CCNP Network Assurance Practice Test 2 — 15 Questions

Question 1

A network engineer is troubleshooting a Cisco Catalyst 9300 switch that is experiencing high CPU utilization. The output of 'show processes cpu sorted' shows that the 'ARP Input' process is consuming a significant amount of CPU. Which of the following is the most likely cause of this high CPU usage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch is receiving a large number of ARP requests from a host on the network for the switch's management IP address.. The ARP Input process on a Cisco switch handles ARP packets that are destined to the switch's own IP addresses, such as its management IP. When a host on the network continuously sends ARP requests for the switch's IP, the switch must respond to each, consuming CPU cycles. This can happen due to a misconfigured host, a loop, or a malicious attack. High CPU in ARP Input is typically a sign of excessive ARP traffic directed at the switch itself.

Answer

The switch is configured with a large number of static ARP entries, causing the ARP Input process to constantly refresh them.

Answer

The switch is the target of an ARP spoofing attack, causing it to process a large number of gratuitous ARP packets.

Answer

A malware infection on a host is sending a large number of ARP requests for non-existent IP addresses.

Question 2

A network engineer is configuring a Cisco IOS router to monitor the reachability of a critical server at 10.1.1.100 using IP SLA. The engineer wants to receive a syslog message when the server becomes unreachable. Which configuration is required to achieve this?

Accepted Answer

Configure an IP SLA operation with the icmp-echo operation type, a tracking object using the track command, and enable the ip sla logging traps command.. To receive a syslog message when a server becomes unreachable via IP SLA, the engineer must configure an IP SLA operation to monitor reachability, create a tracking object that tracks that operation, and enable ip sla logging traps. The tracking object detects state changes, and with logging traps enabled, the router generates syslog messages. Without the tracking object, no syslog is triggered.

Answer

Configure an IP SLA operation with the icmp-echo operation type and enable the ip sla responder on the target server.

Answer

Configure an IP SLA operation with the icmp-echo operation type and enable the ip sla logging traps command.

Answer

Configure an IP SLA operation with the icmp-echo operation type and use the ip sla schedule command to start the operation immediately.

Question 3

A network administrator is using Cisco DNA Center Assurance to monitor the health of network devices. The administrator wants to receive alerts when a specific interface on a switch goes down. Which feature should be used to configure this?

Accepted Answer

Create a health policy that includes the interface status and set up a notification for when the policy is violated.. In Cisco DNA Center Assurance, health policies define the thresholds for various metrics, including interface status. When a policy is violated, such as an interface going down, a notification can be triggered. This allows administrators to be alerted in near real-time. The other options describe device-level or manual methods that are not part of the Assurance feature set.

Answer

Configure a syslog server on DNA Center and create a syslog filter for interface down messages.

Answer

Enable IP SLA on the switch and configure DNA Center to poll the IP SLA results for interface status.

Answer

Use the Network Hierarchy to assign the switch to a site and enable SNMP traps for linkDown on the switch.

Question 4

A network engineer is troubleshooting a Cisco Catalyst 9300 switch that is experiencing high CPU utilization. The output of 'show processes cpu sorted' shows that the 'ARP Input' process is consuming a significant amount of CPU. Which of the following is the most likely cause of this high CPU usage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

On the vManage, check the 'Control Connections' dashboard to see the status of all control connections.. To troubleshoot control connections in Cisco SD-WAN, you can check the status on the vEdge router using 'show control connections' and on vManage through the Control Connections dashboard. These provide the necessary information to determine if the vEdge is connected to vSmart controllers. The other options either use incorrect commands or are less direct.

Answer

On the vManage, use the 'show control connections' command to display the status of control connections.

Answer

On the vSmart controller, use the 'show control connections' command to display connections to vEdge routers.

Answer

On the vEdge router, use the 'show control connections-history' command to view the history of control connection attempts.

Question 5

A network engineer is troubleshooting an OSPF adjacency between two routers that stays in EXSTART state. The engineer suspects an MTU mismatch on the interface. Which command should be used to verify the IP MTU on a Cisco IOS XE router?

Accepted Answer

show ip interface GigabitEthernet0/0. The correct answer is the command that directly displays the IP MTU of the interface. OSPF adjacency stuck in EXSTART often indicates an MTU mismatch, and the 'show ip interface' command provides the IP MTU value. Comparing this value on both routers will confirm if there is a mismatch. Other commands either show different parameters or do not display the IP MTU explicitly.

Answer

show interface GigabitEthernet0/0

Answer

show ip ospf interface GigabitEthernet0/0

Answer

show run interface GigabitEthernet0/0

Question 6

A network engineer is analyzing output from the 'show ip sla statistics' command on a Cisco router. The output shows that the latest RTT for an ICMP echo operation is 45 ms, but the operation's status is 'Timeout'. What is the most likely cause of this discrepancy?

Accepted Answer

The target device is not responding to the ICMP echo requests.. The 'Timeout' status in IP SLA statistics indicates that the most recent probe did not receive a response within the configured timeout. The RTT value of 45 ms is from a prior successful probe, not the timed-out one. This suggests intermittent connectivity or that the target has stopped responding. The other options do not explain why a previous RTT exists but the current probe timed out.

Answer

The IP SLA operation is configured with a frequency that is too high.

Answer

The IP SLA responder is not configured on the target device.

Answer

The IP SLA operation is not scheduled and is in a pending state.

Question 7

A network engineer is configuring Flexible NetFlow on a Cisco IOS XE router to monitor traffic flows. After applying the flow monitor to an interface, the engineer notices that no flow records are being exported to the collector. The configuration includes a flow exporter, flow record, and flow monitor, and all are correctly referenced. What is the most likely cause of the missing exports?

Accepted Answer

The flow exporter is configured with a destination address but no source interface.. Flexible NetFlow requires a source interface on the flow exporter to send export packets. Without it, the router cannot source the export packets, and no data reaches the collector. The other options are either optional or already addressed in the scenario. The correct answer is the missing source interface configuration.

Answer

The flow monitor is not associated with the flow exporter.

Answer

The flow record does not include the 'match ipv4 protocol' field.

Answer

The flow monitor was applied in the input direction but the traffic is egress-only.

Question 8

A network engineer is using Cisco DNA Center Assurance to monitor a campus fabric. The engineer needs to quickly identify which network device is experiencing the highest number of client onboarding failures over the past 24 hours. Which Assurance dashboard or tool should the engineer use?

Accepted Answer

Issues dashboard. The Issues dashboard aggregates and correlates network events to present actionable issues, including client onboarding failures. It allows filtering by time range and device, enabling the engineer to sort by failure count and pinpoint the device with the highest number of onboarding failures in the last 24 hours. Other dashboards provide health scores or client-centric views but lack this specific device ranking capability.

Answer

Network Health dashboard

Answer

Device 360 view

Answer

Client Health dashboard

Question 9

A network engineer is using the Cisco DNA Center Assurance API to retrieve health scores for all network devices. The engineer needs to authenticate to the API and obtain a token. Which authentication method is used by the Cisco DNA Center API?

Accepted Answer

Token-based authentication using the /dna/system/api/v1/auth/token endpoint. Cisco DNA Center API uses token-based authentication. The engineer must send a POST request to the /dna/system/api/v1/auth/token endpoint with Basic Authentication credentials. The response includes a token that is then used in the X-Auth-Token header for subsequent API calls. This is the documented and standard method for authenticating to the DNA Center API.

Answer

Basic Authentication with username and password

Answer

Certificate-based authentication with client certificates

Answer

OAuth 2.0 with client credentials

Question 10

A network engineer is troubleshooting a Cisco Catalyst 9300 switch that is experiencing high CPU utilization. The output of 'show processes cpu sorted' shows that the 'ARP Input' process is consuming a significant amount of CPU. Which of the following is the most likely cause of this high CPU usage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show ip device tracking all. The IP device tracking table maintains a mapping of IP addresses to MAC addresses and switch ports for hosts on the network. It is populated by snooping DHCP and ARP traffic. This table is essential for troubleshooting duplicate IP addresses because it shows all IP-to-MAC bindings and can reveal if multiple MACs are using the same IP. Other commands do not provide this specific information.

Answer

show arp

Answer

show mac address-table

Answer

show ip arp inspection

Question 11

A network engineer is troubleshooting an OSPF adjacency that fails to reach the FULL state on a Cisco Catalyst 9300 switch. The engineer has verified that the interfaces are up, IP addresses are correct, and area IDs match. The engineer then runs the command 'show ip ospf interface Gi1/0/1' and sees that the interface is in DR state but the neighbor is stuck in EXSTART. What is the most likely cause of this issue?

Accepted Answer

The MTU is mismatched on the two interfaces.. The EXSTART state in OSPF is specifically where routers negotiate the master/slave relationship for database exchange. A mismatch in MTU prevents the successful exchange of DBD packets, causing the adjacency to remain stuck in EXSTART. Other common issues like area ID mismatch or timer mismatch would prevent the adjacency from reaching EXSTART at all. Therefore, the MTU mismatch is the correct answer.

Answer

There is an area ID mismatch between the two routers.

Answer

The OSPF hello and dead timers are mismatched on the two routers.

Answer

The OSPF network type is configured as point-to-point on one side and broadcast on the other.

Question 12

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that the health score for a particular building has dropped significantly. Which two actions can be taken within the Assurance dashboard to identify the root cause of the issue? (Choose two.)

Accepted Answer

Use the Client Health dashboard to analyze the connectivity and onboarding status of clients in the building.. The Network Health and Client Health dashboards are core components of Cisco DNA Center Assurance that provide device-level and client-level insights. When a building's health score drops, these dashboards allow the administrator to quickly identify whether the issue is due to network devices or client connectivity, enabling faster root cause analysis.

Answer

Run a Path Trace analysis between two critical endpoints to visualize the forwarding path and identify any drops.

Answer

Check the Application Health dashboard to see if business-critical applications are experiencing latency or errors.

Answer

Generate a report of all syslog messages from the switches in the building to identify recent errors.

Question 13

A network engineer is troubleshooting an intermittent connectivity problem between two data center switches. The engineer needs to determine whether packets are being dropped due to a hardware forwarding issue on the ingress switch. Which Cisco IOS command should the engineer use to capture a snapshot of the packet as it enters the switch and is processed by the forwarding ASIC?

Accepted Answer

show platform capture. The engineer needs to examine packets at the hardware forwarding level to identify whether the ASIC is dropping them. The show platform capture command provides that capability by capturing packets directly from the forwarding engine. Interface counters and throughput levels give only aggregate statistics, while CPU-based debugging does not see hardware-forwarded packets and can disrupt the network.

Answer

debug ip packet detail

Answer

show platform hardware throughput level

Answer

show interfaces counters errors

Question 14

A network administrator is investigating why a Catalyst 9300 switch reports high CPU utilization. The output of 'show processes cpu sorted' shows the ARP Input process consuming 45% CPU. Which action should be taken first to mitigate this issue?

Accepted Answer

Implement Dynamic ARP Inspection on the affected VLANs. Dynamic ARP Inspection is the correct first action because it validates ARP packets and rate-limits them on untrusted ports, directly reducing the load on the ARP Input process. It leverages the DHCP snooping binding table to drop invalid ARP messages, which both mitigates the CPU spike and hardens the network against ARP-based attacks.

Answer

Enable DHCP snooping on all access VLANs

Answer

Configure storm control for broadcast traffic on all ports

Answer

Enable PortFast and BPDU Guard on access ports

Question 15

A network administrator is troubleshooting a Cisco SD-WAN deployment where an application experiences poor voice quality. The administrator suspects that the overlay tunnel is selecting a suboptimal path. Which tool in Cisco vManage should be used to analyze the flow and determine the path taken by the voice traffic?

Accepted Answer

Flow Analytics. Flow Analytics leverages NetFlow and DPI to provide granular visibility into application flows, including the overlay path, latency, jitter, and packet loss. For voice quality issues, it can show whether the flow is taking a suboptimal path and identify the specific overlay tunnel. Other tools like Real-Time Monitoring or App Route Visualization offer complementary but less flow-specific insights, making Flow Analytics the correct choice.

Answer

Real-Time Monitoring

Answer

App Route Visualization

Answer

Troubleshooting Wizard