CCNA Architecture Questions

Cisco SD-Access supports a dual-stack overlay, meaning that both IPv4 and IPv6 packets can be encapsulated in VXLAN and transported over an IPv4 underlay. This allows native IPv6 communication without translation. The underlay can remain IPv4, as the fabric data plane uses VXLAN with an IPv4 transport. This is the recommended approach for supporting both protocols natively.

VXLAN is the encapsulation used to carry Layer 2 frames over Layer 3 fabric.

To assign an IP address for management on a Cisco switch, you create an SVI for the management VLAN and assign the IP address under that interface. This is the correct method because it allows the switch to be reachable on VLAN 10. The command sequence is entered in global configuration mode: interface vlan 10, then ip address 10.10.10.2 255.255.255.0. This enables SSH management when combined with proper default gateway and SSH configuration.

In Cisco SD-Access, LISP (Locator/ID Separation Protocol) serves as the control plane protocol that separates endpoint identity (EID) from its location (RLOC). It maintains a mapping database that allows fabric edge nodes to query the mapping system to locate endpoints. This enables scalable, dynamic endpoint mobility and policy enforcement across the fabric.

Overlay Management Protocol (OMP) is the control plane protocol used in Cisco SD-WAN. It runs between vSmart controllers and vEdge routers to distribute routing, policy, and service information securely. OMP uses TLS for encryption and authentication, ensuring secure communication. It is the correct protocol for this requirement.

This is correct because enabling unicast routing on a bridge domain, combined with the hardware proxy function, allows the leaf switches to perform distributed gateway routing for endpoints in that bridge domain. The anycast gateway is programmed on every leaf, so traffic is routed at the ingress leaf without tromboning to a central spine, meeting the distributed routing requirement.

In LLQ, the priority queue is serviced first and can starve other queues if not policed. Configuring policing on the voice class limits the amount of traffic that can enter the priority queue, ensuring that other queues get bandwidth. This is the standard method to prevent starvation in LLQ deployments.

Cisco ISE is the policy server that assigns SGTs to users and devices during authentication. It also defines security group access control policies (SGACLs) that determine which tags can communicate. Without ISE, there is no centralized source for tag assignment and policy, so it is a fundamental component of a TrustSec deployment.

Configuring the core switches with routed ports (no switchport) enables pure Layer 3 forwarding, eliminating MAC address table entries for those interfaces and relying on routing protocols or static routes. This directly satisfies the requirement to avoid a large MAC address table and forward based on Layer 3 reachability, which is typical in a three-tier campus core.

Fabric border nodes provide the handoff between the fabric and external networks such as data center, WAN, or legacy campus. They run routing adjacencies and redistribute or leak routes between the fabric's VXLAN domain and outside domains, which is exactly what the scenario describes.

SXP (SGT Exchange Protocol) is used to propagate SGT information between Cisco TrustSec-capable devices, especially when some devices do not support hardware-based SGT tagging. It allows IP-to-SGT mappings to be shared across network boundaries, enabling consistent policy enforcement. In this scenario, SXP is the correct protocol to carry SGT information between devices that need to enforce role-based segmentation.

Application-aware routing policies in Cisco SD-WAN use SLA classes to monitor path characteristics such as latency, jitter, and loss. By associating business-critical traffic with an SLA class that prefers MPLS and configuring a fallback to broadband, the engineer ensures preferred path selection and automatic failover when the MPLS circuit degrades.

This is correct because vBond is the first point of contact for WAN Edge devices; it validates their identity and provides the information needed to reach vManage and vSmart. It acts as the orchestrator for control connections, enabling secure onboarding without pre-configuring every peer address on each edge device.

Creating a dedicated guest WLAN mapped to a separate VLAN, combined with ACLs or firewall rules between the guest and corporate subnets, provides clear Layer 2 and Layer 3 separation. This approach isolates guest traffic while allowing shared physical access points. It directly satisfies the requirement to separate guest and corporate clients, making it the correct design choice.

The vSmart controller is the SD-WAN control-plane component that builds DTLS/TLS control connections with each vEdge/cEdge and distributes OMP routes, TLOCs, and centralized policy. In this branch scenario, the edge device registers to vSmart, which pushes the routing and policy information needed for the single-transport overlay, making it the component that owns control-plane distribution.

LLQ (Low Latency Queuing) combines a strict-priority queue with CBWFQ: the priority queue is serviced first on every scheduling cycle, before any CBWFQ class queues, so voice is dequeued with minimal and deterministic delay. The priority queue can be policed to a configured rate to prevent a flood of priority traffic from starving the non-priority classes, but within the committed rate voice effectively experiences 'express lane' treatment. This strict-priority scheduling is exactly what makes LLQ the standard QoS queueing strategy for real-time voice traffic in an enterprise.

The management interface on a Cisco WLC is used for out-of-band management, including GUI, CLI, and RADIUS communication. It is typically assigned an IP address on the management VLAN and is essential for controller reachability. It is the primary interface for administrative access.

vSmart is the control plane component that distributes policies and reachability information to all SD-WAN devices. It uses OMP to share routing and policy data, enabling application-aware routing and centralized policy enforcement. The branch devices receive their forwarding policies and route information from vSmart, making it the correct answer.

A priority queue, implemented via LLQ (Low Latency Queuing) within the CBWFQ shaper, ensures that DSCP EF voice packets are dequeued ahead of all other classes before the shaped output is released. This guarantees that voice traffic experiences low latency and jitter, and critically, that voice packets are not tail-dropped when the shaper's buffer is temporarily congested due to bursts. The priority queue's strict scheduling protects real-time traffic from the queue-full condition that causes drops in other classes.

In a StackWise-480 deployment, the standby switch is ready to take over if the active switch fails. The stack retains its configuration and forwarding state, and the standby becomes active with minimal disruption. This is the designed behavior for high availability, ensuring that network services continue without a full stack reload.

DMVPN (Dynamic Multipoint VPN) allows spoke-to-spoke tunnels to be established on demand, enabling direct communication between branch sites without routing traffic through the hub. It uses mGRE (multipoint GRE) and NHRP (Next Hop Resolution Protocol) to dynamically discover and build tunnels. This matches the requirement for dynamic multipoint VPN with encryption, typically provided by IPsec.

The ingress Cisco Catalyst switch (or wireless controller) is responsible for assigning SGTs to packets based on the classification policy received from ISE. It inserts the SGT into the Cisco Metadata (CMD) field of the packet or uses inline tagging. This enables enforcement throughout the network without relying on IP addresses. Thus, the switch is the component that assigns SGTs at the ingress point.

The fabric control plane node runs LISP and maintains the mapping of endpoint EIDs to RLOCs. When a fabric site is connected via a transit network, control plane nodes in each site exchange LISP map-register and map-notify messages so that endpoints in the same VN are reachable across sites while different VNs stay isolated by their respective VRFs and LISP instance IDs.

Application-aware routing policy is created on the vSmart controller and distributed to vEdge or cEdge devices. It defines SLA classes with latency, jitter, and loss thresholds, and can specify a preferred transport such as MPLS. When the SLA is violated, the policy allows failover to the internet transport, exactly matching the requirement to prefer MPLS and fall back on high latency.

Low Latency Queuing combines a strict priority queue for voice with a policer that caps the priority traffic at a configured rate, such as 30 percent of interface bandwidth. This ensures voice is serviced first with minimal delay while preventing the priority class from starving other queues if voice traffic exceeds the limit, exactly matching the design requirement.

The management interface on a Cisco WLC is used for in-band management. It must be configured with an IP address, subnet mask, and default gateway to allow remote management from a different subnet. This interface is also used for communication with access points, DHCP, and other services. It is typically mapped to a VLAN on the trunk port.

The fabric control plane node runs the LISP map-server and map-resolver functions. It maintains the mapping of endpoint IP addresses to fabric edge nodes, enabling communication between endpoints attached to different edge nodes. When an edge node needs to reach an endpoint not locally attached, it queries the control plane node for the location, which returns the RLOC of the correct edge node.

StackWise Virtual combines two switches into a single logical entity. One switch is elected active and handles control plane and management functions, while the other is standby and ready to take over. Both switches actively forward data traffic, providing increased bandwidth and redundancy. This active/standby control plane with active/active data plane is the defining characteristic of StackWise Virtual.

The control plane node runs the LISP map-server and map-resolver functions, maintaining the database that maps endpoint identifiers (EIDs) to routing locators (RLOCs), which are the fabric edge nodes. When a fabric edge needs to reach an endpoint, it queries the control plane node to learn which edge node is authoritative for that endpoint, enabling proper forwarding.

FlexConnect is correct because it separates the control plane (which remains with the WLC) from the data plane (which is switched locally at the AP). This allows client traffic to be forwarded directly to the wired network at each access point, avoiding unnecessary latency and controller bottlenecks, which is ideal for high-bandwidth, high-density indoor environments. Furthermore, FlexConnect supports IEEE 802.11r fast roaming and can perform client-based or AP-based neighbor discovery when connected to a WLC, ensuring seamless and fast handoffs as users move across the office. Its design balances centralized management with localized forwarding, offering both the operational consistency of a controller and the performance of distributed switching.

SD-Access decouples identity from location by using a VXLAN overlay, so a user keeps the same IP subnet and security group tag whether wired or wireless. This eliminates per-floor VLAN/subnet sprawl and enforces consistent group-based policy through the fabric, which directly matches the stated requirement for unified wired/wireless policy with minimal VLAN provisioning.

The ingress enforcement device, such as a switch or wireless controller, assigns the SGT to traffic as it enters the network. It can do this statically via port configuration or dynamically based on authentication and authorization from Cisco ISE. The SGT is then carried in the packet, allowing egress devices to enforce SGACLs based on the tag without needing to reclassify the traffic.

Voice VLAN is a Cisco feature that automatically assigns a VLAN to IP phones based on CDP or LLDP discovery. The switch detects the phone and places its voice traffic in the configured voice VLAN, while data traffic from a connected PC remains in the access VLAN. This simplifies deployment and ensures QoS for voice.

The command 'transport input ssh' under the VTY line configuration restricts incoming connections to SSH only, which is required to enable SSH access. Without it, the router may still allow Telnet or other protocols. This command ensures that only secure shell connections are accepted, aligning with the requirement to manage the router via SSH.

A trunk port carries frames from multiple VLANs and tags each frame with its 802.1Q VLAN ID, except for the native VLAN which remains untagged. Router subinterfaces configured with encapsulation dot1Q can accept these tagged frames, allowing the router to route between VLANs over one physical link. This is the required configuration for router-on-a-stick inter-VLAN routing when a single router interface must handle traffic for many VLANs.

LISP separates endpoint identity from location, allowing a client to keep its IP address while its location changes. In a campus design, LISP can be used to provide seamless mobility across Layer 3 boundaries by updating the mapping of the endpoint identifier to its new routing locator.

Cisco StackWise Virtual enables active/active forwarding, meaning both switches in the virtual domain can forward traffic concurrently. This provides load balancing and increased bandwidth utilization. Multichassis EtherChannel (MEC) leverages this capability, allowing access switches to form a port-channel with both distribution switches for redundancy and increased throughput.

The vSmart controller is the centralized policy and control plane component of Cisco SD-WAN. It distributes OMP routes and policies to vEdge routers, enabling per-application traffic steering across MPLS and Internet transports. It does not forward data traffic; it only manages control plane and policy. This matches the requirement for centralized policy in a controller-based architecture.

When 802.1X is configured with a RADIUS server, such as Cisco ISE, the server can return attributes that instruct the switch to place the authenticated endpoint into a specific VLAN. This is done using the IETF RADIUS attribute Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID. The switch then dynamically assigns the port to that VLAN. This feature is supported on Catalyst 9000 switches and is the standard method for dynamic VLAN assignment.

LISP separates endpoint identity (EID) from routing locator (RLOC), which is exactly the identifier/locator split the scenario demands. VXLAN provides the tunneling data plane over the routed underlay, and the fabric border and edge nodes register EIDs to the map server. Together they deliver Layer 2 and Layer 3 overlay connectivity without stretching VLANs across sites.

HSRP version 1 uses the virtual MAC address 0000.0c07.acXX, where XX is the group number in hexadecimal, and it supports only IPv4. Configuring HSRPv1 with the standby command and a group number satisfies both requirements, making it the correct choice for this scenario.

CBWFQ is correct because it provides a guaranteed minimum bandwidth to each class during congestion, based on the configured bandwidth value, while allowing classes to use unused bandwidth from others. This matches the requirement for a guaranteed floor with excess sharing. It is implemented with the bandwidth command inside a policy-map class.

Creating a separate WLAN for guests and mapping it to a dynamic interface with its own VLAN isolates guest traffic from internal networks. The dynamic interface can be configured with an ACL or firewall rules to restrict guests to internet-only access. This approach ensures that guest traffic is segregated at Layer 2 and can be controlled at Layer 3.

The OSPF dead timer is the primary factor in convergence delay because it dictates how long a router waits for a missing hello before marking the neighbor unavailable. Setting the dead timer to 1 second ensures that a link failure is detected within roughly one second, and a hello interval of 333 milliseconds satisfies the standard three-hello requirement while maintaining a stable neighbor state. This direct reduction of the detection timer cuts the outage from tens of seconds to about one second, whereas other mechanisms only optimize post-detection processing.

The command 'switch convert mode virtual' converts a standalone switch to StackWise Virtual mode. This is required before the switch can join an existing StackWise Virtual domain. It changes the switch's operation to support the virtual domain and prepares it for the stacking connection. Without this conversion, the switch remains in standalone mode and cannot participate in the virtual domain.

Traffic always traverses one spine hop, resulting in consistent latency.

In StackWise Virtual, a dual-active detection link is a separate physical connection between the two switches that is used to detect a virtual link failure. When the virtual link fails, the switches use this link to determine which switch should remain active. Configuring this link and enabling dual-active detection prevents both switches from becoming active and causing a split-brain.

Enabling port security with switchport port-security, setting the maximum number of MAC addresses, and configuring the violation action to shutdown causes the port to err-disable when the limit is exceeded. This directly meets the requirement to limit MAC addresses per port and shut down on violation. The commands are applied in interface configuration mode.

In a high-density wireless design, co-channel interference is the primary limiting factor because all APs on the same channel share the medium. A channel reuse plan ensures that APs operating on the same non-overlapping channel are separated by enough physical distance, often using different channels for adjacent cells. This spatial reuse maximizes aggregate throughput by allowing more simultaneous transmissions.

This sequence enters interface configuration mode, sets the port to access mode, and assigns it to VLAN 20. The switchport mode access command ensures the port operates as an access port, and switchport access vlan 20 places it in the correct VLAN. This is the standard method to configure an access port on a Cisco Catalyst switch.

The 'vlan 200' command in global configuration mode creates VLAN 200 and enters VLAN configuration mode. This is the correct way to create a VLAN on a Cisco Catalyst switch. After entering this command, the VLAN is active by default unless it is shutdown. This command is essential for adding a new VLAN to the switch's VLAN database.

The fabric edge node provides the layer 3 gateway and policy enforcement for endpoints in the SD-Access fabric. It encapsulates traffic using VXLAN and registers endpoints with the control plane node. In a branch with minimal IT staff, the edge node enables automated onboarding and consistent policy from Cisco DNA Center, exactly as required.

vSmart is the centralized control plane component of Cisco SD-WAN. It distributes routing information, policies, and keys to the WAN Edge devices. It uses Overlay Management Protocol (OMP) to exchange routes and policies, enabling dynamic path selection based on application policies. This matches the requirement for centralized control plane functions.

In Cisco ACI, the Policy Enforcement Point (PEP) is responsible for enforcing contracts between EPGs. The PEP is typically implemented in the leaf switches, where it applies filters and actions defined in the contract. This ensures that traffic is permitted or denied based on the contract, meeting the security requirement.

The fabric control plane node, which runs LISP map-server and map-resolver functions, maintains the database of endpoint IP addresses and their associated fabric edge nodes. It provides the mapping service that allows fabric edge nodes to locate endpoints and establish optimal forwarding paths, making it essential for large-scale SD-Access deployments.

StackWise-480 uses a ring topology in which each switch connects to the next and the final switch connects back to the first. This loop allows traffic to flow in either direction, so a single cable or switch failure does not split the stack. That matches the requirement for a resilient stack ring.

Fabric edge nodes are responsible for VXLAN encapsulation and decapsulation at the fabric boundary. They provide the anycast gateway, which serves as the default gateway for endpoints, allowing seamless mobility. This statement correctly describes a key role of edge nodes in SD-Access, making it one of the accurate statements.

vSmart controllers form the control plane of Cisco SD-WAN. They run the Overlay Management Protocol (OMP) to distribute routing, policy, and key information to vEdge routers, establishing a secure and scalable overlay. They maintain the control plane relationships and enforce centralized policies, separating control from data plane.

In SD-Access, the LISP map server and map resolver track endpoint identifier to routing locator mappings. Fabric edge nodes register local endpoints and query the map server for remote ones, which provides a control-plane lookup instead of data-plane flooding. This is how the fabric scales to thousands of endpoints while avoiding broadcast or unknown unicast flooding across the underlay.

Application-Aware Routing (AAR) in Cisco SD-WAN uses real-time performance metrics such as latency, jitter, and packet loss to select the best path for specific applications. It can direct traffic based on SLA policies, ensuring critical SaaS applications get prioritized treatment. This feature meets the requirement by dynamically choosing the optimal path and enforcing QoS. Therefore, it is the correct answer.

Centralized data policy in Cisco SD-WAN allows you to define traffic steering based on application, source/destination, and transport. You can create a policy that matches ERP traffic and directs it exclusively to the MPLS transport, while matching guest traffic and directing it to the Internet. This enforces the required path selection.

The feasibility condition is EIGRP's loop-free guarantee: a neighbor advertises a reported distance (RD) that is strictly lower than the current feasible distance (FD) to a destination. This proves the neighbor's path does not pass back through the local router, so the path can safely be used as a feasible successor. If no such neighbor exists, DUAL goes active and queries neighbors, but the feasibility condition remains the core mechanism ensuring that any selected path is genuinely loop-free.

LLQ provides strict priority queuing for voice traffic while allowing other classes to have guaranteed bandwidth. It is configured using the priority command within a policy map applied to the interface. This meets the requirement for voice to have strict priority, video to have guaranteed bandwidth (using bandwidth command), and data to use leftover bandwidth. Therefore, LLQ is the correct queuing mechanism for this scenario.

The control-plane node runs LISP and hosts the map-server and map-resolver functions that store endpoint identifier-to-routing locator mappings. Edge nodes register endpoints with it and query it to resolve destinations. This directly fulfills the requirement of maintaining the mapping database that enables fabric forwarding, making it the correct role.

PFC is the correct choice because it operates on IEEE 802.1Q CoS priorities and allows a receiver to send a PAUSE frame for a specific priority, pausing only the storage class of traffic while LAN traffic on other priorities continues unimpeded. This satisfies the requirement for lossless FCoE without head-of-line blocking across the entire link.

IS-IS is the recommended underlay routing protocol for Cisco SD-Access fabrics. It provides fast convergence, supports ECMP, and scales well in large campus deployments. It operates independently of the LISP/VXLAN overlay, allowing the underlay to focus on IP reachability. This directly meets the requirements for fast convergence and multipathing without overlay routing, making it the correct selection.

The access layer is the optimal trust boundary because it is the first device in the path that can inspect source identities (e.g., IP phone vs. workstation) with port-level granularity. Re-marking DSCP here ensures that packets enter the network with a consistent QoS class, allowing all downstream switches to rely on these markings for queuing and policing. This prevents untrusted end devices from dictating their own priority, which is essential for converged networks carrying voice, video, and data.

A Mobility Group allows multiple Cisco WLCs to share client context and coordinate roaming. When a client roams between access points on different controllers, the controllers exchange information via the mobility group, enabling seamless roaming with consistent security. This is essential for high-density environments with multiple controllers.

Cisco Client Load Balancing distributes client devices across access points by delaying association responses when an AP is heavily loaded. This helps achieve even distribution in high-density environments. Combined with other features like 802.11k/v, it can optimize roaming, but load balancing itself is the primary feature for even client distribution, making it correct here.

The LISP Map-Server maintains the mapping of endpoint identities (EIDs) to routing locators (RLOCs), effectively tracking endpoint location and identity. It registers EID-to-RLOC mappings from fabric edge nodes and responds to map requests. This enables policy-based segmentation and mobility by allowing endpoints to be reached regardless of their location. Thus, it is the correct component.

EF (Expedited Forwarding) with DSCP value 46 is the standard marking for voice traffic. It provides low latency, low jitter, and low loss, which are critical for voice quality. Voice traffic should be marked with EF to ensure it receives priority treatment in the network. This is a widely accepted best practice.

VPN segments in vManage allow the creation of separate virtual private networks (VPNs) within the SD-WAN overlay. Each segment has its own routing table and can be assigned to different VRFs on the WAN Edge devices. This provides isolation between guest, employee, and IoT traffic. Policies can be applied per VPN segment, enabling granular control. This is a core mechanism for segmentation in Cisco SD-WAN.

In ACI, leaf switches connect to all spine switches, forming a full-mesh at the spine level. If a spine fails, the remaining spines continue to forward traffic, so the fabric remains operational. This provides high availability and load balancing across all available paths, meeting the design requirements.

A routed access layer with IS-IS or OSPF is the required foundation for an SD-Access underlay. Link-state protocols offer rapid convergence, loop-free topology, and hierarchical scalability, which are essential when building a large leaf-and-spine fabric. The underlay is a pure L3 network, and all devices carry only unique loopback/p2p addresses, allowing the overlay (LISP/VXLAN) to run independently of L2 constraints. Without this routed design, the fabric cannot propagate reachability efficiently and may revert to spanning-tree, which is explicitly contrary to SD-Access best practices.