CCNP Virtualization Practice Test 5 — 15 Questions

Question 1

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.. The issue is that the remote PE router does not have the correct route target import/export configuration for VRF CUSTOMER_C. In MPLS L3VPN, VRFs on different PEs must have matching route target values to import and export VPNv4 routes into the correct VRF. Even if the local PE is correctly configured, the remote PE must also import the routes from the local PE using the same route target. Without this, the remote PE will not install the VPNv4 prefixes into its VRF, causing the customer to be unable to reach sites connected to that remote PE.

Answer

Increase the MTU on the link between the PE routers.

Answer

Reconfigure LDP on the PE routers to establish a targeted session.

Answer

Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.

Question 2

Which TWO statements about virtual switching in a hypervisor environment are correct?

Accepted Answer

A virtual switch can be connected to a physical network through uplink ports.. Option A is correct because a virtual switch (vSwitch) uses uplink ports, also called physical NICs or pNICs, to bridge virtual machine traffic onto the physical network, allowing VMs to communicate beyond the host. Option D is correct because a virtual switch operates at Layer 2, learning MAC addresses and forwarding Ethernet frames between virtual machines (and to uplinks) based on destination MAC addresses, just like a physical switch. Option B is wrong because virtual switches do support VLAN tagging, typically via VLAN IDs on port groups or virtual switch ports (e.g., 802.1Q tagging). Option C is wrong because a virtual switch is a Layer 2 device and does not perform IP routing between subnets; routing requires a router or Layer 3 device. Option E is wrong because a virtual switch is a software construct running inside the hypervisor, not a physical device installed in the host.

Answer

A virtual switch does not support VLAN tagging.

Answer

A virtual switch performs routing between different subnets.

Answer

A virtual switch is a physical device installed in the hypervisor host.

Question 3

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Accepted Answer

CUSTOMER-A. The packet arrives on interface Gi0/1/0, which is configured under VRF CUSTOMER-A (as shown in the exhibit with 'ip vrf forwarding CUSTOMER-A'). When a VRF is applied to an ingress interface, the router uses that VRF's routing table (not the global table) to perform the destination IP lookup. Therefore, the packet with destination 10.1.1.2 is routed using the CUSTOMER-A VRF.

Answer

Global routing table

Answer

Mgmt-intf

Answer

CUSTOMER-B

Question 4

Drag and drop the steps to configure OSPF on a Cisco router in the correct order.

Accepted Answer

Enter global configuration mode, then configure 'router ospf ', then configure 'network

area '. OSPF configuration starts with enabling the OSPF process, then defining networks and areas.

Answer

Enter global configuration mode, then configure 'network

area ', then configure 'router ospf '

Answer

Configure 'router ospf ', then enter global configuration mode, then configure 'network

area '

Answer

Enter global configuration mode, then configure 'router ospf ', then configure 'network

' without the 'area' keyword

Question 5

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

Accepted Answer

Configure ISAKMP policy, then IPsec transform set, then crypto ACL, then create and apply crypto map. IPsec VPN setup requires IKE phase 1, then phase 2 (transform set and crypto map).

Answer

Configure IPsec transform set, then ISAKMP policy, then crypto ACL, then create and apply crypto map

Answer

Configure ISAKMP policy, then IPsec transform set, then create and apply crypto map, then crypto ACL

Answer

Configure crypto ACL, then ISAKMP policy, then IPsec transform set, then create and apply crypto map

Question 6

Match each Cisco switch security feature to its function.

Accepted Answer

Port Security: Limits the number of MAC addresses allowed on a switch port.. Port Security limits MAC addresses per port to prevent MAC flooding. DHCP Snooping filters DHCP messages to block rogue servers. Dynamic ARP Inspection validates ARP packets using DHCP snooping entries to prevent spoofing. IP Source Guard filters IP traffic based on the binding table to prevent IP spoofing. Common confusions include swapping these functions, e.g., assigning ARP spoofing prevention to Port Security or MAC flooding prevention to DHCP Snooping.

Answer

Port Security: Prevents ARP spoofing attacks.

Answer

DHCP Snooping: Prevents MAC flooding attacks.

Question 7

A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints be authenticated and assigned to a VLAN and VRF based on their identity before any traffic is forwarded. Which Cisco SD-Access component is responsible for this function?

Accepted Answer

Cisco Identity Services Engine. Cisco ISE is the identity services component that authenticates endpoints and returns the VLAN and VRF assignment to the fabric edge node. The edge node then places the endpoint into the correct virtual network and applies group-based policy. Neither the control plane nor border nodes perform authentication or endpoint classification.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Fabric edge node

Question 8

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer needs to specify the loopback0 interface as the source for VXLAN tunnels. Which command must be entered under the NVE interface configuration?

Accepted Answer

source-interface loopback0. The correct command to set the source interface for VXLAN tunnels on a Cisco Nexus 9000 NVE interface is 'source-interface loopback0'. This command ensures that the loopback0 IP address is used as the source IP for VXLAN encapsulated traffic, which is critical for VTEP reachability and proper tunnel establishment. Without it, the NVE interface cannot function correctly.

Answer

vxlan source-interface loopback0

Answer

interface loopback0

Answer

source loopback0

Question 9

A network engineer is deploying a Cisco Catalyst 9300 switch stack that will host several isolated tenant environments. Each tenant must have its own separate routing table and its own independent instance of a dynamic routing protocol on the same physical switch, while sharing the same physical uplinks to the core. Which technology should the engineer implement to meet these requirements?

Accepted Answer

Virtual Routing and Forwarding (VRF). VRF is the Cisco IOS/IOS-XE feature that partitions a single physical router or switch into multiple logically separate Layer 3 routing domains. Each VRF maintains its own routing and forwarding table and can run its own routing protocol process, which is exactly what is needed when several tenants must share hardware and uplinks while remaining logically isolated.

Answer

Virtual Switching System (VSS)

Answer

Private VLAN (PVLAN) configuration

Answer

VLAN access map on the uplink

Question 10

A network engineer is designing a new data center leaf-spine fabric using Cisco Nexus 9000 switches. The design requires that the fabric automatically discover the IP addresses of remote VTEPs participating in a VXLAN EVPN deployment. Which control-plane protocol should be enabled on the leaf switches to provide this dynamic VTEP discovery?

Accepted Answer

Multiprotocol BGP with EVPN address family. VXLAN EVPN uses MP-BGP with the EVPN address family as the overlay control plane. It advertises Type-2 (MAC/IP) and Type-3 (IMET) routes, allowing leaf switches to learn remote VTEP IP addresses automatically. This eliminates the need for static VTEP configuration and supports efficient multi-tenancy and mobility.

Answer

OSPFv3 in the underlay network

Answer

Protocol Independent Multicast (PIM) sparse mode

Answer

Cisco Fabric Services (CFS) over the management network

Question 11

A network engineer is configuring a Cisco CSR 1000v router to run multiple virtual routing and forwarding (VRF) instances. The engineer wants to ensure that traffic from VRF RED can reach the internet while traffic from VRF BLUE remains isolated. Which feature should be configured to allow VRF RED to access the global routing table?

Accepted Answer

Route leaking using static routes with next-hop in the global table. Route leaking is the correct feature to allow traffic from a specific VRF to access the global routing table or another VRF. By configuring static routes or BGP import/export, the engineer can selectively leak routes for VRF RED to the global table, enabling internet access while maintaining isolation for VRF BLUE.

Answer

MPLS L3VPN with route targets

Answer

GRE tunnel between VRF RED and the global table

Answer

VRF-lite with OSPF process per VRF

Question 12

An engineer is deploying a new branch office that must run multiple isolated routing domains on a single Cisco IOS-XE router. Each department requires its own routing table and overlapping IP addressing. The engineer plans to use VRF-Lite. Which configuration step is required to ensure that routes from one VRF do not leak into another?

Accepted Answer

Assign the VRF to the appropriate interfaces and configure a separate routing protocol instance within each VRF.. VRF-Lite achieves isolation by binding interfaces to a VRF and running a separate routing protocol instance inside each VRF. This creates independent routing and forwarding tables, allowing overlapping IP addresses and preventing route leakage. RDs, RTs, and MPLS are not needed on a single device; they are relevant only when extending VRFs across a provider core.

Answer

Enable MPLS LDP on all interfaces and redistribute the global routing table into each VRF.

Answer

Configure a single OSPF process and use different area IDs for each department.

Answer

Associate each VRF with a unique route distinguisher (RD) and route target (RT) in the BGP configuration.

Question 13

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The underlay is a Layer 3 routed fabric using OSPF. The engineer needs to ensure that multicast replication is not used for BUM (Broadcast, Unknown Unicast, Multicast) traffic. Which VXLAN EVPN configuration is required on the leaf switches?

Accepted Answer

Configure the NVE interface with `ingress-replication protocol bgp` and ensure EVPN is enabled for the VNI.. To avoid multicast replication in a VXLAN EVPN fabric, ingress replication must be used. The leaf switches must be configured with `ingress-replication protocol bgp` under the NVE interface, and EVPN must be enabled for the VNI. This allows the leaf to use the EVPN control plane to discover remote VTEPs and replicate BUM traffic to them via unicast. Multicast replication requires PIM in the underlay, which is not desired here.

Answer

Configure the NVE interface with a multicast group address using the `member vni mcast-group ` command.

Answer

Configure PIM sparse mode on all underlay interfaces and enable multicast routing on the leaf switches.

Answer

Configure the NVE interface with `source-interface loopback0` and rely on OSPF to flood BUM traffic to all VTEPs.

Question 14

A network engineer is deploying a new branch office that uses Cisco SD-WAN with a single transport underlay. The design requires that the branch router participate in the SD-WAN fabric and establish control connections to the controllers. Which component must the engineer configure on the branch device to allow it to register with the SD-WAN controllers and receive policy from vManage?

Accepted Answer

A unique system IP address and organization name configured on the device. For a Cisco SD-WAN device to join the overlay, it must be configured with a unique system IP address and the same organization name as the controllers. These values are used during the initial vBond handshake and subsequent control connections to vSmart and vManage. Without them, the device cannot authenticate, receive centralized policy, or participate in the fabric.

Answer

An IPsec pre-shared key matching the vBond controller

Answer

A VRF named TRANSPORT with an OSPF process advertising the system IP

Answer

A BGP autonomous system number peering with the vSmart controller

Question 15

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP). The switch has two loopback interfaces: Loopback0 (10.0.0.1/32) and Loopback1 (10.0.0.2/32). The engineer wants VXLAN traffic to use the loopback interface that is also used for BGP EVPN peering. Which command should be used to specify the source interface for the VXLAN tunnels?

Accepted Answer

interface nve1
  source-interface loopback1. The correct configuration is to specify the source interface under the NVE interface using 'source-interface loopback1'. This binds the VTEP to the same loopback used for BGP EVPN peering, ensuring that the tunnel source address is reachable and consistent with the control plane. Using a different loopback could cause routing inconsistencies and is not recommended when the same loopback is already used for EVPN peering.

Answer

interface loopback1
  vxlan source-interface

Answer

interface nve1
  source-interface loopback0

Answer

feature nv overlay
  source-interface loopback1