CCNA Architecture Questions

In local mode, the AP establishes a CAPWAP tunnel to the Catalyst 9800-CL and the controller handles all client authentication, including 802.1X and dynamic VLAN assignment. This centralizes configuration and keeps the APs simple, matching the requirement for minimal AP configuration. Local mode is the standard controller-based deployment for branch offices with centralized management.

OMP is the SD-WAN control-plane protocol that runs between WAN Edge devices and the vSmart controller over DTLS/TLS. It advertises TLOCs, service-side routes, and centralized policy, enabling the controller to orchestrate fabric reachability without hairpinning data traffic. This matches the requirement of a single control plane with direct branch-to-branch data forwarding, so it is the correct choice.

CAPWAP (Control and Provisioning of Wireless Access Points) is the standard protocol for AP-to-WLC communication. It uses DTLS to encrypt control and data traffic, and it supports Layer 3 discovery via broadcast, DHCP option 43, or DNS. Enabling DTLS ensures management traffic is encrypted, and CAPWAP operates across Layer 3 networks, satisfying both requirements.

Access points use CAPWAP (Control and Provisioning of Wireless Access Points) to discover and join a WLC, encapsulating control and data traffic. The WLC GUI is accessed via HTTPS by default, providing secure management. This combination meets the requirement for secure AP join and management in a large campus deployment.

Cisco SD-WAN supports multicast over the overlay by replicating traffic through the fabric with a rendezvous point, allowing one overlay to carry both unicast and multicast. This meets the goal of a single overlay without separate tunnels for each traffic type.

Virtual Routing and Forwarding (VRF) creates separate, independent IP routing tables and associated forwarding tables on the Provider Edge (PE) router. Each VRF instance contains its own set of routes, interfaces, and routing protocol processes, ensuring that customer A's routing information is completely invisible to customer B. This table separation is how an MPLS L3VPN achieves routing isolation, even though both customers share the same physical backbone. When combined with route distinguishers (RDs) and route targets (RTs), VRF controls the import and export of routes into the VPN, thereby maintaining strict logical isolation across a shared MPLS core.

LISP is the control plane protocol in SD-Access. The map-server registers endpoint EID-to-RLOC mappings from fabric edge nodes, and the map-resolver answers map requests from ingress tunnel routers. This enables scalable endpoint mobility and policy enforcement based on endpoint groups, exactly as required for IoT and employee segmentation across wired and wireless.

The 'ip default-gateway' command is used on Layer 2 switches to specify a default gateway for management traffic. When the switch is not performing routing, it needs a default gateway to reach remote subnets. This command sets the gateway of last resort for the management interface. Without it, the switch can only communicate with devices on the same subnet, so this is the correct solution for the scenario.

In a totally stubby area, the ABR suppresses Type 4 (ASBR-summary) and Type 5 (AS-external) LSAs, and also replaces all Type 3 inter-area summaries with a single default route. This leaves only Type 1 (router) and Type 2 (network) LSAs for intra-area topology, plus the injected Type 3 default LSA for any traffic leaving the area. Therefore, the allowed LSA set is exactly Type 1, Type 2, and the default Type 3.

Mismatched MTU sizes break the link's ability to carry full-size frames consistently. A 9000-byte jumbo frame sent toward the 1500-byte interface is dropped or fragmented, causing intermittent packet loss on the LACP port-channel, especially for large transfers.

FlexConnect mode allows the access point to switch client traffic locally at the branch while still being managed by the controller. If the WAN link fails, the AP enters standalone mode and continues to serve clients with local switching, meeting the requirement for local forwarding and reduced WAN bandwidth usage. This is the correct choice for branch survivability.

VRRPv3 is an open standard defined by the IETF and supports both IPv4 and IPv6. It allows multiple routers to share a virtual IP and can be configured for load sharing across groups. Since the scenario requires IPv6 gateway redundancy with an open standard, VRRPv3 satisfies all stated conditions.

Creating a separate guest WLAN mapped to a dedicated interface (e.g., a DMZ VLAN) and applying an ACL that permits only Internet-bound traffic is the standard method for guest isolation. This ensures guest devices cannot reach corporate subnets. The WLC supports this through interface mapping and ACLs applied to the WLAN.

Cisco SD-Access is a campus fabric architecture that uses LISP for control plane, VXLAN for data plane, and Cisco TrustSec for group-based policy. It provides centralized management via Cisco DNA Center, automated fabric provisioning, and consistent policy for wired and wireless users, including guest onboarding, which matches the requirements exactly.

A guest anchor controller is a dedicated WLC that handles guest traffic separately from the corporate network. Guest clients are tunneled from the foreign controller to the anchor controller, which typically resides in a DMZ. This provides isolation and ensures that guest traffic only has internet access, not corporate network access. This is the standard design for guest wireless.

The management interface on a Cisco 9800 Series Wireless Controller is used for out-of-band management, including device access via SSH, HTTPS, and SNMP. It must be configured with an IP address, subnet mask, and default gateway. This interface is separate from data interfaces and is essential for administrative access to the controller.

The Cisco Embedded Wireless Controller is a feature on Catalyst 9000 switches that provides integrated wireless controller functionality. It allows the switch to manage access points directly without needing an external WLC. This meets the requirement for centralized control and AP management. Enabling this feature allows the switch to act as a wireless controller, simplifying the deployment and reducing hardware footprint.

In Cisco SD-Access, the recommended underlay for a Fabric-enabled campus is IS-IS, which is automatically configured by the fabric provisioning workflow through Cisco DNA Center. IS-IS supports fast convergence and ECMP, and the automated deployment minimizes manual configuration on intermediate underlay switches, matching the stated requirement for minimal configuration.

GLBP is a Cisco-proprietary First Hop Redundancy Protocol that provides both redundancy and load sharing. It uses an Active Virtual Gateway (AVG) and up to four Active Virtual Forwarders (AVFs). The AVG assigns virtual MAC addresses to each AVF, and hosts are distributed across the AVFs for load balancing. Failover is sub-second, and if an AVF fails, another AVF takes over its virtual MAC address.

SD-Access uses a fabric with VXLAN encapsulation and Cisco Identity Services Engine (ISE) for policy, enabling consistent security and automation across wired and wireless. It provides a single policy plane and reduces manual configuration through fabric provisioning, matching the requirement for unified policy and minimal manual effort.

In an MPLS Layer 3 VPN, the CE router exchanges routes with the provider PE router using eBGP. Redistributing the branch LAN prefix into BGP advertises it to the PE, which places it into the correct VRF and propagates it across the provider backbone to other sites in the same VPN. This keeps the branch routing table simple because the CE only needs a default or summarized route toward the PE.

OFDMA (Orthogonal Frequency-Division Multiple Access) is a key feature of Wi-Fi 6 that allows multiple clients to be served simultaneously within the same channel by allocating subsets of subcarriers. This improves airtime efficiency and reduces overhead in high-density environments by enabling parallel transmissions to multiple clients. In an auditorium with many concurrent clients, OFDMA significantly enhances capacity and performance.

StackWise Virtual combines two physical switches into a single logical switch with one control plane and one management IP. Both switches actively forward traffic, and the control plane is distributed, allowing both to process control protocols. This provides active-active forwarding and simplified management, meeting the design goals.

StackWise Virtual merges two Catalyst 9000 chassis into one logical switch with a unified control plane, one management address, and one configuration. Multichassis EtherChannel, an MEC, lets a downstream access switch bundle uplinks to both chassis into one port-channel, so all links forward and spanning tree sees a single logical neighbor. This satisfies both the bandwidth and the single-logical-device requirements in the distribution pair.

LLQ combines strict priority queuing with CBWFQ. It designates one or more classes as priority queues, which are serviced before any other queues. This ensures that voice traffic receives strict priority treatment and minimal delay and jitter, even during congestion. LLQ also includes a policer to limit the priority queue bandwidth, preventing starvation of other traffic. It directly satisfies the requirement for strict priority for voice.

Cisco SD-Access uses VXLAN as the data plane encapsulation, and it adds a Group Policy Option header to carry security group tag information. This allows the fabric to enforce group-based policies without requiring traditional ACLs on every device, which is a core part of the SD-Access architecture.

Cisco SD-WAN centralized data policy lets the engineer define traffic steering rules based on application, source, destination, and other match criteria, and then apply actions such as directing traffic over a specific VPN or out the local internet connection. Application-aware routing continuously measures path characteristics to select the best path. Together they satisfy the requirement to send SaaS traffic directly to the internet while forcing critical traffic through IPsec tunnels to the data centers.

VRF provides separate routing and forwarding tables on a single device, and combining it with 802.1Q subinterfaces allows traffic from multiple tenants to be tagged and mapped to distinct VRFs on the same physical link. This satisfies the isolation and shared-link requirements exactly as described.

With a hub-and-spoke topology, each branch (spoke) establishes tunnels only to the data center (hub), and inter-branch traffic is hairpinned through the hub. This matches the requirement that all branches use a single IPsec tunnel to the VPN concentrator and that branch-to-branch traffic transits the data center.

VRF (Virtual Routing and Forwarding) instances create separate routing and forwarding tables on PE routers. Each customer is assigned its own VRF, so routes from one customer are not leaked into another's table. This logical separation is fundamental to MPLS Layer 3 VPNs and ensures traffic isolation. The VRF also allows overlapping IP address spaces between customers, which is a key benefit of MPLS VPNs.

PAT, also known as NAT overload, allows multiple internal hosts to share a single public IP address by translating both IP addresses and port numbers. Each internal host's connections are tracked using unique source port numbers, enabling thousands of simultaneous connections through one public IP. This is the correct choice for the scenario.

LLQ provides a strict priority queue for voice traffic while also supporting other queues with guaranteed bandwidth. This ensures voice gets minimal latency and jitter, and the policer on the priority queue prevents starvation of other traffic. It is the recommended mechanism for meeting strict voice requirements in a campus QoS design.

The 'ip default-gateway' command is used on a Layer 2 switch to specify a default gateway for management traffic when the switch is not running a routing protocol. This allows the management VLAN interface to communicate with remote subnets, enabling remote management from a different subnet.

The vEdge router (or cEdge in Cisco SD-WAN) is the data plane device that actually enforces application-aware routing policies. It inspects traffic, classifies applications, and applies the forwarding decisions defined in the policy. Since the question asks where the policy is enforced, the vEdge router is the correct component because it sits in the forwarding path and executes the policy.

Low Latency Queuing (LLQ) provides strict priority queuing for delay-sensitive traffic like VoIP. It includes a policer that limits the priority queue to a configured bandwidth, preventing it from starving other queues. This matches the requirement for strict priority treatment with policing of excess VoIP traffic, making it the correct choice.

In Cisco SD-Access, the control plane is based on LISP (Locator/ID Separation Protocol). The map server and map resolver (often co-located on control plane nodes) maintain the mapping of endpoint identifiers (EIDs) to routing locators (RLOCs). This enables scalable endpoint registration and location without flooding, which is essential for large fabrics supporting thousands of endpoints.

The fabric edge node is responsible for encapsulating traffic from wired endpoints using VXLAN and forwarding it to the fabric. It acts as the first-hop router for endpoints and registers them with the control plane node. This component is essential for wired client integration in SD-Access, as it provides the anycast gateway and encapsulation functions.

StackWise Virtual supports Multichassis EtherChannel, allowing a downstream access switch to form a port-channel with one link to each stack member. Because the two switches operate as one logical device, the port-channel is seen as a single EtherChannel, providing loop-free redundancy and active-active forwarding without relying on spanning tree to block a link.

VSS or StackWise combines two physical core switches into one logical device, providing stateful failover and sub-second convergence between the chassis. This approach enables active-active traffic forwarding and allows downstream switches to use Cross-Stack EtherChannel (MEC), so both links carry traffic rather than one being blocked by spanning tree. Because the pair appears as a single switch, routing protocols and STP see one node, which simplifies configuration and improves redundancy compared to a standalone pair running HSRP.

The priority command in an MQC policy map enables strict priority queuing, which means that traffic in this class is serviced before any other queues as long as the queue is not empty. It also allows configuration of a policer to limit the priority traffic. This is the correct mechanism to ensure voice traffic receives strict priority scheduling, as required.

LLQ provides a strict priority queue for voice, ensuring low latency and jitter. CBWFQ provides guaranteed bandwidth for other classes, such as business-critical applications, preventing starvation. Together, they meet the requirements by prioritizing voice while allocating minimum bandwidth to other traffic classes.

Cisco vEdge routers (or cEdge routers) are the data plane components at branch and data center sites. They establish secure control connections to vSmart and vBond, and they forward data plane traffic based on policies and routes received. They can continue forwarding traffic using cached control information if the control plane is temporarily unavailable, satisfying the scenario.

Entering interface configuration mode and issuing switchport mode access sets the port to access mode, and switchport access vlan 20 assigns it to VLAN 20. This is the standard Cisco IOS method to configure a static access port. The VLAN must exist in the VLAN database, but the command sequence itself is correct for placing the port into VLAN 20.

The Catalyst 9200 supports SD-Access fabric edge and can be onboarded via Cisco DNA Center Plug and Play without a local controller. It is designed for branch deployments requiring fabric capabilities, making it the correct choice for this scenario.

The fabric control plane node runs LISP and maintains the endpoint-to-edge-node mapping database, known as the map-server and map-resolver. When a fabric edge node needs to locate an endpoint, it queries the control plane node, which returns the RLOC of the edge node where the endpoint is attached. This ensures consistent mapping across all fabric edge nodes.

In Cisco SD-WAN, when using enterprise PKI, an external CA server (such as Microsoft Certificate Services or a third-party CA) signs the device certificates. The WAN edge devices generate a CSR, which is sent to the CA; the CA returns a signed certificate that the device uses to authenticate to the controllers. This satisfies the requirement for certificates signed by an enterprise PKI.

LLQ provides strict priority queuing for delay-sensitive traffic such as voice. It combines priority queuing with CBWFQ. The priority queue is serviced first, and voice traffic is placed in this queue, ensuring it is transmitted before other traffic even during congestion. LLQ also includes a policer to limit the priority queue bandwidth, preventing starvation of other queues.

Border nodes in Cisco SD-Access provide connectivity between the fabric and external networks, such as the data center, internet, or legacy networks. They perform the role of LISP proxy tunnel routers (PxTRs) and can also run BGP or other routing protocols to exchange routes with external devices. In this scenario, the border node is the correct component because it is specifically designed to handle external traffic entering and leaving the fabric.

This configuration uses PAT overload by referencing the outside interface in the ip nat inside source command, which translates all inside hosts to the outside interface IP. The access list defines the inside subnet, and the interfaces are marked correctly as inside and outside. This is the standard method for PAT to a single outside address, matching the requirement.

Cisco SD-Access uses a fabric with a centralized control plane (LISP) and distributed data plane (VXLAN), enabling seamless mobility and preventing traffic tromboning by allowing edge nodes to forward traffic directly. This matches the requirement for centralized control and distributed data plane.

The control plane node in SD-Access runs LISP map-server and map-resolver functions. It maintains the mapping database of endpoint EIDs to RLOCs (fabric edge node locators). When an edge node needs to reach an endpoint, it queries the control plane node, which resolves the EID to the correct RLOC. This enables communication across fabric edge nodes.

The vSmart controller is the centralized control plane component in Cisco SD-WAN. It distributes routing and policy information to WAN edge devices using the Overlay Management Protocol (OMP). This enables secure tunnel establishment and consistent policy enforcement across the fabric, making it the correct answer for orchestrating the control plane.

During the EXSTART/EXCHANGE phase, OSPF routers exchange database description (DBD) packets that can be as large as the interface MTU; if one router's MTU is lower, the larger DBD packet will be dropped or fragmented, and the neighbor will never leave EXSTART because it keeps waiting for a valid DBD sequence. The interface MTU mismatch is a classic cause of OSPF adjacencies stuck in EXSTART, as the router with the smaller MTU silently discards the oversized multicast packets. This can be diagnosed by checking the 'show ip ospf neighbor' state and by ensuring both ends have the same MTU or by enabling 'ip ospf mtu-ignore' as a workaround.

The control plane node in Cisco SD-Access maintains the mapping database of endpoint IP addresses to fabric locators (such as VTEP addresses) and provides the control plane that fabric edge nodes use to resolve endpoint locations. It uses LISP to register and query endpoint information, enabling separation of policy from topology. This directly matches the requirement described.

The fusion router is used in SD-Access to provide inter-VN routing and to connect to shared services that reside outside the fabric or in a different VN. It allows multiple virtual networks to reach a common service without duplicating it. It is typically connected to the border node and runs VRF-aware routing to leak routes between VNs.

The border node in Cisco SD-Access provides connectivity between the fabric and external networks. It handles traffic entering and leaving the fabric, performing functions such as VXLAN-to-VLAN translation and routing to external networks. This allows external users to reach fabric endpoints.

LLQ combines a strict priority queue with CBWFQ for other traffic. Voice traffic can be placed in the priority queue to ensure minimal delay and jitter, while call signaling and other traffic are handled by CBWFQ with guaranteed bandwidth. This prevents the priority queue from starving other queues because LLQ includes a policer to limit the priority queue bandwidth.

The Catalyst 9800-80 is a high-end appliance in the Catalyst 9800 series, supporting up to 6,000 access points and 64,000 clients. It provides centralized management, policy enforcement, and runs IOS-XE, making it ideal for large campus deployments. It meets the exact scalability requirement of the scenario.

A guest anchor controller allows guest traffic to be tunneled from the foreign controller to a designated anchor controller in the DMZ. This isolates guest traffic from internal networks and fulfills the requirement to tunnel guest traffic directly to the DMZ.

StackWise Virtual combines two Catalyst 9000 switches into one logical entity with a single management IP and one configuration file. Both switches actively forward traffic in an active-active fashion using a virtual switch link, which exactly matches the requirement for one logical control plane and dual active forwarding in a collapsed core design.

Fabric edge nodes encapsulate traffic in VXLAN and enforce group-based policy using Cisco TrustSec security group tags and scalable group ACLs derived from ISE policy. When a guest wireless user tries to reach an EHR server, the ingress edge node drops the packet based on the source and destination security group tags. This directly delivers the required isolation between guest and clinical traffic in the SD-Access fabric.

StackWise Virtual requires a dedicated StackWise Virtual Link (SVL) between the two switches using supported high-bandwidth ports, and both switches must run identical software versions to form a single logical entity. This ensures control plane synchronization and consistent forwarding behavior, which is essential for the domain to operate correctly.

The fabric control-plane node runs LISP map-server and map-resolver functions. Fabric edge nodes register endpoint EIDs with it, and it answers EID-to-RLOC map requests so that edge nodes can build VXLAN tunnels to the correct destination. In this design it is the component that owns identity-to-location mapping, satisfying the requirement stated in the scenario.

Correct. Spine-leaf provides predictable latency for east-west traffic because every leaf-to-leaf path crosses exactly one spine switch, giving a consistent hop count of two (leaf-to-spine-to-leaf) regardless of which leaf pair communicates. This uniform topology yields low, bounded, and predictable latency, unlike hierarchical designs where traffic may traverse multiple aggregation and core layers with variable distances. It is a key reason spine-leaf suits latency-sensitive data center applications.

vlan 100 is the global configuration command that creates a new VLAN with ID 100 and immediately enters VLAN configuration mode. This is the required first step when establishing a new VLAN, as it adds the VLAN to the switch's local VLAN database. From this mode, you can set optional parameters such as the VLAN name, MTU, or other interface-specific settings. Issuing this command makes the VLAN available for subsequent operations like assigning access ports or creating an SVI.

StackWise Virtual pairs two physical switches into a single logical device over a StackWise Virtual Link. Unlike classic StackWise with a master and members, both chassis run independent control planes that stay synchronized, and Multichassis EtherChannel to downstream devices is supported.