CCNA Network Assurance Questions

LISP (Locator/ID Separation Protocol) is used in Cisco SD-Access for endpoint location mapping. Fabric edge nodes register endpoint EIDs with the control plane node, which maintains a mapping of EIDs to RLOCs. This allows the fabric to route traffic based on endpoint identity. LISP is the correct protocol for this function.

The vEdge router is responsible for data plane forwarding and application identification. It uses deep packet inspection (DPI) or Cisco NBAR to classify traffic into applications, which is essential for application-aware routing policies. This classification allows the router to make informed path selection decisions based on application performance requirements.

Cisco DNA Center Assurance allows administrators to define issues and configure notifications based on health score thresholds. By setting up assurance issues, the system can trigger alerts via email, syslog, or webhook when a switch's health score falls below a specified value. This is the correct feature for proactive alerting.

LLQ combines a strict-priority queue with a guaranteed bandwidth allocation, so voice packets are serviced first and never dropped during congestion while their reserved bandwidth is protected. CBWFQ alone offers no strict priority, so latency-sensitive voice could still be delayed.

IGMP is the end-system to router protocol that lets hosts on a directly connected subnet announce their interest in a specific multicast group, which is exactly what an IPTV receiver must do to request a channel. Routers send general queries and process membership reports to maintain an active group list on each interface. IGMPv3 further supports source-specific joins (S,G), enabling explicit control over which IPTV streams are received. Without IGMP, the first-hop router would have no way to know that a host wants multicast traffic.

ARP rate limiting or policing limits the number of ARP packets processed by the switch's CPU, preventing excessive ARP traffic from overwhelming the control plane. This directly reduces the load on the ARP Input process. It is an effective mitigation for high CPU caused by ARP storms or ARP-based attacks. Configuring this on interfaces facing untrusted hosts can protect the switch.

This is the most likely cause. The switch is learning the same MAC address on two different ports, which indicates the device is either connected to both ports (e.g., via a loop or a misconfigured NIC teaming) or there is a loop in the network. The switch detects the flapping and generates the syslog message to alert the administrator.

The show interfaces GigabitEthernet0/1 command displays detailed information about the specified interface, including the configured and operational duplex mode. This is the correct command to verify duplex settings, as it shows both the hardware and configured duplex, and can indicate mismatches.

When OSPF redistributes a default route, the default metric-type is 2 (E2), which means the route's metric remains fixed at the ASBR-advertised value (20) and does not include the internal cost of reaching that ASBR. This is why a default route injected via redistribute or default-information originate is normally seen as an E2 route unless metric-type 1 is explicitly selected.

Low Latency Queuing (LLQ) is correct because it integrates a strict priority queue (PQ) with CBWFQ. The LLQ scheduler always empties the priority class before servicing any other CBWFQ class, which guarantees that real-time packets like voice are dequeued first and experience minimal, jitter-free delay. To prevent the PQ from starving other classes, LLQ applies a policer to priority-class traffic, dropping or shaping excess packets while still meeting the latency objective for admitted real-time flows.

The 'show control connections' command displays the state of control plane connections between the vEdge router and vSmart controllers, including uptime, local and remote IPs, and status. This directly helps verify if the control plane is stable, which is crucial for diagnosing intermittent packet loss due to control plane issues.

Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.

A static route to 192.168.1.0/24 with administrative distance 1 creates a more trustworthy entry than OSPF's default AD of 110, so the router prefers the static route for that exact prefix. This is the precise, surgical fix: it overrides OSPF only for this subnet while leaving all other OSPF-learned routes untouched, and it does not depend on the metrics of the two equal-cost OSPF paths.

The 'show interfaces status' command provides a summary of all interfaces, including their status (connected/notconnect), VLAN, duplex, speed, and type. This is ideal for quickly verifying physical layer connectivity and interface configuration on Cisco switches, as it displays the operational state and speed of each port.

The Client 360 view in Cisco DNA Center Assurance provides a comprehensive, detailed timeline of a specific client's onboarding and connectivity events. It includes granular data on association, authentication, DHCP, and other phases, allowing the administrator to pinpoint delays. This is exactly the tool needed to analyze the onboarding process step by step.

UDP jitter operations in Cisco IP SLA send packets at a defined interval and measure round-trip latency, one-way delay, jitter, and packet loss, with configurable thresholds that trigger alerts or actions. This directly addresses the need to characterize the provider's handling of the committed rate across the WAN.

The Network Health dashboard in Cisco DNA Center Assurance provides an overview of device and link health, including error counters such as CRC errors and interface flaps. It highlights devices with the most issues, allowing administrators to quickly identify problematic areas. This is the appropriate dashboard for finding devices with high error rates.

This command displays detailed forwarding ASIC resource utilization, including TCAM, packet buffer, and other hardware forwarding resources, on the active switch of a Catalyst 9000 series switch. It is the correct choice for verifying ASIC status and resource usage when troubleshooting hardware forwarding issues, as it provides granular per-ASIC data that can identify resource exhaustion or errors.

The Assurance feature in Cisco DNA Center provides comprehensive monitoring, health dashboards, and issue detection. It uses telemetry and analytics to show network health, client health, and application health, and it highlights problems that need attention. This is the correct feature for the administrator's requirement.

This is a Cisco proprietary STP enhancement that accelerates convergence after a direct link failure on a switch port that was in a blocking state. When a root port fails, UplinkFast immediately transitions a designated alternate port to forwarding state without waiting for the normal MAX Age + Forward Delay timers (typically 30-50 seconds). It works by caching a multicast frame from the root to verify the alternate path, but the primary effect is fast failover to a redundant uplink, often within 1-5 seconds. This directly improves convergence time.

Client 360 provides detailed information about a specific client's connectivity experience, including disconnect reasons, onboarding issues, and RF statistics. By selecting the affected clients, the engineer can see the exact cause of disconnects, such as authentication failures or roaming problems, making it the best tool for root cause analysis.

CRC errors indicate that frames are being corrupted during transmission, which is commonly caused by cable interference, damage, or poor quality cabling. The CRC checksum fails when bits are altered, so the issue is likely at the physical layer. This is the most probable cause.

Application Health provides detailed metrics on application performance, including network latency, jitter, and packet loss for specific applications like voice. It can help determine if the voice quality issue is due to the application itself or the network path. By analyzing application-specific data, the administrator can isolate whether the problem is within the application or the underlying network.

Client 360 in Cisco DNA Center Assurance provides a comprehensive view of a specific client's connectivity, including historical trends, onboarding information, and detailed event timeline. It allows the administrator to drill down into the client's connectivity issues, view past sessions, and identify root causes such as authentication failures or RF problems. This is the correct tool for troubleshooting a single client's intermittent drops.

WAN Edge routers are responsible for establishing BFD sessions with each other. BFD is used to detect link failures and measure quality metrics such as latency, jitter, and packet loss. These sessions are established over the data plane, typically over IPsec tunnels or direct links. The WAN Edge routers send BFD packets periodically and use the results to make routing decisions. Therefore, they are the component that establishes and maintains BFD sessions.

This command configures the SPAN session to use VLAN 10 as the source, capturing all traffic within that VLAN. It is the correct first step to monitor VLAN traffic. The destination is then configured separately with the monitor session destination command.

Configuring a tracking object (track 1 ip sla 1 reachability) and associating it with the static route (ip route 10.1.1.0 255.255.255.0 192.168.1.2 track 1) allows the router to remove the route when the IP SLA operation fails. This provides automatic failover based on reachability.

A broadcast storm floods every port with endlessly circulating frames, forcing the switch CPU to process enormous volumes of broadcast traffic and replicate frames across the broadcast domain. This software-path processing load, rather than normal hardware switching, is what drives control-plane CPU utilisation upward.

The 'logging trap 4' command sets the syslog severity level for messages sent to the syslog server to level 4 (warnings). This means only messages with severity 4 and higher (0-4) will be sent, which matches the requirement. It is the correct command to limit syslog messages to the specified severity.

The show interfaces trunk command displays the trunk interfaces, their mode, encapsulation, and the native VLAN. It explicitly lists the native VLAN in the output, allowing the administrator to quickly verify if it matches on both ends. This is the most direct command to check the native VLAN configuration on a trunk port.

The traceroute command sends packets with incrementally increasing Time-to-Live (TTL) values and records the ICMP Time Exceeded messages returned by each hop. This provides a list of routers along the path and round-trip time for each hop. It is the standard tool for path discovery and latency measurement on Cisco IOS XE.

The 'ip flow ingress' command enables NetFlow accounting for ingress traffic on the interface. It is the correct command to start capturing flow data for incoming packets. This is a fundamental step in configuring NetFlow on a Cisco IOS router, and it must be applied to the interface that will be monitored.

Cisco DNA Center Assurance provides detailed client health metrics beyond the overall health score. By drilling down into a specific client's details, you can view RSSI, SNR, retry rates, and other RF parameters that may indicate poor performance despite an overall 'Good' status. This granular data helps identify the root cause of the issue.

Assurance Health Rules (also known as Health Rules) in Cisco DNA Center allow administrators to define custom thresholds and conditions for various health metrics, including onboarding time. By configuring a health rule, the administrator can specify a threshold and have Cisco DNA Center generate an alert when that threshold is exceeded. This is the correct feature for proactive, threshold-based alerting.

EPC uses an access list to filter captured traffic. The access list 'permit tcp any eq 80 host 10.1.1.1' matches TCP packets with source port 80 and destination IP 10.1.1.1. This access list is then applied to the capture point using the 'access-list' keyword. This is the correct method to filter specific traffic in EPC, as it leverages standard ACL syntax to define match criteria.

IP SLA operations can be tied to Cisco tracking objects using the 'track' command, where the tracked object state changes based on probe reachability or response-time thresholds. When the probe fails consecutive times, the tracking object transitions to 'down', which can trigger a floating static route, policy-based routing, or other route manipulation to redirect traffic. This creates a dynamic failover or convergence mechanism driven by synthetic traffic rather than solely by physical link state.

On Cisco Nexus switches, NetFlow is configured using flow exporters, flow records, and flow monitors. The flow exporter defines the collector's IP address and UDP port. The flow monitor references the exporter and record, and is applied to an interface. This enables the export of flow data to the specified collector.

NetFlow (IP traffic export) samples and exports flow records containing source/destination IP addresses, Layer 4 ports, protocol numbers, and packet/byte counts to a NetFlow collector. By analyzing these exported records, the administrator can pinpoint exactly which flows are contributing to the saturated 'IP Input' process, such as specific hosts generating large volumes of routed traffic. This local, low-overhead mechanism is specifically designed for flow-level visibility and is the correct tool for this troubleshooting scenario.

Path Trace in Cisco DNA Center Assurance visually traces the path of a client's traffic through the network, showing each hop and any drops. It can simulate DHCP requests and responses, highlighting where packets are discarded. This directly addresses the need to identify where DHCP packets are being dropped for the client, making it the correct tool.

Cisco DNA Center Assurance integrates with Cisco ISE to pull client authentication and authorization information. This integration allows Assurance to show detailed client onboarding and policy compliance data. By correlating network and identity data, engineers can troubleshoot issues related to authentication and access. This is a valid and important capability.

Cisco DNA Center Assurance uses streaming telemetry from fabric nodes, collected by the Network Data Platform (NDP), to compute health scores. This provides near-real-time data on underlay and overlay performance, including latency, packet loss, and fabric control plane status. The NDP aggregates and analyzes this data to generate the health score.

The ip flow-export destination command specifies the IP address and port of the NetFlow collector. This is required to send NetFlow data to an external collector. Without this command, the router would not know where to export the flow records, so it is essential for NetFlow export configuration.

Cisco DNA Center uses SNMP to discover and monitor network devices. Even if SSH is reachable and the community string is correct, SNMP must be enabled on the switch for DNA Center to poll device information such as interfaces, CPU, and topology data. Without SNMP, the device will not appear in the topology view or be monitored.

Flexible NetFlow requires a flow monitor to be applied to an interface to activate flow accounting. Without applying the monitor, no flows are tracked or exported, even if the record and exporter are correctly defined. The ingress direction is typical for capturing incoming traffic, and this step is mandatory for the feature to function.

This command creates a static route to 10.1.1.0/24 via next-hop 192.168.1.1 and associates it with tracked object 1. The track object is linked to the IP SLA operation, so if the operation fails, the route is removed from the routing table. This is the correct way to tie IP SLA state to a static route.

Streaming telemetry pushes continuous, model-driven data from network devices to Cisco DNA Center, enabling near real-time analytics rather than polling-based SNMP collection. This satisfies the stem's Assurance requirement for live health monitoring, rapid fault detection and granular visibility into device and client performance across the fabric.

CRC errors and runts are statistical counters that typically indicate frame corruption at the data-link layer, almost always rooted in physical-layer problems. Faulty patch cables, damaged RJ-45 connectors, improper termination, or electromagnetic interference near the cable can cause bit-level corruption that the NIC detects as cyclic redundancy check failures. Runts—frames shorter than 64 bytes—frequently accompany this condition when transceivers detect a signal loss or electrical anomaly mid-frame. Therefore, inspecting the physical path from the switchport through the patch panel to the end device is the first and most effective troubleshooting step.

The 'ip flow ingress' command enables NetFlow for ingress traffic on the interface. It tells the switch to capture flow data for packets entering that interface and export it to the configured collector. This is the correct command to meet the requirement of exporting only ingress traffic from a specific interface.

A path-echo operation in IP SLA sends a series of packets with incrementing TTLs to discover the path and collect per-hop latency and loss statistics. This directly matches the requirement to validate the path and gather hop-by-hop performance data. It provides detailed information about each hop, including packet loss and round-trip time per hop, making it the correct tool.

NetFlow version 5, 9, and IPFIX can use UDP as the transport protocol for exporting flow records to a collector. UDP is commonly used because it is lightweight and the loss of some flow records is acceptable for monitoring purposes. However, some versions like NetFlow v9 can also use SCTP, but UDP is a valid option. This statement is true.

The 'show ip sla statistics' command provides a summary of the operation's results, including the number of successes and failures. This helps administrators quickly assess the reliability of the monitored path or service. It is a key piece of information for validating SLA compliance.

Client 360 is a feature in Cisco DNA Center Assurance that provides a comprehensive view of a specific client device. It includes a detailed timeline of events such as onboarding, authentication, DHCP, DNS, and application usage. This allows administrators to troubleshoot client-specific issues by correlating events over time. It is the correct tool for this scenario because it gives a holistic view of the client's network experience.

This is correct because IP SLA reactions define what happens when a monitored threshold is breached. By specifying a reaction condition (e.g., timeout) and an action (e.g., logging, SNMP trap), the device generates syslog messages and SNMP traps when the SLA operation fails or exceeds the threshold. This directly enables correlation with monitoring systems.

Configuring the new switch with a higher bridge priority (e.g., 28672) ensures that its BPDUs are inferior to those of the current root bridge, so Root Guard on the Layer 3 switch port will no longer block the port. Since bridge priority is the first criterion in root bridge election, setting a value like 28672 (higher than the current root's priority) makes the new switch a non-root candidate. This resolves the root guard blocking while keeping the new switch operational and preserving the intended spanning-tree topology.

AI Network Analytics in Cisco DNA Center uses machine learning to analyze historical network data, including device performance metrics and events, to identify anomalies and root causes. It can correlate data over time, detect trends, and provide insights into why a health score dropped, making it the appropriate tool for this scenario.

In a Cisco SD-Access fabric, the control plane nodes (running LISP) are critical for overlay reachability. If the fabric health score is low while device health scores are high, the issue likely lies in the fabric control plane, such as LISP map-server/ map-resolver problems or inconsistent fabric domain configurations. This can cause overlay connectivity issues without affecting individual device health.

AI Network Analytics in Cisco DNA Center uses machine learning to establish a dynamic baseline of normal network behavior and detect anomalies without manual thresholds. It continuously learns from telemetry and surfaces deviations, directly matching the engineer's goal of automated anomaly detection.

Client 360 provides a comprehensive view of a specific client, including its connectivity history, onboarding events, and performance metrics. It shows a timeline of association, authentication, and roaming events, making it ideal for troubleshooting intermittent disconnects. The administrator can see exactly when the client disconnected and what happened during the process, enabling root cause analysis.

The 'show spanning-tree' command displays the STP topology, including the root bridge, root port, designated ports, and port states. It is the primary command to verify STP operation and detect loops. On a Cisco Catalyst switch, this command provides detailed information for each VLAN, helping the administrator identify the root bridge and any blocked ports.

Assurance custom threshold rules in Cisco DNA Center allow you to define alerts based on specific metric thresholds, such as CPU utilization exceeding 80% for a sustained period. This directly matches the administrator's need to be notified when the condition persists for more than 5 minutes.

Interface resets occur when the interface goes down and comes back up, typically due to physical layer problems like faulty cables, damaged connectors, or hardware issues causing link flapping. This distinguishes resets from other errors.

The Client Health dashboard in Cisco DNA Center Assurance provides detailed metrics such as onboarding time, connectivity, and throughput for individual clients. This allows the administrator to pinpoint issues affecting a specific wireless client, making it a key tool for troubleshooting poor client experience.

ICMP Echo is the correct choice because it measures round-trip time and reachability to a destination. The engineer can set a threshold of 100 ms and configure a reaction to trigger when the threshold is exceeded, which can then be tracked. This operation type is specifically designed for this purpose.

The show interfaces gigabitEthernet 0/1 command provides detailed information about the interface, including duplex, speed, and error counters. This allows the engineer to confirm the operational duplex mode and detect a mismatch. It is the most direct way to verify duplex settings on a specific interface.

The show processes cpu history command displays a graphical representation of CPU utilization over the past 60 seconds, 60 minutes, and 72 hours. This helps correlate high CPU with specific events or times, such as a spike during a network storm or a scheduled task. It provides historical context that can identify patterns and narrow down the cause of sustained high CPU.

RF statistics for the client, such as RSSI, SNR, and channel utilization, are available in Client 360. These metrics help determine if the disconnections are due to poor signal quality, interference, or coverage gaps. By analyzing RF trends over time, the engineer can correlate disconnects with RF conditions.

Cisco DNA Center Assurance leverages streaming telemetry to gather near real-time data from network devices. This allows for continuous monitoring and rapid detection of issues. Streaming telemetry is more efficient than polling and provides granular data for analysis. This is a key feature of Assurance.

For UDP jitter operations, the destination router must have the ip sla responder command enabled to provide accurate measurements. The responder allows the destination to timestamp incoming packets and return them, enabling the source to calculate jitter and packet loss. Without it, the operation may still function in some cases, but the responder is required for precise jitter and loss statistics, making this statement correct.

Client 360 provides a comprehensive view of a specific client's experience, including onboarding, connectivity, and application performance. It shows the path taken through the network, including switches and access points, and highlights issues like onboarding failures or poor signal quality. This is the ideal tool for troubleshooting individual client performance.

This applet uses a syslog event detector that matches the OSPF adjacency change syslog message. When the router logs a %OSPF-5-ADJCHG message, the EEM applet triggers. This is a common method to monitor OSPF neighbor state changes without polling. The pattern must match the exact syslog text, and the tag is used to associate actions.

The HTTP operation type in IP SLA sends HTTP requests to a specified URL and measures the response time. It can be configured to use GET or RAW operations and can measure the time to establish a TCP connection, send the request, and receive the response. This directly measures HTTP traffic RTT, which is what the engineer wants. It is the correct choice for measuring HTTP performance.

If the timeout value is set lower than the actual round-trip time, the probe will time out even if the response eventually arrives. This is common in high-latency networks. Adjusting the timeout to accommodate network conditions can resolve the timeouts.

Client 360 provides a detailed view of a specific client's connectivity, including onboarding, authentication, association, and performance metrics. It shows the client's health score, issues, and the ability to drill down into specific events and path trace. This is the correct tool to determine why a client has a poor health score, as it aggregates data from multiple sources and provides root cause analysis.

Auto QoS for VoIP on access ports dynamically configures the necessary trust boundaries, classification, and egress queuing to properly handle voice traffic. It typically sets the ingress port to trust CoS for the connected IP phone, marks voice traffic appropriately, and places it in the priority queue to minimize latency and drop risk. This is the correct remediation because it matches the network behavior to the requirements of voice—ensuring priority without manual, error-prone configuration.