CCNA Infrastructure Questions

The ip helper-address command is configured on the client-facing interface and instructs the router to forward UDP broadcasts, including DHCP DISCOVER and REQUEST, to the specified server as unicast packets. It also inserts the giaddr field with the interface IP so the server can select the correct pool. This directly satisfies the scenario.

In a Cisco switch stack, the active and standby switches are elected based on the stack priority value. If priorities are equal, the switch with the lowest MAC address wins. This priority can be configured with the 'switch X priority Y' command, allowing deterministic control over which member becomes active and which becomes standby.

The show vlan brief command displays a concise summary of all VLANs, including VLAN ID, name, status, and the ports assigned to each VLAN. This provides exactly the information needed to verify the current VLAN configuration on the switch.

EIGRP authenticates each hello packet and every routing update using a configured key, typically MD5 or SHA-2. If one router has authentication enabled (e.g., 'ip authentication mode eigrp' and 'ip authentication key-chain eigrp') while the peer does not, the receiving router fails the authentication check and silently discards the hello, so no adjacency can ever form. Even a key mismatch or different key-chain name on both sides produces the same failure, making this a classic common cause of missing EIGRP neighbor relationships.

This sequence correctly defines an IKEv2 proposal with AES-256 encryption, SHA-256 integrity, and DH group 14. It then creates a keyring with a peer address and matching local and remote pre-shared keys. This is the proper syntax for IKEv2 configuration on Cisco IOS, ensuring the proposal and keyring are correctly associated for the VPN.

This command enables OSPF process 1 on the interface and assigns it to area 0. It is the interface-level method for enabling OSPF, which is precise and avoids the need for network statements. This is the recommended practice in modern Cisco IOS because it directly associates the interface with the OSPF process and area, reducing configuration errors.

This command enables OSPFv3 on the interface and associates it with OSPF process 1 and area 0. It is the correct way to enable OSPFv3 for IPv6 on an interface in Cisco IOS. The process ID must match the one configured in the global 'ipv6 router ospf' command. This command is essential for OSPFv3 operation on a per-interface basis.

This configuration defines an access list (101) that matches traffic from 10.1.1.0/24 to 10.2.2.0/24, and references it in the crypto map with the 'match address' command. This access list identifies the interesting traffic that will be encrypted by IPsec. The crypto map also sets the peer and transform set, completing the IPsec configuration.

Type 2 EVPN routes are used to advertise MAC address and optionally IP address reachability. In a VXLAN EVPN fabric, leaf switches advertise their locally learned MAC addresses using Type 2 routes. This allows other leaf switches to learn remote MAC addresses and forward traffic accordingly. Type 2 routes are essential for Layer 2 connectivity and are the correct choice for advertising MAC address reachability.

The command 'interface vlan 1' enters the configuration mode for the switched virtual interface (SVI) associated with VLAN 1. This allows the administrator to assign an IP address to the management VLAN. This is the correct method to configure Layer 3 connectivity on a switch for management purposes. It is a fundamental step in setting up in-band management on Cisco switches.

The network command under router ospf with a wildcard mask matching the LAN subnet will advertise the LAN prefix into OSPF regardless of the WAN IP address. This is the standard method to enable OSPF on an interface and advertise its connected network. It does not depend on the WAN IP, so it remains stable when the DHCP lease changes.

In local mode, access points establish a Control and Provisioning of Wireless Access Points (CAPWAP) tunnel to the WLC for both management and client data traffic. This allows the WLC to be the single point of management and ensures client traffic is tunneled back to the WLC. Local mode is the default and most common deployment mode for centralized wireless networks.

When an interface is assigned to a VRF using the ip vrf forwarding command, any existing IP address is removed because the interface's IP address is now part of the VRF's routing table. The engineer must re-enter the IP address configuration after the VRF assignment. This is a common operational step when configuring VRF-lite.

IPsec in tunnel mode encrypts the entire original IP packet, including the GRE header and payload, and encapsulates it within a new IPsec packet. This provides confidentiality and integrity for the GRE tunnel, making it suitable for transporting IPv6 over an IPv4 underlay securely. It is the standard method for protecting GRE tunnels.

An SVI is created with the interface vlan 10 command. To make it operational, you must assign an IP address and enable it with no shutdown. The SVI will remain down until at least one access port in VLAN 10 is up and the VLAN exists in the VLAN database. Once these conditions are met, the SVI can route traffic for the subnet.

LLQ is an extension of CBWFQ that adds a strict priority queue for delay-sensitive traffic such as voice. Configuring a priority statement for the voice class ensures that packets marked DSCP EF are dequeued first, up to the specified bandwidth (30%). This provides strict priority scheduling and guarantees bandwidth, meeting both requirements for voice traffic.

MQC is the framework for configuring QoS on Cisco IOS. It uses class-maps to classify traffic (e.g., matching DSCP) and policy-maps to define actions such as marking with a new DSCP value. The service-policy command applies the policy to an interface. This is the standard and correct method to classify and mark traffic based on DSCP.

Configuring 802.1X with a guest VLAN allows authenticated devices to be placed into a VLAN after successful RADIUS authentication, while unauthenticated devices are assigned to a separate guest VLAN. This meets the branch requirement exactly. The guest VLAN feature is specifically designed for this scenario and is supported on Cisco Catalyst switches.

A Layer 2 loop occurs when redundant paths exist without Spanning Tree Protocol actively blocking one of them. The new switch, if connected with multiple links to the distribution switches and STP disabled or misconfigured, will forward broadcast frames out all ports, causing a broadcast storm. This leads to severe symptoms such as high CPU utilization on all switches, MAC address table flapping, and complete network unavailability.

VXLAN encapsulates the original Layer 2 frame inside a MAC-in-UDP header. The 8-byte VXLAN header, UDP header, and outer IP header allow the frame to be routed across a Layer 3 underlay. This directly satisfies the scenario requirement to carry Layer 2 frames over an IP network.

The switchport voice vlan command enables the voice VLAN feature on an access port. Data frames from the PC remain untagged in the access VLAN (100), while voice frames from the phone are tagged with VLAN 200. The phone can also receive the voice VLAN assignment through LLDP-MED or CDP, making this the correct and simplest solution for a phone-plus-PC topology.

VXLAN adds 50 bytes of overhead (outer IP, UDP, VXLAN header). The underlay must support an MTU of at least 1550 bytes (typically 1600 or higher) to avoid fragmentation of VXLAN-encapsulated packets. If the underlay MTU is too small, large packets may be dropped or fragmented, causing performance issues. Therefore, configuring jumbo frames on the underlay is a best practice for SD-Access.

In a StackWise stack, the standby switch automatically takes over as master if the active master fails. The failover is designed to be hitless or near-hitless, with other stack members continuing to forward traffic without reloading. This provides high availability and minimal disruption, which is a key benefit of StackWise technology.

LLQ includes a strict priority queue that is always serviced first when packets are present, which minimizes delay and jitter for voice. This is a key characteristic of LLQ, making it suitable for real-time traffic. The priority queue is typically configured with a bandwidth guarantee and a policer to limit its maximum rate, preventing starvation of other queues.

In Cisco ACI, a contract defines the rules that permit or deny traffic between EPGs. It consists of subjects and filters that specify the protocols and ports allowed. Contracts are applied to EPGs as providers or consumers. When an EPG provides a contract and another consumes it, traffic is allowed according to the contract's filters. This is the fundamental mechanism for enforcing policy in ACI, making it the correct answer.

This command configures the default login authentication method list to try TACACS+ first, then fall back to the local username database if the TACACS+ servers do not respond. The 'local' keyword ensures that local authentication is used as a backup, providing administrative access even when the AAA server is unreachable.

This configuration creates a DHCP pool named POOL1, defines the network and subnet mask, and provides the default gateway and DNS server. The ip dhcp pool command enters DHCP pool configuration mode, where network, default-router, and dns-server are valid commands. This fully satisfies the requirement to provide IP addresses, gateway, and DNS information to clients. It is the correct and standard way to configure a Cisco IOS DHCP server.

The anycast gateway feature allows multiple leaf switches to share the same virtual IP and MAC address for a subnet's default gateway. This enables hosts to use a consistent gateway regardless of their location, and ensures optimal forwarding without traffic tromboning. Configuring the same virtual MAC on all leaf switches achieves the requirement.

The access-class command is used under line configuration mode to restrict incoming VTY connections based on an ACL. The in keyword specifies that the ACL filters traffic entering the VTY lines. This is the correct way to apply an ACL to management access, ensuring only hosts from permitted subnets can establish SSH or Telnet sessions.

This is the correct configuration. Setting the port to access mode with access VLAN 10 handles the untagged PC traffic, while the switchport voice vlan 200 command tells the switch to recognize 802.1Q-tagged frames for VLAN 200 as voice traffic from the attached IP phone. This is the standard Cisco IP telephony deployment model for a single physical port supporting both a phone and a PC.

GRE is designed to encapsulate a wide variety of protocols, including multicast and broadcast. When you configure a GRE tunnel, it acts like a virtual point-to-point link that can carry multicast traffic, which is essential for routing protocols like OSPF and EIGRP that use multicast hellos. This is a key advantage over IPsec tunnels, which typically only support unicast unless specifically configured with GRE.

Rapid PVST+ is Cisco's implementation of RSTP that runs a separate instance per VLAN. It incorporates RSTP mechanisms such as edge ports, link-type point-to-point, and proposal/agreement to achieve rapid convergence. This allows per-VLAN topology optimization and fast failover, making it suitable for modern switched networks with multiple VLANs.

The 'ip dhcp excluded-address' command prevents the router from assigning specific addresses, such as its own interface address, to DHCP clients. It is configured in global configuration mode and can specify a single address or a range. This ensures the router's IP is not leased to other devices.

LACP is an IEEE 802.3ad standard protocol that dynamically negotiates EtherChannel formation between devices from different vendors. It provides increased bandwidth and redundancy by bundling multiple physical links into a single logical link. This meets the requirement for dynamic negotiation and interoperability.

For dynamic VLAN assignment, the RADIUS server must return the standard IETF attributes: Tunnel-Type set to VLAN, Tunnel-Medium-Type set to IEEE-802, and Tunnel-Private-Group-ID containing the VLAN ID or name. The switch interface must be configured for 802.1X and typically in access mode so that the port can be moved to the assigned VLAN upon authentication. This is the correct combination to meet the requirement.

vSmart is the controller that implements control plane policies and distributes routing information via the Overlay Management Protocol (OMP). It maintains the centralized control plane and pushes policies to vEdge devices. This is essential for SD-WAN fabric operation.

The Ingress Policy Enforcement Point (Ingress PEP) is the device where traffic enters the TrustSec domain. It is responsible for classifying the traffic and tagging the packet with the appropriate Security Group Tag (SGT). This tagging allows subsequent devices to enforce policies based on the SGT without reclassifying the traffic. The Ingress PEP is typically a switch or router that supports TrustSec.

WPA2-PSK with AES-CCMP is the appropriate choice because it offers robust wireless encryption (AES in counter mode with CBC-MAC) and uses a pre-shared key for straightforward authentication. This configuration is widely supported, passes PCI DSS requirements for strong encryption, and fulfills the stated requirement of using AES-based security. It balances compatibility with strong protection.

This command specifies that if the RADIUS server becomes unreachable, the port will be authorized into VLAN 10, providing restricted access. It is used within 802.1X configuration to define fallback behavior when the authentication server is dead, ensuring that endpoints can still gain limited network access according to policy.

This command configures inter-area route summarization for OSPFv3 on the ABR. The 'area 1 range' command tells the ABR to advertise a single summary route for the specified prefix into other areas. It must be configured under IPv6 router OSPF configuration mode. This is the correct way to summarize OSPFv3 routes between areas.

In Cisco TrustSec, ISE authenticates the user via 802.1X and returns an authorization result that includes the SGT. The access switch enforces that result by tagging the user's traffic with the assigned SGT. This classification at the access layer is what allows downstream devices to enforce group-based policies. ISE provides the identity-to-SGT mapping, and the switch applies it.

For OSPF MD5 authentication to succeed, both routers must have the same key ID, the same key string, and the same authentication type configured for the area or interface. The area authentication command enables MD5 for the area, and the interface command provides the key. If any of these parameters differ, the neighbor relationship will not form.

VXLAN provides Layer 2 extension over a Layer 3 underlay by encapsulating Ethernet frames in UDP/IP. BGP EVPN is used as the control plane to advertise MAC and IP reachability, enabling efficient forwarding and multi-tenancy. This matches the requirement for a protocol that encapsulates Layer 2 frames in IP and uses EVPN for MAC/IP advertisement.

To forward multicast traffic over a GRE tunnel, multicast routing must be enabled on both the tunnel interface and the physical interface that carries the tunnel. The tunnel interface must be included in the multicast routing configuration (e.g., 'ip pim sparse-mode'). Otherwise, multicast packets will not be forwarded into or out of the tunnel.

CoPP allows the engineer to police traffic destined to the control plane, including ARP packets. By creating a class-map that matches ARP and a policy-map that sets a rate limit of 500 pps with a drop action, the switch CPU is protected from excessive ARP. This is the correct feature for rate-limiting control-plane traffic.

Multi-Domain Authentication (MDA) allows both a data device (PC) and a voice device (IP phone) to authenticate on the same switch port. The phone authenticates in the voice domain, and the PC authenticates in the data domain. This is the correct feature for this scenario because it separates the authentication domains and supports the typical IP phone with a PC attached.

For WPA2-Enterprise with 802.1X, the WLAN's Layer 2 Security must be set to WPA2 with 802.1X. Layer 3 Security should be set to None because 802.1X handles authentication at Layer 2. This configuration enables the WLC to use the RADIUS server for authentication.

This configuration includes 'aaa authorization network default group radius', which is necessary for the switch to authorize the user and apply VLAN assignment from the RADIUS server. The authentication command verifies credentials, while authorization processes the returned attributes such as tunnel-type, tunnel-medium, and tunnel-private-group-id to assign the VLAN. The RADIUS server and dot1x system-auth-control are also correctly configured.

SXP is a control-plane protocol that propagates IP-to-SGT mappings to devices that cannot perform inline tagging, such as older switches or firewalls. It allows SGTs to be shared across network boundaries, enabling enforcement on devices that lack hardware support for inline tagging. This is a standard method for SGT propagation in TrustSec.

This command instructs the switch to place the port into the specified guest VLAN when the RADIUS server fails to respond to authentication requests, satisfying the requirement to avoid shutting the port down. It is part of Cisco IOS 802.1X authentication event configuration and directly addresses the server-dead condition by authorizing a fallback VLAN rather than a critical VLAN.

An MTU mismatch is the classic cause of an OSPF neighbor being stuck in EXSTART; during the Database Description exchange, each router advertises its outgoing interface MTU in the DBD packet header. If one router's interface has a lower MTU, it discards DBD packets that declare a larger MTU, so the neighboring router never receives a valid acknowledgment and remains in EXSTART. Because OSPF does not initialize the DBD exchange until both MTUs are verified equal, the adjacency stalls at the point where the Master/Slave election occurs, exactly matching the reported symptom.

EVPN is a BGP address family (L2VPN EVPN) that carries MAC and IP reachability information. VTEPs peer with each other or with route reflectors using MP-BGP and advertise EVPN routes. This replaces flood-and-learn for MAC learning and provides control-plane learning, making the statement correct for an EVPN deployment.

This command enables the voice VLAN on the interface, allowing the switch to send Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) information to the IP phone. The phone can then tag voice traffic with the appropriate VLAN and CoS. It also allows data traffic from the PC to be untagged. This is the correct configuration for a voice VLAN.

For WPA2-Enterprise, the WLAN must be configured to use 802.1X authentication and point to the correct RADIUS server. If 802.1X is not enabled or the RADIUS server is not specified on the WLAN, clients cannot authenticate. This is a common oversight when configuring enterprise SSIDs on a WLC.

This command displays the IP routing table for the VRF named DEPARTMENT1. It is the correct way to verify routes within a specific VRF. Without specifying the VRF, the global routing table is shown, which does not include VRF routes. This command is essential for troubleshooting VRF-Lite configurations.

HSRP uses a virtual MAC address in the format 0000.0c07.acXX, where XX is the group number in hexadecimal. The address 0000.0c07.ac0a corresponds to group 10 (0a in hex equals 10 in decimal). HSRP provides redundancy with an active and standby router.

Inaccessible Authentication Bypass (IAB) is a Cisco feature that allows a port to be authorized and placed into a configurable critical VLAN when the RADIUS server is unreachable. This ensures that critical devices can still access the network without authentication during a server outage, meeting the requirement exactly.

vBond acts as the orchestrator in Cisco SD-WAN. It is the first point of contact for vEdge routers. It authenticates the routers and provides them with the IP addresses of the vSmart controllers and vManage. vBond also facilitates the establishment of control plane connections (DTLS) between vEdge routers and vSmart controllers. It does not participate in the data plane or routing decisions. Its primary role is onboarding and orchestration.

This configuration enables 802.1X with RADIUS authentication, sets the port to auto mode, allows multiple authenticated hosts, and uses the authentication event server dead action authorize vlan 10 command. When the RADIUS server is unreachable, the port is placed in the specified access VLAN (10) rather than shutting down or remaining unauthorized, exactly matching the fallback requirement.

Setting the OSPF interface priority to 0 prevents the router from being elected as a designated router (DR) or backup designated router (BDR) on broadcast networks. This meets the requirement that the router does not become a DR. The priority is configured per interface with the 'ip ospf priority 0' command under the interface configuration.

To assign an IP address to the management VLAN, you enter interface configuration mode for VLAN 1 using 'interface vlan 1', then assign the IP address with 'ip address', and ensure the interface is up with 'no shutdown'. This is the standard method for configuring a management IP on a Cisco switch. VLAN 1 is the default management VLAN.

With vlan dot1q tag native enabled, the switch tags all frames on the native VLAN. Any untagged frames arriving on the trunk are considered invalid and dropped. This is the expected behavior when this global command is used, and it explains why untagged frames are being dropped.

The command 'dot1x system-auth-control' enables 802.1X authentication globally on a Cisco switch. It is a prerequisite for configuring 802.1X on individual interfaces. Without this command, 802.1X authentication will not function, even if interface-level commands are configured. This command allows the switch to act as an authenticator and communicate with the RADIUS server to authenticate supplicants.

This correctly configures the port as an 802.1Q trunk, sets VLAN 10 as the native VLAN (untagged), and allows both VLAN 10 and VLAN 20 on the trunk. The AP can send management traffic untagged on VLAN 10 and tag client traffic for VLAN 20, exactly matching the requirements for the wireless deployment.

In Cisco SD-WAN, the vEdge router must authenticate with the vBond orchestrator to obtain the list of vSmart controllers and establish control connections. This requires a valid certificate installed during onboarding. Without proper authentication, the vEdge cannot join the overlay network, even if IP reachability exists.

The global configuration command 'vlan 100' creates VLAN 100 and enters VLAN configuration mode, allowing optional parameters such as a name or MTU to be applied. This is the standard and correct method to create a VLAN on modern Cisco IOS switches, as it directly adds the VLAN to the switch's VLAN database and running configuration. Without this command, other VLAN-related commands have no VLAN to act upon.

The interface-level command ip ospf authentication message-digest enables MD5 authentication for OSPF on that interface. The ip ospf message-digest-key command defines the key ID and MD5 key. Together, they satisfy the requirement to authenticate neighbors using MD5 without sending the key in clear text.

This configuration sets the port as a trunk, matches the native VLAN to 999, and restricts allowed VLANs to 50. It aligns with the distribution switch configuration, ensuring native VLAN consistency and limiting traffic to the management VLAN. This meets both requirements exactly.

Multi-host mode allows multiple hosts to connect to a single port, but only the first host is authenticated. Once that host is authenticated, all other hosts are granted access without individual authentication. This matches the scenario where multiple hosts are allowed but only one host should be authenticated, making it the correct command.

This command configures NAT overload, also known as Port Address Translation (PAT), using the outside interface's IP address for translation. The 'list 1' refers to an access list that defines the inside local addresses. The 'overload' keyword enables many-to-one translation by multiplexing inside addresses using port numbers. This is the correct way to configure NAT overload when using the interface address rather than a pool.

This sequence enters interface configuration mode, sets the port to trunk mode, and assigns VLAN 999 as the native VLAN. This is the correct Cisco IOS syntax to change the native VLAN on a trunk port, mitigating VLAN hopping by using an unused VLAN.

The distributed anycast gateway uses the same virtual MAC on the anycast SVI of all edge nodes, so hosts see one consistent gateway identity regardless of attachment point. Each edge node can forward locally for hosts in its own subnet while the shared MAC preserves a stable default gateway, enabling seamless mobility and optimal forwarding without tromboning traffic to a central gateway.

The access-class command is used on VTY lines to filter incoming Telnet or SSH connections based on a standard or extended ACL. Applying 'access-class 10 in' with an ACL that permits 10.10.10.0/24 and denies all others restricts management access to the IT subnet. This is the correct configuration to meet the requirement.

Setting the OSPF interface priority to 0 makes the router ineligible to become DR or BDR on that broadcast segment. The priority value is carried in Hello packets and used in the DR election; a priority of 0 explicitly excludes the interface from the election, ensuring the switch remains a DROTHER and only forms adjacencies with the DR and BDR.

The Fabric Wireless Controller (WLC) is essential for integrating wireless access points into the SD-Access fabric. It manages the wireless infrastructure and communicates with the fabric control plane to register wireless clients and their locations. The Fabric WLC uses VXLAN to tunnel client traffic to the fabric edge nodes. Without it, wireless clients cannot be part of the fabric's unified policy and segmentation. Thus, it is a required component for wireless integration.