CCNP Timed Practice Test 5 — 10 Questions

Question 1

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Accepted Answer

Configure underlay network with IS-IS or OSPF. SD-Access deployment begins with underlay configuration for physical connectivity, then overlay setup with LISP/VXLAN, followed by policy definition and integration with DNA Center for automation and assurance.

Question 2

Examine the following configuration snippet:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 100
 spanning-tree portfast
 spanning-tree bpduguard enable

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.. The configuration enables PortFast and BPDU Guard on an access port. PortFast immediately transitions the port to forwarding state, bypassing the usual STP listening and learning phases. BPDU Guard monitors for incoming BPDUs; if any are received, it error-disables the port to prevent a potential bridging loop from an unauthorized switch connection.

Answer

The port will remain in blocking state until a BPDU is received from the root bridge.

Answer

The port will only forward BPDUs and will not forward data traffic.

Answer

The port will participate in RSTP and will not be affected by BPDU reception.

Question 3

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

Accepted Answer

Each VDC can have its own admin account and separate management interface.. Option C is correct because each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

Answer

VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

Answer

VDCs provide Layer 3 routing isolation by default across all VDCs.

Answer

VDCs are supported on all Cisco IOS-XE switches.

Question 4

Drag and drop the steps of SD-Access fabric node onboarding into DNA Center into the correct order, from first to last.

Accepted Answer

Physically connect the node to the network and power it on. The correct order begins with physical connectivity and discovery, followed by adding the device to inventory, assigning it to a site, configuring the network profile and fabric role, and finally provisioning the node. This sequence ensures the device is discovered, recognized, and properly configured within the SD-Access fabric.

Question 5

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Accepted Answer

authentication port-control auto. Option B is correct because 'authentication port-control auto' is the required interface command to enable 802.1X authentication on a switch port. This command sets the port to initiate the authentication process, placing it in the unauthorized state until the client successfully authenticates via the RADIUS server (Cisco ISE). Without this command, the port will not enforce 802.1X.

Answer

dot1x pae authenticator

Answer

authentication port-control force-authorized

Answer

authentication port-control force-unauthorized

Question 6

Which TWO of the following are benefits of implementing a spine-leaf architecture in a data center?

Accepted Answer

Provides predictable latency for east-west traffic.. In a spine-leaf architecture, every leaf switch connects to every spine switch, creating a full mesh topology. This design ensures that any east-west traffic (server-to-server) traverses exactly one spine hop, providing consistent and predictable latency regardless of which leaf switches the source and destination are connected to.

Answer

Eliminates the need for spanning-tree protocol.

Answer

Reduces the amount of cabling required.

Answer

Eliminates the need for firewall appliances.

Question 7

Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.

Accepted Answer

Define the external network and VLAN mapping. The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.

Question 8

Drag and drop the steps of SD-Access fabric endpoint registration into the correct order, from first to last.

Accepted Answer

Endpoint sends ARP or DHCP request. The correct order begins with the endpoint sending an ARP or DHCP request, the edge node detecting the new endpoint, registering it with the control plane (LISP), the control plane updating the map server, and finally the edge node installing the necessary forwarding entries. This sequence ensures the endpoint is properly discovered and integrated into the fabric.

Question 9

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

Accepted Answer

The next-hop IP addresses are in the global routing table, not in the VRF.. When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.

Answer

LISP is not configured to map the virtual network.

Answer

OSPF is not redistributing the routes into the VRF.

Answer

The physical interface is not configured as a trunk.

Question 10

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.. The issue is that the remote PE router does not have the correct route target import/export configuration for VRF CUSTOMER_C. In MPLS L3VPN, VRFs on different PEs must have matching route target values to import and export VPNv4 routes into the correct VRF. Even if the local PE is correctly configured, the remote PE must also import the routes from the local PE using the same route target. Without this, the remote PE will not install the VPNv4 prefixes into its VRF, causing the customer to be unable to reach sites connected to that remote PE.

Answer

Increase the MTU on the link between the PE routers.

Answer

Reconfigure LDP on the PE routers to establish a targeted session.

Answer

Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.