CCNP QoS Architecture — Timed 15 Questions

Question 1

A network engineer is configuring QoS on a Cisco Catalyst 9300 switch to prioritize voice traffic. The switch has multiple access ports connected to IP phones and PCs. The engineer applies a policy-map that matches DSCP EF and sets the CoS to 5. However, after testing, the voice packets are not being marked correctly. What is the most likely cause?

Accepted Answer

The interface is missing the 'mls qos trust cos' or 'mls qos trust dscp' command.. On Cisco Catalyst switches like the 9300, QoS marking policies applied via a policy-map only re-mark packets if the interface port is configured to trust a specific marking. Without the 'mls qos trust dscp' command, the switch defaults to an untrusted state and may ignore or overwrite the DSCP-to-CoS mapping set by the policy-map. Option C is correct because the missing trust command prevents the policy-map from correctly applying the CoS 5 marking to voice packets.

Answer

The policy-map is not applied to the correct interface direction.

Answer

The switch does not support DSCP-to-CoS mapping.

Answer

The IP phone is not sending packets with DSCP EF.

Question 2

An enterprise is deploying a new VoIP system and wants to ensure voice traffic receives priority over data traffic on a WAN link. The engineer configures a class-map to match RTP traffic using the 'match protocol rtp' command. However, the class-map does not match any packets. What is the most likely reason?

Accepted Answer

The 'match protocol rtp' command requires NBAR to be enabled globally with 'ip nbar protocol-discovery'.. The 'match protocol rtp' command relies on Network-Based Application Recognition (NBAR) to identify RTP traffic by inspecting packet payloads and using protocol signatures. Without NBAR enabled globally via 'ip nbar protocol-discovery', the class-map cannot match any packets because the router does not have the necessary deep packet inspection capability. Enabling NBAR allows the device to recognize RTP traffic even though it uses dynamic UDP ports.

Answer

RTP traffic uses UDP ports, and the class-map must match on the UDP port range instead.

Answer

The class-map must be configured with 'match any' to capture all traffic.

Answer

RTP traffic is always marked with DSCP EF, so the class-map should match on DSCP instead.

Question 3

A network engineer is designing a QoS policy for a Cisco router that connects to an MPLS VPN. The service provider expects all traffic to be marked with IP Precedence values. The engineer wants to ensure that voice traffic (DSCP EF) is mapped to IP Precedence 5. What configuration is required on the router to perform this mapping?

Accepted Answer

Configure a policy-map that sets the IP precedence to 5 using 'set ip precedence 5'.. Option A is correct because the 'set ip precedence 5' command in a policy-map explicitly marks the IP Precedence field to 5, which corresponds to the same value as DSCP EF (46) in the IP header. This ensures that voice traffic is marked with IP Precedence 5 as required by the service provider, regardless of any existing DSCP markings.

Answer

Configure a policy-map that sets the DSCP to EF, and the router will automatically set IP precedence to 5.

Answer

Use the 'qos map dscp-ip-precedence' command to create a mapping table.

Answer

The router will automatically map DSCP EF to IP precedence 5 without any configuration.

Question 4

A company is implementing QoS on its campus network. The network engineer configures a policy-map that sets the CoS value for voice traffic to 5 on a switch interface. However, when the traffic reaches the router, the CoS marking is lost. What is the most likely reason?

Accepted Answer

CoS is a Layer 2 marking and is not carried across a Layer 3 hop; the router must map CoS to DSCP.. CoS (Class of Service) is a Layer 2 marking field in the 802.1Q VLAN tag, which is stripped when a frame passes through a Layer 3 device (router). Since the router operates at Layer 3, it does not preserve the CoS value; instead, the router must map the CoS to a DSCP (Differentiated Services Code Point) value at Layer 3 to maintain QoS across the routed hop. Option B correctly identifies this fundamental Layer 2 vs. Layer 3 boundary issue.

Answer

The router does not trust the CoS marking and re-marks it to 0.

Answer

The switch must be configured to set DSCP instead of CoS.

Answer

The router must have 'mls qos trust cos' configured on the interface.

Question 5

A network engineer is troubleshooting voice quality issues on a WAN link. The engineer notices that voice packets are being dropped during congestion. The QoS policy uses LLQ for voice traffic, but the priority queue is not providing the expected bandwidth. What is the most likely cause?

Accepted Answer

The priority queue has a built-in policer that drops traffic exceeding the configured bandwidth.. The priority queue in LLQ uses a built-in policer that drops traffic exceeding the configured bandwidth. When congestion occurs, the policer enforces the bandwidth limit by dropping excess packets, which explains why voice packets are being dropped despite the priority queue being active. This is a fundamental behavior of LLQ to prevent the priority queue from starving other queues.

Answer

The priority queue is not configured with a bandwidth statement.

Answer

The class-map is not matching voice traffic correctly.

Answer

The router is using FIFO queuing instead of LLQ.

Question 6

An enterprise is deploying QoS across a network that includes both Cisco and non-Cisco devices. The engineer wants to use a marking scheme that is end-to-end and not stripped at Layer 3 boundaries. Which marking field should the engineer use?

Accepted Answer

DSCP. DSCP (Differentiated Services Code Point) is the correct choice because it is defined in RFC 2474 as a Layer 3 marking field in the IP header. Unlike CoS (Layer 2) or MPLS EXP (which is stripped at MPLS boundaries), DSCP markings are preserved across Layer 3 boundaries (routers) and can be used end-to-end across both Cisco and non-Cisco devices, as long as the intermediate devices trust the DSCP value.

Answer

CoS

Answer

IP Precedence

Answer

MPLS EXP

Question 7

A network engineer is configuring QoS on a Cisco router to prioritize business-critical applications. The engineer creates a class-map that matches traffic based on the destination IP address and port. However, the class-map does not match the expected traffic. What is the most likely reason?

Accepted Answer

The class-map uses 'match-all' but the engineer intended to use 'match-any'.. Option A is correct because when a class-map uses 'match-all', all match conditions must be true for a packet to be classified. If the engineer intended to match traffic based on either the destination IP address OR the port, using 'match-any' would allow the class-map to match if any single condition is met. The mismatch occurs because the class-map is too restrictive, requiring both conditions to be satisfied simultaneously.

Answer

The access-list used for matching is not applied to the correct interface.

Answer

The router does not support matching on both IP and port in the same class-map.

Answer

The class-map must be applied to the interface before it can match traffic.

Question 8

A network engineer is configuring QoS on a Cisco switch to ensure that video traffic (DSCP AF41) is not dropped during congestion. The engineer creates a policy-map that sets the queue-limit for the AF41 class. However, the switch is still dropping video packets. What is the most likely cause?

Accepted Answer

The switch uses a single queue for all traffic unless multiple queues are configured.. By default, Cisco switches use a single queue for all traffic. Creating a policy-map that sets a queue-limit for the AF41 class does not automatically create a separate queue for that class; the switch must have multiple egress queues configured (e.g., via the 'priority-queue out' command or by mapping DSCP values to specific queues). Without multiple queues, all traffic shares the same queue, and setting a queue-limit on a class within a single-queue system does not prevent drops during congestion.

Answer

The queue-limit is set too low, causing tail drops.

Answer

The video traffic is not being marked with DSCP AF41.

Answer

The policy-map must be applied to the output direction.

Question 9

A network engineer is implementing QoS on a Cisco router that connects to a service provider. The provider uses MPLS and expects the MPLS EXP bits to be set for voice traffic. The engineer configures a policy-map that sets the MPLS EXP to 5. However, the provider reports that the EXP bits are not being set. What is the most likely reason?

Accepted Answer

The policy-map is applied to the incoming interface, but MPLS EXP marking must be done on the outgoing interface.. The most likely reason is that the policy-map is applied to the incoming interface, but MPLS EXP marking must be applied on the outgoing interface. MPLS EXP bits are set at the imposition (ingress) of the MPLS label stack, which occurs when the packet is forwarded out of an interface that has MPLS enabled. If the policy-map is applied inbound, it marks the IP packet before MPLS encapsulation, and the EXP bits are not set on the MPLS label. The correct approach is to apply the policy-map outbound on the interface facing the service provider, so that the 'set mpls experimental' command marks the EXP bits on the imposed label.

Answer

The router does not support setting MPLS EXP bits.

Answer

The MPLS EXP bits are set automatically based on the IP precedence.

Answer

The policy-map must use 'set mpls experimental imposition 5' instead of 'set mpls experimental 5'.

Question 10

An architect is designing a QoS policy for a campus LAN that must support real-time voice and video traffic alongside mission-critical data. The design must use the DiffServ model with consistent per-hop behavior across all switches. Which approach should the architect choose to ensure that voice traffic receives priority queuing while video traffic is guaranteed bandwidth without starving other classes?

Accepted Answer

Use the MQC framework to classify traffic based on DSCP markings, apply a priority queue for EF traffic, and allocate a minimum bandwidth guarantee for AF41 traffic.. Option A is correct because it uses the Modular QoS CLI (MQC) framework to classify traffic by DSCP markings, which aligns with the DiffServ model's per-hop behavior consistency. By applying a strict priority queue for EF (Expedited Forwarding, DSCP 46) traffic, voice gets low-latency treatment, while a minimum bandwidth guarantee for AF41 (Assured Forwarding, DSCP 34) ensures video traffic receives a guaranteed share without starving other classes, as AF uses weighted fair queuing with bandwidth allocation.

Answer

Implement a single FIFO queue on all interfaces and rely on the default CoS-to-queue mapping to prioritize voice.

Answer

Configure strict priority queuing for all traffic marked with DSCP values greater than 0.

Answer

Use the IntServ model with RSVP to reserve bandwidth for each voice and video flow.

Question 11

A network team is designing QoS for a Cisco SD-WAN fabric connecting multiple branch offices to a central data center. The design must ensure that VoIP traffic from branch sites receives priority treatment across the WAN overlay, regardless of the underlying transport (MPLS, Internet, LTE). Which architectural component should the team configure to enforce consistent QoS policies across all WAN edges?

Accepted Answer

Configure a centralized QoS policy on vManage that matches VoIP DSCP markings and applies priority queuing on all WAN edge routers.. Option A is correct because vManage serves as the centralized SD-WAN management plane, allowing administrators to define a single QoS policy that matches VoIP DSCP markings (e.g., EF for expedited forwarding) and applies priority queuing across all WAN edge routers. This ensures consistent treatment of VoIP traffic over any transport (MPLS, Internet, LTE) by pushing the policy to all vEdge/cEdge devices via the vSmart controller, leveraging the SD-WAN overlay's ability to enforce QoS independently of the underlying physical transport.

Answer

Define a localized QoS policy on each branch router using MQC, matching the same DSCP values.

Answer

Use the vSmart controller to apply QoS policy only on the MPLS transport, leaving Internet and LTE unmanaged.

Answer

Implement QoS using RSVP across the overlay tunnels.

Question 12

An enterprise is deploying a leaf-spine architecture in its data center to support high-bandwidth east-west traffic. The design must include QoS to prioritize storage replication traffic (iSCSI) over backup traffic, while ensuring low latency for real-time applications. Where should the architect apply QoS classification and queuing policies in this topology?

Accepted Answer

Apply classification and marking on the leaf switches at ingress, and queuing policies on egress interfaces of both leaf and spine switches.. In a leaf-spine architecture, QoS classification and marking must occur at the ingress of leaf switches (where traffic enters the fabric) to identify iSCSI, backup, and real-time flows. Queuing policies must be applied on egress interfaces of both leaf and spine switches to manage congestion and prioritize latency-sensitive traffic across the entire path, ensuring end-to-end QoS for east-west traffic.

Answer

Apply all QoS policies only on the spine switches, since they handle inter-leaf traffic.

Answer

Configure QoS only on the default gateway router, which is upstream of the leaf-spine fabric.

Answer

Use a single QoS policy on all interfaces with default settings, relying on hardware buffers.

Question 13

A company is virtualizing its network functions using NFV on a KVM-based hypervisor. The design must ensure that the virtual router (CSR1000v) can handle high-throughput traffic with minimal latency. Which architectural consideration is most critical for achieving this goal?

Accepted Answer

Pin the vCPU of the CSR1000v to dedicated physical cores and ensure the VM memory is allocated from the same NUMA node.. Pinning vCPUs to dedicated physical cores and allocating memory from the same NUMA node eliminates cross-NUMA memory access and CPU scheduling contention, which are critical for reducing latency and maximizing throughput in a data-plane-intensive VNF like the CSR1000v. This ensures that the VM's memory accesses are local to the NUMA node where its vCPUs run, avoiding the performance penalty of remote memory access over the QPI/UPI interconnect.

Answer

Use a Type 2 hypervisor to allow the VNF to share resources with other VMs more efficiently.

Answer

Enable overcommitment of CPU resources to maximize the number of VNFs per host.

Answer

Place the CSR1000v on a VMware ESXi host instead of KVM for better performance.

Question 14

An architect is designing a QoS policy for a Cisco SD-Access fabric. The policy must prioritize voice traffic from wireless clients connected to fabric-enabled access points over other traffic types. The design should use the fabric's built-in capabilities to simplify deployment. Which approach should the architect take?

Accepted Answer

Use Cisco TrustSec to assign an SGT to voice traffic based on ISE authentication, then apply a QoS policy on the fabric edge node that matches the SGT and provides priority queuing.. Option A is correct because Cisco SD-Access uses TrustSec to propagate Security Group Tags (SGTs) from ISE to the fabric edge nodes. By matching the SGT assigned to voice traffic (e.g., via ISE profiling and authentication), the fabric edge node can apply a QoS policy that places that traffic into a priority queue. This leverages the fabric's built-in SGT-based policy enforcement, simplifying deployment without requiring per-device ACLs or complex marking configurations.

Answer

Configure QoS policies on the wireless LAN controller (WLC) only, marking voice traffic with DSCP EF, and rely on the fabric to preserve the marking.

Answer

Implement a centralized QoS policy on the fabric border node that matches the source IP addresses of voice devices.

Answer

Use VXLAN network identifiers (VNIs) to classify voice traffic and apply QoS on the control plane node.

Question 15

A network team is designing QoS for a multi-tenant data center using leaf-spine architecture. Each tenant requires guaranteed bandwidth for their mission-critical applications, while best-effort traffic must not interfere. The design must use hierarchical queuing to enforce per-tenant fairness. Which queuing mechanism should the architect implement on the leaf switches?

Accepted Answer

Implement hierarchical QoS (HQoS) with a parent policy shaping per-tenant traffic and a child policy applying class-based weighted fair queuing (CBWFQ) for each tenant's applications.. Hierarchical QoS (HQoS) is the correct choice because it allows the architect to enforce per-tenant bandwidth guarantees using a parent policy (shaping) while applying class-based weighted fair queuing (CBWFQ) in a child policy to prioritize each tenant's mission-critical applications. This two-level structure ensures that best-effort traffic from one tenant cannot starve another tenant's guaranteed traffic, meeting the multi-tenant fairness requirement.

Answer

Use a single level of CBWFQ on all interfaces, classifying traffic by tenant using VLANs.

Answer

Apply strict priority queuing for all mission-critical traffic across all tenants.

Answer

Configure separate physical interfaces for each tenant and apply independent QoS policies.