRELAY message and forwards it to the specified DHCP server. This allows clients on remote subnets to obtain IP addresses from a centralized server. The server then replies with a DHCPOFFER, which the router relays back to the client.

Answer

DHCPDISCOVER

Answer

DHCPREQUEST

Answer

DHCPOFFER

Question 5

A network engineer is configuring OSPF on a Cisco router. The router is connected to an Ethernet segment where it must form adjacencies with other OSPF routers. Which two conditions are required for OSPF routers to become fully adjacent? (Choose two.)

Accepted Answer

The routers must have the same OSPF area ID on the interface.. OSPF adjacency formation requires that routers agree on several parameters in Hello packets. The area ID must match, and the hello and dead intervals must be identical. Without these, routers will not become neighbors. Other parameters like process ID and router ID are locally significant or must be unique, but not identical. MTU mismatch can cause issues but is not a strict requirement for adjacency initiation.

Answer

The routers must have the same OSPF process ID.

Answer

The routers must have the same router ID.

Answer

The routers must have the same MTU size on the interface.

Question 6

A network engineer is configuring a Cisco IOS XE router to authenticate management users against a central TACACS+ server. The requirement is that if the TACACS+ server becomes unreachable, the router must fall back to using the local username database for authentication, and if that also fails, the user should be granted access with the lowest privilege level. Which AAA authentication configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local line. The correct configuration for falling back to local authentication and then allowing access with lowest privilege is to use the 'none' keyword as the final method. The command 'aaa authentication login default group tacacs+ local none' attempts TACACS+ first, then the local username database, and if both fail, it permits access without further authentication, placing the user at the default privilege level (usually 1). This meets the requirement of granting access when the local database also fails, though the privilege level is not explicitly 0 but the lowest available. Among the options, this is the only one that includes 'none' as a fallback.

Answer

aaa authentication login default group tacacs+ local

Answer

aaa authentication login default group tacacs+ local none

Answer

aaa authentication login default group tacacs+ local enable

Question 7

A network engineer is configuring a Cisco IOS router to authenticate management users against a centralized Cisco ISE server using TACACS+. The engineer wants to ensure that if the TACACS+ server becomes unreachable, a locally configured user can still log in. Which configuration should be applied?

Accepted Answer

aaa new-model
tacacs server ISE
 address ipv4 10.1.1.100
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local. The correct configuration enables AAA, defines the TACACS+ server, and specifies method lists that attempt TACACS+ first and then fall back to the local user database. The local keyword provides the necessary fallback for both authentication and authorization, ensuring management access is maintained if the central server is down. This is a common best practice for resilient AAA deployment.

Answer

aaa new-model
tacacs server ISE
 address ipv4 10.1.1.100
aaa authentication login default group tacacs+ none
aaa authorization exec default group tacacs+ none

Answer

aaa new-model
tacacs server ISE
 address ipv4 10.1.1.100
aaa authentication login default local group tacacs+
aaa authorization exec default local group tacacs+

Answer

aaa new-model
tacacs server ISE
 address ipv4 10.1.1.100
aaa authentication login default group tacacs+
aaa authorization exec default group tacacs+

Question 8

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer wants to ensure that the underlay network uses a routing protocol that provides fast convergence and supports equal-cost multipathing. Which routing protocol should be configured as the underlay routing protocol?

Accepted Answer

eBGP. eBGP is the recommended underlay routing protocol for VXLAN EVPN fabrics because it offers fast convergence, supports equal-cost multipathing, and scales effectively in data center environments. Cisco's validated designs frequently use eBGP for the underlay, leveraging its simplicity and robust path selection. The other protocols may support ECMP and convergence but are not the standard choice for this specific architecture.

Answer

EIGRP

Answer

IS-IS

Answer

OSPFv3

Question 9

A network engineer is configuring a Cisco IOS router for VRRP on a LAN segment. The router must participate in a VRRP group with a virtual IP address of 10.0.0.1 and a priority of 150. Which two commands are required to complete this configuration on the interface? (Choose two.)

Accepted Answer

vrrp 1 ip 10.0.0.1. To configure VRRP on an interface, the minimum commands are to assign a virtual IP address and optionally set the priority. The virtual IP defines the group's address, and the priority influences master election. Authentication, preempt, and timer adjustments are optional and not required for basic operation.

Answer

vrrp 1 timers advertise 1

Answer

vrrp 1 preempt

Answer

vrrp 1 authentication md5 key-string Cisco123

Question 10

A network engineer is configuring a GRE tunnel between two Cisco routers to transport multicast traffic. The engineer must ensure that the tunnel interface supports multicast and that the physical interface is not a bottleneck. Which two statements are true regarding GRE tunnel configuration and operation? (Choose two.)

Accepted Answer

GRE tunnels support multicast and broadcast traffic by default.. GRE tunnels require IP reachability between the tunnel source and destination, which is typically provided by the underlay routing protocol. Additionally, GRE supports multicast and broadcast traffic by default, making it suitable for transporting routing protocols and multicast applications. These two statements are fundamental to GRE operation.

Answer

The tunnel destination must be a loopback interface for redundancy.

Answer

GRE adds 24 bytes of overhead, which must be considered when setting the tunnel MTU.

Answer

The tunnel interface must be configured with a network mask of /31 to conserve IP addresses.

Question 11

A network engineer is configuring a Cisco router to use PIM Sparse Mode (PIM-SM) for multicast routing. The router needs to join a multicast group and receive traffic from a specific source. Which command is used to configure the router to send a PIM join message toward the rendezvous point (RP) for the group 239.1.1.1?

Accepted Answer

ip igmp join-group 239.1.1.1. To make the router join a multicast group and trigger a PIM join toward the RP, the 'ip igmp join-group' command is used. This command causes the router to act as a receiver for the specified group. When PIM-SM is enabled, the router sends a PIM join message toward the RP for that group. Other commands are either for configuring the RP or enabling PIM on an interface, but they do not initiate the join.

Answer

ip pim send-rp-announce

Answer

ip pim rp-address 10.1.1.1

Answer

ip pim sparse-mode

Question 12

A network engineer is configuring a Cisco IOS router to support VRRP. The engineer wants to ensure that the virtual IP address is reachable and that the router can become the master. Which two statements are true about VRRP operation on Cisco IOS? (Choose two.)

Accepted Answer

The virtual IP address can be the same as the physical interface IP address.. VRRP allows the virtual IP to be the same as the physical IP of the master, and it elects the master based on priority, with a default of 100. These two statements are true and are key to VRRP operation. The other options contain incorrect details about multicast address, virtual MAC, or interface restrictions.

Answer

The virtual MAC address used by VRRP is 0000.5e00.01xx, where xx is the VRID.

Answer

VRRP can only be configured on Ethernet interfaces.

Answer

VRRP uses multicast address 224.0.0.18 for Hello packets.

Question 13

A network engineer is implementing QoS on a Cisco IOS router. The engineer needs to classify traffic based on the DSCP value in the IP header and then mark all matching packets with a new DSCP value. Which configuration sequence is correct?

Accepted Answer

class-map match-any VOICE
 match dscp ef
policy-map MARK
 class VOICE
  set dscp af31
interface GigabitEthernet0/0
 service-policy input MARK. The correct configuration uses a class map to match DSCP EF, a policy map to set DSCP to AF31, and applies the service policy inbound on the interface. Inbound classification and marking allow the router to remark traffic before it is queued, ensuring downstream devices see the new DSCP. The other options contain syntax errors, wrong direction, or unnecessary commands.

Answer

class-map match-all VOICE
 match dscp ef
policy-map MARK
 class VOICE
  set dscp af31
interface GigabitEthernet0/0
 service-policy output MARK

Answer

class-map match-any VOICE
 match ip dscp ef
policy-map MARK
 class VOICE
  set ip dscp af31
interface GigabitEthernet0/0
 service-policy input MARK

Answer

class-map match-any VOICE
 match dscp ef
policy-map MARK
 class VOICE
  set dscp af31
interface GigabitEthernet0/0
 service-policy input MARK
 no ip route-cache

Question 14

A network engineer is configuring a GRE tunnel between two Cisco routers to transport multicast traffic and routing protocols. The engineer notices that the tunnel interface is up, but OSPF adjacencies are not forming over the tunnel. Which two actions should the engineer take to resolve this? (Choose two.)

Accepted Answer

Adjust the IP MTU on the tunnel interface to account for the GRE overhead.. OSPF adjacency over GRE fails if the tunnel endpoints are not reachable or if packet size exceeds the path MTU. Ensuring that the tunnel source and destination addresses are reachable via the physical interfaces guarantees that GRE encapsulation and decapsulation occur. Adjusting the tunnel interface MTU to account for GRE overhead prevents fragmentation and drops of OSPF hello and DBD packets, which are essential for adjacency formation. Together, these actions address the most common causes of OSPF over GRE failures.

Answer

Enable multicast routing on the tunnel interface using the 'ip pim sparse-mode' command.

Answer

Enable OSPF on the physical interface that carries the tunnel traffic.

Answer

Set the tunnel interface to use the same OSPF network type as the physical interface (e.g., broadcast).

Question 15

A network engineer is configuring a Cisco Catalyst switch to support a new IP phone that requires Power over Ethernet (PoE). The switch port must also be configured to trust the CoS value from the phone and place untagged traffic from a connected PC into VLAN 20. Which configuration should be applied to the switch port?

Accepted Answer

switchport mode trunk, switchport trunk native vlan 20, switchport trunk allowed vlan 20,100, power inline auto, mls qos trust cos. The correct configuration uses a trunk port with native VLAN 20 for untagged PC traffic and allows VLAN 100 for voice traffic. Power inline auto enables PoE, and mls qos trust cos ensures the phone's CoS markings are trusted. This setup is standard for connecting an IP phone with a PC attached to the phone's switch port.

Answer

switchport mode access, switchport access vlan 20, power inline auto, mls qos trust cos

Answer

switchport mode trunk, switchport trunk native vlan 100, switchport trunk allowed vlan 20,100, power inline auto, mls qos trust cos

Answer

switchport mode access, switchport voice vlan 100, power inline auto, mls qos trust cos