CCNP Infrastructure — Timed 10 Questions

Question 1

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 2

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Option C is correct because voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 3

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

Accepted Answer

Configure the port as a trunk port.. Option B is correct because a trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Answer

Configure the port as a dynamic desirable port.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port.

Question 4

A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because the requirement specifies AES encryption with a pre-shared key. WPA2-PSK (Wi-Fi Protected Access 2 – Pre-Shared Key) mandates AES-CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) as the encryption protocol, providing strong, standards-compliant security for client traffic. This configuration directly satisfies the need for both AES encryption and PSK authentication.

Answer

WPA3-PSK with AES

Answer

WPA2-PSK with TKIP

Answer

WEP with AES

Question 5

A network administrator is troubleshooting an issue where OSPF routes are not being learned from a neighbor. The administrator checks the OSPF configuration and sees that both routers are in the same area. The neighbor state is stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU does not match.. When OSPF neighbors are stuck in the EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange process. The most common cause is an MTU mismatch between the interfaces, because OSPF will not proceed to the Exchange state if the DBD packet is larger than the interface MTU and gets silently dropped. This prevents the routers from agreeing on the master/slave relationship and exchanging link-state information.

Answer

The router ID is the same on both routers.

Answer

The area ID is different.

Answer

The hello timer is set to 30 seconds on one router.

Question 6

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

Accepted Answer

vlan 100. The correct command to create a new VLAN on a Cisco IOS switch is 'vlan 100' entered in global configuration mode. This command creates VLAN 100 and enters VLAN configuration mode, allowing you to assign a name or other parameters. The other options either apply an existing VLAN to an interface, use a deprecated method, or create a switched virtual interface (SVI) for Layer 3 routing, none of which actually create the VLAN itself.

Answer

switchport access vlan 100

Answer

vlan database

Answer

interface vlan 100

Question 7

A company has a requirement to provide redundancy for the default gateway on a subnet. Two switches are configured with HSRP. Which two interfaces on the switches must be in the same VLAN to form the HSRP group?

Accepted Answer

The interfaces must be Layer 2 switchports.. HSRP (Hot Standby Router Protocol) requires that all routers participating in the same HSRP group share the same Layer 2 broadcast domain, which is defined by the VLAN. The interfaces on the switches must be in the same VLAN so that HSRP hello messages (multicast to 224.0.0.2 with UDP port 1985) can be exchanged and the virtual IP address can be used as the default gateway for hosts in that VLAN. Without the same VLAN, the switches cannot communicate at Layer 2, and HSRP adjacency will not form.

Answer

The interfaces must be on the same physical switch.

Answer

The interfaces must have the same IP address.

Question 8

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. The BGP session is established, which confirms that the TCP connection and BGP open messages have been successfully exchanged. However, routes are not being received. The most common cause in this scenario is that the next-hop IP address for the advertised routes is not reachable via the router's routing table. eBGP by default sets the next-hop to the IP address of the neighbor's interface, and if that address is not reachable (e.g., missing route, incorrect static route, or interface down), the router will not install the routes into the BGP table or the routing table.

Answer

The AS number is incorrect.

Answer

The BGP session is using an incorrect interface.

Answer

The network is not advertised under BGP.

Question 9

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Accepted Answer

Apply a standard ACL to the vty lines.. Option D is correct because a standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Answer

Apply an extended ACL to the vty lines.

Answer

Apply a named ACL to the interface.

Answer

Apply an ACL to the console line.

Question 10

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Accepted Answer

switchport mode trunk. Option B is correct because the 'switchport mode trunk' command unconditionally sets the interface to trunk mode, enabling 802.1Q trunking. Option E is correct because 'switchport trunk encapsulation dot1q' explicitly configures the trunk encapsulation to the IEEE 802.1Q standard, which is required on older switches that support both ISL and 802.1Q.

Answer

switchport mode dynamic auto

Answer

switchport mode access

Answer

switchport trunk native vlan 1