aaa radius tacacs

Drag and drop each NFV management layer on the left to its matching function on the right.

Review this IP SLA configuration on Router R1: ip sla 6 icmp-echo 10.6.6.6 frequency 10 ip sla schedule 6 life forever start-time now ip sla reaction-configuration 6 react timeout threshold-type immediate action-type triggerOnly Which statement is true about the 'threshold-type immediate' parameter?

Which three statements about Cisco DNA Center integration with external systems are true? (Choose three.)

A network team is designing the underlay for an SD-Access fabric. The design must use a routing protocol that supports fast convergence and is commonly recommended for the fabric underlay. Which routing protocol should be used?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against excessive ARP traffic. The engineer applies the following policy: policy-map COPP-POLICY class ARP-CLASS police 8000 conform-action transmit exceed-action drop After applying the service-policy to the control-plane, the engineer notices that legitimate ARP requests are being dropped during peak hours. Which action should the engineer take to resolve this issue while maintaining protection?

A network engineer is configuring QoS on a Cisco IOS switch. The engineer needs to mark packets coming from a specific server with DSCP EF (46) and ensure that this marking is trusted throughout the network. Which command should be used to trust the DSCP markings on the interface connected to the server?

An engineer is configuring a new access switch for a branch office. The switch must support multiple VLANs for different departments: VLAN 10 (Engineering), VLAN 20 (Sales), and VLAN 30 (Management). The uplink to the distribution switch is a trunk. The engineer wants to ensure that only the required VLANs are allowed on the trunk and that the native VLAN is changed from the default to VLAN 99 for security reasons. Which configuration commands should the engineer apply on the access switch's uplink interface?

Which three statements about telemetry data collection intervals and on-change notifications are true? (Choose three.)

interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 mpls ip ! interface GigabitEthernet0/2 ip address 10.2.2.1 255.255.255.0 mpls ip ! router ospf 1 network 10.0.0.0 0.255.255.255 area 0 ! router ldp interface GigabitEthernet0/1 ! What is the effect of this configuration?

An engineer is deploying a new SD-WAN solution using Cisco vManage. The WAN edge routers are connected to two different transport networks: MPLS and Internet. The engineer wants to ensure that voice traffic is always sent over the MPLS link when available, and only fails over to the Internet link if the MPLS link goes down. The engineer has configured a policy to set the preferred color for voice traffic to 'mpls'. However, during a test, voice traffic is still using the Internet link even though the MPLS link is up. What is the most likely cause?

A network architect is designing a Cisco SD-Access fabric. The customer requires that the fabric support both IPv4 and IPv6 traffic natively without the use of any translation mechanisms. Which statement describes the correct configuration approach?

A network engineer is configuring a switch stack with two Catalyst 9300 switches. The engineer wants to ensure that if the active switch fails, the standby switch takes over with minimal disruption. Which statement accurately describes the stack MAC address behavior during a failover?

An enterprise is deploying a leaf-spine architecture in its data center to support high-bandwidth east-west traffic. The design must include QoS to prioritize storage replication traffic (iSCSI) over backup traffic, while ensuring low latency for real-time applications. Where should the architect apply QoS classification and queuing policies in this topology?

Drag and drop the steps of hierarchical LAN design implementation phases into the correct order, from first to last.

Which TWO statements are correct about Cisco SD-Access architecture? (Choose two.)

An engineer is configuring an IPsec site-to-site VPN between two Cisco IOS XE routers. Phase 1 completes successfully, but Phase 2 fails and no interesting traffic is encrypted. The engineer confirms that the ACLs on both peers mirror each other correctly. Which configuration element should be verified next to resolve the Phase 2 failure?

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

A network engineer is implementing VXLAN with an EVPN control plane in a Cisco Nexus data center. The requirement is to provide Layer 2 extension over a Layer 3 underlay while maintaining optimal forwarding and avoiding unknown unicast flooding. Which statement describes the role of the EVPN control plane in this VXLAN fabric?

A network engineer is troubleshooting a Cisco SD-WAN deployment. The engineer notices that a branch site's vEdge router is not establishing control connections to the vSmart controller. The vEdge has the correct system IP and organization name. Which action should the engineer take first to verify connectivity?

A network engineer is using a Python script to retrieve the operational status of all interfaces on a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state but receives an HTTP 401 Unauthorized response. The engineer can successfully ping the device and has verified that the RESTCONF feature is enabled with 'restconf' in global configuration. Which action will resolve the issue?

Which two statements about DMVPN Phase 3 are true? (Choose two.)

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

A network engineer is configuring a new Cisco Catalyst switch for a small branch office. The engineer needs to ensure that the switch can be managed remotely via SSH and that only encrypted management traffic is allowed. The management VLAN is VLAN 10, and the switch's management IP address will be 10.10.10.2/24. Which command must be entered to assign the management IP address to the switch?

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

A network engineer runs the following command on Router R9: R9# show mpls ldp bindings 10.9.9.0 255.255.255.0 lib entry: 10.9.9.0/24, rev 10 local binding: label: 22 remote binding: lsr: 10.9.9.1:0, label: 23 remote binding: lsr: 10.9.9.2:0, label: 24 remote binding: lsr: 10.9.9.3:0, label: 25 Based on this output, how many remote LDP peers have advertised a label for the prefix 10.9.9.0/24?

Given this telemetry configuration on a Cisco IOS-XE device: telemetry ietf subscription 400 encoding encode-kvgpb filter xpath /interfaces/interface/state stream yang-push update-policy periodic 1000 receiver ip address 10.1.1.1 50000 protocol grpc source-interface Loopback0 What is the effect of the source-interface Loopback0 command?

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor. The engineer wants to rate-limit ICMP echo requests destined to the router itself while ensuring that transit traffic passing through the router is not affected. Which classification approach should the engineer use in the CoPP policy?

Which two statements about DHCP snooping are true? (Choose two.)

A network engineer runs the following command on Router R7: R7# show ip nat translations verbose Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00 timeout: never, flags: static --- 192.0.2.11 10.0.0.11 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00 timeout: never, flags: static Based on this output, what can be concluded?

A network engineer is deploying Cisco SD-Access and needs to ensure that fabric edge nodes can register with the fabric control plane node. Which protocol is used for this registration and for endpoint location mapping?

Drag and drop the steps of NAT overload (PAT) packet translation process into the correct order, from first to last.

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using SHA-256 HMAC cryptographic authentication on an interface. Which command sequence correctly enables this authentication?

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The engineer wants to ensure that BGP keepalives are not dropped during a control plane overload, while still rate-limiting SSH and SNMP. The engineer creates a class-map matching BGP, SSH, and SNMP traffic, then applies a policy-map with a single policer of 1000 pps to that class. After applying the service-policy to the control plane, BGP sessions flap during high CPU utilization. What is the most likely cause?

What is the maximum number of active member links supported in a single EtherChannel on Cisco Catalyst switches?

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

An engineer configures IP SLA 100 to monitor the jitter and latency of a VoIP call path between two branch routers. The configuration uses UDP jitter with a target of 192.168.2.2 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' but no jitter or latency statistics are collected. The router is generating the probe packets, but the remote router does not respond. What is the most likely reason?

A network engineer needs to secure management access to a Cisco IOS XE router. The requirement is to encrypt all management traffic, including SNMP, and to authenticate administrators against a centralized server. Which combination of features should be implemented?

Drag and drop each Ansible component on the left to its matching function on the right.

A network administrator is configuring a Cisco Nexus 9000 switch to participate in a VXLAN EVPN fabric. The administrator needs to define the source IP address used for VXLAN tunnels. Which interface should be configured as the source for the VXLAN tunnel?

Drag and drop the steps of PPPoE session establishment into the correct order, from first to last.

A network engineer is troubleshooting a BGP issue where a router is not installing a specific prefix in its routing table, even though the prefix is present in the BGP table. The engineer runs 'show ip bgp 10.0.0.0/24' and sees that the route is valid but not best. The BGP table shows that the route has a higher local preference than the current best path, but the AS_PATH is longer. What is the most likely reason the route is not being selected as best?

Drag and drop each HTTP method on the left to its matching REST operation on the right.

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows: { "response": [ { "deviceId": "1234567890", "hostname": "Core-Switch-1", "score": 8, "overallHealth": "good", "timestamp": 1623456789 } ], "version": "1.0" } The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write the automation tasks in YAML and does not want to install any software on the switches. Which tool should be used?

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS devices. The administrator prefers a tool that uses YAML for playbooks and does not require installing software on the managed devices. Which tool should the administrator use?

Drag and drop each BGP attribute on the left to its preferred value (highest or lowest) on the right.

A network engineer is implementing Cisco SD-Access and needs to understand the role of the LISP protocol. Which statement accurately describes the function of LISP in SD-Access?

Drag and drop the steps of RESTCONF GET with depth and field query parameters into the correct order, from first to last.

What is the default EIGRP hello interval on a point-to-point serial link?

A network engineer is deploying a new branch office that uses a single switch stack with two member switches. The stack must forward traffic between access ports in different VLANs without involving an external router. Which feature should be configured to meet this requirement?

An architect is designing an SD-WAN deployment for a multinational enterprise. The design must ensure that control plane traffic remains separate from data plane traffic and that the solution can scale to thousands of sites. Which architectural component is responsible for maintaining the control plane and distributing routing information?

A network engineer runs the following command on Router R9: R9# show policy-map interface GigabitEthernet0/0.900 GigabitEthernet0/0.900 Service-policy input: QOS_POLICY_VRF_G Class-map: CLASS_VOICE (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) police: cir 1000000 bps, bc 31250 bytes, be 31250 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: CLASS_DATA (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) police: cir 2000000 bps, bc 62500 bytes, be 62500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Based on this output, what can be concluded?

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

Given the following SPAN configuration on a Cisco IOS-XE switch: monitor session 4 source interface GigabitEthernet1/0/6 tx monitor session 4 destination interface GigabitEthernet1/0/7 What does this configuration do?

A network engineer is writing a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device. The script connects using NETCONF over SSH on port 830. The engineer wants to filter the response to only include interface configuration data. Which NETCONF operation should be used to retrieve the configuration with a filter?

Consider the following configuration snippet: ``` interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/2 ip address 203.0.113.1 255.255.255.0 ip nat outside ! ip nat inside source list 1 interface GigabitEthernet0/2 overload access-list 1 permit 192.168.1.0 0.0.0.255 ``` What is the effect of this configuration?

Which three statements about the benefits and challenges of NFV are true? (Choose three.)

A network engineer is deploying a Cisco SD-Access fabric and needs to ensure that endpoints can communicate with devices outside the fabric. The engineer configures a fabric border node. Which functionality does the border node provide in this architecture?

Drag and drop each OSPF packet type on the left to its matching function on the right.

A network administrator is deploying a Cisco SD-WAN solution. The administrator wants to ensure that control plane information is securely distributed between vSmart controllers and vEdge routers. Which protocol does Cisco SD-WAN use for this purpose?

A network engineer is configuring IPsec VPN on a Cisco IOS XE router. The requirement is to protect traffic between two sites using ESP with AES-256 encryption and SHA-256 authentication, and to ensure that the tunnel is rekeyed every 3600 seconds. Which configuration element directly controls the rekey interval?

A network engineer is configuring a Cisco Catalyst 9000 switch to support a VXLAN EVPN fabric. The engineer wants to enable the switch to act as a VTEP and perform VXLAN encapsulation and decapsulation. Which command must be configured to create the VXLAN tunnel interface?

A network engineer is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. Hosts in the same subnet are attached to different edge nodes. The engineer must ensure that a host retains its default gateway IP and MAC address when it moves between edge nodes. Which technology should be configured on the edge nodes?

A network designer is evaluating a virtual switch deployment in a Cisco ACI fabric. The requirement is to extend a bridge domain across multiple leaf switches while allowing the fabric to perform distributed IP routing at the leaf for endpoints in that bridge domain. Which ACI construct should the designer use?

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Drag and drop the steps of the 802.1X/EAP authentication process for a wireless client into the correct order, from first to last.

Examine this configuration for a site-to-site VPN on a Cisco router: crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 14 lifetime 86400 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 192.168.1.1 set transform-set TSET match address 101 ! interface GigabitEthernet0/0/0 ip address 10.0.0.1 255.255.255.0 crypto map CMAP ! access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 Which statement about this configuration is true?

A network engineer configures VRF-lite on a router with the following snippet: vrf definition GREEN rd 200:1 ! interface GigabitEthernet0/3 vrf forwarding GREEN ip address 172.16.1.1 255.255.255.0 ! router ospf 10 vrf GREEN network 172.16.1.0 0.0.0.255 area 0 What is missing from this configuration to enable proper OSPF routing within VRF GREEN?

A network engineer is designing a QoS policy for a WAN edge router. The router must prioritize voice traffic with strict priority while ensuring that other traffic classes are not starved. The engineer decides to use Low Latency Queueing (LLQ). Which additional mechanism should be configured to prevent starvation of other queues when voice traffic exceeds its allocated bandwidth?

Which three statements about using Python for interacting with Cisco IOS-XE devices via NETCONF and RESTCONF are true? (Choose three.)

Drag and drop the steps of OSPF virtual link configuration into the correct order, from first to last.

A network administrator is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to a SaaS application. The administrator suspects that the issue is related to the application-aware routing policy not correctly identifying the application. Which component of Cisco SD-WAN is responsible for identifying applications in the data plane?

Examine the following configuration on a Cisco 9800 WLC: ap profile default-ap-profile description "Default AP Profile" country US management-user admin Which statement is true about this configuration?

A network engineer runs the following command on Router R4: R4# show ip sla monitor statistics 3 Round Trip Time (RTT) for Index 3 Latest RTT: 25 ms Latest Operation Start Time: 14:30:00.000 UTC Mon Mar 1 2021 Latest Operation Return Code: OK Number of successes: 100 Number of failures: 0 Over thresholds: 0 Based on this output, what can be concluded about the IP SLA operation?

A network engineer runs the following command on Switch SW5: SW5# show spanning-tree vlan 50 VLAN0050 Spanning tree enabled protocol ieee Root ID Priority 24626 Address aabb.cc00.0800 Cost 4 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 50) Address aabb.cc00.0900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Root FWD 4 128.1 P2p Gi0/2 Desg FWD 4 128.2 P2p Gi0/3 Desg FWD 4 128.3 P2p Gi0/4 Altn BLK 4 128.4 P2p Based on this output, how many ports are in the Forwarding state?

Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.

Examine the following configuration snippet on a Cisco IOS switch: interface GigabitEthernet0/2 switchport mode access switchport access vlan 50 spanning-tree portfast Which statement is true about this interface?

Which SNMP version introduced the use of a username and authentication/password framework, without encryption?

Given the following Ansible playbook snippet: --- - name: Backup running config hosts: routers gather_facts: no tasks: - name: Save config ios_config: backup: yes backup_options: dir_path: /backup/ What is the purpose of the 'backup_options' parameter?

An enterprise is implementing MPLS L3VPN to connect multiple branch offices. The PE routers are using eBGP to exchange VPNv4 routes. The engineer notices that some VPN routes are not being advertised to the remote PE. The 'show bgp vpnv4 unicast all' on the local PE shows the routes as valid but not best. What is the most likely reason?

A network engineer is configuring a Cisco IOS router to support OSPFv3 for IPv6. The router must form adjacencies on its GigabitEthernet0/0 interface, which is assigned to area 0. Which command is required to enable OSPFv3 on the interface?

An engineer is writing an Ansible playbook to configure OSPF on a fleet of Cisco Nexus 9000 switches. The playbook uses the nxos_ospf module. When executed, the playbook reports 'changed' for every switch, even on subsequent runs when no configuration changes are made. The engineer wants to achieve idempotent behavior. What is the most likely cause of the non-idempotent results?

A network engineer is implementing Cisco TrustSec in a campus network. Which two components are required to enable Security Group Tagging (SGT) and enforcement? (Choose two.)

Drag and drop the steps of AAA method list fallback from RADIUS to local into the correct order, from first to last.

A network architect is designing a three-tier campus network with a pair of Cisco Catalyst 9500 switches at the core. The design requires that the core layer avoid maintaining a large MAC address table and instead forward traffic based on Layer 3 reachability. Which technology should be implemented on the core switches to meet this requirement?

A network engineer is troubleshooting an OSPF issue where a router is not learning a route to a network that is advertised via a type 5 LSA from an ASBR. The engineer checks the OSPF database and sees the type 5 LSA, but the route is not in the routing table. The forwarding address in the LSA is 0.0.0.0. What is the most likely cause?

A network engineer is configuring MPLS TE (Traffic Engineering) in an MPLS core to optimize bandwidth utilization. After enabling MPLS TE on all core routers and configuring tunnels, the engineer notices that traffic is not being rerouted when a link fails. The 'show mpls traffic-eng tunnels' shows the tunnels are up but not using the backup path. What is the most likely missing configuration?

Which three statements about extended ACLs on Cisco IOS are true? (Choose three.)

Drag and drop the steps of the 802.1X EAP-TLS authentication exchange into the correct order, from first to last.

Which three statements about Cisco TrustSec security group access control lists (SGACLs) are true? (Choose three.)

Examine the following configuration: flow exporter EXPORTER-1 destination 10.0.0.1 source Loopback0 transport udp 2055 option interface-table option application-table ! What is the purpose of the 'option interface-table' and 'option application-table' commands?

A network architect is evaluating Cisco SD-Access fabric deployment options for a large campus. The design team wants to understand the roles that fabric nodes play in forwarding traffic and in connecting the fabric to external networks. Which two statements accurately describe Cisco SD-Access fabric node roles? (Choose two.)

Drag and drop the steps of SNMP community-based access control setup into the correct order, from first to last.

A network administrator is configuring a Cisco Catalyst switch to assign a voice VLAN to IP phones and a data VLAN to connected PCs on the same port. The phones are Cisco and use CDP to communicate VLAN information. Which configuration should be applied to the switch port?

A network engineer is implementing Cisco TrustSec in a campus network. The requirement is to classify traffic based on the identity of the user and the device, and to enforce policy across the network without relying on IP addresses. Which component assigns the Security Group Tag (SGT) to the packet at ingress?

A network engineer is troubleshooting connectivity issues in a multi-tenant environment where each tenant's traffic is isolated using VRF-Lite. The engineer notices that tenants in the same VRF cannot communicate with each other across different access switches. Which design change should be implemented to enable inter-switch VRF communication?

A network engineer is configuring a Cisco IOS XE router to support a site-to-site VXLAN tunnel over an existing IP underlay. The engineer must configure the NVE interface and ensure that the underlay provides the necessary transport. Which two statements are true about this configuration? (Choose two.)

Which three statements about CoPP configuration and operation are true? (Choose three.)

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

A network engineer is configuring an EtherChannel between two Cisco switches. The engineer wants to use PAgP and ensure that the channel forms only if the neighboring switch is also configured for PAgP. Which mode should be configured on the local switch?

A network administrator is implementing Cisco TrustSec in a data center. The security team wants to enforce segmentation based on user roles rather than IP addresses. The administrator has configured security group tags (SGTs) on the access layer switches and now needs to propagate this information across the network. Which protocol should be used to carry SGT information between Cisco TrustSec-capable devices?

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Drag and drop the steps of MPLS Traffic Engineering (TE) tunnel setup (RSVP) into the correct order, from first to last.

A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco IP phone with a PC attached to the phone's data port. The requirement is to authenticate both the phone and the PC separately, with the phone in the voice VLAN and the PC in the data VLAN. Which 802.1X feature should be enabled?

Consider the following BGP configuration: router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET-MED out ! route-map SET-MED permit 10 set metric 50 ! What is the effect of this route-map on outbound updates to neighbor 10.0.0.2?

A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when a switch's health score drops below a threshold. Which Assurance feature should be configured to generate these alerts?

A network engineer configured a router with the command `ip route 0.0.0.0 0.0.0.0 192.168.1.1` and also has a specific static route for 10.1.1.0/24 pointing to 192.168.1.1. A packet arrives destined for 10.1.1.5. Which route will the router use to forward the packet?

A network architect is designing a Cisco SD-Access fabric for a university campus that requires segmentation between student, faculty, and guest traffic. The design must use Cisco TrustSec for scalable security group tags (SGTs) and integrate with Cisco ISE for policy enforcement. Which fabric component should the architect use to enforce SGT-based policies at the access layer?

Drag and drop the steps of OSPF SPF calculation steps (Dijkstra) into the correct order, from first to last.

A network engineer runs the following command on Router R2: R2# debug ip dhcp server events *Mar 1 00:05:23.123: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 on interface GigabitEthernet0/1 *Mar 1 00:05:23.124: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2) *Mar 1 00:05:23.125: DHCPD: DHCPREQUEST received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 *Mar 1 00:05:23.126: DHCPD: Sending DHCPACK to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2) Based on this debug output, what can be concluded?

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices. The engineer sends a GET request to /dataservice/device but receives a 403 Forbidden error. The engineer has already authenticated successfully and obtained a valid session cookie. What is the most likely reason for this error?

A network engineer runs the following command on Router R1: R1# show aaa sessions Total sessions since last reset: 10 Session Id: 5 Unique Id: 5 User Name: admin IP Address: 192.168.1.100 Idle Time: 0:00:05 Timeout: 0:10:00 Type: SSH Method: local Session Id: 6 Unique Id: 6 User Name: neteng IP Address: 10.0.0.2 Idle Time: 0:02:30 Timeout: 0:10:00 Type: SSH Method: tacacs+ Based on this output, what can be concluded?

Which three statements about IP SLA probe types and their characteristics are true? (Choose three.)

Drag and drop each DSCP value on the left to its matching Per-Hop Behavior (PHB) on the right.

A network engineer is deploying a new branch office that connects to the headquarters via a Cisco SD-WAN solution. The branch has two WAN transports: an MPLS circuit and a broadband internet link. The engineer wants to ensure that business-critical traffic uses the MPLS circuit while guest traffic uses the broadband link, and that failover occurs automatically if the MPLS circuit degrades. Which Cisco SD-WAN feature should be configured to meet these requirements?

Drag and drop the steps of configuring Control Plane Policing (CoPP) on a Cisco IOS router into the correct order, from first to last.

Which of the following is true about the STP max age timer?

A network engineer is writing a Python script to automate the backup of running configurations from a list of 50 Cisco IOS-XE devices. The script uses the netmiko library and a for loop to connect to each device, execute 'show run', and write the output to a file. After running the script, the engineer notices that the script fails on the 15th device with a timeout error, and the remaining devices are not processed. The engineer wants to ensure that if one device fails, the script continues with the next device. What is the best way to modify the script?

Which two statements about Network Function Virtualization (NFV) architecture are true? (Choose two.)

Drag and drop each ACL action on the left to its matching result on the right.

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

Drag and drop each Ansible task return value on the left to its matching meaning on the right.

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

A network administrator is new to automation and wants to start using Ansible to manage a group of Cisco IOS XE switches. The administrator has installed Ansible on a Linux control node and created an inventory file listing the switches. The administrator now needs to create a playbook that will gather facts from the switches and display them. Which Ansible module should the administrator use in the playbook to collect operational facts from the Cisco IOS XE devices?

Consider the following Python script using the requests library to interact with a Cisco IOS-XE device via RESTCONF: ```python import requests from requests.auth import HTTPBasicAuth url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=1/0/1' headers = { 'Accept': 'application/yang-data+json', 'Content-Type': 'application/yang-data+json' } auth = HTTPBasicAuth('admin', 'cisco') response = requests.get(url, headers=headers, auth=auth, verify=False) print(response.json()) ``` What is the script attempting to do?

Which three statements about Python functions and modules for network automation are true? (Choose three.)

A network administrator is configuring a Cisco IOS router to act as a DHCP server for a subnet. The administrator wants to ensure that the router assigns IP addresses to clients and also provides them with the IP address of a TFTP server for configuration files. Which DHCP option should the administrator configure to provide the TFTP server address?

A security architect is evaluating MACsec on a Cisco Catalyst switch uplink between two buildings. The requirement is to encrypt all Layer 2 traffic on the link with minimal configuration and use a standards-based key agreement. Which statement correctly describes how MACsec should be deployed on this link?

A network administrator is configuring a Cisco switch port that connects to an IP phone and a PC. The phone must tag voice traffic with VLAN 200, and the PC must send untagged traffic on VLAN 100. Which configuration is required on the switch port?

A network engineer is using Python with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script connects successfully but receives an RPC error when trying to apply a candidate configuration. The engineer inspects the device capabilities and sees 'urn:ietf:params:netconf:capability:candidate:1.0' is NOT listed. What is the most likely reason for the failure?

A network architect is designing a Cisco SD-WAN fabric using vManage, vSmart, and vBond controllers. Which two statements accurately describe the control plane and onboarding behavior in this architecture? (Choose two.)

A network engineer is configuring OSPF on a multiaccess segment. The design requires that the DR/BDR election be deterministic, with Router A always becoming the DR and Router B always becoming the BDR. Both routers are Cisco IOS devices. Which configuration on Router A ensures it wins the DR election?

Drag and drop each WAN transport type on the left to its matching SD-WAN characteristic on the right.

A network administrator is configuring a Cisco wireless controller for a branch office. The design requires that guest clients be isolated from corporate clients while still using the same physical access points. Which Cisco wireless architecture feature should be used to separate the traffic?

Which three statements about BGP peering are true? (Choose three.)

A network administrator is using Cisco SD-WAN to manage a large enterprise network. They want to automate the deployment of a new branch site using a template. Which component of Cisco SD-WAN is responsible for pushing the configuration to the WAN edge devices?

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

An organization is migrating from a traditional three-tier architecture to a leaf-spine fabric using VXLAN EVPN. The design requires that virtual machines can move between racks without IP address changes. Which technology must be enabled at the leaf switches to support this mobility?

A company uses Cisco Catalyst Center (formerly DNA Center) for intent-based networking. After upgrading the Catalyst Center appliance, the engineer notices that some devices are unreachable via the network, but the Catalyst Center GUI shows them as 'Managed'. What is the most likely cause?

Examine the following OSPF configuration on a Cisco IOS-XE router: router ospf 1 router-id 1.1.1.1 network 10.0.0.0 0.255.255.255 area 0 network 192.168.1.0 0.0.0.255 area 1 default-information originate always metric 10 metric-type 1 What is the effect of the 'default-information originate always' command?

An organization is implementing 802.1X for wireless users using Cisco ISE as the RADIUS server. The network engineer configures the wireless LAN controller (WLC) with 802.1X authentication. Users report that they can connect to the SSID but cannot access any network resources. The engineer checks the WLC and sees that users are authenticated and assigned to VLAN 100. The engineer also checks the switchport connecting the WLC and sees it is a trunk. What is the most likely issue?

Which component in Cisco SD-WAN is responsible for orchestrating the overlay network, including authentication and NAT traversal?

Drag and drop each DTP mode on the left to its matching trunking behavior on the right.

Which three statements about BGP route selection are true? (Choose three.)

Examine this OSPF configuration on router R4: interface GigabitEthernet0/0 ip address 172.16.1.4 255.255.255.0 ip ospf 1 area 0 ip ospf cost 50 ! router ospf 1 router-id 4.4.4.4 network 172.16.0.0 0.0.255.255 area 0 What is the OSPF cost of the GigabitEthernet0/0 interface?

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Consider the following configuration: class-map match-all HTTP match protocol http policy-map QOS class HTTP police 2000000 1500 3000 conform-action transmit exceed-action drop interface GigabitEthernet0/1 service-policy input QOS What is the effect of this configuration?

A network engineer is troubleshooting multicast video distribution across an enterprise campus. The multicast source is connected to a switch that is the PIM Designated Router (DR) on a multi-access segment. Receivers in a different VLAN report that they are not receiving the multicast stream, although the DR shows the correct (S,G) entry. The engineer checks the RPF neighbor for the source and notices that the unicast route to the source points to a different interface than the one where the multicast stream is received. What is the most likely cause of the issue?

Consider the following partial configuration on Router R1: ip sla 2 icmp-echo 10.2.2.2 frequency 15 ip sla schedule 2 life forever start-time now ip sla reaction-configuration 2 react timeout threshold-type immediate action-type triggerOnly Which statement about this configuration is true?

A network automation team is evaluating configuration management tools. They need a tool that uses a declarative, agentless architecture and communicates over SSH to push configuration to Cisco IOS XE devices. Which tool best fits these requirements?

A network engineer is configuring IPsec site-to-site VPNs on a Cisco IOS XE router. The design requires that the router authenticate peers using certificates issued by an internal PKI rather than pre-shared keys, and that IKEv2 be used for the key exchange. Which configuration element is required to support certificate-based authentication for IKEv2 on this router?

Which two statements about Cisco QoS classification and marking are true? (Choose two.)

A network engineer runs the following command on Router R4: R4# show mpls interfaces Interface IP Tunnel BGP Static Operational GigabitEthernet0/0 Yes No No No Yes GigabitEthernet0/1 Yes No No No Yes GigabitEthernet0/2 No No No No No Based on this output, what can be concluded?

A network engineer is deploying a new Cisco SD-WAN fabric using Cisco vManage, vSmart, and vBond controllers. The engineer must ensure that the control plane is secure and resilient. Which two statements are true regarding the roles of these controllers? (Choose two.)

Drag and drop the steps of SD-WAN overlay routing protocol (OMP) route advertisement sequence into the correct order, from first to last.

A Cisco Catalyst 9500 switch in a data center is configured with IP Source Guard on an access port where a server is connected. The server has a static IP address of 10.10.10.50 and MAC address 00:11:22:33:44:55. The network administrator has configured a static IP source binding using the command 'ip source binding 0011.2233.4455 vlan 10 10.10.10.50 interface GigabitEthernet1/0/1'. However, the server cannot communicate through the switch. What is the most likely cause?

A network engineer is configuring dynamic ARP inspection (DAI) on a Cisco switch to prevent ARP spoofing. The switch has DHCP snooping enabled and the DHCP server is trusted. The engineer enables DAI on VLAN 10 and configures 'ip arp inspection trust' on the port connected to the DHCP server. After enabling DAI, some legitimate ARP replies from hosts are being dropped. The engineer checks the DAI statistics and sees 'ARP ACL drops' incrementing. What is the most likely reason?

Drag and drop each WPA security version on the left to its matching authentication method on the right.

Which three statements about Cisco SD-WAN architecture components and their roles are true? (Choose three.)

A network engineer is using the Python 'requests' library to interact with a Cisco DNA Center controller. The engineer wants to retrieve a list of all network devices. Which HTTP method and URL should be used?

A network architect is designing a new branch office that must run Cisco SD-WAN with a single WAN transport and requires all control-plane and data-plane traffic to be encrypted by default using DTLS/TLS tunnels managed by the controller. Which SD-WAN component is responsible for establishing the secure control connections and distributing route and policy information to the branch edge devices?

Drag and drop the steps of MPLS Layer 3 VPN VRF configuration on a PE router into the correct order, from first to last.

What is the purpose of the 'ip sla schedule' command in IP SLA configuration?

Which three statements about VRF path isolation in a service provider network are true? (Choose three.)

A network engineer is deploying MACsec on a Cisco Catalyst switch to secure point-to-point links between the access and distribution layers. The design must ensure data confidentiality and integrity on the wire, and must use a key agreement mechanism that supports dynamic key exchange. Which TWO of the following are required to meet these requirements? (Choose two.)

A network administrator is deploying a new QoS policy to prioritize voice traffic across a WAN link. The policy must ensure that voice packets are not dropped even during congestion, and that bandwidth is guaranteed for voice. Which queuing mechanism should be used for the voice class?

Which three statements about EIGRP packet types are true? (Choose three.)

Examine the following partial configuration on a Cisco IOS-XE device: interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 ip ospf hello-interval 5 ip ospf dead-interval 20 ! What is the effect of this configuration?

A network engineer is implementing VXLAN with Cisco SD-Access. The engineer needs to ensure that the fabric supports Layer 2 and Layer 3 traffic between endpoints in different subnets. Which two components are required in the VXLAN data plane to achieve this? (Choose two.)

Consider this SNMP configuration on a Cisco IOS-XE switch: snmp-server community public RO snmp-server community private RW snmp-server ifindex persist What is the purpose of the 'snmp-server ifindex persist' command?

Drag and drop each STP variant on the left to its matching standard on the right.

Which three statements about OSPF LSA types are true? (Choose three.)

A company is implementing QoS in a network where voice traffic must have strict priority over all other traffic. Which queuing mechanism should be used on the outbound interface of a router to ensure voice packets are always sent first?

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) and needs to ensure that the management interface is reachable from the wired network. Which interface on the WLC is used for out-of-band management and is typically assigned an IP address on the management VLAN?

An engineer is deploying a new branch office that must run multiple isolated routing domains on a single Cisco IOS-XE router. Each department requires its own routing table and overlapping IP addressing. The engineer plans to use VRF-Lite. Which configuration step is required to ensure that routes from one VRF do not leak into another?

A network engineer runs the following command on Router R8: R8# show ip mroute count IP Multicast Statistics Group: 239.4.4.4, Source: 10.0.0.9 Packets: 1500, Bytes: 1200000, Average rate: 8000 pps, 5 sec rate: 0 pps Group: 239.5.5.5, Source: 10.0.0.10 Packets: 0, Bytes: 0, Average rate: 0 pps, 5 sec rate: 0 pps Based on this output, what can be concluded?

A network architect is evaluating Cisco SD-WAN for a company with 50 branch sites and two data centers. The design must provide application-aware routing, direct internet access at branches, and centralized policy management. Which Cisco SD-WAN component is responsible for distributing policies and reachability information to the branch devices?

Drag and drop the steps of Jinja2 template rendering for device config generation into the correct order, from first to last.

Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.

Which two statements about SNMP trap and inform operations are true? (Choose two.)

A network automation engineer is using NETCONF to configure a Cisco IOS XE device. The engineer wants to ensure that the configuration changes are applied atomically and that the device can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities should the engineer verify are supported by the device? (Choose two.)

A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive SSH traffic. The engineer wants to classify SSH traffic destined to the router itself and apply a policer to it. Which mechanism is used by CoPP to classify traffic before the policer is applied?

Which three statements about Ansible roles and directory structure are true? (Choose three.)

A mid-size enterprise is deploying a new branch office with 50 users. The branch will have its own router, switch, and wireless AP. The WAN link is a 50 Mbps MPLS circuit. The company uses VoIP and requires Quality of Service. The network administrator has configured the router with a QoS policy that marks VoIP traffic with DSCP EF and all other traffic with DSCP 0. The policy also shapes traffic to 50 Mbps. After deployment, users report that voice quality is poor during peak hours. The administrator checks the router and sees that the output queue on the WAN interface is often full and drops are occurring. Which action should the administrator take to improve voice quality?

A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints in the same virtual network can communicate with each other even when they attach to different fabric edge nodes, while endpoints in different virtual networks remain isolated. Which control-plane component is responsible for registering endpoint IP-to-location mappings and answering fabric edge node queries?

A network engineer runs the following command on Router R1: R1# show ip eigrp topology all-links EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.1.1.0/24, 1 successors, FD is 1310720, serno 5 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 via 10.2.2.2 (1587200/1310720), GigabitEthernet0/1 P 10.2.2.0/24, 1 successors, FD is 1310720, serno 6 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 via 10.2.2.2 (1587200/1310720), GigabitEthernet0/1 Based on this output, what can be concluded?

An engineer configures a VXLAN tunnel between two Nexus switches acting as VTEPs. The underlay is a routed Layer 3 network using OSPF, and the loopback interfaces of the VTEPs are reachable. However, hosts in the same VXLAN VNI on different VTEPs cannot communicate. Which action should the engineer take to resolve the issue?

A network administrator is configuring a Cisco Catalyst 9300 switch stack using StackWise-480 technology. The administrator wants to ensure that if the active switch fails, the standby switch takes over with minimal disruption. Which statement describes the behavior of the stack during a failover?

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which configuration element is required to define this traffic?

A network technician is troubleshooting a switch that is experiencing high CPU utilization. The technician runs the command 'show processes cpu sorted' and notices that the process 'ARP Input' is consuming a large percentage of CPU. Which action should the technician take to mitigate this issue?

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to use 802.1X authentication for wireless clients. The administrator wants to ensure that the WLC communicates with the RADIUS server securely. Which protocol should be used to encrypt the RADIUS communication between the WLC and the RADIUS server?

A network engineer runs the following command on switch SW4: SW4# show cts environment-data CTS Environment Data: Device ID: SW4.cisco.com Device Name: SW4 CTS Capabilities: SGT, SXP, CTSD, CTSA SGT: 100 SXP Node: Enabled SXP Connection: 10.1.1.1:64999 Based on this output, what can be concluded?

A network engineer is deploying a new branch office that requires a WAN connection with built-in encryption and dynamic multipoint VPN capabilities. The engineer wants to use a Cisco technology that supports spoke-to-spoke communication without requiring traffic to traverse the hub. Which technology should be implemented?

Which three statements about Cisco SD-Access design are true? (Choose three.)

A campus network architect is redesigning the LAN to support high availability and east-west traffic growth. The current design uses a traditional three-tier hierarchy with a collapsed core. The architect must choose a new design that provides predictable latency, simple scalability, and efficient use of uplinks. Which design should the architect select?

A network engineer is configuring a Cisco SD-WAN fabric with vManage, vSmart, and vBond controllers. The engineer wants to ensure that all branch routers automatically discover the vSmart and vManage controllers without manually configuring the vSmart or vManage addresses on each branch. The engineer has configured the vBond with a public IP address and enabled NAT traversal. However, branch routers are failing to establish control connections. The engineer verifies that the branch routers have the correct organization name but have not been configured with the vBond IP address. What is the most likely missing configuration?

A network engineer is implementing Cisco TrustSec in a campus network. The security team wants to enforce access policies based on user identity and device type without relying on IP addresses. Which component is responsible for assigning Security Group Tags (SGTs) to traffic at the ingress point?

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoints in the same virtual network (VN) can communicate across fabric sites while endpoints in different VNs remain isolated. Which control plane component is responsible for propagating endpoint reachability information between fabric sites?

A network engineer is configuring a Cisco IOS router for NAT overload (PAT) to allow internal hosts on the 10.1.1.0/24 network to access the internet using the router's outside interface IP address. The engineer wants to ensure that all internal hosts can initiate connections and that return traffic is correctly translated. Which configuration is required?

Examine the following configuration snippet: interface GigabitEthernet1/0/2 switchport mode access authentication port-control auto mab dot1x pae authenticator dot1x timeout tx-period 10 Which statement about this configuration is true?

An enterprise is deploying QoS across a network that includes both Cisco and non-Cisco devices. The engineer wants to use a marking scheme that is end-to-end and not stripped at Layer 3 boundaries. Which marking field should the engineer use?

A network administrator is deploying a new Cisco Catalyst switch and wants to restrict management access to the switch. The requirement is that only hosts on the 10.10.10.0/24 subnet can access the switch via SSH, and all other SSH attempts must be denied. Which configuration achieves this?

A network administrator is configuring a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the data transmitted between the sites is encrypted and authenticated. Which IPsec protocol should be used to provide both confidentiality and integrity for the data payload?

A network engineer is configuring QoS on a Cisco router to prioritize business-critical applications. The engineer creates a class-map that matches traffic based on the destination IP address and port. However, the class-map does not match the expected traffic. What is the most likely reason?

A network engineer is configuring a Cisco IOS router to support PIM Sparse Mode (PIM-SM) for multicast traffic. The engineer needs to ensure that the router can dynamically discover Rendezvous Points (RPs). Which two mechanisms can be used to achieve this? (Choose two.)

A network engineer runs the following command on Router R3: R3# show interfaces GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Hardware is ISR4331-2x1GE, address is aabb.cc00.0300 (bia aabb.cc00.0300) Internet address is 10.0.0.3/24 MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 1000 bits/sec, 2 packets/sec 5 minute output rate 2000 bits/sec, 3 packets/sec 12345 packets input, 1234567 bytes, 0 no buffer Received 123 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 12345 packets output, 2345678 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out Based on this output, what can be concluded?

interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip ospf network non-broadcast ip ospf priority 1 ! router ospf 1 network 192.168.1.0 0.0.0.255 area 0 neighbor 192.168.1.2 What is the effect of this configuration?

A network administrator is analyzing syslog messages from a Cisco Catalyst switch and notices the message %SW_MATM-4-MACFLAP_NOTIF: Host 0000.1111.2222 in vlan 10 is flapping between port Gi1/0/1 and port Gi1/0/2. What is the most likely cause of this message?

A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tags (SGTs) and enforce policies using a Cisco Catalyst switch as an enforcement point. Which two statements are true regarding SGT propagation and enforcement in this scenario? (Choose two.)

An enterprise network uses 802.1X for wired access. The authentication server is a Cisco ISE. Recently, some Windows 10 clients fail to authenticate, while others succeed. The engineer checks the switch configuration and finds 'authentication port-control auto' and 'dot1x pae authenticator' are configured. The failing clients show 'EAP failure' in the logs. The engineer suspects a mismatch in EAP method. Which EAP method is most likely causing the issue if the ISE is configured to require EAP-TLS but the Windows clients are configured for PEAP-MSCHAPv2?

A network administrator is troubleshooting a network performance issue and suspects a duplex mismatch on a switch port. Which command should be used to verify the duplex settings on a Cisco switch interface?

A network engineer is deploying a Cisco SD-WAN solution with two data center sites and 40 branch sites. The design must ensure that traffic from a branch to a critical application in Data Center A always prefers the MPLS transport while using the internet transport only when MPLS latency exceeds a defined threshold. Which Cisco SD-WAN component and feature combination accomplishes this?

A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints be authenticated and assigned to a VLAN and VRF based on their identity before any traffic is forwarded. Which Cisco SD-Access component is responsible for this function?

Which two statements about VLAN trunking using IEEE 802.1Q are true? (Choose two.)

A network administrator is configuring a zone-based firewall on a Cisco IOS XE router. The requirement is to allow HTTP traffic from the INSIDE zone to the OUTSIDE zone while blocking all other traffic initiated from INSIDE. Which action must be taken to define the traffic that is permitted?

Which THREE of the following are components of a Cisco ACI fabric? (Choose three.)

A network engineer is configuring a Cisco IOS router to support NAT overload (PAT) for a small office. The inside network is 192.168.1.0/24, and the outside interface is GigabitEthernet0/1 with IP address 203.0.113.5. The engineer wants to translate all inside addresses to the outside interface address. Which two commands are required to complete this configuration? (Choose two.)

Examine the following SD-WAN configuration on a Cisco vEdge router: vpn 0 interface ge0/0 ip address 10.0.0.1/24 tunnel-interface encapsulation ipsec color public-internet allow-service all ! interface ge0/1 ip address 10.0.0.2/24 tunnel-interface encapsulation ipsec color 3g allow-service all ! Which statement is correct?

Drag and drop the steps to configure OSPF on a Cisco router in the correct order.

A network engineer runs the following command on Switch SW3: SW3# show etherchannel summary Flags: D - down P - in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+--------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Based on this output, what can be concluded?

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail EIGRP-IPv4 Interfaces for AS(100) Interface: GigabitEthernet0/0 Mtu: 1500, Bandwidth: 1000000 Kbit, Delay: 100 microseconds Reliability: 255/255, Load: 1/255, Min MTU: 1500 Hello interval: 5 sec, Hold time: 15 sec Next hello in: 3 secs Passive interface: No Split horizon: Enabled Authentication: None Neighbor count: 1 Interface: GigabitEthernet0/1 Mtu: 1500, Bandwidth: 100000 Kbit, Delay: 1000 microseconds Reliability: 255/255, Load: 1/255, Min MTU: 1500 Hello interval: 5 sec, Hold time: 15 sec Next hello in: 1 secs Passive interface: No Split horizon: Enabled Authentication: None Neighbor count: 1 Based on this output, what can be concluded?

A healthcare provider runs a Python script that issues a RESTCONF PATCH to a Cisco IOS XE switch to modify an interface description. The device returns HTTP 400 with an error-tag of 'invalid-value'. The JSON body is syntactically valid and the URI targets the correct interface. Which action most directly resolves this error?

A network engineer runs the following command on Router R1: R1# show ip eigrp topology EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.1.1.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 P 10.2.2.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 P 10.3.3.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 Based on this output, what can be concluded?

In Cisco SD-WAN, what is the maximum number of TLOCs that can be associated with a single OMP route?

Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.

A network engineer is deploying virtual switching for a hypervisor host. The requirement is that virtual machines on the same host can communicate with each other using Layer 2 frame forwarding without any traffic leaving the physical NIC, and that VLAN tags be enforced per port profile. Which Cisco technology should be used to meet these requirements?

What is the default port used by TACACS+ for communication?

Drag and drop each EAP method on the left to its matching authentication type on the right.

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

A network engineer is building a Python script that must retrieve the operational state of all interfaces from a Cisco IOS XE device using RESTCONF. The engineer sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state and receives an HTTP 401 Unauthorized response. The device is reachable, RESTCONF is enabled, and the correct credentials are being used in the request. What is the most likely cause of the 401 response?

A network administrator is configuring a new Cisco Catalyst switch and needs to assign a management IP address to VLAN 1. Which command is used to enter the interface configuration mode for VLAN 1?

A network engineer is deploying Cisco DNA Center in a brownfield network. The engineer wants to use DNA Center to automate the configuration of QoS policies across all access switches. After discovering the devices and adding them to Inventory, the engineer creates a QoS policy and assigns it to a site. However, when attempting to provision, DNA Center reports that the devices are in 'Compliance Error' state. What is the most likely reason?

Drag and drop the steps of DSCP re-marking at enterprise WAN edge into the correct order, from first to last.

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from the EVPN control plane. The underlay is OSPF, and BGP EVPN peering is established with the spine switches. Which command should the engineer use to verify that the switch is receiving EVPN Type-2 routes?

An engineer is configuring multicast on a Cisco router. The router receives multicast traffic from a source on interface GigabitEthernet0/0 and needs to forward it to receivers on interface GigabitEthernet0/1. The engineer enables PIM sparse mode on both interfaces and configures a static RP. However, the router does not create a multicast routing entry for the (S,G) pair. What is the most likely missing configuration?

Drag and drop each 802.11 standard on the left to its matching frequency band and maximum speed on the right.

Which two statements about REST API HTTP methods are true? (Choose two.)

A network engineer is designing a QoS policy for a WAN edge router. Voice traffic must be serviced with strict priority and guaranteed low latency, while a policer must limit voice to 30 percent of the interface bandwidth to prevent starvation of other queues. Which queuing mechanism should the engineer configure?

Drag and drop each BGP message type on the left to its matching function on the right.

A network engineer runs the following command on Switch SW7: SW7# show monitor session 7 Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20 Encapsulation : Native Ingress : Enabled Based on this output, what can be concluded?

Which two statements about IP SLA probe scheduling and operation states are true? (Choose two.)

Drag and drop the steps of stateless DHCPv6 address assignment steps into the correct order, from first to last.

Consider the following configuration: router eigrp 100 network 10.0.0.0 0.255.255.255 passive-interface default no passive-interface GigabitEthernet0/0 Which statement is true about this EIGRP configuration?

A network engineer runs the following command on Router R7: R7# show ip sla monitor statistics 6 Round Trip Time (RTT) for Index 6 Latest RTT: NoConnection/Busy/Timeout Latest Operation Start Time: 18:00:00.000 UTC Mon Mar 1 2021 Latest Operation Return Code: Timeout Number of successes: 0 Number of failures: 15 Over thresholds: 0 Based on this output, what is the status of the IP SLA operation?

Which three statements about OSPF route summarization are true? (Choose three.)

A network engineer runs the following command on Router R3: R3# show bgp vpnv4 unicast all summary BGP router identifier 10.0.0.3, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 1360 bytes of memory 6/5 BGP path/bestpath attribute entries using 840 bytes of memory 4 BGP AS-PATH entries using 112 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 3752 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65000 1000 1000 10 0 0 01:23:45 5 192.168.2.2 4 65000 800 800 10 0 0 00:45:12 3 Based on this output, what can be concluded?

Which of the following is a valid AP mode on Cisco 9800 WLCs that allows the AP to function as a standalone access point without controller management?

A network engineer is deploying a new Cisco Catalyst 9000 switch stack. The engineer wants to ensure that the stack uses the most efficient use of stack ports and provides the highest possible bandwidth between stack members. Which stacking technology and topology should be used?

A campus switch connects to an IP phone that has a PC daisy-chained behind it. The engineer wants the phone to reside in VLAN 100 and the PC in VLAN 200, with the phone tagging its own voice traffic. Which interface configuration accomplishes this?

Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.

Given this NAT configuration: ``` interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 ip nat outside ! ip nat inside source static 10.0.0.5 198.51.100.5 ``` What is the purpose of this configuration?

Which two statements about EtherChannel configuration and verification are true? (Choose two.)

Refer to the exhibit. Which OSPF route type is the default route?

A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics: GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 Accept: application/yang-data+json Response: { "ietf-interfaces:interface": [ { "name": "GigabitEthernet1", "type": "iana-if-type:ethernetCsmacd", "enabled": true, "ietf-ip:ipv4": { "address": [ { "ip": "192.168.1.1", "netmask": "255.255.255.0" } ] } } ] } What does the response indicate about the interface?

A network administrator is configuring a Cisco IOS zone-based firewall (ZBFW) on a router that connects a LAN zone to an Internet zone. The administrator wants to allow outbound HTTP and HTTPS from the LAN to the Internet while blocking all other outbound traffic, and to allow return traffic for established sessions. Which two configuration elements are required to accomplish this? (Choose two.)

Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.

A network engineer is migrating a physical server running a critical database to a virtual machine on a VMware vSphere cluster. The database requires high I/O performance and low latency. The engineer decides to use VMFS datastores with multiple extents to improve performance. After migration, the database performance is worse than on the physical server. What is the most likely reason?

Drag and drop the steps of Cisco ISE profiling and policy assignment flow into the correct order, from first to last.

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The TACACS+ server is reachable at 10.1.1.100. The administrator wants to ensure that if the TACACS+ server becomes unreachable, the router will fall back to local authentication using the local username 'admin' with password 'Cisco123'. Which configuration should be applied?

Consider the following DMVPN configuration on a hub router: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 no ip redirects ip nhrp map multicast dynamic ip nhrp network-id 100 tunnel source GigabitEthernet0/0/0 tunnel mode gre multipoint What is the effect of the command 'ip nhrp map multicast dynamic'?

Drag and drop the steps of a NETCONF get-config operation into the correct order, from first to last.

A network engineer is troubleshooting an STP issue in a switched network. The network has two distribution switches connected via a trunk, and each distribution switch connects to the same access switch. The engineer notices that the root bridge is not the intended distribution switch. Upon checking, the engineer sees that the access switch has a higher priority than the distribution switches. The engineer needs to ensure that the intended distribution switch becomes the root bridge without causing a temporary loop. What should the engineer do?

Which two statements about policing and shaping are true? (Choose two.)

A network administrator is deploying a virtual switch on a Cisco UCS B-Series blade server. The administrator wants the virtual switch to be managed by Cisco UCS Manager and to support Cisco VM-FEX so that virtual machine traffic is visible to the upstream fabric interconnects. Which virtual switch technology meets these requirements?

A network engineer is troubleshooting an EIGRP issue where two routers, R1 and R2, are directly connected. Neither router shows an EIGRP adjacency with the other. The engineer checks the interface configurations and finds that R1 has 'ip authentication mode eigrp 1 md5' and 'ip authentication key-chain eigrp 1 MYKEY' configured, while R2 has no authentication configured. What is the most likely cause?

Drag and drop the steps of LDP session establishment between LSRs into the correct order, from first to last.

Which two statements about the Cisco Enterprise Campus Architecture are true? (Choose two.)

Examine the following configuration snippet: interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip ospf hello-interval 20 ip ospf dead-interval 80 What is the effect of this configuration?

Which two statements about NAT configuration on Cisco IOS-XE are true? (Choose two.)

An enterprise is designing a QoS architecture for its WAN edge routers connecting to multiple service providers. The design must support traffic shaping to avoid packet drops due to provider policers, while also prioritizing real-time traffic. Which approach should the architect use to shape traffic to the contracted CIR while still allowing bursts?

A network engineer is configuring a VXLAN overlay. The underlay is an IP-routed network, and the engineer needs to ensure that the VXLAN tunnel endpoints can discover each other's VTEP IP addresses dynamically. Which technology should be used?

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. The engineer must ensure that BGP keepalives are never dropped even during a control-plane flood, while SSH and SNMP traffic should be rate-limited. Which CoPP configuration element accomplishes this requirement?

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook runs successfully on most switches, but one switch fails with an error indicating that the VLAN configuration command is not recognized. What is the most likely cause?

Which two statements about Cisco DNA Center software image management (SWIM) are true? (Choose two.)

A network engineer runs the following command on Router R4: R4# show ip pim rp mapping PIM Group-to-RP Mappings This system is an RP (Auto-RP) This system is an RP (BSR) Group(s) 224.0.0.0/4 RP 10.0.0.2 (?), v2v1 Info source: 10.0.0.2 (?), elected via Auto-RP, expires in 00:01:30 RP 10.0.0.3 (?), v2v1 Info source: 10.0.0.3 (?), elected via BSR, expires in 00:02:00 Based on this output, what can be concluded?

Examine the following configuration: policy-map MARKING class VOICE set dscp ef class VIDEO set dscp af41 class class-default set dscp default interface GigabitEthernet0/0 service-policy input MARKING Which statement is true?

Which BGP attribute is preferred when it has the lowest value?

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Drag and drop each OSPF area type on the left to its matching characteristic on the right.

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is that only SSH version 2 with a 2048-bit RSA key be accepted, that Telnet be disabled, and that only the 'netadmin' user with privilege level 15 be allowed to log in via VTY lines 0 through 4. Which configuration accomplishes this?

Drag and drop the steps of the CAPWAP discovery and join process between a lightweight AP and a WLC into the correct order, from first to last.

A network engineer is using Ansible to manage a fleet of Cisco IOS XE devices. The engineer wants to ensure that the playbook is idempotent and only makes changes when necessary. The playbook uses the ios_config module with a set of lines to configure an interface. After running the playbook, the engineer notices that the task always reports 'changed' even when the configuration is already present. What is the most likely reason for this behavior?

Drag and drop each data encoding format on the left to its typical use case on the right.

A network automation team is using YANG models with NETCONF to configure a Cisco IOS XE device. They want to change the description of a loopback interface. The engineer writes an <edit-config> RPC with the 'operation' attribute set to 'merge' on the <description> leaf. The RPC is accepted, but the description is not changed. The engineer verifies that the YANG path is correct and that the interface exists. What is the most likely reason the description was not updated?

A network engineer is configuring QoS on a Cisco switch to ensure that video traffic (DSCP AF41) is not dropped during congestion. The engineer creates a policy-map that sets the queue-limit for the AF41 class. However, the switch is still dropping video packets. What is the most likely cause?

A network engineer runs the following command on Router R8: R8# show ip dhcp server statistics Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 10 Manual bindings: 2 Expired bindings: 1 Malformed messages: 0 Message Received BOOTREQUEST 0 DHCPDISCOVER 100 DHCPREQUEST 95 DHCPDECLINE 1 DHCPRELEASE 2 DHCPINFORM 0 Based on this output, what can be concluded?

Which three statements about MPLS VPN (Layer 3 VPN) are true? (Choose three.)

Drag and drop the steps of configuring NETCONF YANG-based telemetry with on-change subscription into the correct order, from first to last.

A network engineer is configuring a new Cisco Wireless LAN Controller (WLC) and needs to ensure that the WLC can be managed remotely from a different subnet. The WLC is connected to a switch port that is configured as a trunk. Which interface on the WLC must be configured with an IP address to allow remote management?

A network engineer is deploying a Cisco SD-Access fabric using Cisco DNA Center. The design requires that wired users authenticate via 802.1X and be assigned to a specific overlay segment based on their department. Which Cisco SD-Access fabric component is responsible for authenticating the endpoint and assigning the endpoint to the correct overlay?

A network engineer is configuring a Cisco IOS switch and needs to ensure that a port connected to a server is placed into the forwarding state immediately when the link comes up, without going through the listening and learning states. The engineer also wants to protect against accidental loops if a switch is connected to that port. Which feature should be configured on the port?

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The engineer needs to ensure that the VXLAN overlay can carry traffic for multiple tenants while maintaining isolation. Which component is responsible for identifying the VXLAN segment and providing tenant isolation?

A network automation team is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The team writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script includes a valid authentication token in the headers, but the response returns a 403 Forbidden error. The token was obtained successfully using the /dna/system/api/v1/auth/token endpoint. What is the most likely reason for the 403 error?

A network engineer runs the following command on switch SW9: SW9# show cts role-based policy Role-based policy: Source Group Dest Group Action 10 20 PERMIT 10 30 DENY 20 30 PERMIT Based on this output, what can be concluded?

A company uses VRF-lite to separate management traffic (VRF MGMT) from user traffic (VRF USER) on a Cisco Catalyst 3850 stack. The management network is 10.0.0.0/24, and the user network is 192.168.1.0/24. The engineer wants to allow SSH access from the user network to the management network for device administration. The switch has an SVI for each VRF. What is the simplest way to achieve this while maintaining VRF isolation?

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

An engineer is configuring a new Cisco 9800 WLC in a branch office. The WLC will manage 50 APs and must provide guest access with a captive portal. The engineer configures a guest SSID with open authentication and a redirect ACL for the captive portal. However, after the configuration, clients can associate to the guest SSID but cannot reach the captive portal page. What is the most likely cause?

A network architect is designing a Cisco SD-Access fabric for a campus network. The architect wants to ensure that endpoints in the same virtual network can communicate with each other even when they are attached to different fabric edge nodes. Which control plane component is responsible for resolving endpoint location information across the fabric?

A network engineer is designing a high-availability campus network using Cisco StackWise Virtual technology on two Cisco Catalyst 9000 switches. The engineer wants to ensure that the control plane remains operational if one switch fails, and that the data plane can continue forwarding traffic with minimal disruption. Which statement accurately describes the operation of StackWise Virtual in this scenario?

A network engineer runs the following command on Router R6: R6# show ip bgp vpnv4 all summary BGP router identifier 10.0.0.6, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 800 bytes of memory 4/3 BGP path/bestpath attribute entries using 576 bytes of memory 2 BGP AS-PATH entries using 48 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory BGP using 2896 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.0.0.7 4 65001 1000 1000 10 0 0 00:20:00 5 10.0.0.8 4 65002 500 500 10 0 0 00:10:00 3 Based on this output, what can be concluded?

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-POLICY Class-map: ICMP-CLASS (match-all) 10 packets, 1000 bytes 5 minute offered rate 0 bps Match: access-group name ICMP-ACL police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 10 packets, 1000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: SSH-CLASS (match-all) 5 packets, 500 bytes 5 minute offered rate 0 bps Match: access-group name SSH-ACL police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 5 packets, 500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 20 packets, 2000 bytes 5 minute offered rate 0 bps Match: any police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 20 packets, 2000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, what can be concluded?

Which three statements about policing and shaping are true? (Choose three.)

A network engineer is configuring a Cisco IOS XE router to support NETCONF over SSH for automated configuration. The management application requires that the router expose a standards-based data model and that configuration changes be applied as complete, atomic transactions. Which action must the engineer take?

Which three statements about REST API authentication and security are true? (Choose three.)

Which two statements about queuing and congestion management are true? (Choose two.)

A network engineer is implementing VXLAN on a Cisco Nexus 9000 series switch running NX-OS. The underlay network uses OSPF and the loopback0 interface of each VTEP is advertised. The engineer wants to verify that the VXLAN tunnel endpoints can communicate. Which command should be used to check the VXLAN tunnel status?

A company is deploying a virtualized network function (VNF) for a Cisco CSR1000v router on a VMware vSphere hypervisor. The architect must choose the hypervisor type to ensure the best performance for the VNF. Which hypervisor type is VMware vSphere classified as, and why is it suitable for VNF deployment?

A network engineer needs to provide secure remote-access VPN connectivity for employees using Cisco AnyConnect. The requirement is to use digital certificates issued by the corporate PKI for both server and client authentication. Which component must be configured on the Cisco ASA to validate client certificates presented during the VPN session?

A security team wants to deploy MACsec on a Cisco Catalyst switch uplink between two buildings to protect Layer 2 traffic. The switches are Cisco Catalyst 9300 series running IOS XE, and the link must encrypt all frames between them. Which statement accurately describes a requirement for this deployment?

A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?

A network engineer issues the following command on Router R6: R6# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.168.1.100 10.0.0.10 --- --- --- 192.168.1.101 10.0.0.11 --- --- udp 192.168.1.100:1234 10.0.0.10:1234 203.0.113.5:53 203.0.113.5:53 tcp 192.168.1.101:80 10.0.0.11:80 198.51.100.2:443 198.51.100.2:443 Based on this output, what is true about the NAT translations?

A network engineer is writing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer wants to retrieve the current configuration of a specific interface. Which HTTP method and URI should be used?

Given the following configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip pim sparse-mode ip igmp version 3 What is the purpose of the 'ip igmp version 3' command?

Router R3 has the following OSPF configuration: router ospf 1 router-id 3.3.3.3 network 10.0.0.0 0.255.255.255 area 0 default-information originate always metric 20 metric-type 2 What is the effect of the 'default-information originate always' command?

Which three statements about the Multiple Spanning Tree Protocol (MSTP) are true? (Choose three.)

A network engineer is configuring a new Cisco Catalyst switch that will participate in a VTP domain. The switch must not be able to create, modify, or delete VLANs, but it must synchronize its VLAN database with the current VTP server. Which VTP mode should be configured on this switch?

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The engineer wants to ensure that the VXLAN traffic is encapsulated and forwarded correctly over the underlay network. Which statement describes the VXLAN encapsulation and forwarding process?

Drag and drop each SD-WAN policy type on the left to its matching application point on the right.

Drag and drop each syslog severity level on the left to its matching numeric value on the right.

A network engineer runs the following command on Router R5: R5# show ip route vrf CUSTOMER-A Routing Table: CUSTOMER-A Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 10.1.1.1 to network 0.0.0.0 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.1.1.0/24 is directly connected, GigabitEthernet0/0 B 10.2.2.0/24 [20/0] via 10.1.1.1, 00:10:20 Based on this output, what can be concluded?

Which three statements about Cisco DNA Center Assurance are true? (Choose three.)

Drag and drop each queuing mechanism on the left to its matching feature on the right.

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet that also contains a DHCP relay agent. The router must ensure that DHCP clients receive the correct default gateway address of 10.1.1.1, which is the router's own interface on that subnet. Which command is required to accomplish this?

Drag and drop each BGP path selection criterion on the left to its order of preference (1 = highest priority) on the right.

A network engineer is hardening a Cisco IOS XE router that terminates IPsec site-to-site tunnels with remote branches. The security policy requires that the router only accept IKEv2 negotiations using cryptographically strong parameters and that it validate peer identity via certificates issued by the corporate PKI. Which two configuration elements must the engineer apply to meet these requirements? (Choose two.)

A network engineer runs the following command on Router R4: R4# show interfaces tunnel 0 Tunnel0 is up, line protocol is up Hardware is Tunnel Internet address is 10.0.0.4/30 MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 192.168.1.4, destination 192.168.2.4 Tunnel protocol/transport GRE/IP Key disabled, sequencing disabled Checksumming of packets disabled Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out Based on this output, what is true about this tunnel?

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce role-based access control between endpoints without relying on IP addresses or VLANs, and they need to ensure that access policies are consistently applied even when endpoints move between switches. The administrator has already configured Cisco ISE for authentication and authorization. Which technology should be used to propagate the security group tag (SGT) information to network devices that do not support SGT tagging natively?

Which QoS mechanism is used to prevent congestion by dropping packets before a queue becomes full?

Drag and drop each protocol on the left to its matching characteristic on the right.

A network architect is designing a Cisco SD-Access fabric that spans two buildings. The fabric must support Layer 2 extension for a legacy application that requires broadcast traffic to reach hosts in both buildings. The architect plans to use a single fabric with two fabric edge nodes connected to a common control plane node. Which component of the SD-Access architecture is responsible for mapping endpoint identifiers to fabric edge nodes?

A network engineer must protect the OSPF adjacency between two Cisco routers from spoofed hello packets injected by a rogue device on the same broadcast segment. The engineer wants to use a cryptographic authentication method that is natively supported by OSPFv2 and does not rely on plain-text key exchange. Which configuration should be applied to the interfaces?

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and is managed over SSH. The administrator needs to protect the route processor from excessive BGP and SSH traffic without breaking the existing sessions. Which action should be taken when applying the CoPP policy?

Which three statements about DHCP snooping are true? (Choose three.)

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The administrator needs to verify which traffic classes are being matched and how many packets are being dropped by the policy. Which command should be used to display the CoPP policy statistics and class-map information?

A network engineer is troubleshooting a Cisco SD-WAN deployment where some branches experience intermittent packet loss. The engineer suspects that the issue is related to the control plane connections between vEdge routers and the vSmart controller. Which command should be used on a vEdge router to verify the status of the control connections?

Match each network automation tool to its purpose.

Which three statements about RADIUS server configuration and operation are true? (Choose three.)

A network engineer is configuring VXLAN on a Cisco Nexus switch. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) can forward traffic between hosts in the same VXLAN segment across the Layer 3 underlay. Which two statements are true about VXLAN operation? (Choose two.)

Which three statements about HTTP response status codes in REST APIs are true? (Choose three.)

A network engineer runs the following command on Router R7: R7# show ip ospf virtual-links Virtual Link OSPF_VL0 to router 2.2.2.2 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface GigabitEthernet0/1, Cost of using 10 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:07 Adjacency State FULL Based on this output, what can be concluded?

Which two statements about the QoS trust boundary on a Cisco switch are true? (Choose two.)

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

Drag and drop the steps of MPLS LDP label distribution and FIB population into the correct order, from first to last.

An architect is designing a virtualized service chain for a campus network using NFV. The chain must include a firewall, WAN optimizer, and IPS. The architect needs to minimize latency by placing VNFs on the same hypervisor host. Which design consideration is most important?

A network administrator is configuring a Cisco Catalyst switch to assign a voice VLAN to IP phones. The phones will tag voice traffic with VLAN 200, and data traffic from attached PCs should be untagged in VLAN 10. Which interface configuration correctly implements this?

Which three statements about NAT64 and NPTv6 are true? (Choose three.)

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

An engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The hub router is configured with a dynamic crypto map and a local pool for assigning IP addresses to spokes. The spokes are configured with a static crypto map and a tunnel interface with an IP address from the pool. The tunnel comes up, but the spoke cannot ping the hub's tunnel interface. The hub can ping the spoke's tunnel interface. What is the most likely cause?

Which three statements about trunking and VLAN pruning are true? (Choose three.)

Drag and drop the steps of DMVPN Phase 1 spoke-to-hub tunnel setup into the correct order, from first to last.

Drag and drop the steps of cisco.ios.ios_config module idempotent apply flow into the correct order, from first to last.

A network engineer is implementing IPsec VPN on a Cisco IOS XE router to connect a branch office to headquarters. The engineer must ensure that the IKEv2 negotiation uses strong authentication and that the data plane is protected with integrity and encryption. Which two configuration elements are required to achieve this? (Choose two.)

A network automation engineer is developing a Python script that will retrieve interface statistics from a Cisco IOS XE device using NETCONF. The engineer needs to discover which YANG models are supported by the device before constructing the RPC. Which NETCONF capability exchange message should the script send first to obtain this information?

Router R5 has the following OSPF configuration: router ospf 1 router-id 5.5.5.5 network 10.0.0.0 0.255.255.255 area 0 area 0 authentication message-digest ! interface GigabitEthernet0/0 ip address 10.1.1.5 255.255.255.0 ip ospf message-digest-key 1 md5 cisco123 What is missing from this OSPF authentication configuration?

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured for VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from other VTEPs. The underlay routing is working, and MP-BGP EVPN peering is established. Which configuration issue could prevent the switch from learning remote MAC addresses?

Which BGP attribute is preferred with the lowest value?

A network engineer is troubleshooting an EIGRP issue in a large enterprise network. Two routers, R1 and R2, are connected via a T1 link. R1 is learning a route to 10.0.0.0/8 from R2 with a metric of 28160, but the same route is also learned from another neighbor with a metric of 26880. The engineer notices that the route from R2 is not being installed in the routing table. What is the most likely cause?

Which THREE benefits does network automation provide over manual configuration?

Drag and drop each BGP attribute on the left to its matching attribute type on the right.

Drag and drop the steps of Flexible NetFlow flow record and exporter setup into the correct order, from first to last.

A company is using a dual-homed MPLS L3VPN connection with two different ISPs. The CE router is running eBGP with both PE routers. The engineer wants to ensure that inbound traffic from the Internet to the company's web servers uses both links, but outbound traffic from the company should prefer ISP A. The company advertises the same /24 prefix to both ISPs. What BGP configuration should the engineer apply on the CE router?

interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 mpls ip mpls label protocol tdp ! router ospf 1 network 10.1.1.0 0.0.0.255 area 0 ! router ldp interface GigabitEthernet0/1 ! Which statement about this configuration is true?

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

A network engineer runs the following command on a Cisco WLC: WLC# show ap stats ap-name AP-3 AP Statistics for AP-3 ---------------------- Channel Utilization: 75% Interference: 30% Noise Floor: -80 dBm Total Packets Received: 5000 Total Packets Sent: 4500 Total Errors: 1500 Based on this output, what can be concluded?

Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-POLICY Class-map: MGMT-CLASS (match-all) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: access-group name MGMT-ACL police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 80 packets, 4000 bytes; actions: transmit exceeded 15 packets, 750 bytes; actions: drop violated 5 packets, 250 bytes; actions: drop Class-map: class-default (match-any) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: any police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 200 packets, 10000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, what can be concluded?

A network engineer is troubleshooting a Connectivity issue between two data center switches. The engineer suspects a physical layer problem and wants to verify the cable and interface status. Which command should be used to check the status of all interfaces, including the link state and speed?

A network administrator is using the Cisco DNA Center Assurance application to troubleshoot a user's slow wireless experience. The administrator notices that the client's onboarding time is high and wants to see a detailed timeline of the client's onboarding process, including association, authentication, and DHCP phases. Which Cisco DNA Center Assurance feature provides this information?

A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is that the tunnel must support multicast traffic for OSPF neighbor adjacency across the VPN. Which IPsec configuration element is required to meet this requirement?

Given the following configuration on a Cisco IOS switch: interface GigabitEthernet0/6 switchport mode dynamic desirable What is the effect of this configuration?

A network engineer is evaluating Cisco SD-WAN (Viptela) for a large enterprise. The engineer needs to automate the deployment of vEdge routers using zero-touch provisioning. Which two components are required to enable zero-touch provisioning for vEdge routers? (Choose two.)

A network engineer is implementing VXLAN with an EVPN control plane in a data center. The engineer must ensure that the underlay network supports the required traffic and that the overlay provides optimal forwarding. Which two statements are true regarding this implementation? (Choose two.)

Drag and drop each VM storage type on the left to its matching characteristic on the right.

Drag and drop each DNA Center Intent API on the left to its matching use on the right.

A network architect is designing a new branch office that must support wired and wireless users on the same Layer 2 segment while enforcing consistent security policy regardless of where a user connects. The design must minimize the number of VLANs and IP subnets that must be provisioned as users move between floors. Which Cisco architecture feature should be used to meet these requirements?

A financial services firm wants to automate configuration backups of 200 Cisco IOS XE switches. The team prefers an imperative, script-driven approach where Python code calls a structured API and stores the retrieved configuration in a version-controlled repository. Which method best aligns with this goal?

Drag and drop the steps of VNF scaling up and scaling out steps into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.10 --- --- --- 203.0.113.11 192.168.1.11 --- --- tcp 203.0.113.10:1024 192.168.1.10:1024 198.51.100.5:80 198.51.100.5:80 Based on this output, what can be concluded?

A network engineer is troubleshooting intermittent packet loss on a WAN circuit connecting a branch office to headquarters. The engineer suspects the provider is not honoring the committed rate. Which tool should be used to measure one-way delay, jitter, and packet loss between the two sites and generate threshold-based alerts?

A network engineer is hardening a Cisco IOS XE router against control plane attacks. The router runs OSPF, BGP, and SSH management. The engineer wants to apply Control Plane Policing (CoPP) to rate-limit nonessential traffic while ensuring routing protocols are not disrupted. Which two actions should the engineer take? (Choose two.)

What is the maximum hop count for EIGRP?

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that carries eBGP, OSPF, SSH management, and SNMP traffic. The engineer wants to ensure that BGP and OSPF routing updates are never dropped while still rate-limiting SSH and SNMP. Which CoPP configuration approach best meets this requirement?

Drag and drop each MPLS label operation on the left to its matching action on the right.

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?

Drag and drop the steps of SD-WAN zero-touch provisioning (ZTP) flow into the correct order, from first to last.

A network architect is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches to replace a traditional three-tier data center design. The architect wants to use a distributed anycast gateway so that hosts can move between leaf switches without changing their default gateway. Which two statements correctly describe the anycast gateway design? (Choose two.)

Drag and drop the steps of EIGRP authentication using MD5 key-chain into the correct order, from first to last.

A Python script using Netmiko is written to send a command to a Cisco router: from netmiko import ConnectHandler device = { 'device_type': 'cisco_ios', 'ip': '192.168.1.1', 'username': 'admin', 'password': 'cisco', 'secret': 'enable' } connection = ConnectHandler(**device) connection.enable() output = connection.send_command('show ip interface brief') print(output) connection.disconnect() What is the potential issue with this script?

A network engineer issues the following command on Router R2: R2# show ip ospf interface GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Internet Address 192.168.1.2/24, Area 0 Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 2.2.2.2, Interface address 192.168.1.2 Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:03 Index 1/1/1, flood queue length 0 Next 0x0(0)/0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 2, Adjacent neighbor count is 2 Adjacent with neighbor 1.1.1.1 (Backup Designated Router) Adjacent with neighbor 3.3.3.3 Based on this output, what can be concluded?

Given the following Ansible playbook snippet: --- - name: Configure interface hosts: routers gather_facts: no tasks: - name: Set IP address ios_config: lines: - ip address 192.168.1.1 255.255.255.0 - no shutdown parents: interface GigabitEthernet0/1 What is the effect of this playbook?

Drag and drop each STP port role on the left to its matching definition on the right.

A network engineer configures a Cisco IOS router to authenticate administrative SSH logins against a Cisco ISE server using TACACS+. After applying the configuration, a valid ISE user can log in but receives no privilege level and cannot enter privileged EXEC mode. The relevant configuration is: aaa new-model aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local tacacs server ISE address ipv4 10.10.10.50 key Cisco123 Which action most directly resolves the problem?

A network engineer is implementing VXLAN on a Cisco Nexus switch. The engineer wants to ensure that the VXLAN tunnel endpoint (VTEP) can forward traffic between VLANs by mapping them to VNIs. Which component is responsible for the mapping of VLANs to VNIs on the VTEP?

A network engineer is configuring EIGRP on a router that connects to multiple remote sites via Frame Relay. The engineer wants to ensure that EIGRP does not form adjacencies over the Frame Relay interfaces to reduce overhead, but still wants to advertise the connected networks. The engineer applies the 'passive-interface' command to the Frame Relay interfaces. However, the remote sites stop receiving the routes. What is the most likely reason?

A network automation engineer is using the ncclient Python library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The engineer writes a script that establishes a NETCONF session and sends a <get-config> RPC. However, the script fails with an error indicating the source datastore is not specified. What should the engineer do to correct the script?

Consider this AAA configuration: aaa new-model aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa accounting exec default stop-only group tacacs+ tacacs-server host 10.0.0.1 key SecretKey tacacs-server host 10.0.0.2 key SecretKey What is the effect of the accounting command?

Which TWO statements are true about RESTCONF and NETCONF in a Cisco IOS XE environment? (Choose two.)

A network engineer is implementing Cisco TrustSec in a data center. The engineer wants to enforce security policies based on logical groupings of endpoints rather than IP addresses. Which component is used to assign a Security Group Tag (SGT) to traffic at the ingress point?

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

A network engineer is writing a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The script uses the <get-config> RPC with the source datastore set to 'running'. After running the script, the engineer receives a large XML response but needs to extract only the interface configuration. Which NETCONF capability allows the engineer to filter the response to include only specific configuration data?

An engineer is configuring a new switch stack using Cisco StackWise technology. The stack must be resilient to the failure of the active switch, and the engineer wants to ensure that the standby switch takes over with minimal disruption. The engineer has four switches in the stack. Which statement describes the role of the standby switch in a StackWise stack?

What is the default trust state of a Cisco IOS switch port when no 'mls qos trust' command is configured?

A network administrator is deploying a new Cisco Catalyst switch in a campus network. The administrator wants to enable a feature that automatically assigns a voice VLAN to Cisco IP phones connected to the switch, based on CDP or LLDP information. Which feature should be configured?

A network engineer is deploying a Cisco Nexus 9000 leaf-spine fabric with VXLAN EVPN. The design requires that all leaf switches act as VTEPs and that each leaf learn remote MAC addresses only from the fabric control plane rather than from data-plane flooding. Which configuration on the leaf switches accomplishes this requirement?

Given the following configuration: ip access-list extended FILTER permit tcp any host 10.1.1.1 eq 22 permit icmp any any echo-reply ! interface GigabitEthernet0/4 ip access-group FILTER in What traffic is permitted?

A network engineer is using Ansible to manage a group of Cisco IOS XE devices. The engineer wants to ensure that the playbook can securely connect to the devices without prompting for passwords and without storing passwords in plaintext in the playbook. Which method should be used to provide the credentials?

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is to ensure that only SSH version 2 is used for remote CLI access, and that Telnet is disabled. Which configuration achieves this?

A network administrator is troubleshooting a network issue using Cisco DNA Center Assurance. The administrator wants to identify which network devices are experiencing the highest number of errors, such as CRC errors and interface flaps. Which Assurance dashboard should the administrator use?

A network engineer is configuring a DMVPN Phase 3 deployment with EIGRP as the routing protocol. The hub router has multiple spoke routers behind a single physical interface. The engineer notices that spoke-to-spoke traffic is being forwarded through the hub instead of directly. The spoke routers have the correct NHRP and mGRE configuration. What is the most likely cause of this issue?

A network engineer is troubleshooting a Cisco Catalyst 9300 switch that is experiencing intermittent packet drops. The engineer suspects a hardware forwarding issue and needs to verify the status of the switch's forwarding ASIC and its associated resources. Which command should the engineer use to display the current ASIC and forwarding resource utilization?

A network engineer is using Cisco SD-WAN vManage APIs to automate the deployment of a new branch site. The engineer needs to retrieve a list of all devices in the overlay network. Which REST API endpoint should the engineer use?

What is the default STP hello timer value in seconds?

A network engineer runs the following command on Router R1: R1# show aaa sessions Total sessions since last reload: 5 Session Id: 1 Unique Id: 1 User Name: admin IP Address: 10.1.1.100 Idle Time: 0 Timeout: 0 Type: Login Method: RADIUS Session Id: 2 Unique Id: 2 User Name: jdoe IP Address: 10.1.1.101 Idle Time: 120 Timeout: 0 Type: Login Method: LOCAL Based on this output, what can be concluded?

A network engineer is configuring port security on a Cisco switch. The requirement is to allow only the first MAC address that appears on the port to be learned and to automatically disable the port if a violation occurs. The engineer configures 'switchport port-security mac-address sticky' but does not specify a maximum number of secure MAC addresses. After connecting a single host, the port works. However, when the host is replaced with a different device, the port is error-disabled. What is the most likely reason?

A network engineer is implementing Cisco TrustSec (CTS) with Security Group Tags (SGTs) using SXP (SGT Exchange Protocol). The engineer configures the switch as an SXP speaker and the Cisco ISE as an SXP listener. The engineer verifies that SXP peers are established. However, when the engineer checks 'show cts role-based sgt map', the SGT mappings for users are not present. What is the most likely cause?

A network engineer is configuring OSPF on a Cisco router. The router is connected to a broadcast network with multiple OSPF neighbors. The engineer wants to ensure that this router does not become the Designated Router (DR) or Backup Designated Router (BDR) on this network. Which configuration achieves this goal?

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) running AireOS in a branch office. The security policy requires that guest wireless clients be isolated from internal corporate clients and that guest traffic be tunneled back to a DMZ interface on the WLC. Which WLAN configuration element should the administrator use to meet these requirements?

A network engineer is configuring a new Cisco IOS router and needs to ensure that the router can be managed remotely via SSH. The engineer has already generated RSA keys and configured a username and password. Which additional command is required to enable SSH access on the VTY lines?

A network engineer is configuring a Cisco CSR 1000v router to support a virtual routing and forwarding (VRF) instance for a customer. The engineer wants to enable OSPFv2 within the VRF and ensure that OSPF routes are installed in the VRF's routing table. Which command is required to start the OSPF process for the VRF?

A network engineer runs the following command on Router R7: R7# show vrf brief Name Default RD Protocols Interfaces Mgmt-intf <not set> ipv4,ipv6 GigabitEthernet0/0 CUSTOMER-A 65001:100 ipv4 GigabitEthernet0/1.10 CUSTOMER-B 65001:200 ipv4 GigabitEthernet0/1.20 Based on this output, what can be concluded?

Given the following Ansible playbook snippet: --- - name: Configure VLAN hosts: switches gather_facts: no tasks: - name: Create VLAN 100 ios_vlan: vlan_id: 100 name: Engineering state: present Which statement is true about this playbook?

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast summary | include 10.0.1.5 10.0.1.5 4 65005 3456 3457 15 0 0 00:15:22 5 Based on this output, what can be concluded?

A network engineer is deploying a new branch office with a single Cisco Catalyst switch that will connect to the corporate network via a routed uplink. The switch must be able to forward traffic for VLANs 10, 20, and 30 over that single uplink to a router. The router interface is configured with subinterfaces and dot1Q encapsulation. Which switchport configuration should be applied to the uplink port?

A network administrator is using Cisco DNA Center to monitor the health of network devices. The administrator wants to see a summary of the overall network health and any issues that need attention. Which Cisco DNA Center feature provides this information?

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

A network engineer is deploying 802.1X on a Cisco switch with Cisco ISE as the RADIUS server. The engineer wants to allow devices that do not support 802.1X supplicant to connect to a guest VLAN. Which feature should be configured on the switch port to accomplish this?

A security team is hardening a Cisco IOS router that terminates IPsec site-to-site tunnels to several branch offices. The team wants to protect the control plane by rate-limiting and filtering traffic destined to the router's own CPU. Which two mechanisms are designed specifically for control plane protection on Cisco IOS? (Choose two.)

A network engineer runs the following command on Router R4: R4# show mpls ldp neighbor Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.54567 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 00:15:30 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.0.0.2 Addresses bound to peer LDP Ident: 10.0.0.2 192.168.1.1 Based on this output, what can be concluded?

A network administrator is configuring a new Cisco IOS switch. The administrator needs to assign switch port GigabitEthernet0/1 to VLAN 20 and ensure that the port is in access mode. Which command sequence is correct?

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Given the following configuration: policy-map MARKING_POLICY class CRITICAL_DATA set dscp af31 class BULK_DATA set dscp af11 class class-default set dscp default What is the effect of the set dscp default command in the class-default?

Which TWO STP features are used to improve convergence time after a topology change?

A data center architect is designing a virtualized environment to host critical applications. The design must maximize performance by allowing virtual machines (VMs) to directly access physical CPU cores and memory without hypervisor overhead for latency-sensitive workloads. Which hypervisor configuration should be used?

A small business has a single router connected to the internet and a switch for the LAN. They want to implement VLANs to separate guest and corporate traffic. The router has only one physical interface to the switch. The network engineer proposes using subinterfaces with 802.1Q trunking on the router interface. Which configuration step is required on the switch port connected to the router?

A network engineer is using Cisco DNA Center Assurance to monitor the health of a wireless network. The engineer notices that a particular access point is reporting a high number of client disconnects. Which feature in DNA Center Assurance would best help identify the root cause of these disconnects?

Drag and drop the steps of EtherChannel troubleshooting and verification into the correct order, from first to last.

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

A network security engineer is configuring an IPsec site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) and that the encryption is AES-256. Which combination of commands achieves this?

Drag and drop each RADIUS attribute on the left to its correct attribute number on the right.

A network engineer runs the following command on Router R3: R3# show ip route ospf Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set 10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks O IA 10.1.1.0/24 [110/20] via 192.168.1.1, 00:12:34, GigabitEthernet0/0 O 10.2.2.0/24 [110/10] via 192.168.1.2, 00:15:22, GigabitEthernet0/0 O E2 10.3.3.0/24 [110/20] via 192.168.1.3, 00:08:11, GigabitEthernet0/0 Based on this output, what can be concluded?

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

A network architect is designing a campus network that must support seamless mobility for wireless clients across Layer 3 boundaries. The design requires that clients retain their IP address when roaming between different subnets. Which Cisco technology should be implemented to achieve this?

A network administrator is configuring MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two switches. Which two statements about MACsec are true? (Choose two.)

A company is deploying an SD-Access fabric with multiple sites connected via a WAN. The design must allow inter-site traffic to be forwarded without requiring a full mesh of VXLAN tunnels between all edge nodes. Which fabric role should be used to interconnect the sites?

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?

Review the ACL configuration: ip access-list extended TEST permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 deny ip any any ! interface GigabitEthernet0/3 ip access-group TEST in What is missing or incorrect?

interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/0 overload What is the effect of this configuration?

A network engineer issues the following command on Router R5: R5# show ip pim interface Interface PIM Nbrs Hello DR DR Count Intvl Prior GigabitEthernet0/0 on 2 30 1 10.1.1.1 GigabitEthernet0/1 on 1 30 1 10.2.2.2 Loopback0 on 0 30 1 10.3.3.3 Based on this output, what can be concluded?

A network architect is evaluating Cisco StackWise Virtual for a pair of distribution switches. The design requires that the two switches appear as a single logical entity for Layer 2 and Layer 3 forwarding, and that they support Multichassis EtherChannel (MEC) to access switches. Which statement accurately describes a characteristic of Cisco StackWise Virtual?

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

What is the purpose of the 'police' command in a QoS policy-map?

A network administrator is examining the output of the show interfaces command on a switch and notices a high number of CRC errors on a Gigabit Ethernet port. What is the most likely cause of these errors?

A network security team is implementing Cisco TrustSec in a campus network. They need to deploy Security Group Tags (SGTs) and enforce policies using Security Group ACLs (SGACLs). Which two statements are true regarding SGT propagation and enforcement in this environment? (Choose two.)

Drag and drop each DHCP option on the left to its matching purpose on the right.

An engineer configures IP SLA 50 to monitor the response time of a TCP connection to a server at 10.1.1.1 on port 80. The operation is used to trigger a backup path. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 100 ms', but the server is actually down and not responding to TCP SYN packets. What is the most likely reason?

A network architect is designing a Cisco SD-WAN fabric for a company with 50 branch sites. The company requires that each branch have two WAN transports (MPLS and Internet) with per-application traffic steering, and that the fabric use a controller-based architecture for centralized policy. Which Cisco SD-WAN component is responsible for distributing fabric-wide policy and managing control plane connectivity?

Which three statements about virtual machine (VM) resource allocation and overcommitment are true? (Choose three.)

interface GigabitEthernet0/2 spanning-tree link-type point-to-point end What is the effect of this configuration?

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide segmentation for different user groups (employees, guests, contractors) while allowing them to share the same physical infrastructure. Which Cisco SD-Access component is responsible for enforcing group-based policies between endpoints?

Drag and drop each BGP path selection criterion on the left to its correct order of preference (1 = highest priority) on the right.

Which three statements about Cisco QoS policing and shaping are true? (Choose three.)

Drag and drop each data encoding format on the left to its matching use case on the right.

Examine the following interface configuration on a Cisco IOS-XE switch: ``` interface GigabitEthernet0/1 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security violation restrict switchport port-security mac-address sticky ``` What is the effect of this configuration?

Drag and drop each VNF category on the left to its matching example on the right.

A network engineer runs the following command on Router R5: R5# show ip nat translations Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80 Based on this output, what can be concluded?

Examine the following configuration snippet: interface GigabitEthernet0/1 ip access-group FILTER_IN in ! ip access-list extended FILTER_IN deny icmp any any echo permit ip any any What is the effect of this configuration?

Drag and drop the steps of SR-IOV configuration for VM network bypass into the correct order, from first to last.

A network engineer is deploying a new Cisco SD-Access fabric. The design includes underlay and overlay networks. Which two statements accurately describe the underlay network in a Cisco SD-Access fabric? (Choose two.)

A network administrator is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The administrator wants to identify whether the issue is related to the network or the application. Which two Assurance features should be used to gather relevant data? (Choose two.)

A network automation team is using the Cisco DNA Center Intent API to create a new site hierarchy and assign devices. The API call to create the site returns HTTP 202 Accepted, but a subsequent call to assign a device to that site fails with an error that the site does not exist. The team is polling the task endpoint but has not yet received a success status. What is the most likely explanation?

A network administrator is configuring a Cisco IOS router to act as a DHCP server for the 10.10.10.0/24 subnet. The router interface GigabitEthernet0/0 is configured with IP address 10.10.10.1/24. Which command is required to specify the DNS server address that will be provided to DHCP clients?

A network engineer is configuring a Cisco Catalyst 9000 switch for a new access layer. The engineer needs to enable a feature that allows the switch to authenticate endpoints using 802.1X and then assign them to a specific VLAN based on the result. Which Cisco feature should be configured to dynamically assign VLANs?

A network architect is designing a fabric that must support Layer 2 and Layer 3 connectivity for endpoints across multiple sites without stretching VLANs between them. The design requires a control plane that separates the endpoint identifier from the routing locator, allowing traffic to be tunneled over a routed underlay. Which Cisco architecture component provides this separation in an SD-Access fabric?

Consider the following Python script that uses the requests library to delete a VLAN via RESTCONF on a Cisco IOS-XE device: ```python import requests from requests.auth import HTTPBasicAuth url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/vlan=10' headers = { 'Accept': 'application/yang-data+json', 'Content-Type': 'application/yang-data+json' } auth = HTTPBasicAuth('admin', 'cisco') response = requests.delete(url, headers=headers, auth=auth, verify=False) print(response.status_code) ``` What is the expected outcome if the VLAN 10 exists?

Drag and drop the steps of configuring model-driven telemetry with gRPC on a Cisco IOS-XE device into the correct order, from first to last.

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

A network engineer is designing a WAN connection for a branch office that requires high availability and bandwidth aggregation. The branch has two internet connections from different ISPs. The engineer wants to use both links actively for load balancing and failover. Which design approach should be used?

Drag and drop the steps of Cisco IOS-XE mdt subscription via CLI configuration into the correct order, from first to last.

Which two statements about RESTCONF are true? (Choose two.)

A security architect is designing a Cisco TrustSec deployment for a campus network. The architect needs to ensure that security group tags (SGTs) are propagated across a Layer 2 trunk between two Catalyst switches that do not support SGACL enforcement. Which technology should be used to carry SGT information inline within the Ethernet frame?

Examine this configuration: aaa new-model aaa authentication login default local aaa authorization exec default local aaa accounting exec default start-stop group tacacs+ line vty 0 4 login authentication default privilege level 15 What is missing to ensure that VTY users are authenticated via TACACS+?

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

A network administrator must secure management access to a Cisco IOS XE router so that only SSH version 2 is accepted and Telnet is disabled on all VTY lines. Which configuration accomplishes this requirement?

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The router runs OSPF, BGP, SSH management, and NTP. The engineer wants to ensure that OSPF hello packets are always prioritized and that SSH traffic from the management subnet is rate-limited. Which two statements about the CoPP configuration are true? (Choose two.)

A network engineer is configuring QoS on a Cisco IOS router. The engineer needs to ensure that packets marked with DSCP AF31 are placed into a queue that guarantees at least 30% of the interface bandwidth during congestion, while allowing other traffic to use any remaining bandwidth. Which configuration should be used?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router has management SSH access, SNMP monitoring, and BGP peering. After applying the CoPP policy shown in the exhibit, the engineer notices that SNMP polling from the management station fails, while SSH and BGP remain operational. Which action should be taken to restore SNMP polling while maintaining control plane protection?

Drag and drop each SD-WAN controller on the left to its matching function on the right.

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

A network security engineer is configuring 802.1X on a Cisco Catalyst switch with Cisco ISE as the RADIUS server. The switch is configured with 'dot1x system-auth-control' and the interface is set to 'authentication port-control auto'. The engineer wants to allow a printer that does not support 802.1X to connect to the network by using MAC Authentication Bypass (MAB). Which additional configuration is required on the switch interface to enable MAB?

A network engineer is configuring VXLAN on a Cisco Nexus 9000 series switch. The underlay network is a routed Layer 3 network using OSPF. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) IP addresses are reachable across the underlay. Which statement describes the correct configuration for the VTEP source interface?

Drag and drop each EtherChannel port state on the left to its matching description on the right.

A network engineer is comparing YANG models used in Cisco IOS XE automation. The engineer needs to distinguish between standard IETF YANG models and Cisco-specific YANG models. Which two statements accurately describe these YANG model types? (Choose two.)

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing intermittent connectivity drops. The administrator wants to view the historical trend of the client's connectivity and identify the root cause. Which Cisco DNA Center Assurance feature should the administrator use?

An engineer is troubleshooting a connectivity issue between two switches, SW1 and SW2, connected via a trunk. The trunk is configured with switchport mode trunk on both sides. The engineer notices that some VLANs are not passing traffic, even though they are in the allowed list. The output of 'show interfaces trunk' on SW1 shows that VLANs 10, 20, and 30 are in the allowed list and are active. However, hosts in VLAN 30 cannot reach the distribution switch. What is the most likely cause?

Drag and drop each Netmiko device type on the left to its matching OS on the right.

An architect is designing an SD-WAN policy to ensure that real-time video traffic from headquarters to branch offices is always sent over the most reliable transport, while all other traffic uses the least-cost path. Which type of policy should be used to achieve this?

A network engineer is implementing VXLAN with Cisco SD-Access. The engineer must ensure that the underlay network provides the necessary transport for VXLAN traffic. Which two statements about VXLAN and its underlay are true? (Choose two.)

Drag and drop each STP variant on the left to its matching IEEE standard on the right.

Which two statements about BGP route selection are true? (Choose two.)

An engineer must secure the management plane of a Cisco IOS XE router so that only SSH version 2 is accepted for remote administration, while Telnet and SSHv1 are rejected. Which set of commands accomplishes this?

A company has a requirement to provide redundancy for the default gateway on a subnet. Two switches are configured with HSRP. Which requirement must be met for the interfaces on the switches to form the HSRP group?

An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?

A network engineer configures IP SLA 60 to monitor the jitter of a VoIP call path between two sites. The operation uses UDP jitter with a target of 192.168.3.3 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 10 ms', but the jitter values are all zero. The remote router has an IP SLA responder configured. What is the most likely cause?

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet. The engineer wants to exclude a range of addresses from being assigned dynamically. Which command should be used?

Which three statements about NFV MANO (Management and Orchestration) are true? (Choose three.)

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch series to secure Layer 2 traffic between two switches. Which two statements about MACsec operation are true? (Choose two.)

Which two statements about telemetry subscription types in model-driven telemetry are true? (Choose two.)

A network engineer is new to automation and wants to use a Python library that provides a simple, high-level interface for interacting with network devices, including Cisco IOS XE, without dealing with low-level SSH or NETCONF details. The engineer needs to quickly script configuration changes and command execution. Which Python library is best suited for this requirement?

Given this configuration on a Cisco IOS-XE router: crypto ikev2 keyring KEYRING peer SPOKE1 address 192.168.2.1 pre-shared-key cisco123 ! crypto ikev2 profile IKEV2_PROF match identity remote address 192.168.2.1 255.255.255.255 authentication remote pre-share authentication local pre-share keyring KEYRING ! What is missing from this configuration for a successful IKEv2 tunnel to the peer at 192.168.2.1?

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not advertising EVPN routes for a specific VNI. The NVE interface is up, and the VNI is configured. Which action should the engineer take to verify that the VNI is properly associated with the EVPN control plane?

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE device that is part of a DNA Center managed fabric. The telemetry subscription configuration is: telemetry ietf subscription 101 encoding encode-kvgpb filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization stream yang-push update-policy periodic 500 receiver ip address 10.10.10.10 port 5555 protocol grpc-tcp What is the purpose of the 'encoding encode-kvgpb' line?

A network administrator is configuring a Cisco IOS router to participate in a First Hop Redundancy Protocol group. The requirement is that the group must use a virtual MAC address of 0000.0c07.acXX and support only IPv4. Which protocol should the administrator configure?

A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to the data center. The engineer suspects that the issue is related to the Bidirectional Forwarding Detection (BFD) configuration on the WAN Edge routers. Which Cisco SD-WAN component is responsible for establishing BFD sessions between WAN Edge routers?

A network engineer runs the following command on switch SW7: SW7# show authentication registrations Authentication Method Registrations: Method Priority Type dot1x 10 Interface mab 20 Interface webauth 30 Interface Based on this output, what can be concluded?

A network engineer is configuring a Switched Port Analyzer (SPAN) session on a Cisco Catalyst switch to capture traffic from a specific VLAN. Which configuration command is required to monitor all traffic on VLAN 10 and send it to a destination port?

Drag and drop the steps of DNA Center site hierarchy creation into the correct order, from first to last.

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs BGP, OSPF, SSH management, and SNMP. After applying a CoPP policy that rate-limits all control-plane traffic to 1000 pps, BGP sessions flap and OSPF adjacencies reset during peak traffic. Which action should the engineer take to resolve the problem while maintaining control-plane protection?

Which three statements about Cisco DNA Center software image management are true? (Choose three.)

Which two statements about Cisco SD-WAN overlay routing and OMP are true? (Choose two.)

A network engineer is designing a QoS policy for a Cisco Catalyst switch. The requirement is to ensure that a specific class of traffic receives a guaranteed minimum bandwidth during congestion while still allowing other classes to use excess bandwidth when available. Which queuing mechanism should the engineer configure?

A network administrator is configuring a switch port to support a VoIP phone and a PC connected to the phone's internal switch. The phone must be placed in VLAN 50 and the PC in VLAN 60. Which configuration on the switch port achieves this?

A network engineer is using the Cisco Meraki Dashboard API to automate the creation of VLANs across multiple networks. The engineer writes a Python script that uses the 'createNetworkVlan' endpoint. The script runs successfully for the first few networks, but then starts returning HTTP 429 errors. The engineer checks the API documentation and finds that the Meraki API has rate limits. The script currently sends requests as fast as possible. What should the engineer implement to avoid hitting the rate limit?

A network engineer is deploying a Cisco Wireless LAN Controller (WLC) in a centralized deployment mode. The engineer needs to ensure that guest traffic is isolated from internal traffic and that guests can only access the internet. Which feature should be configured on the WLC to meet these requirements?

Drag and drop each NAPALM getter on the left to its matching returned data on the right.

Which three statements about EIGRP named mode configuration are true? (Choose three.)

A network administrator is deploying Cisco ACI in a data center. The administrator must configure a bridge domain that allows Layer 2 connectivity between endpoints in the same tenant while also providing Layer 3 gateway services. The design requires that the bridge domain support both unicast routing and unknown unicast flooding. Which two settings must be enabled on the bridge domain to meet these requirements? (Choose two.)

Which two statements about Ansible modules and idempotency are true? (Choose two.)

A network engineer is configuring an EtherChannel between a Cisco switch and a server that supports LACP. The switch ports are configured as trunk ports allowing multiple VLANs. The engineer wants to ensure the EtherChannel forms automatically without manual intervention. Which configuration should be applied on the switch?

Which two statements about VRF-aware services are true? (Choose two.)

Examine the following configuration on a Cisco IOS-XE router: ip multicast-routing distributed ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip pim sparse-dense-mode ip igmp version 2 ! Which statement about this configuration is true?

Drag and drop the steps of IP Source Guard binding and enforcement into the correct order, from first to last.

A network engineer has configured a Cisco IOS IP SLA operation with an ICMP echo probe to monitor reachability of a remote branch router. The engineer wants to automatically remove a static route from the routing table when the probe fails. Which feature should be configured to achieve this?

Drag and drop the steps of NFV MANO (VNFM/NFVO/VIM) interaction flow into the correct order, from first to last.

Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.

Given this OSPF configuration: router ospf 1 router-id 1.1.1.1 network 192.168.1.0 0.0.0.255 area 0 network 10.0.0.0 0.255.255.255 area 1 default-information originate always What is the effect of the 'default-information originate always' command?

A network engineer is implementing VXLAN with an EVPN control plane. The underlay is a routed Layer 3 network. Which statement describes the role of the VXLAN Tunnel Endpoint (VTEP)?

Which TWO features are part of Cisco TrustSec for providing role-based access control?

A network engineer needs to programmatically retrieve the operational status of all GigabitEthernet interfaces on a Cisco IOS XE device. The engineer wants to use a REST-based protocol that returns data in JSON and uses HTTP methods. The device is configured with 'restconf' and 'ip http secure-server'. Which protocol should the engineer use?

Given the following configuration: interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip access-group 101 in ! access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 101 deny ip any any What is the effect of this configuration?

A service provider is deploying NFV to host virtual network functions (VNFs) such as firewalls, routers, and WAN optimizers on a single server. The design must support service chaining, where traffic flows through multiple VNFs in a specific order, and must allow dynamic insertion of new VNFs without re-cabling. Which technology should be used to implement the service chain?

Which two statements about Cisco DNA Center integration with Cisco SD-Access are true? (Choose two.)

Drag and drop the steps of SD-Access fabric node onboarding into DNA Center into the correct order, from first to last.

Drag and drop the steps of SD-WAN edge device (vEdge/cEdge) bring-up sequence into the correct order, from first to last.

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Examine the following AAA configuration snippet: aaa new-model aaa authentication login default local aaa authentication login CONSOLE local aaa authorization exec default local aaa accounting exec default start-stop group tacacs+ line con 0 login authentication CONSOLE line vty 0 4 login authentication default What is the effect of this configuration?

Drag and drop the steps of using a REST API to retrieve interface statistics from a Cisco device into the correct order, from first to last.

Which two statements about network design for high availability are true? (Choose two.)

Which two statements about Cisco SD-WAN control plane components are true? (Choose two.)

Examine this configuration: interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8::1/64 ipv6 ospf 1 area 0 What is the effect of the 'ipv6 ospf 1 area 0' command?

A network administrator is deploying 802.1X on Cisco Catalyst access switches with Cisco ISE as the RADIUS server. The design requires that devices failing authentication be placed into a restricted VLAN, and that IP phones be authenticated before the attached PC. Which two features must be configured to meet these requirements? (Choose two.)

In Cisco SD-WAN, what is the default OMP hello interval (in seconds) between a vEdge router and a vSmart controller?

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

A network engineer is deploying a new virtualized application on a VMware vSphere cluster. The application requires dedicated CPU cores to meet licensing requirements, and the engineer must ensure that no other virtual machine can use those cores. The cluster uses VMware ESXi 7.0. Which configuration should the engineer apply to the virtual machine?

A network engineer runs the following command on Switch SW1: SW1# show vlan id 10 VLAN ID: 10 VLAN Name: Sales VLAN Type: Ethernet VLAN State: active MTU: 1500 Remote SPAN VLAN: No Primary VLAN ID: 10 Private VLAN Type: Primary Associated Secondary VLAN IDs: 100, 200 Based on this output, what can be concluded?

A network engineer is configuring a Cisco Nexus 9000 switch in VXLAN EVPN mode. The engineer wants the leaf switch to advertise the local MAC addresses and IP addresses of hosts in a VLAN to remote leaf switches so that Layer 2 and Layer 3 forwarding can occur without flooding. Which EVPN route type must the engineer ensure is advertised for this purpose?

Which two statements about NetFlow are true? (Choose two.)

Drag and drop each ACL type on the left to its matching capability on the right.

An engineer is designing a Layer 2 network with redundancy. The network uses MST (Multiple Spanning Tree) to reduce the number of STP instances. The engineer has configured two regions: Region 1 and Region 2. The engineer notices that switches in Region 1 are not forming a single MST region, and instead, they are treating each other as if they are in different regions. The engineer checks the configuration and finds that the region name and revision number are the same on all switches in Region 1, but the VLAN-to-instance mapping is different on one switch. What is the most likely cause of the issue?

A network engineer uses the following Python script with Netmiko to send a command to a Cisco IOS-XE device: ```python from netmiko import ConnectHandler device = { 'device_type': 'cisco_ios', 'ip': '10.1.1.1', 'username': 'admin', 'password': 'password', 'secret': 'enable_secret' } connection = ConnectHandler(**device) output = connection.send_command('show ip interface brief') print(output) connection.disconnect() ``` What is the purpose of the 'secret' parameter in the device dictionary?

A large enterprise has a campus network with a collapsed core design. The core switch connects to two distribution switches, each serving several access switches. The network uses OSPF as the IGP. Recently, after a link failure between the core and distribution switch A, the network experienced a 30-second outage before converging. The engineer wants to improve convergence time to under 5 seconds. The budget is limited, so hardware upgrades are not an option. The engineer is considering the following actions: A. Enable OSPF Fast Hello on all interfaces. B. Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds. C. Implement OSPF LSA throttling with a minimum interval of 0 ms. D. Use OSPF incremental SPF (iSPF). Which action will provide the most significant improvement in convergence time for this scenario?

A network engineer is deploying a new branch office that uses Cisco SD-Access. The fabric must support both wired and wireless clients, with a single control plane that provides host tracking, location, and policy enforcement. Which fabric component is responsible for these functions?

A network administrator is configuring a Cisco Catalyst 9000 switch to participate in a StackWise Virtual configuration. The administrator wants to ensure that the switch is ready to be added to an existing StackWise Virtual domain. Which command must be issued on the new switch before it can join the domain?

Which three statements about queuing and congestion avoidance in a QoS architecture are true? (Choose three.)

A network engineer is deploying MACsec on a Cisco Catalyst 9300 switch to secure a point-to-point link between two access switches. The engineer configures the switchport with the macsec command and a pre-shared key. After applying the configuration, the link comes up but MACsec is not encrypting traffic. Which action should the engineer take to resolve the issue?

Given the following Ansible playbook snippet: --- - name: Configure OSPF hosts: routers gather_facts: no tasks: - name: OSPF config ios_config: lines: - router ospf 1 - network 10.0.0.0 0.255.255.255 area 0 parents: router ospf 1 What is wrong with this playbook?

Given the following configuration: aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius local aaa accounting exec default start-stop group radius radius-server host 192.168.1.100 key Cisco123 radius-server host 192.168.1.101 key Cisco123 Which statement is true about this configuration?

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Which THREE are common causes of high CPU utilization on a Cisco Catalyst switch? (Choose three.)

Drag and drop the steps of MST region configuration and operation into the correct order, from first to last.

A network administrator is deploying 802.1X on Cisco Catalyst switches with Cisco ISE as the RADIUS server. The administrator wants to allow devices that do not support 802.1X, such as printers, to connect to the network. Which feature should be configured on the switch ports to support these devices while maintaining security?

Drag and drop the steps of Control Plane Policing (CoPP) rate-limit evaluation into the correct order, from first to last.

Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.

Router R6 has the following OSPF configuration: router ospf 1 router-id 6.6.6.6 network 192.168.0.0 0.0.255.255 area 0 passive-interface default no passive-interface GigabitEthernet0/0 ! interface GigabitEthernet0/0 ip address 192.168.1.6 255.255.255.0 ip ospf 1 area 0 What is the effect of the 'passive-interface default' command?

Which two statements about Cisco DNA Center automation workflows are true? (Choose two.)

Which three statements about NAT traversal and translation are true? (Choose three.)

A network engineer is configuring a Cisco IOS router to support NAT for a small office. The inside network uses the 192.168.1.0/24 subnet, and the outside interface is GigabitEthernet0/0 with IP address 203.0.113.5. The engineer wants to translate all inside addresses to the outside interface address. Which command is required to define the NAT source list?

Consider the following configuration: router bgp 65000 bgp router-id 192.168.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 ebgp-multihop 2 neighbor 10.0.0.2 update-source Loopback0 ! interface Loopback0 ip address 192.168.0.1 255.255.255.255 What is missing for this BGP session to establish?

Drag and drop the steps of Netmiko multi-threaded device polling workflow into the correct order, from first to last.

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

A network engineer is designing a high-availability campus network using Cisco StackWise Virtual. The engineer wants to ensure that if the virtual link fails, the switches do not both become active and cause a split-brain scenario. Which mechanism should be implemented to detect and prevent a dual-active situation?

Drag and drop the steps of syslog message generation and storage into the correct order, from first to last.

Drag and drop the steps of MPLS L2VPN (AToM) pseudowire setup into the correct order, from first to last.

A network engineer is designing an EIGRP network with multiple routers. The network has a core layer where all routers are fully meshed. The engineer wants to ensure that if a link fails, EIGRP converges quickly without relying on route redistribution or static routes. The engineer configures EIGRP with default timers. However, during a failure simulation, convergence takes over 15 seconds. What is the most likely reason?

A network administrator is deploying a new Cisco Catalyst switch and wants to enable a feature that provides per-port MAC address limiting to prevent MAC flooding attacks. The administrator also wants to ensure that when the limit is exceeded, the port is err-disabled. Which command set accomplishes this?

A network engineer is configuring QoS on a Cisco IOS XE router. The router must mark all ingress traffic from a specific subnet with DSCP AF31 and ensure that this marking is trusted throughout the network. Which configuration step is required to achieve this?

A network administrator is configuring a Cisco IOS router to use VRRP. The router should be the master for the virtual IP 192.168.1.1 on interface GigabitEthernet0/0. The administrator wants to ensure that if this router fails, another router takes over with minimal delay. Which command should be used to set the priority to 150?

An engineer is configuring a Cisco Catalyst switch with VXLAN to extend Layer 2 connectivity between two data centers. The switch will act as a VXLAN Tunnel Endpoint (VTEP) and must encapsulate traffic from VLAN 10 into VXLAN VNI 10010. Which command is required to map the VLAN to the VNI?

A network engineer is configuring OSPF on a multiaccess network. The engineer wants to ensure that only two specific routers become DR and BDR, and that other routers do not participate in the election. Which OSPF interface setting should be configured on the routers that should not become DR or BDR?

A network engineer is implementing QoS on a Cisco IOS router. The engineer wants to ensure that VoIP traffic is marked with DSCP EF and that the router prioritizes this traffic during congestion. Which mechanism should be used to provide priority queuing for VoIP?

A network engineer runs the following command on Switch SW1: SW1# show etherchannel summary Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Based on this output, what can be concluded?

A REST API call is made to Cisco DNA Center to get the list of network devices: GET /dna/intent/api/v1/network-device Headers: X-Auth-Token: <token> The response is: { "response": [ { "id": "123456", "managementIpAddress": "10.10.10.1", "platformId": "C9300-24P", "role": "ACCESS" } ], "version": "1.0" } What does this response indicate?

Drag and drop the steps of Netconf/Yang-based device monitoring subscription into the correct order, from first to last.

A company is deploying a new wireless network in a large warehouse. The network engineer must choose between using a centralized WLC architecture (with CAPWAP tunnels) or a converged access (SD-Access) wireless architecture. The warehouse has high-density client areas and requires low latency for real-time applications like voice and video. Which architecture should the engineer choose and why?

Consider the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet1/0/1 switchport mode access authentication port-control auto dot1x pae authenticator dot1x timeout tx-period 5 spanning-tree portfast What is the effect of this configuration?

A network security team is hardening a Cisco IOS XE router that terminates IPsec tunnels to remote branch offices. The team wants to use zone-based firewall (ZBFW) to inspect traffic between the inside, outside, and VPN zones. Which two statements correctly describe zone-based firewall behavior on this platform? (Choose two.)

interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip ospf network broadcast ip ospf priority 0 ! router ospf 1 network 192.168.1.0 0.0.0.255 area 0 What is the effect of setting the OSPF priority to 0 on this interface?

A network engineer is planning to use Cisco DNA Center to automate the deployment of a new branch office. The engineer has already discovered the devices and added them to Inventory. The engineer wants to use a template to configure the devices consistently. Which tool in DNA Center should the engineer use to create and apply the template?

Examine the following configuration: interface Port-channel1 switchport mode trunk ! interface GigabitEthernet0/1 switchport mode trunk channel-group 1 mode active spanning-tree portfast ! interface GigabitEthernet0/2 switchport mode trunk channel-group 1 mode active spanning-tree portfast What is the effect of the 'spanning-tree portfast' command on the member interfaces of this EtherChannel?

Which THREE of the following are valid considerations when planning a wireless network for high-density environments?

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write playbooks in YAML and use SSH for connectivity. Which tool should the engineer choose?

A network administrator is configuring a Cisco Catalyst switch and needs to assign a port to VLAN 20 as an access port. Which command sequence is correct?

A network engineer is implementing VXLAN with BGP EVPN on Cisco Nexus switches. The underlay network is OSPF, and the overlay uses MP-BGP EVPN. The engineer wants to ensure that the VXLAN tunnel endpoints (VTEPs) can discover each other and exchange MAC and IP address information. Which statement correctly describes the role of the BGP EVPN address family in this scenario?

A network automation team uses a Python script with the ncclient library to configure a Cisco IOS XE router via NETCONF. The script sends an <edit-config> RPC with a candidate datastore, but the router returns an error indicating the candidate datastore is not supported. The team wants to make configuration changes without affecting the running configuration until they are verified. Which NETCONF capability should the team ensure is enabled on the router to allow this workflow?

A network security team is evaluating Cisco TrustSec (CTS) for deployment in a campus network. The team wants to understand which components are essential for enforcing security group tags (SGTs) and providing role-based access control. Which two of the following are required to implement CTS with SGT enforcement? (Choose two.)

A network administrator is configuring a Cisco Catalyst switch to support a new VLAN 200 for a guest network. The administrator wants to ensure that VLAN 200 is created and active on the switch. Which command should be used?

A network engineer runs the following command on Router R8: R8# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 Based on this output, what can be concluded?

A network engineer runs the following command on Switch SW5: SW5# show running-config | section interface port-channel interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 1-100,200-300 ! interface Port-channel2 switchport mode access switchport access vlan 10 ! SW5# show interfaces trunk Port Mode Encapsulation Status Native vlan Po1 on 802.1q trunking 1 Port Vlans allowed on trunk Po1 1-100,200-300 Port Vlans allowed and active in management domain Po1 1-100,200-300 Port Vlans in spanning tree forwarding state and not pruned Po1 1-100,200-300 Based on this output, what can be concluded?

A network administrator is configuring a Cisco IOS XE device to send syslog messages to a remote server. The administrator wants to ensure that only messages with severity level 4 and higher (i.e., more severe) are sent. Which command should be used?

A network engineer is configuring a pair of Catalyst switches to run VRRP on VLAN 10 (10.10.10.0/24). The virtual IP must be 10.10.10.1 with a priority of 110 on the primary switch and 100 on the standby. The primary switch is currently active. Which configuration on the primary switch correctly sets the VRRP priority and virtual IP?

A network engineer runs the following command on Router R1: R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.0.0.2 1 FULL/DR 00:00:32 192.168.1.2 GigabitEthernet0/0 10.0.0.3 1 2WAY/DROTHER 00:00:35 192.168.1.3 GigabitEthernet0/0 Based on this output, what can be concluded?

A network automation engineer is using the Python 'ncclient' library to manage a Cisco IOS XE device via NETCONF. The engineer wants to retrieve the running configuration. Which NETCONF operation should be used to accomplish this?

A network engineer is deploying a virtual WAN edge device using Cisco SD-WAN on an NFVIS platform. After powering on the VM, the device fails to boot and the NFVIS console shows 'ERROR: No bootable device found'. The engineer verified that the ISO image is correctly uploaded. What is the most likely cause?

A network engineer issues the following command on a router: R1# show tacacs TACACS+ Server: 10.1.1.10/49 Socket opens: 5 Socket closes: 3 Socket aborts: 0 Total packets sent: 10 Total packets received: 9 Retransmissions: 1 Timeouts: 1 Current idle time: 30 seconds Based on this output, what can be concluded?

An organization uses Ansible to manage network device configurations. They have a playbook that uses the ios_command module to execute 'show ip route' on multiple routers and then uses the 'debug' module to print the output. Recently, the playbook started failing with 'Timeout (12s) waiting for privilege escalation prompt'. The routers are reachable and SSH credentials are correct. What is the most likely cause?

Drag and drop the steps of Metro Ethernet E-Line service provisioning into the correct order, from first to last.

A network engineer runs the following command on Router R6: R6# show mpls ldp neighbor 10.6.6.7 detail Peer LDP Ident: 10.6.6.7:0; Local LDP Ident 10.6.6.6:0 TCP connection: 10.6.6.7.646 - 10.6.6.6.179 State: Oper; Msgs sent/rcvd: 200/195; Downstream Up time: 1d04h LDP discovery sources: Targeted Hello 10.6.6.6 -> 10.6.6.7, active, passive Addresses bound to peer LDP Ident: 10.6.6.7 192.168.6.7 Hold time: 15 seconds; keepalive interval: 5 seconds Peer hold time: 15 seconds; keepalive interval: 5 seconds Based on this output, what type of LDP session is this?

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

A network architect is designing a new branch office that requires a lightweight, scalable solution for device onboarding and policy enforcement. The branch has minimal on-site IT staff and must integrate with the existing Cisco DNA Center deployment at headquarters. Which Cisco SD-Access fabric role is responsible for providing the layer 3 gateway and policy enforcement for wired and wireless endpoints in this branch?

Drag and drop each streaming telemetry mode on the left to its matching trigger on the right.

An engineer is configuring QoS on a Cisco ASR 1000 router to support three traffic classes: voice (EF), video (AF41), and data (default). The link is a 50 Mbps Ethernet circuit. The engineer wants to guarantee 10 Mbps for voice, 20 Mbps for video, and the remaining for data. The current policy uses bandwidth percent statements. During congestion, voice traffic is not receiving its guaranteed bandwidth. What is the most likely cause?

Drag and drop each VRF component on the left to its matching function on the right.

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce access policy based on a device's role rather than its IP address, so that the enforced policy remains consistent even when endpoints move between VLANs or subnets. Which Cisco TrustSec component is responsible for assigning and carrying this role-based identity through the network?

Consider the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet0/3 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 1 What is the effect of this configuration?

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

A network engineer is deploying Cisco SD-Access and wants to ensure that traffic from employee endpoints is tunneled to a fabric border node for external connectivity. Which component is responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border?

A network engineer is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF) for a multi-tenant environment. The engineer wants to ensure that traffic from each tenant is isolated and that overlapping IP addresses can be used. Which command is used to create a VRF instance and enter VRF configuration mode?

A network administrator is deploying a new Cisco SD-WAN solution. The administrator needs to ensure that the control plane is separated from the data plane and that the solution can dynamically select the best path for application traffic based on policies. Which component of Cisco SD-WAN is responsible for centralized control plane functions and distributing routing information to the WAN Edge devices?

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

A network security team deploys Cisco ISE for 802.1X wired authentication. The switches are configured with MAB as a fallback. A printer that does not support 802.1X is connected, but ISE rejects it even though the printer's MAC address is in the correct identity group. The switch port shows the authentication method as MAB and the status as unauthorized. Which configuration issue is the most likely cause?

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The design requires that only traffic from specific subnets be encrypted and that the routers use a preshared key for authentication. Which combination of configuration elements must the administrator define to match the interesting traffic and establish the tunnel?

A network engineer is troubleshooting an EtherChannel between two Cisco switches. The show etherchannel 1 port-channel command shows the port-channel is up, but traffic is not load-balanced evenly. The engineer notices that all traffic is using only one link. The physical ports are all configured identically. What is the most likely cause?

A network administrator is troubleshooting a connectivity issue between two switches connected via a trunk link. The trunk is configured with 802.1Q encapsulation. The administrator suspects that the native VLAN is mismatched. Which command displays the native VLAN configuration on a Cisco Catalyst switch?

A network team is evaluating automation tools to manage a large Cisco IOS XE environment. They need a tool that uses a declarative, agentless approach and can be run from a central server without installing software on managed devices. Which tool best fits this requirement?

A network architect is designing a data center network using Cisco ACI. The architect must ensure that traffic between endpoints in different EPGs is allowed only when a contract exists. Which Cisco ACI component is responsible for enforcing these contracts?

A network administrator is configuring a Cisco Catalyst switch and needs to assign a port to VLAN 20 as an access port. The port is currently in VLAN 1. Which command sequence correctly configures the interface?

A network engineer runs the following command on Switch SW1: SW1# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 1-1005 Gi0/2 1-1005 Port Vlans allowed and active in management domain Gi0/1 1,10,20 Gi0/2 1,10,20 Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Gi0/2 1,10,20 Based on this output, what can be concluded?

A network engineer is deploying Control Plane Policing on a Cisco IOS-XE router that runs OSPF, BGP, and SSH management. The engineer wants to rate-limit routing protocol traffic while ensuring that SSH management traffic is never dropped, even during a routing protocol flood. The router uses a single physical interface for all control plane traffic. Which CoPP design approach best meets these requirements?

Given the following configuration on a Cisco IOS router: policy-map SHAPE class class-default shape average 1000000 interface Serial0/0/0 service-policy output SHAPE What is the effect of this configuration?

A network engineer is configuring uRPF (unicast Reverse Path Forwarding) on a Cisco router to prevent spoofed IP traffic. The engineer enables uRPF in strict mode on the ingress interface connected to the internal network. After enabling uRPF, legitimate traffic from internal hosts is being dropped. The engineer checks the routing table and sees that the routes for the internal subnets are present. What is the most likely cause?

Drag and drop each SNMP component on the left to its matching role on the right.

Drag and drop the steps of connecting to a network device via Netmiko into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show access-lists 130 Extended IP access list 130 10 permit icmp host 10.1.1.1 any echo (8 matches) 20 permit icmp host 10.1.1.1 any echo-reply (5 matches) 30 deny icmp any any (3 matches) 40 permit ip any any (12 matches) Based on this output, what can be concluded?

Which three statements about BGP route reflectors are true? (Choose three.)

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Consider the following configuration: flow monitor FM-1 exporter EXPORTER-1 record netflow ipv4 original-input cache entries 16000 ! Which statement about this configuration is correct?

A network administrator is deploying a new Cisco Catalyst 9200 switch at a branch office. The security policy requires that when a device connected to a port is shut down or moved, the switch must immediately send a SNMP trap and place the port into an error-disabled state while also incrementing a violation counter. The administrator configures port security with the violation mode that meets these requirements. Which command must be applied to the interface to achieve this?

Drag and drop the steps of the gRPC dial-out telemetry subscription flow into the correct order, from first to last.

Which three statements about OSPF LSA types are correct? (Choose three.)

A network engineer is designing a large-scale campus network using Cisco SD-Access. The fabric must support thousands of endpoints and provide optimal forwarding paths. Which control plane component is responsible for maintaining the mapping of endpoint IP addresses to fabric edge nodes?

A network engineer deploys Cisco HyperFlex with ESXi hosts and a vSwitch. The requirement is that storage traffic for the HyperFlex distributed data platform be isolated from management and VM traffic, and that jumbo frames be used end to end. Which configuration on the ESXi host satisfies this requirement?

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Examine the following configuration on a Cisco 9800 WLC: wireless profile policy test-policy no security wpa no security wpa2 security wpa3 security wpa3 akm sae security ft over-the-ds What is the effect of the 'security ft over-the-ds' command?

Drag and drop each protocol number on the left to its matching protocol on the right.

A network administrator is configuring a Cisco CSR 1000v router in a virtualized environment. The administrator needs to ensure that the virtual router can forward traffic between virtual machines on different VLANs. Which feature must be enabled on the CSR 1000v to support this?

A network automation engineer is using Cisco DNA Center's Intent API to retrieve a list of all network devices. The engineer writes a Python script that sends a GET request to the /dna/intent/api/v1/network-device endpoint. The script receives an HTTP 403 Forbidden response. The engineer has verified that the username and password are correct and that the user has the SUPER-ADMIN-ROLE. What is the most likely cause of the issue?

A network engineer is configuring a new Cisco Catalyst switch to connect to an existing network. The uplink to the distribution switch is configured as a trunk. The engineer wants to ensure that the trunk uses 802.1Q encapsulation and that the native VLAN is set to VLAN 100. The distribution switch is a Cisco Catalyst 3850. Which configuration should the engineer apply on the uplink interface?

Drag and drop the steps of IPFIX template negotiation and export into the correct order, from first to last.

Drag and drop the steps of Hierarchical QoS (H-QoS) parent/child policy steps into the correct order, from first to last.

An engineer is using Ansible to automate the configuration of NTP on a group of Cisco IOS-XE switches. The playbook uses the ios_ntp module. The engineer wants to ensure that the NTP configuration is applied only to switches that are in the 'core' group, not the 'access' group. The inventory file defines these groups. Which Ansible feature should the engineer use to restrict the playbook to the 'core' group?

A data center architect is designing a virtualized environment for a latency-sensitive application. The application requires dedicated CPU cores and memory to avoid performance degradation. Which hypervisor feature should be configured to meet this requirement?

A network administrator is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The router must use key 1 with the password 'Cisco123' on interface GigabitEthernet0/0. Which configuration is correct?

Given the configuration: flow monitor FM-1 exporter EXPORTER-1 record netflow ipv4 original-input cache timeout active 60 cache timeout inactive 15 ! What is the effect of the 'cache timeout active 60' command?

An organization uses Cisco DNA Center to automate network provisioning. A network engineer deploys a new access switch but finds that the switch does not receive the intended configuration template. The switch appears in DNA Center inventory with status 'Managed'. What is the most likely cause?

A network administrator is planning a new Cisco Catalyst switch stack and wants to verify that the stacking cables provide redundancy so that the loss of a single stacking link does not split the stack. The switches support StackWise-480. Which cabling practice should the administrator follow to achieve a resilient stack ring?

Drag and drop the steps for the DHCP DORA process in the correct order.

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote access. The requirement is to use IKEv2 with certificate-based authentication. The administrator has installed a valid identity certificate on the router and configured the IKEv2 profile. However, remote clients are unable to establish the VPN tunnel, and the router logs show 'IKEv2 certificate authentication failed'. What is the most likely cause?

Consider this AAA configuration: aaa new-model aaa authentication login default local aaa authorization exec default local aaa accounting exec default start-stop group tacacs+ tacacs-server host 10.0.0.1 key SecretKey line con 0 login authentication default line vty 0 4 login authentication default What is the effect of this configuration?

A network architect is designing a Cisco SD-Access fabric and must ensure that the control plane and data plane are properly separated. Which two statements accurately describe the roles of fabric nodes in Cisco SD-Access? (Choose two.)

A network engineer is implementing VXLAN on Cisco Nexus 9000 switches. The engineer needs to verify the configuration of the VXLAN data plane. Which two statements are true regarding VXLAN operation? (Choose two.)

A network administrator is configuring a Cisco IOS router to authenticate management users against a TACACS+ server. The administrator wants to ensure that if the TACACS+ server becomes unreachable, a local username and password can still be used to log in. Which configuration accomplishes this requirement?

Drag and drop each RESTCONF method on the left to its matching NETCONF equivalent on the right.

A network engineer is troubleshooting a connectivity issue and wants to verify the path that packets take from a Cisco IOS XE router to a remote destination. Which command provides a hop-by-hop listing of the path, including latency information for each hop?

An engineer is using a Python script to retrieve interface statistics from a Cisco IOS-XE device via the REST API. The script sends a GET request to 'https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/statistics' and receives a 404 Not Found response. The interface exists and is operational. What is the most likely issue?

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The router experiences high CPU utilization due to SSH and SNMP traffic. The engineer creates a class-map to match SSH (TCP/22) and SNMP (UDP/161) and applies a policy-map that polices this traffic to 1 Mbps. After applying the policy, legitimate SSH sessions from the management station start dropping intermittently. What is the most likely cause?

Which statement about RSPAN is true?

A network engineer is configuring a new Cisco IOS router and wants to ensure that OSPFv2 adjacencies form only on the interface that connects to the trusted internal network. The router has three interfaces: GigabitEthernet0/0 (internal), GigabitEthernet0/1 (DMZ), and GigabitEthernet0/2 (Internet). The engineer enables OSPF process 1 and wants to advertise the internal network 10.1.1.0/24 while preventing OSPF from sending or receiving hello packets on the other interfaces. Which configuration accomplishes this goal?

Drag and drop each CoS value on the left to its matching traffic type on the right.

A network engineer runs the following command on switch SW6: SW6# show cts role-based counters Role-based counters: Source Group Dest Group Packets Sent Bytes Sent Packets Denied Bytes Denied 10 20 1500 120000 0 0 10 30 0 0 500 40000 Based on this output, what can be concluded?

A company uses Cisco TrustSec in its campus network. Security policy requires that a user authenticated by 802.1X be assigned a Security Group Tag (SGT) based on the user's Active Directory group, and that the SGT be carried to downstream switches for enforcement. The access switch is configured for 802.1X with Cisco ISE. Which combination of features must be enabled to meet the requirement?

A network designer is planning a Cisco SD-WAN solution. The customer requires that control plane and data plane traffic be separated, and that the control plane uses a protocol that provides secure, scalable, and resilient overlay topology. Which component of Cisco SD-WAN architecture should the designer use for the control plane?

A network engineer is configuring a Cisco IOS router to export NetFlow data to a collector. The engineer wants to ensure that only ingress traffic on GigabitEthernet0/0 is monitored and that the NetFlow cache is optimized for high traffic volumes. Which configuration step is required to enable NetFlow on the interface?

An engineer configures VXLAN EVPN on a Nexus 9000 switch. The configuration is shown. The switch does not advertise any EVPN routes for VNI 10100. Which configuration change is required to fix this issue?

A network security engineer is deploying MACsec on a Cisco Catalyst 9000 switch. The switch is connected to a Cisco IP phone that does not support MACsec, and a PC is connected to the phone. The engineer wants to encrypt traffic between the switch and the phone, but the phone does not support MACsec. What should the engineer do to secure the link?

A network administrator is using Cisco DNA Center Assurance to monitor the health of wireless clients. The administrator notices that some clients are experiencing poor performance, but the Assurance dashboard shows them as 'Good'. Which action should the administrator take to troubleshoot the issue?

A network engineer is designing a QoS policy for a Cisco router that connects to an MPLS VPN. The service provider expects all traffic to be marked with IP Precedence values. The engineer wants to ensure that voice traffic (DSCP EF) is mapped to IP Precedence 5. What configuration is required on the router to perform this mapping?

Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.

Which of the following is a valid transport protocol for model-driven telemetry receivers on Cisco IOS-XE?

A network engineer is troubleshooting a Layer 2 loop that occurred in a network using Rapid PVST+. The network has three switches: SW1 (root), SW2, and SW3. The engineer examines the topology and finds that SW2 and SW3 are connected via a link that is not supposed to be there. The engineer suspects that an unauthorized switch was connected to the network, causing the loop. The engineer wants to prevent such loops in the future by configuring a feature that will disable any port that receives a BPDU from an unauthorized switch. Which feature should the engineer configure on the access ports?

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator wants to receive alerts when the onboarding time for wireless clients exceeds a defined threshold. Which Cisco DNA Center Assurance feature should be configured to accomplish this?

An engineer is troubleshooting a problem where a host in VLAN 20 cannot communicate with a host in VLAN 30, even though both are connected to the same access switch. The access switch is configured with VLANs 20 and 30, and the uplink to the distribution switch is a trunk that allows both VLANs. The distribution switch has SVIs for both VLANs and IP routing is enabled. The engineer verifies that the trunk is up and both VLANs are allowed. What is the most likely cause of the communication failure?

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer wants to ensure that the switch uses the loopback0 interface as the source for VXLAN tunnels and that it can dynamically learn remote VTEPs via BGP EVPN. Which command set is required under the NVE interface?

Which two statements about NFV MANO (Management and Orchestration) are true? (Choose two.)

A network engineer runs the following command on Router R8: R8# show ip pim neighbor vrf CUSTOMER-F Neighbor Interface Uptime/Expires Ver DR 10.0.3.2 GigabitEthernet0/0.700 02:00:00/00:01:30 v2 1/ DR 10.0.4.2 GigabitEthernet0/0.800 01:30:00/00:01:45 v2 0/ NDR (BDR) Based on this output, what can be concluded?

A network engineer is analyzing network traffic using Cisco IOS Embedded Packet Capture (EPC) on a Cisco ISR router. The engineer wants to capture only TCP packets with a source port of 80 and a destination IP address of 10.1.1.1. Which EPC configuration is required to achieve this?

An engineer is implementing a VXLAN overlay network using Cisco Nexus switches. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) can dynamically learn the mapping of remote VTEP IP addresses to MAC addresses. Which protocol should be used to achieve this dynamic learning?

Drag and drop the steps of Unicast Reverse Path Forwarding (uRPF) check process into the correct order, from first to last.

Which TWO statements are true about IP SLA? (Choose two.)

Drag and drop each RADIUS attribute name on the left to its matching attribute number on the right.

Drag and drop the steps of deploying a CoPP policy on a Cisco IOS-XE router into the correct order, from first to last.

A network engineer is using Cisco DNA Center to monitor network health. The Assurance dashboard shows that a particular access switch has a high CPU utilization issue. The engineer wants to investigate the root cause using DNA Center's built-in tools. Which feature should the engineer use to analyze the switch's CPU utilization over time?

A network engineer is analyzing traffic flows on a Cisco Nexus switch and needs to collect NetFlow data. The engineer wants to export flow records to an external collector at 192.168.100.50 on port 2055. Which configuration step is required to enable NetFlow export?

Which two statements about PIM sparse mode are true? (Choose two.)

A network architect is evaluating Cisco SD-Access for a large campus. The architect must ensure the fabric supports policy enforcement based on user identity and group membership, and that the fabric can scale to thousands of endpoints without flooding the underlay. Which two statements are correct about how SD-Access achieves these goals? (Choose two.)

Given the following SNMPv3 configuration on a Cisco IOS-XE router: snmp-server group ADMIN v3 priv write ADMINVIEW snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456 snmp-server view ADMINVIEW iso included What is missing or incorrect in this configuration?

A network administrator at a small company wants to prevent users from plugging unauthorized switches into wall jacks and creating loops or bypassing security controls. The administrator decides to implement BPDU Guard on all access ports on a Cisco Catalyst switch. Which statement accurately describes the behavior of BPDU Guard when configured on an access port?

A network engineer is configuring a new switch that will be used as an access layer switch. The switch connects to two distribution switches via trunk links. The engineer wants to ensure that the access switch does not become the root bridge for any VLAN. The engineer also wants to provide redundancy so that if one uplink fails, the other uplink takes over quickly. The engineer is using Rapid PVST+. What configuration should the engineer apply on the access switch?

A network engineer is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The engineer wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which configuration step is required to maintain isolation between VRFs?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against DoS attacks. The router has a management plane that includes SSH and SNMP, and a control plane that includes routing protocols like OSPF and BGP. The engineer wants to rate-limit traffic destined to the route processor while ensuring that management traffic is not dropped during high CPU load. Which CoPP configuration approach is most appropriate?

Given the following SD-WAN configuration on a Cisco IOS-XE router: router ospf 1 redistribute bgp 65000 subnets network 192.168.1.0 0.0.0.255 area 0 ! interface GigabitEthernet0/0/0 ip address 192.168.1.1 255.255.255.0 ip ospf network point-to-point ! Which statement is true?

Drag and drop each SD-Access fabric role on the left to its matching function on the right.

A network architect is designing a WAN with Cisco SD-WAN. The requirement is to ensure that traffic from a branch office to a critical SaaS application is prioritized and uses the best path based on real-time performance metrics. Which Cisco SD-WAN feature should be used to meet this requirement?

interface GigabitEthernet0/3 spanning-tree guard root end What is the effect of this configuration?

Which three statements about virtual networking and hypervisor switches are true? (Choose three.)

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET_COMMUNITY in ! route-map SET_COMMUNITY permit 10 set community 100:200 ! What is the effect of this configuration?

A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?

Which two statements about MPLS label operations are true? (Choose two.)

Drag and drop the steps of MSTP region and instance configuration steps into the correct order, from first to last.

Drag and drop the steps of DNA Center SWIM (Software Image Management) upgrade flow into the correct order, from first to last.

Examine the following configuration: flow record REC-1 match ipv4 source address match ipv4 destination address match ipv4 protocol collect interface input collect interface output collect counter bytes collect counter packets ! flow monitor MON-1 record REC-1 exporter EXPORTER-1 ! interface GigabitEthernet0/1 ip flow monitor MON-1 input ! What is the purpose of this configuration?

An engineer is troubleshooting a site-to-site VPN between a Cisco ASA and a Cisco IOS router. The VPN is configured using IKEv1 with pre-shared keys. The tunnel establishes and traffic flows, but after a few hours, the tunnel drops and re-establishes. The engineer checks the logs and sees that the Phase 1 SA is being rekeyed. What is the most likely reason for the tunnel dropping?

A network architect is designing a Cisco SD-WAN solution with multiple data centers and a mix of MPLS and Internet transports. The company requires that business-critical traffic (e.g., ERP) always use the MPLS transport, while guest traffic uses the Internet. Which Cisco SD-WAN feature should be used to enforce this policy?

Examine the following BGP configuration on a Cisco IOS-XE router: ``` router bgp 65000 bgp default local-preference 150 neighbor 10.1.1.1 remote-as 65001 neighbor 10.1.1.1 password cisco123 neighbor 10.1.1.1 route-map SET-MED out ! route-map SET-MED permit 10 set metric 50 ``` What is the effect of the route-map on outbound updates to 10.1.1.1?

A network administrator is deploying Cisco Identity Services Engine (ISE) for wired 802.1X authentication on a Cisco Catalyst 9200 switch. The RADIUS server is reachable at 10.10.10.50 with shared secret 'C1sco123'. The administrator wants the switch to authenticate users before granting access to the data VLAN, and to place unauthenticated devices into a restricted VLAN. Which command sequence correctly enables 802.1X on a switch port?

A network security architect is designing a Zero Trust architecture for a campus network using Cisco Identity Services Engine (ISE) and Cisco TrustSec. The requirement is to enforce segmentation based on user identity and device posture, and to apply policy dynamically as users move between wired and wireless access points. Which Cisco TrustSec component is responsible for tagging packets with a Security Group Tag (SGT) at the access layer?

A network engineer is writing a Python script to retrieve the operational status of all GigabitEthernet interfaces from a Cisco IOS XE device using NETCONF. The script establishes an SSH session to the device on port 830 and sends a <get> RPC with a subtree filter. The device responds with an <rpc-error> indicating 'unknown-element' for the filter. Which action should the engineer take to resolve this issue?

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

A network security administrator is configuring a Cisco IOS Zone-Based Firewall on a branch router. The inside zone and outside zone are defined, and the administrator wants to allow inside hosts to initiate sessions to outside servers while preventing outside hosts from initiating sessions to inside hosts. Which configuration accomplishes this?

A network engineer is using Cisco SD-WAN vManage APIs to automate the creation of a new VPN template. The engineer needs to authenticate to the vManage REST API using a Python script. Which authentication method is natively supported by the vManage API for programmatic access?

Consider the following IPv6 access-list on a Cisco IOS-XE router: ``` ipv6 access-list PERMIT_ICMP permit icmp any any echo-request permit icmp any any echo-reply deny ipv6 any any ! interface GigabitEthernet0/0 ipv6 traffic-filter PERMIT_ICMP in ``` What is the effect of this configuration?

Drag and drop the steps of OSPF summarization at ABR configuration steps into the correct order, from first to last.

A network engineer runs the following command on Switch SW4: SW4# show etherchannel 1 detail Channel-group number: 1 Group state = L2 Ports in the group: ------------------- Port: Gi0/0 -------- Port state = Up, In-Bundle Channel group = 1 Mode = Active/PagNego Gcchange = - Port-channel = Po1 GC = 0x00010001 Pseudo port-channel = Po1 Port index = 0 Load = 0x00 Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs A - Device is in active mode. P - Device is in passive mode. Local information: LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi0/0 SA bndl 32768 0x1 0x1 0x101 0x3D Partner information: LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi0/0 SA bndl 32768 0x1 0x1 0x102 0x3D Age of the port = 0d:00h:15m:20s Based on this output, what can be concluded?

Consider the following configuration: flow exporter EXPORTER-1 destination 10.0.0.1 source Loopback0 transport udp 9996 template data timeout 60 ! Which statement about this configuration is true?

Drag and drop each TACACS+ packet type on the left to its matching function on the right.

A network administrator is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The client is associated to a wireless controller but cannot reach the default gateway. The administrator notices that the client's onboarding status shows 'DHCP failed'. Which Assurance feature should the administrator use to trace the client's path and identify where DHCP packets are being dropped?

Given the following Ansible playbook snippet: --- - name: Configure SNMP hosts: routers gather_facts: no tasks: - name: SNMP community ios_config: lines: - snmp-server community public RO What is the result of this playbook?

A network engineer is deploying a Cisco Catalyst 9300 switch stack that will host several isolated tenant environments. Each tenant must have its own separate routing table and its own independent instance of a dynamic routing protocol on the same physical switch, while sharing the same physical uplinks to the core. Which technology should the engineer implement to meet these requirements?

Which three statements about RADIUS and TACACS+ are true? (Choose three.)

An enterprise has two BGP routers, R1 and R2, both in AS 65000. R1 peers with ISP1 (AS 100) and R2 peers with ISP2 (AS 200). The enterprise advertises a prefix 192.168.0.0/24 to both ISPs. The engineer wants to ensure that traffic from the Internet to this prefix enters the network primarily via R1, and only uses R2 if the link to ISP1 fails. Which BGP attribute should be manipulated on the updates sent to the ISPs?

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect against DoS attacks. The router has a management plane that must remain accessible via SSH and SNMP, and a control plane that must process BGP and OSPF routing updates. The administrator applies a CoPP policy that rate-limits all traffic destined to the control plane to 1000 pps, except for traffic from trusted management subnets. After applying the policy, BGP sessions flap intermittently. What is the most likely cause?

An architect is designing a virtualized environment for network functions that require direct access to physical NICs for performance. The hypervisor must support PCI passthrough. Which hypervisor type is best suited for this requirement?

A network engineer is using Cisco DNA Center Assurance to monitor and troubleshoot a network. The engineer wants to use the Assurance features to proactively detect issues and receive recommendations. Which two statements are true about Cisco DNA Center Assurance capabilities? (Choose two.)

A network engineer is deploying a new branch office and needs to assign IPv6 addresses to hosts on the LAN segment. The engineer wants hosts to automatically configure their own addresses using the MAC address and the network prefix, without relying on a DHCPv6 server. Which IPv6 address assignment method should be configured on the router interface?

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has a single physical interface Gi0/0/0 that carries both management SSH traffic and transit data traffic. The administrator wants the CoPP policy to apply only to traffic destined to the router's control plane, not to transit traffic. Which CoPP configuration element must be applied to achieve this?

Drag and drop the steps of DHCP snooping operation on a Cisco switch into the correct order, from first to last.

A network engineer is troubleshooting a routing loop in an EIGRP network. Which mechanism is designed to prevent routing loops by causing a router to reject routes that are learned from a neighbor that is not the successor?

Examine the following configuration snippet: interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 100 spanning-tree portfast spanning-tree bpduguard enable What is the effect of this configuration?

A network engineer is designing a QoS policy for a Cisco Catalyst switch that will carry voice, video, and data traffic. The engineer wants to ensure that voice traffic receives strict priority queuing, video traffic gets guaranteed bandwidth, and data traffic uses leftover bandwidth. The switch supports Cisco Modular QoS CLI (MQC). Which queuing mechanism should be configured on the egress interface to meet these requirements?

A retail company wants its network engineers to push consistent OSPF configurations to dozens of Cisco IOS XE routers using a declarative, agentless automation tool that connects over SSH and does not require installing software on the managed devices. Which tool best fits these requirements?

A network team is designing QoS for a multi-tenant data center using leaf-spine architecture. Each tenant requires guaranteed bandwidth for their mission-critical applications, while best-effort traffic must not interfere. The design must use hierarchical queuing to enforce per-tenant fairness. Which queuing mechanism should the architect implement on the leaf switches?

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-POLICY Class-map: BGP-CLASS (match-all) 50 packets, 2500 bytes 5 minute offered rate 500 bps Match: access-group name BGP-ACL police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 50 packets, 2500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: SNMP-CLASS (match-all) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: access-group name SNMP-ACL police: cir 16000 bps, bc 2000 bytes, be 2000 bytes conformed 150 packets, 7500 bytes; actions: transmit exceeded 40 packets, 2000 bytes; actions: drop violated 10 packets, 500 bytes; actions: drop Class-map: class-default (match-any) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: any police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 100 packets, 5000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, what can be concluded?

Which three statements about the Differentiated Services (DiffServ) QoS model are true? (Choose three.)

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoint IP addresses are mapped to fabric locators so that the fabric can forward traffic between wired and wireless clients. Which control-plane node role is responsible for maintaining this mapping database?

A network engineer is deploying a new branch office that must use dynamic ARP inspection (DAI) on its access switches. The engineer wants to minimize manual configuration while ensuring that only valid IP-to-MAC bindings are permitted. Which feature should be enabled on the switches to provide the required binding information to DAI?

A network engineer is configuring a zone-based firewall (ZBF) on a Cisco router to allow traffic from the inside zone to the outside zone while blocking traffic from outside to inside. The engineer creates zones, assigns interfaces, and configures a policy-map with a class-map that matches all traffic from inside to outside. The engineer applies the policy to the zone-pair inside-to-outside. However, traffic from inside to outside is being dropped. What is the most likely reason?

A network engineer is designing a Python script to interact with a Cisco Catalyst Center (formerly DNA Center) appliance using its Intent API. The script must retrieve a list of all network devices and then update the location of a specific device. Which two steps are required to authenticate and authorize the API requests? (Choose two.)

A network engineer is configuring a Cisco switch for 802.1X with RADIUS authentication. The switch is also configured with 'aaa authentication dot1x default group radius'. The engineer wants to use a single RADIUS server for both authentication and accounting. The RADIUS server is configured with the same shared secret for both services. The engineer configures 'radius-server host 10.1.1.1 auth-port 1812 acct-port 1813 key cisco123'. However, accounting records are not being sent to the server. The engineer verifies that the RADIUS server is reachable and that accounting is enabled on the server. What is the most likely cause?

A network engineer runs the following command on Router R1: R1# show ip bgp summary BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 10, main routing table version 10 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 1024 1020 10 0 0 02:30:15 5 192.168.1.3 4 65003 500 498 10 0 0 00:15:20 3 10.0.0.2 4 65004 0 0 0 0 0 never Active Based on this output, what can be concluded?

Which two statements about YANG data models and their role in model-driven telemetry are true? (Choose two.)

An engineer uses the following Ansible playbook to configure an interface on a Cisco IOS-XE device using the cisco.ios.ios_interfaces module: ```yaml --- - name: Configure interface hosts: cisco-routers gather_facts: no tasks: - name: Set interface description cisco.ios.ios_interfaces: config: - name: GigabitEthernet0/1 description: "Uplink to Core" enabled: true state: replaced ``` What is the result of running this playbook?

A network engineer is configuring a Cisco IOS XE router to support NETCONF over SSH. The requirement is to allow a remote management station to retrieve and modify the router's configuration using NETCONF. Which command must be used to enable the NETCONF subsystem on the router?

A network engineer is deploying 802.1X on Catalyst access switches with Cisco ISE as the RADIUS server. Some endpoints, such as printers and badge readers, do not support 802.1X supplicants. The design must allow these devices onto a restricted VLAN while still requiring authentication for laptops. Which TWO mechanisms should the engineer configure to achieve this? (Choose two.)

A network engineer is deploying Cisco DNA Center Assurance to monitor a campus fabric. The engineer needs to verify that the fabric underlay and overlay health scores are being calculated correctly. Which data source does Cisco DNA Center Assurance primarily use to compute the fabric health score?

A network engineer is deploying a new wireless LAN controller (WLC) in a campus network. The WLC must manage 200 access points across three buildings. The engineer configures the WLC with a management IP address and enables CAPWAP. However, the access points fail to join the WLC. The APs are in the same VLAN as the WLC and can ping the WLC's management IP. What is the most likely cause of the APs not joining?

A network administrator needs to securely manage a Cisco Catalyst switch remotely. The requirement is to encrypt all management traffic, including username and password, between the administrator's workstation and the switch. Which management protocol should be enabled on the switch to meet this requirement?

A security team is deploying Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. They notice that after applying a CoPP policy, OSPF adjacency with a directly connected neighbor flaps intermittently. Which action should the engineer take to resolve the issue while maintaining control plane protection?

An enterprise is deploying Cisco SD-WAN with vManage, vSmart, vBond, and vEdge routers. The architect must design the control plane to securely onboard new vEdge routers and establish DTLS/TLS tunnels. Which component is responsible for the initial authentication and coordination of control plane connections?

Drag and drop the steps of NBAR2 application recognition and classification steps into the correct order, from first to last.

An engineer is configuring multicast on a Cisco switch running IOS. The switch is acting as the IGMP querier for a VLAN. The engineer notices that multicast traffic is being flooded to all ports in the VLAN, even though only a few receivers have joined the group. The engineer checks the IGMP snooping configuration and sees that IGMP snooping is enabled globally and on the VLAN. What is the most likely cause of the flooding?

A network architect is selecting a switching platform for a data center access layer that must support lossless Ethernet for FCoE. The platform must provide per-priority flow control so that storage traffic can be paused without affecting LAN traffic. Which technology should the architect specify?

A network engineer at a branch office needs to configure a Cisco IOS router to obtain its WAN interface IPv4 address dynamically from the ISP using DHCP while also ensuring the ISP can reach a web server hosted on the internal LAN at 10.10.10.50. Which single command on the router's WAN interface accomplishes the address acquisition requirement?

A network automation team uses a Python script with the ncclient library to configure a Cisco IOS XE device via NETCONF. The script establishes a session and sends an <edit-config> RPC with a candidate datastore. After sending the RPC, the script immediately sends a <commit> RPC, but the device returns an error indicating that the candidate datastore is not supported. Which statement explains the cause of this error?

A network engineer is deploying a virtualized branch solution using Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS). The goal is to run multiple virtual network functions such as a virtual router and a virtual firewall on a single Cisco UCS E-Series or C-Series server at the branch. Which statement accurately describes how NFVIS supports this deployment?

A network engineer is using NetFlow to monitor traffic on a Cisco router. The engineer wants to export NetFlow data to a collector for analysis. Which two commands are required to configure NetFlow export on the router? (Choose two.)

A network engineer is troubleshooting a VMware vSphere cluster where a VM with a large memory footprint (256 GB) is experiencing poor performance. The host has two NUMA nodes, each with 128 GB of memory. The VM is configured with 256 GB of memory and 4 vCPUs. Performance monitoring shows high memory latency and CPU ready time. What is the most likely cause?

A company runs a Cisco IOS router as the WAN edge. The security team wants to detect and log traffic that matches a set of known malicious signatures without blocking legitimate traffic, while still dropping clearly malformed packets. Which technology should be deployed on the router?

A network engineer configures SNMPv3 on a Cisco router for secure monitoring. The configuration includes 'snmp-server group ADMIN v3 priv', 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456', and 'snmp-server host 10.1.1.2 version 3 priv admin'. The NMS is configured with the same credentials. However, the NMS cannot poll the router. The engineer verifies that the router's SNMP agent is enabled. What is the most likely cause?

A network administrator runs the following command on a switch: Switch# show aaa method-list Method List Name: default Type: authentication Group: radius Group: local Method List Name: console Type: authentication Group: local Method List Name: default Type: authorization Group: tacacs+ Group: local Based on this output, what can be concluded?

Given the following snippet from a Cisco 9800 WLC: ap ethernet-port default-ethernet-port description "Default Ethernet Port" mode trunk allowed vlan 10,20,30 native vlan 10 What is the effect of this configuration on the AP?

A network engineer is troubleshooting why a newly added Cisco Catalyst 9300 switch is not appearing in Cisco DNA Center's topology view, even though it is reachable via SSH from the management network. The switch has been configured with the correct SNMP community string. Which protocol must be enabled on the switch for Cisco DNA Center to discover and monitor it?

A network engineer runs the following command on Switch SW2: SW2# show interfaces port-channel 1 etherchannel Port-channel1 : Age of the Port-channel = 0d:00h:10m:32s Logical slot/port = 16/1 Number of ports = 2 HotStandby port = null Port state = Port-channel Ag-Inuse Protocol = LACP Ports in the Port-channel: Index Load Port EC state No of bits ------+------+------+----------------+---------- 0 00 Gi0/0 Active 4 1 00 Gi0/1 Active 4 Time since last port bundled: 0d:00h:05m:23s Gi0/1 Based on this output, what can be concluded?

Drag and drop the steps of IKEv2 IPsec tunnel establishment into the correct order, from first to last.

A network engineer is troubleshooting why a Cisco Catalyst 9300 switch is not exporting flow data to a NetFlow collector. The engineer verified that the flow record and exporter are correctly configured and that the collector is reachable. Which additional configuration is required on the switch to enable Flexible NetFlow?

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Which three statements about configuring AAA on Cisco IOS devices are true? (Choose three.)

Drag and drop the steps of configuring a Cisco IOS Zone-Based Firewall (ZBFW) into the correct order, from first to last.

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to Cisco IOS XE devices. The administrator prefers using YAML for playbook definitions and wants to avoid installing software on the managed devices. Which tool best fits these requirements?

A network engineer needs to monitor traffic between two VLANs on a Cisco Catalyst 9300 switch. The engineer wants to capture all packets that traverse the switch between VLAN 10 and VLAN 20. The monitoring station is connected to port Gi1/0/24. Which configuration should the engineer use to capture this inter-VLAN traffic?

Given the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet0/1 switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30 What is the effect of this configuration?

Drag and drop the steps of IGMP v3 SSM membership report process into the correct order, from first to last.

Which three statements about Syslog severity levels are true? (Choose three.)

A network engineer is using Cisco DNA Center's Intent API to create a new site hierarchy for a branch office. The engineer sends a POST request to the /dna/intent/api/v1/site endpoint with a JSON payload containing the site name and parent site. The API returns HTTP 202 Accepted. The engineer immediately sends a GET request to retrieve the newly created site but receives a 404 Not Found. What is the most likely explanation?

A network engineer has configured an IP SLA operation on a Cisco router to monitor the reachability of a remote server. The engineer wants to ensure that the operation sends ICMP echo requests every 30 seconds and that the router tracks the operation's state to influence a static route. Which command is required to associate the IP SLA operation with the static route?

Drag and drop the steps of parsing 'show interfaces' output using TextFSM into the correct order, from first to last.

An engineer is configuring 802.1X on a Cisco Catalyst switch port where a PC is connected. The requirement is that if the authentication server becomes unreachable, the port should still allow the PC to send traffic in a restricted VLAN rather than being shut down. Which configuration meets this requirement?

Examine the following BGP configuration: router bgp 65001 bgp log-neighbor-changes neighbor 10.1.1.1 remote-as 65002 neighbor 10.1.1.1 route-map SET_MED out ! route-map SET_MED permit 10 set metric 50 What is the purpose of this configuration?

A network administrator is deploying Cisco ACI in a data center. The administrator needs to ensure that a new tenant's application profile can communicate with an external Layer 2 network that is connected to a border leaf switch. Which ACI construct must be configured to extend the tenant's bridge domain to the external network?

A network engineer is writing a Python script to retrieve the configured hostname from a Cisco IOS XE device using RESTCONF. The device has RESTCONF enabled, and the engineer sends a GET request to https://10.1.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname with the header 'Accept: application/yang-data+json'. However, the request fails with HTTP 401 Unauthorized. The engineer verifies that the device is reachable and RESTCONF is enabled. What is the most likely reason for the failure?

A network security team is hardening a Cisco IOS-XE router that terminates IPsec VPN tunnels. They want to protect the control plane from CPU-intensive IKE and management traffic without dropping legitimate tunnel establishment packets. They decide to apply a Control Plane Policing (CoPP) policy. Which statement best describes how CoPP interacts with the forwarding plane and the control plane on this router?

Which two statements about DMVPN phase 2 are true? (Choose two.)

What is the default OSPF hello interval on an Ethernet broadcast network?

A network architect is designing a campus network that must support thousands of endpoints with a fabric overlay. The design requires that the underlay provide fast convergence and equal-cost multipathing without running a separate routing protocol in the overlay. Which underlay routing protocol should be selected to meet these requirements?

Drag and drop the steps of OSPF redistribution from EIGRP with metric conversion into the correct order, from first to last.

Which three statements about RRM (Radio Resource Management) in a Cisco wireless LAN are true? (Choose three.)

A network engineer runs the following command on Router R6: R6# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 500 packets, 50000 bytes 5 minute offered rate 50000 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 500/50000 police cir 1000000 bc 15625 be 15625 conformed 500 packets, 50000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 1000 packets, 100000 bytes 5 minute offered rate 100000 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 1000/100000 bandwidth remaining percent 50 Class-map: class-default (match-any) 2000 packets, 200000 bytes 5 minute offered rate 200000 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 2000/200000 bandwidth remaining percent 50 Based on this output, what can be concluded?

A network administrator is configuring a Cisco IOS XE router to protect against spoofed source addresses on an internal interface facing user subnets. The requirement is to drop packets whose source address does not match the routing table entry for the incoming interface. Which feature should be enabled?

A network engineer runs the following command on Router R1: R1# show mpls ldp neighbor Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.49231 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 01:23:45 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 192.168.1.2 Addresses bound to peer LDP Ident: 10.0.0.2 192.168.1.2 Based on this output, what can be concluded?

Which two statements about SPAN and RSPAN are true? (Choose two.)

Consider this configuration: interface GigabitEthernet0/2 switchport mode trunk switchport trunk native vlan 10 switchport trunk allowed vlan 10,20,30 ! interface Vlan10 ip address 192.168.10.1 255.255.255.0 Which statement is true about this configuration?

An engineer is deploying a virtual router (vRouter) on a Cisco NFVIS host. The vRouter needs to advertise routes to a physical router connected to the host's management port. The engineer configures the vRouter with an IP address on the same subnet as the management port. However, the physical router does not receive any routing updates. What should the engineer do to enable route exchange?

A network administrator is deploying QoS in a converged network. Which approach correctly implements trust boundaries and marking?

A network automation team needs to securely retrieve the running configuration from 200 Cisco IOS XE routers daily using a Python script. The script must authenticate with individual user credentials, use a structured data format, and avoid screen-scraping. Which approach best meets these requirements?

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer needs to authenticate to the API. Which authentication method should be used to obtain a token for subsequent API calls?

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Which two statements about multicast RPF check are true? (Choose two.)

A network engineer is using the Cisco Meraki REST API to update the SSID settings for a wireless network. The engineer sends a PUT request to 'https://api.meraki.com/api/v1/networks/{networkId}/wireless/ssids/{ssidNumber}' with a JSON payload containing the new settings. The API returns a 429 Too Many Requests error. What should the engineer do to resolve this issue?

An architect is planning a Cisco SD-Access fabric deployment. The design must support host mobility across multiple fabric edge nodes while ensuring consistent policy enforcement. Which fabric component is responsible for tracking endpoint locations and mapping them to the fabric?

A network engineer runs the following command on switch SW2: SW2# show cts role-based sgt-map Active IPv4-SGT Mapping Table: IP Address SGT 192.168.1.10 10 192.168.1.20 20 192.168.1.30 30 Total number of entries: 3 Based on this output, what can be concluded?

Which two statements about AAA accounting are true? (Choose two.)

Which type of NAT translates multiple inside addresses to a single outside address using different port numbers?

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

A network engineer executes the following command on Router R3: R3# show ip igmp groups 239.2.2.2 IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter 239.2.2.2 GigabitEthernet0/0 1d04h 00:02:10 192.168.1.100 Based on this output, what can be concluded?

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) for a high-density auditorium. The engineer wants to ensure that clients can roam seamlessly between access points while maintaining consistent security policies. Which Cisco wireless architecture feature should be enabled to allow controllers to share client context and facilitate inter-controller roaming?

Drag and drop each STP protection feature on the left to its matching purpose on the right.

A company is implementing QoS on its campus network. The network engineer configures a policy-map that sets the CoS value for voice traffic to 5 on a switch interface. However, when the traffic reaches the router, the CoS marking is lost. What is the most likely reason?

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

A network administrator is configuring a Cisco Catalyst 9000 switch to authenticate users via 802.1X. The authentication server is a Cisco Identity Services Engine (ISE). The administrator wants to ensure that if the ISE server becomes unreachable, the switch will allow devices to connect with limited access. Which feature should be configured?

A security team wants to protect a web application hosted behind a Cisco IOS router from cross-site scripting and SQL injection attacks without modifying the application itself. Which Cisco IOS feature is designed for this purpose?

A network administrator is configuring a Cisco wireless controller to support a high-density auditorium. The design requires that client devices be evenly distributed across available access points and that roaming be optimized for voice traffic. Which feature should be enabled to achieve these goals?

spanning-tree vlan 10 priority 4096 What is the effect of this global configuration command?

Which three statements about VRF-lite are true? (Choose three.)

A network engineer runs the following command on Router R1: R1# show mpls ldp neighbor Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.179 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 00:10:00 LDP discovery sources: GigabitEthernet0/0, Src IP: 10.0.0.2 Addresses bound to peer LDP Ident: 10.0.0.2 192.168.2.2 Peer LDP Ident: 10.0.0.3:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.3.646 - 10.0.0.1.179 State: Oper; Msgs sent/rcvd: 200/190; Downstream Up time: 00:20:00 LDP discovery sources: GigabitEthernet0/1, Src IP: 10.0.0.3 Addresses bound to peer LDP Ident: 10.0.0.3 192.168.3.3 Based on this output, what can be concluded?

Which three statements about the classification and marking tools in Cisco IOS are true? (Choose three.)

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and NTP. The requirement is to protect the route processor from excessive BGP keepalive traffic while still allowing all legitimate BGP peering. Which CoPP module should the administrator use to classify and police this traffic before the policy is applied to the control plane?

A network team must design a QoS policy for a WAN link that carries voice, video, and data. The policy must ensure that voice traffic is never dropped, even during congestion. Which queuing mechanism should be used for the voice class?

Review the following DHCP relay configuration: ``` interface Vlan10 ip address 192.168.10.1 255.255.255.0 ip helper-address 172.16.1.100 ``` What is the effect of the 'ip helper-address' command?

A network engineer is using the Cisco DNA Center Intent API to create a new site hierarchy. The engineer sends a POST request to /dna/intent/api/v1/site with a JSON payload defining the site. The API returns a 202 Accepted response with a task ID. What should the engineer do next to confirm the site was created successfully?

A network administrator is configuring a Cisco IOS switch to authenticate users via 802.1X. The administrator wants to ensure that if the RADIUS server is unreachable, users are placed into a guest VLAN with limited access. Which feature should be configured to achieve this?

Given the following configuration snippet on a Cisco IOS-XE switch: interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 10 spanning-tree portfast monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2 What is the effect of this configuration?

Drag and drop the steps of OSPF route redistribution into a different autonomous system into the correct order, from first to last.

A network engineer is implementing Cisco SD-Access and needs to ensure that the fabric provides policy-based segmentation and mobility for endpoints. Which component is responsible for maintaining the endpoint location and identity information?

An engineer is configuring a Cisco IOS XE switch to secure the management plane. The requirement is to allow SSH only from the management subnet 10.10.10.0/24 and block all other management protocols such as Telnet and HTTP. Which configuration approach best meets this requirement?

Examine this configuration: policy-map QOS_POLICY class VOICE priority percent 10 class VIDEO bandwidth percent 30 class class-default fair-queue ! interface GigabitEthernet0/0 service-policy output QOS_POLICY What is the effect of this policy-map?

Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?

Examine the following IPsec configuration snippet: crypto ikev2 proposal IKEV2_PROP encryption aes-cbc-256 integrity sha256 group 14 ! crypto ikev2 policy IKEV2_POL proposal IKEV2_PROP ! crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac mode tunnel ! crypto ipsec profile IPSEC_PROF set transform-set TSET set ikev2-profile IKEV2_POL Which statement about this configuration is true?

A network engineer runs the following command on Router R4: R4# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy input: SHAPE_POLICY Class-map: class-default (match-any) 1000 packets, 100000 bytes 5 minute offered rate 100000 bps, drop rate 0 bps Match: any Queueing shape (average) cir 500000, bc 5000, be 5000 target shape rate 500000 Based on this output, what can be concluded?

A network engineer configures model-driven telemetry on a Cisco IOS-XE device using gRPC dial-out. The subscription configuration snippet is: ``` telemetry ietf subscription 100 encoding encode-kvgpb filter xpath /interfaces/interface/statistics stream yang-push update-policy periodic 500 receiver ip address 10.1.1.1 50001 protocol grpc-tcp ``` What is the primary issue with this configuration?

Which three statements about hypervisor security and isolation are true? (Choose three.)

Drag and drop the steps of YANG module import and augmentation resolution into the correct order, from first to last.

A network engineer runs the following command on Router R2: R2# show crypto ipsec sa peer 10.2.2.2 interface: Tunnel0 Crypto map tag: CMAP, local addr 10.1.1.2 protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0) current_peer 10.2.2.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500 #pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200 #pkts compressed: 0, #pkts decompress: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 Based on this output, what can be concluded?

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint. The engineer needs to define the source interface used for the VXLAN tunnels and map VLANs to a VNI. Which command sequence accomplishes this?

A Python script uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device: from napalm import get_network_driver driver = get_network_driver('ios') device = driver('192.168.1.1', 'admin', 'cisco') device.open() arp_table = device.get_arp_table() print(arp_table) device.close() What is the issue with this script?

Given the following SNMP configuration on a Cisco IOS-XE router: snmp-server community public RO snmp-server community private RW snmp-server location Building-A snmp-server contact admin@example.com snmp-server enable traps snmp linkdown linkup snmp-server host 192.168.1.100 version 2c public What is the effect of this configuration?

An architect is planning a virtualized infrastructure for a branch office that will host a Cisco ISRv router and a local DHCP server. The architect wants to minimize management overhead and ensure the VMs can be easily backed up. Which hypervisor deployment model is most appropriate?

A network engineer configures SNMPv2c on a Cisco router to monitor CPU and memory utilization. The NMS is reachable and configured with the same community string 'public'. However, the NMS receives no traps from the router. The engineer verifies that the router's SNMP configuration includes 'snmp-server enable traps' and 'snmp-server host 192.168.1.100 version 2c public'. What is the most likely cause of the missing traps?

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide secure segmentation for different departments without deploying separate physical networks or traditional VRFs on every switch. Which Cisco SD-Access component provides this segmentation by using a group-based policy model?

A network architect is designing a QoS policy for a Cisco Catalyst switch. The architect needs to ensure that voice traffic is marked with the appropriate DSCP value for expedited forwarding. Which DSCP value should be used for voice traffic?

Examine this IP SLA configuration on Router R1: ip sla 4 icmp-echo 10.4.4.4 frequency 10 ip sla schedule 4 life forever start-time now ip sla reaction-configuration 4 react timeout threshold-type immediate action-type triggerOnly Which of the following is missing from this configuration to make it useful for tracking?

A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET_MED out ! route-map SET_MED permit 10 set metric 50 ! What is the effect of this configuration on routes advertised to 10.0.0.2?

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET_ORIGIN in ! route-map SET_ORIGIN permit 10 set origin incomplete ! What is the effect of this configuration?

Drag and drop the steps of Streaming telemetry sensor path subscription flow into the correct order, from first to last.

Examine the following telemetry configuration on a Cisco IOS-XE device: telemetry ietf subscription 200 encoding encode-kvgpb filter xpath /interfaces/interface[name='GigabitEthernet0/0/0']/state stream yang-push update-policy on-change receiver ip address 192.168.1.100 50001 protocol grpc Which statement is true about this configuration?

Examine this SNMP configuration snippet from a Cisco IOS-XE router: snmp-server community MyComm RO 10 access-list 10 permit 192.168.1.0 0.0.0.255 What is the effect of this configuration?

Which three statements about path isolation using VRF are true? (Choose three.)

A network engineer is configuring a Cisco Catalyst switch to send flow data to a NetFlow collector for traffic analysis. The engineer wants to ensure that only ingress traffic on a specific interface is exported. Which command is required to enable NetFlow on that interface?

Which three statements about YANG data models are true? (Choose three.)

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

A network engineer is using the Python requests library to interact with a Cisco IOS XE device's RESTCONF API. The engineer wants to retrieve the configured hostname. Which HTTP method and URI should be used?

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent for a subnet that has no local DHCP server. The DHCP server is at 10.10.10.5, and the router interface facing the clients is GigabitEthernet0/1 with IP address 10.20.20.1. Which command must be applied to the interface so that client DHCP broadcasts are forwarded to the server?

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

A network engineer uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device: ```python from napalm import get_network_driver driver = get_network_driver('ios') device = driver('192.168.1.1', 'admin', 'cisco123') device.open() arp_table = device.get_arp_table() print(arp_table) device.close() ``` What is the expected data type of arp_table?

A network engineer is configuring a new Cisco Catalyst 9300 switch stack. The design requires that if the active switch fails, the standby switch takes over the active role, and the member switch that was formerly standby becomes the new standby. The engineer needs to verify and influence the election order. Which mechanism determines the active and standby switch election in a switch stack?

Consider the following EIGRP configuration on a Cisco IOS router: router eigrp 100 network 10.0.0.0 passive-interface default no passive-interface GigabitEthernet0/1 What is the effect of this configuration?

A network engineer is deploying VXLAN EVPN on a Cisco Nexus 9000 switch. Which two statements about the configuration of the NVE interface are true? (Choose two.)

A network engineer is deploying Cisco SD-WAN in a hybrid cloud environment. The company requires secure segmentation between guest, employee, and IoT traffic across all branches. The engineer must ensure that traffic from each segment is isolated and that policies can be applied per segment. Which two components are used to achieve this segmentation? (Choose two.)

Drag and drop each syslog severity level on the left to its matching severity number on the right.

A network administrator is configuring a Cisco IOS switch and needs to verify the current VLAN configuration, including VLAN IDs, names, and status. Which command should be used?

Consider the following configuration on a Cisco 9800 WLC: ap join-profile default-join-profile description "Default Join Profile" controller 1 primary 10.1.1.1 controller 2 secondary 10.1.1.2 What is the purpose of this configuration?

A network administrator is configuring a Cisco IOS router to terminate a site-to-site IPsec VPN with a remote peer that uses dynamic public IP addressing. The administrator wants the router to accept IKE negotiations from any peer that presents a valid pre-shared key and matches a specific protected subnet. Which configuration element is required to support this?

Examine the following RSPAN configuration on a Cisco switch: vlan 200 name RSPAN_VLAN remote-span monitor session 3 source interface GigabitEthernet1/0/5 both monitor session 3 destination remote vlan 200 interface GigabitEthernet1/0/10 switchport mode trunk switchport trunk allowed vlan 200 What is missing for RSPAN to function correctly across multiple switches?

A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tagging (SGT) and enforce policies based on SGTs. Which two mechanisms can be used to propagate SGTs between network devices? (Choose two.)

A network engineer is using the Cisco DNA Center REST API to retrieve the list of network devices. The engineer sends a GET request to '/dna/intent/api/v1/network-device' and receives a 400 Bad Request response. The API documentation indicates that the request requires a query parameter 'siteId'. What should the engineer do to resolve the issue?

Consider the following configuration: class-map match-any VOICE match ip dscp ef class-map match-any VIDEO match ip dscp af41 match ip dscp af42 What is the effect of the match-any keyword in these class-maps?

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote access using SSL VPN. The requirement is to allow users to connect via a web browser and access internal web applications without installing a client. Which feature should the administrator configure?

A network automation team is evaluating RESTCONF as a replacement for CLI scraping on Cisco IOS XE devices. They need to understand the operational characteristics of RESTCONF to design their tooling. Which two statements accurately describe RESTCONF behavior on Cisco IOS XE? (Choose two.)

A network engineer is implementing MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two campus distribution switches. Which two statements accurately describe MACsec operation on Cisco platforms? (Choose two.)

Drag and drop the steps of Cisco DNA Center assurance data collection workflow into the correct order, from first to last.

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

A network automation engineer is writing a Python script to retrieve interface statistics from a Cisco IOS XE device using NETCONF. The script uses the 'ncclient' library and connects to the device on port 830. However, the connection fails with a 'Could not open socket' error. The engineer confirms that the device is reachable via ping and SSH on port 22. What is the most likely reason for the failure?

A company is deploying a virtualized network function (VNF) on a KVM-based host. The VNF requires dedicated CPU cores and must avoid performance interference from other VMs. Which hypervisor configuration best meets these requirements?

Drag and drop the steps of NFVI resource allocation and VNF instantiation into the correct order, from first to last.

A network administrator wants to use a declarative, agentless automation tool to push VLAN configurations to a group of Cisco IOS XE switches. The tool should connect over SSH, use YAML playbooks, and require no software installation on the switches. Which tool best fits these requirements?

An architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation based on user identity and device type, and must integrate with Cisco ISE. Which fabric component and protocol should be used to enforce micro-segmentation?

A network administrator needs to validate that the path taken by packets from a branch router to a remote server matches the expected primary path. The administrator wants to collect per-hop latency and packet loss statistics along that path. Which tool should be used?

A network engineer is designing a high-availability solution for a data center using Cisco Application Centric Infrastructure (ACI). The engineer wants to ensure that the fabric can continue to operate if a spine switch fails, and that traffic is load-balanced across all available paths. Which statement accurately describes the ACI fabric architecture?

Consider the following partial syslog configuration on a Cisco IOS-XE switch: logging host 10.10.10.1 transport udp port 514 logging trap 6 logging source-interface Loopback0 logging on Which statement is true about this configuration?

A network engineer issues the following command on Router R3: R3# show ip sla statistics 2 Round Trip Time (RTT) for Index 2 Latest RTT: 12 ms Latest RTT: NoConnection/Busy/Timeout Latest Operation Start Time: 12:00:00.000 UTC Mon Mar 1 2021 Latest Operation Return Code: Timeout Number of successes: 45 Number of failures: 5 Over thresholds: 0 Based on this output, what is the most likely issue?

Consider the following configuration on a Cisco IOS-XE router: ``` ip access-list extended BLOCK_SSH deny tcp any any eq 22 permit ip any any ! line vty 0 4 access-class BLOCK_SSH in ``` Which statement is true about this configuration?

Examine the following EIGRP configuration for route summarization: interface GigabitEthernet0/0 ip summary-address eigrp 100 192.168.0.0 255.255.252.0 What is the effect of this command?

A DevOps team is implementing a CI/CD pipeline that automates network configuration changes. Which design principle is most important to ensure that a failed deployment does not cause prolonged outages?

Drag and drop each NETCONF operation on the left to its action on the right.

A network security team is deploying Cisco TrustSec in a data center environment. They want to assign Security Group Tags (SGTs) to traffic based on user identity and device type without relying on IP addresses or VLANs. The team plans to use inline tagging on Cisco Nexus switches that support hardware-based SGACL enforcement. Which statement correctly describes how inline tagging propagates SGT information?

Which three statements about Dynamic Trunking Protocol (DTP) are true? (Choose three.)

A network engineer issues the following command on Router R9: R9# show ip pim bsr-router PIMv2 Bootstrap Router (BSR) information This system is the Bootstrap Router (BSR) BSR address: 10.0.0.11 Uptime: 1w2d, BSR priority: 0, Hash mask length: 30 Next bootstrap message in 00:00:45 Based on this output, what can be concluded?

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

A network administrator is implementing NetFlow on a Cisco IOS XE router to monitor traffic. Which two statements about NetFlow are true? (Choose two.)

A network engineer runs the following command on Switch SW1: SW1# show interfaces gi0/1 trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 10,20 Port Vlans allowed and active in management domain Gi0/1 10,20 Port Vlans in spanning tree forwarding state and not pruned Gi0/1 10,20 Based on this output, what can be concluded?

Drag and drop each hypervisor product on the left to its matching vendor on the right.

A network engineer is configuring VXLAN on a Cisco Nexus 9000 switch. The engineer wants to ensure that the VXLAN tunnel interface uses the loopback 0 interface as the source for all VXLAN traffic. Which command should be entered under the NVE interface configuration?

Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.

An engineer is configuring a Cisco Nexus 9000 switch running VXLAN EVPN. Tenant traffic must be encapsulated with a VXLAN header that includes a 24-bit VNI, and the underlay must provide loopback-based VTEP addressing with ECMP. The engineer notices that the switch is not forming VXLAN tunnels to remote leaf switches. Which configuration issue is the most likely cause?

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map FILTER in ! route-map FILTER deny 10 match ip address prefix-list BLOCKED route-map FILTER permit 20 ! ip prefix-list BLOCKED seq 5 permit 10.0.0.0/8 ! What is the effect of this configuration?

Which three statements about SD-WAN segmentation and multi-tenancy are true? (Choose three.)

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN with a remote peer using IKEv2. The engineer wants to ensure that the router uses a pre-shared key for authentication and that the IKEv2 proposal uses AES-256 for encryption and SHA-256 for integrity. Which configuration sequence correctly sets up the IKEv2 proposal and keyring?

An architect is designing a QoS policy for a campus LAN that must support real-time voice and video traffic alongside mission-critical data. The design must use the DiffServ model with consistent per-hop behavior across all switches. Which approach should the architect choose to ensure that voice traffic receives priority queuing while video traffic is guaranteed bandwidth without starving other classes?

A network administrator is analyzing the output of 'show ip sla statistics' on a Cisco router. Which two statements correctly describe the information provided by this command? (Choose two.)

What is the default hold time multiplier for EIGRP?

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE router. The VRF CUSTOMER_C has route-target import 300:1 and export 300:1. The PE receives VPNv4 routes from the route reflector, but the CE router connected to the PE cannot ping any remote site IP addresses. The PE can ping the remote site IP addresses from the VRF. What is the most likely cause?

An enterprise network uses TACACS+ for device administration and RADIUS for network access (VPN and wireless). The TACACS+ server is configured to authorize commands. A network engineer notices that after a recent upgrade of the TACACS+ server software, some commands that were previously authorized are now being denied. The engineer checks the router configuration and sees 'aaa authorization commands 15 default group tacacs+'. The TACACS+ server logs show that the authorization requests are being sent and responded to. What is the most likely cause?

What is the purpose of the Dynamic Trunking Protocol (DTP) on Cisco switches?

An engineer is using the Cisco DNA Center REST API to retrieve a list of network devices and their health scores. The engineer writes a Python script using the requests library. The script successfully retrieves data for the first 100 devices, but when trying to get the next 100, the API returns an empty list. The engineer checks the API documentation and finds that the endpoint supports pagination with the 'offset' and 'limit' parameters. The current script does not handle pagination. What should the engineer do to retrieve all devices?

A network administrator is configuring a new Cisco IOS router and needs to enable OSPFv2 on an interface with the correct area and network type. The interface is a broadcast multi-access network. Which command should be used to enable OSPF on the interface and set the area to 0?

Drag and drop each BGP attribute on the left to the value that is preferred (highest or lowest) during path selection on the right.

Consider the following configuration for a FlexVPN spoke router: interface Tunnel0 ip address 10.0.0.2 255.255.255.0 tunnel source GigabitEthernet0/0/0 tunnel mode gre ip tunnel protection ipsec profile FLEXPROF ip nhrp network-id 100 ip nhrp nhs 10.0.0.1 ip nhrp map 10.0.0.1 192.168.1.1 What is the purpose of the 'ip nhrp map 10.0.0.1 192.168.1.1' command?

Drag and drop each MPLS VPN role on the left to its matching description on the right.

A network administrator is configuring a new Cisco IOS router and needs to enable OSPFv3 for IPv6 on an interface. The interface is already configured with an IPv6 address. Which command must be entered in interface configuration mode to enable OSPFv3 on that interface?

Examine the following configuration snippet on a Cisco IOS-XE router: interface GigabitEthernet0/1 service-policy output QOS_POLICY policy-map QOS_POLICY class VOICE priority percent 10 class VIDEO bandwidth percent 30 class class-default fair-queue What is the effect of this configuration?

Drag and drop the steps of configuring Dynamic NAT on a Cisco IOS router into the correct order, from first to last.

A network architect is designing a new branch office that requires a controller-based wireless solution. The branch has a single Cisco Catalyst 9800-CL appliance and needs to support 802.1X authentication with dynamic VLAN assignment for employee SSIDs. Which deployment mode should the architect use for the access points to meet these requirements with minimal configuration on the APs?

A network engineer is configuring a Cisco IOS router to support a site-to-site VPN using IPsec. The engineer wants to ensure that traffic from the local subnet 10.1.1.0/24 to the remote subnet 10.2.2.0/24 is encrypted. Which configuration is required to define the interesting traffic?

Drag and drop the steps of LLQ configuration for voice traffic into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show ip eigrp neighbors EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:12:34 12 100 0 45 1 10.1.1.2 Gi0/1 12 00:10:20 15 120 0 32 Based on this output, what can be concluded?

Drag and drop each NETCONF operation on the left to its matching action on the right.

An enterprise is migrating its data center to a leaf-spine architecture. The design must provide high availability and support for east-west traffic patterns. Which design choice best meets these requirements?

A network administrator is implementing a VXLAN EVPN fabric in a data center. The requirement is to provide Layer 2 connectivity between two leaf switches for a VLAN that must be stretched across the fabric. Which EVPN route type is used to advertise MAC address reachability information?

A network engineer is troubleshooting a Cisco IOS-XE router that hosts several virtual routing and forwarding instances. A route to 10.20.30.0/24 exists in both the global routing table and in VRF CUSTOMER_A. A packet arrives on an interface assigned to VRF CUSTOMER_A with destination 10.20.30.10. How does the router determine which routing table to consult?

Which two statements about multicast RP (Rendezvous Point) are true? (Choose two.)

A network automation team is designing a solution to manage configuration changes across a fleet of Cisco IOS XE devices. They want to use model-driven programmability with YANG data models. Which two protocols can be used to programmatically retrieve and modify configuration using YANG models on these devices? (Choose two.)

A network engineer is implementing MACsec on a Cisco switch-to-switch link to provide encryption. Both switches support MACsec and are configured with the same pre-shared key (PSK). The engineer configures 'mka' and 'macsec' on the interfaces. After configuration, the link does not come up, and the engineer sees 'MKA not operational' in the show macsec status. What is the most likely cause?

Which three statements about dynamic ARP inspection (DAI) are true? (Choose three.)

A network engineer is configuring a VRF on a Cisco IOS-XE router to isolate a customer's traffic. The engineer creates VRF CUST_A, assigns the customer-facing interface to it, and runs the show ip route vrf CUST_A command, which returns no routes. The interface is up and the customer router is reachable. What is the most likely cause?

Examine the following VRF configuration: vrf definition BLUE rd 1:1 route-target export 1:1 route-target import 2:2 ! interface GigabitEthernet0/5 vrf forwarding BLUE ip address 10.0.0.1 255.255.255.0 What is the effect of having different export and import route targets?

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP). The switch has two loopback interfaces: Loopback0 (10.0.0.1/32) and Loopback1 (10.0.0.2/32). The engineer wants VXLAN traffic to use the loopback interface that is also used for BGP EVPN peering. Which command should be used to specify the source interface for the VXLAN tunnels?

Drag and drop the steps of NETCONF edit-config with candidate datastore flow into the correct order, from first to last.

Examine this Python script that uses the napalm library to manage a Cisco IOS-XE device: ```python from napalm import get_network_driver driver = get_network_driver('ios') device = driver('192.168.1.1', 'admin', 'cisco') device.open() print(device.get_facts()) device.close() ``` What is the output of this script?

Examine the following Python script snippet that uses netmiko to configure a Cisco IOS-XE device: ```python from netmiko import ConnectHandler device = { 'device_type': 'cisco_ios', 'ip': '192.168.1.1', 'username': 'admin', 'password': 'cisco', } connection = ConnectHandler(**device) output = connection.send_command('show ip interface brief') print(output) connection.disconnect() ``` What is the primary purpose of this script?

Which three statements about model-driven telemetry are true? (Choose three.)

A network administrator is configuring a Cisco IOS-XE router to support Virtual Routing and Forwarding (VRF). The administrator wants to ensure that traffic from different VRFs can be routed between each other using a shared service VRF. Which VRF feature allows routes to be leaked between VRFs?

A network administrator is configuring a new Cisco IOS switch and wants to ensure that the management VLAN is isolated from user traffic. The administrator needs to assign an IP address to VLAN 1 for management access. Which command should be used to enter the interface configuration mode for VLAN 1?

Which two statements about 802.1X authentication with MAC Authentication Bypass (MAB) are true? (Choose two.)

Which two statements about AAA authentication methods are true? (Choose two.)

A network engineer is building a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate, retrieve interface configuration, and handle the response. Which two actions are required to successfully complete this task? (Choose two.)

A network administrator is comparing configuration management tools and wants to use one that is agentless, uses YAML for playbooks, and communicates with Cisco IOS XE devices over SSH. Which tool best meets these requirements?

A network architect is designing a Cisco SD-WAN fabric for a retail chain with 200 branch sites. The design must provide a single control-plane protocol that distributes routing and policy information between the SD-WAN controllers and the WAN Edge devices, while keeping data-plane traffic direct between branches. Which technology should the architect select for the control plane?

Consider this configuration for TrustSec on a Cisco switch: cts role-based enforcement interface GigabitEthernet1/0/5 cts manual sap pmk AABBCCDDEEFF00112233445566778899 mode-list both propagate sgt What is the purpose of the 'propagate sgt' command under the interface?

A network engineer is deploying a new branch office router that must obtain its WAN interface IP address dynamically from the ISP while also advertising its LAN prefix into OSPF. The engineer configures the WAN interface with the ip address dhcp command. Which additional configuration is required on the router to ensure the LAN prefix is advertised into OSPF with the correct network statement when the WAN IP changes?

A network engineer writes a Python script using Paramiko to execute a command on a Cisco IOS device: ```python import paramiko ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh.connect('192.168.1.1', username='admin', password='cisco123') stdin, stdout, stderr = ssh.exec_command('show version') output = stdout.read().decode() print(output) ssh.close() ``` What is a potential issue with this approach?

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) for a new wireless network. The engineer wants to ensure that client traffic is tunneled back to the WLC and that the WLC is the single point of management for the access points. Which mode should the access points be configured in?

A network engineer is configuring NTP authentication on a Cisco IOS-XE router. The goal is to ensure the router only synchronizes with a trusted NTP server and that the server's keys are validated. Which sequence of configuration steps correctly enforces authenticated NTP peering?

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

An engineer is configuring a new access switch that connects to two distribution switches via trunk links. The distribution switches are configured with Rapid PVST+ and are both running as root bridges for different VLANs. The engineer wants to ensure that the access switch does not become the root bridge for any VLAN, even if the distribution switches fail. The engineer also wants to prevent any unauthorized switch from becoming root. What configuration should the engineer apply on the access switch?

A network engineer is configuring a remote access VPN using Cisco AnyConnect on an ASA. The engineer wants to use certificate-based authentication. The ASA is configured with a CA server. After configuration, users can connect, but they are prompted for a username and password instead of using certificates. The engineer checks the ASA configuration and sees that the tunnel group has authentication method set to AAA. What should the engineer do to fix this?

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive CPU utilization due to malicious traffic. The engineer wants to ensure that BGP, SSH, and SNMP traffic are rate-limited appropriately. After applying the CoPP policy, the engineer notices that BGP sessions are flapping. Which action should the engineer take to resolve the issue while maintaining protection?

Drag and drop the steps of SD-WAN policy creation and push via vManage into the correct order, from first to last.

A telemetry subscription is configured on a Cisco IOS-XE device using gRPC dial-out: telemetry ietf subscription 101 encoding encode-kvgpb filter xpath /interfaces/interface/statistics stream yang-push update-policy periodic 500 receiver ip address 10.10.10.10 50001 protocol grpc-tcp What does this configuration do?

A company uses Cisco NFVIS to host a virtual ASA (vASA) and a virtual router (vRouter). The engineer notices that the vASA cannot communicate with the vRouter even though both are on the same NFVIS host. The vASA is connected to a bridge network, and the vRouter is connected to a different bridge. What should the engineer do to enable communication between the two VNFs?

An Ansible playbook uses the cisco.ios.ios_l3_interfaces module to configure an IPv4 address on GigabitEthernet0/1: ```yaml --- - name: Configure IPv4 address hosts: cisco-routers gather_facts: no tasks: - name: Set IP address cisco.ios.ios_l3_interfaces: config: - name: GigabitEthernet0/1 ipv4: - address: 10.1.1.1/24 state: merged ``` What is the effect of the 'state: merged' parameter?

What is the default OSPF reference bandwidth used for cost calculation in Cisco IOS?

Consider the following TrustSec configuration on a Cisco switch: cts role-based enforcement interface GigabitEthernet1/0/3 cts manual sap pmk 0123456789ABCDEF mode-list both What is the purpose of this configuration?

Drag and drop the steps of EIGRP stub configuration for hub-and-spoke into the correct order, from first to last.

A network team must design QoS for a campus network that carries voice, video, and data traffic. The design must use the DiffServ model and ensure that voice traffic is prioritized over all other traffic classes. Which DSCP marking and queuing strategy should be used for voice?

A network engineer at a logistics company is building a Python script that must retrieve the running configuration of a Cisco IOS XE router without parsing CLI screen-scraping output. The engineer wants a programmatic, model-driven interface that returns structured data over HTTPS. Which approach best satisfies this requirement?

Which three statements about Cisco DNA Center wireless assurance are true? (Choose three.)

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

A network engineer runs the following command on a Cisco WLC: WLC# show client summary Client MAC Address AP Name WLAN State Protocol RSSI SNR 00:11:22:33:44:55 AP-1 1 Run 802.11ac -65 25 00:11:22:33:44:66 AP-2 2 Run 802.11n -70 20 00:11:22:33:44:77 AP-1 1 Run 802.11ac -60 30 00:11:22:33:44:88 AP-3 3 Probe 802.11ax -75 15 Based on this output, what can be concluded?

A network engineer is configuring a Cisco Catalyst switch to mitigate VLAN hopping attacks. The switch has multiple access ports assigned to VLAN 10 and trunk ports connecting to other switches. The engineer wants to ensure that an attacker cannot send double-tagged frames to hop into another VLAN. Which action should the engineer take on all access ports?

Drag and drop each STP timer on the left to its matching default value on the right.

Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

A network engineer is configuring a Cisco IOS router to support VRF-lite for a customer. The engineer creates a VRF named CUST_A and assigns an interface to it using the command ip vrf forwarding CUST_A. After assigning the interface, the engineer notices that the interface IP address is removed. Which action must the engineer take to restore connectivity?

Examine the following configuration snippet: ip pim send-rp-announce Loopback0 scope 10 group-list 10 ip pim send-rp-discovery scope 10 access-list 10 permit 239.0.0.0 0.255.255.255 ! interface Loopback0 ip address 192.168.0.1 255.255.255.255 ip pim sparse-mode ! What is the purpose of this configuration?

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a specific client device is experiencing poor performance. Which feature in DNA Center Assurance provides a detailed timeline of events, including onboarding, authentication, and application usage for a specific client?

Examine the following Python script that uses the netmiko library to send configuration commands to a Cisco IOS-XE device: ```python from netmiko import ConnectHandler device = { 'device_type': 'cisco_ios', 'ip': '192.168.1.1', 'username': 'admin', 'password': 'cisco', } connection = ConnectHandler(**device) config_commands = [ 'interface GigabitEthernet1/0/1', 'description Link to Core', 'ip address 10.1.1.1 255.255.255.0', 'no shutdown' ] output = connection.send_config_set(config_commands) print(output) connection.disconnect() ``` What is the purpose of this script?

A network engineer is deploying Cisco TrustSec in a campus network. The security team requires that the Security Group Tag (SGT) be carried inside the Ethernet frame so that switches in the path can enforce group-based policy without inline tagging. Which Cisco-proprietary protocol should be enabled on the uplinks between the access and distribution switches to achieve this?

A network engineer is configuring PIM sparse mode in a network that uses a Bootstrap Router (BSR) for RP discovery. The engineer has configured a candidate BSR and candidate RPs. However, some routers in the network are not learning the RP set. The engineer checks the BSR and sees that it is receiving candidate RP advertisements, but the BSR messages are not being forwarded to all routers. What is the most likely cause?

Drag and drop the steps of deploying a virtual router as a VNF into the correct order, from first to last.

Drag and drop the steps of AAA accounting for command logging setup into the correct order, from first to last.

A network engineer is designing a Python script to automate configuration changes on a fleet of Cisco IOS XE devices using the NETCONF protocol. The script must ensure that changes are atomic and that the device validates the configuration before committing. Which two NETCONF capabilities must the script check for during the capability exchange to guarantee these requirements? (Choose two.)

A network engineer has configured a Cisco IOS IP SLA operation using ICMP echo to monitor reachability to a remote branch router. The engineer wants to correlate the results with syslog messages and SNMP traps to detect when the branch becomes unreachable. Which IP SLA configuration step is required to generate these notifications?

An enterprise is deploying Cisco SD-WAN with multiple vSmart controllers for redundancy. The engineer configures the vEdge routers to connect to two vSmart controllers. After deployment, the engineer notices that the vEdge routers are only connected to one vSmart, and the second vSmart is not being used. The vEdge routers show that the second vSmart is reachable. What is the most likely reason for this behavior?

Which three statements about VRF route targets are true? (Choose three.)

A network engineer is troubleshooting OSPF adjacency issues between two routers connected via a Gigabit Ethernet link. The engineer notices that the routers are stuck in the EXSTART state. Both routers have the same MTU of 1500 bytes. What is the most likely cause of this issue?

A network engineer runs the following command on Router R6: R6# show ip dhcp conflict IP address Detection method Detection time VRF 10.0.0.10 Ping Mar 01 2025 10:00 AM default 10.0.0.15 Gratuitous ARP Mar 01 2025 10:05 AM default Based on this output, what can be concluded?

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) and access points in a branch office. The administrator wants to ensure that all management traffic between the WLC and APs is encrypted and that APs can discover the WLC across a Layer 3 network. Which protocol should be used for AP-to-WLC communication?

An engineer configures model-driven telemetry on a Cisco IOS-XE device with the following gRPC dial-out configuration: ``` telemetry ietf subscription 101 encoding encode-kvgpb filter xpath /interfaces/interface/state/counters source-address 10.1.1.1 stream yang-push update-policy periodic 500 receiver ip address 10.2.2.2 50001 protocol grpc-tcp ``` What is the purpose of the 'encoding encode-kvgpb' command?

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Which IP SLA operation type requires an IP SLA responder to be configured on the target device?

A network engineer is configuring a Zone-Based Firewall on a Cisco IOS XE router. The design requires that traffic from the inside zone to the outside zone be inspected, that return traffic be permitted, and that traffic from the outside zone to the inside zone be dropped unless it matches an existing session. Which configuration element is required to achieve this behavior?

A network engineer is configuring a GRE tunnel between two sites to transport IPv6 traffic over an IPv4-only underlay. The engineer wants to ensure that the tunnel interface supports IPv6 and that traffic is encrypted. Which technology should be combined with GRE to provide encryption?

A network engineer is deploying a new branch office switch and needs to configure a switched virtual interface (SVI) to act as the default gateway for VLAN 10. The VLAN has been created and ports have been assigned. Which additional step is required for the SVI to become operational and pass traffic?

Drag and drop each MP-BGP address family on the left to its matching use case on the right.

A network engineer is deploying a Cisco Wireless LAN Controller (WLC) in a large campus with 500 access points. The engineer must ensure that the WLC can handle the expected client load and that APs can join the controller securely. Which protocol does the AP use to discover and join the WLC, and what is the default secure management protocol for the WLC GUI?

Examine the following configuration: policy-map SHAPE_POLICY class class-default shape average 10000000 service-policy INNER_POLICY What is the purpose of the nested service-policy (service-policy INNER_POLICY) under the shape command?

Drag and drop each IP SLA threshold type on the left to its trigger condition on the right.

Drag and drop the steps of SNMP bulk walk operation process into the correct order, from first to last.

Which three statements about SD-WAN (Cisco Catalyst SD-WAN) are true? (Choose three.)

An engineer is implementing a QoS policy on a Cisco IOS XE router. The requirement is to prioritize voice traffic (marked DSCP EF) and ensure that it receives strict priority scheduling with a guaranteed bandwidth of 30% of the interface capacity. Which queuing mechanism should be configured on the interface?

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, BGP, SSH management, and SNMP polling. After applying a CoPP policy, the administrator notices that OSPF adjacencies flap intermittently while BGP and SSH remain stable. Which action should the administrator take to resolve the flapping while maintaining control plane protection?

Drag and drop each EIGRP router role on the left to its matching definition on the right.

Examine the following configuration: interface GigabitEthernet0/0 ip address 172.16.1.1 255.255.255.0 ipv6 address 2001:db8:1::1/64 ipv6 ospf 100 area 0 ! What is missing from this configuration to enable OSPFv3 on this interface?

A network engineer is implementing QoS on a Cisco IOS router. The requirement is to classify traffic based on the DSCP value in the IP header and then mark it with a new DSCP value. Which QoS mechanism should be used to accomplish this?

A network engineer is deploying Cisco TrustSec (CTS) with Security Group Access Control Lists (SGACLs) on a campus network. The engineer configures the switch with 'cts role-based enforcement' and assigns SGTs to users via 802.1X. The engineer tests connectivity between a user in SGT 10 and a server in SGT 20. The SGACL permits traffic from SGT 10 to SGT 20, but the user cannot reach the server. The engineer checks 'show cts role-based sgt map' and sees that the user's SGT is 0. What is the most likely cause?

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- Based on this output, what can be concluded?

A network engineer runs the following command on Switch SW6: SW6# show monitor session 6 Session 6 --------- Type : Remote Destination Session Source RSPAN VLAN : 200 Destination Ports : Gi1/0/12 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

Drag and drop each CPU feature on the left to its matching virtualization purpose on the right.

A network engineer is new to automation and wants to use a Python script to configure a Cisco IOS XE device. The engineer prefers a protocol that uses HTTP methods and JSON for data encoding, as it is easier to read and debug. Which protocol should the engineer choose?

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Drag and drop each PnP workflow step on the left to its matching action on the right.

Which three statements about the Cisco Enterprise WAN design principles are true? (Choose three.)

A network administrator must protect the control plane of a Cisco IOS XE router that peers BGP with an ISP. The requirement is to rate-limit specifically ARP and IPv4 TTL-expired packets destined to the route processor while allowing all other transit traffic to be forwarded normally. Which CoPP implementation step is required to achieve this?

A network engineer is using Cisco DNA Center to automate the deployment of a new VLAN across multiple access switches. The engineer creates a new network profile with the VLAN definition and assigns it to a site. However, after provisioning, the VLAN is not created on any of the switches. The engineer verifies that the devices are in the Inventory and are reachable. What is the most likely cause?

Drag and drop the steps of vSphere VM snapshot creation and revert steps into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show ip interface GigabitEthernet0/1 | include access list Inbound access list is not set Outbound access list is 140 R1# show access-lists 140 Extended IP access list 140 10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches) 20 deny tcp any any eq 443 (10 matches) 30 permit ip any any (50 matches) Based on this output, what can be concluded?

A network engineer is deploying a new branch office with a single Cisco Catalyst switch. The branch requires that all access ports automatically authenticate devices using 802.1X with RADIUS, but also allow unauthenticated devices to be placed into a guest VLAN. Which feature must be configured on the switch to meet this requirement?

A network automation team is using Ansible to push configuration changes to a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module with the 'backup: yes' option. During a recent run, the playbook failed on one device due to a syntax error in the configuration lines. The team wants to ensure that if a failure occurs, the device automatically reverts to its previous configuration without manual intervention. Which Ansible feature should be used to achieve this?

A network engineer is using a Python script with the requests library to retrieve interface information from a Cisco IOS XE device via RESTCONF. The script sends a GET request to https://192.168.1.1/restconf/data/ietf-interfaces:interfaces but receives a 401 Unauthorized error. The engineer has verified that the device has RESTCONF enabled and the URL is correct. Which action should the engineer take to resolve the error?

A network engineer issues the following command on Router R2: R2# show ip mroute 239.1.1.1 IP Multicast Routing Table Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet, X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement, U - URD, I - Received Source Specific Host Report, Z - Multicast Tunnel, z - MDT-data group session, Y - Joined MDT-data group, y - Sending to MDT-data group Outgoing interface flags: H - Hardware switched, A - Assert winner Timers: Uptime/Expires Interface state: Interface, Next-Hop or VCD, State/Mode (*, 239.1.1.1), 00:03:45/00:02:15, RP 10.0.0.1, flags: S Incoming interface: GigabitEthernet0/0, RPF nbr 10.0.0.1 Outgoing interface list: GigabitEthernet0/1, Forward/Sparse, 00:03:45/00:02:15 Based on this output, what can be concluded?

A network engineer runs the following command on Router R2: R2# show mpls forwarding-table Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 16 Pop Label 10.1.1.1/32 0 Gi0/0 192.168.1.1 17 18 10.2.2.0/24 1500 Gi0/1 192.168.2.3 18 Untagged 10.3.3.0/24 0 Gi0/2 192.168.3.4 Based on this output, what is the correct interpretation?

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream interface statistics to a collector using gRPC. The engineer wants to ensure that the telemetry data is sent only when there is a change in the interface counters, rather than at a fixed interval. Which configuration parameter should the engineer use to achieve this behavior?

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

A company is migrating its branch WAN to a Cisco SD-WAN solution. The design team wants to use a single overlay that supports both point-to-point and multipoint traffic, and they want to avoid running separate tunnels for unicast and multicast. Which Cisco SD-WAN technology should they enable on the overlay?

A network engineer runs the following command on Switch SW1: SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 10 Sales active Gi0/4, Gi0/5 20 Engineering active Gi0/6 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Based on this output, what can be concluded?

A network engineer runs the following command on Switch SW1: SW1# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Both : Gi1/0/2 Destination Ports : Gi1/0/10 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip ospf network point-to-point ip ospf hello-interval 10 ! router ospf 1 network 192.168.1.0 0.0.0.255 area 0 What is the effect of this configuration?

An engineer is troubleshooting an MPLS VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are running OSPF with the CE routers. On PE1, the 'show ip route vrf CUSTOMER' output shows 10.2.2.0/24 as an OSPF route, but the prefix is not present in the global BGP table. What is the most likely cause?

A network architect is designing the QoS architecture for a Cisco SD-WAN deployment that carries voice, video, and data traffic across MPLS and Internet transports. The design must use a consistent DiffServ marking strategy across all transports and ensure that voice traffic is prioritized over video. Which QoS policy type and marking approach should the architect use?

A company has a network with multiple VLANs connected via a Layer 3 switch acting as the gateway for all VLANs. The network uses Rapid PVST+ for spanning tree. Recently, the network team added a new access switch to VLAN 100. After the switch was connected, users in VLAN 100 experienced intermittent connectivity, and the Layer 3 switch logs show 'SPANTREE-2-ROOTGUARD_BLOCK' messages for the port connected to the new switch. The new switch is intended to provide additional access ports for VLAN 100. The network team ensured that the new switch's configuration is correct for VLAN 100 access. What is the most likely cause of the issue, and what action should be taken to resolve it?

An enterprise is deploying a virtualized network function (VNF) for a next-generation firewall on a KVM-based hypervisor. The architect must ensure that the VNF can handle high throughput without CPU bottlenecks. Which hypervisor configuration technique should the architect use to dedicate physical CPU cores to the VNF?

What is the default multicast group range for Source-Specific Multicast (SSM) as defined by IANA and supported by Cisco IOS?

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that the health score for a particular building has dropped significantly. Which feature of Cisco DNA Center Assurance should the administrator use to identify the root cause of the issue by analyzing network events and device performance metrics over time?

A company has a campus network with two distribution switches (DSW1 and DSW2) connected via a Layer 2 trunk. Each distribution switch connects to two access switches. Spanning Tree Protocol (STP) is running with default settings. Recently, a network administrator added a new access switch (ASW3) and connected it to both distribution switches. After the connection, network performance degraded significantly, and users in VLAN 10 reported intermittent connectivity. The administrator checked the logs and saw multiple TCN notifications. What is the most likely cause of the issue?

A network engineer is using Cisco DNA Center Assurance to monitor a network with Cisco SD-Access fabric. The engineer notices that the fabric health score is consistently low, but individual device health scores are high. Which component of the fabric should the engineer investigate first?

Drag and drop the steps of Ansible playbook execution flow into the correct order, from first to last.

A network engineer is deploying a wireless mesh network using outdoor access points. The mesh APs are configured to use 802.11a/n on the 5 GHz band for backhaul and 802.11b/g/n on the 2.4 GHz band for client access. The engineer notices that the mesh backhaul links are unstable and have high packet loss. What is the most likely cause of the instability?

A network engineer runs the following command on a Cisco WLC: WLC# show ap config general AP-2 AP Name: AP-2 MAC Address: aabb.cc00.0200 Country Code: US - United States Regulatory Domain: 802.11bg: -A 802.11a: -A AP Submode: FlexConnect AP Mode: FlexConnect AP Join Priority: 2 Primary Controller: WLC-1 Secondary Controller: WLC-2 Tertiary Controller: WLC-3 Based on this output, what can be concluded?

An engineer is deploying a wireless network in a hospital that requires strict security and client isolation. The network must support 802.1X authentication for employees and a separate guest SSID with a captive portal. The engineer configures the WLC with RADIUS servers for 802.1X and a local web server for the captive portal. However, guest users can access the internal network after authentication. What configuration change is needed?

A network engineer runs the following command on Switch SW3: SW3# show etherchannel load-balance EtherChannel Load-Balancing Configuration: src-dst-ip EtherChannel Load-Balancing Operational State: src-dst-ip Based on this output, what can be concluded?

An engineer configures gRPC dial-out telemetry on a Cisco IOS-XE device: ``` telemetry ietf subscription 100 receiver ip address 10.1.1.100 port 50051 protocol grpc-tcp source-address 10.1.1.1 encoding encode-kvgpb filter xpath /interfaces/interface/state/counters update-policy periodic 10000 ``` What is the purpose of the 'source-address' command?

A network engineer is configuring a Cisco ASA firewall with a site-to-site VPN to a remote peer. The engineer wants to ensure that only specific subnets are encrypted and that traffic from other subnets is not sent through the tunnel. Which configuration element defines the traffic that will be protected by the VPN?

A network engineer is automating the configuration of VLANs on a Cisco Nexus 9000 switch using Python and the NX-API. The engineer sends a Python dictionary with the CLI commands to the API and receives a successful response. However, when checking the switch, the VLANs are not created. The engineer verifies that the credentials and IP address are correct, and the API is enabled. The engineer also notices that the API response contains a 'code' field of '200' and a 'result' field that shows the command output. What is the most likely cause of the issue?

Drag and drop each YANG module on the left to its matching standard body on the right.

A network engineer is deploying Cisco DNA Center Assurance to monitor a campus network. The engineer wants to leverage machine learning to baseline normal behavior and detect anomalies without manually defining thresholds. Which capability should be enabled?

An engineer is writing a Python script to parse the output of 'show ip interface brief' from multiple Cisco routers. The engineer uses the netmiko library to collect the output and then uses regular expressions to extract the interface name, IP address, and status. The script works correctly for most routers, but on one router, the output format is slightly different (e.g., extra spaces or different column headers). The engineer wants to make the parsing more robust. What is the best approach?

Analyze this NAT configuration: ``` ip nat pool GLOBAL 203.0.113.10 203.0.113.20 netmask 255.255.255.0 ip nat inside source list 1 pool GLOBAL overload access-list 1 permit 192.168.1.0 0.0.0.255 ``` Which statement is correct?

A network engineer runs the following command on Router R3: R3# show mls qos interface GigabitEthernet0/1 GigabitEthernet0/1 trust state: trust DSCP trust mode: trust dscp COS override: dis default COS: 0 DSCP Mutation Map: default dscp mutation map trust device: none qos mode: port-based R3# show mls qos QoS is enabled globally QoS global counters: total packets not matching QoS criteria = 0 Total packets with known CoS = 0 Total packets dropped by policing = 0 Based on this output, what can be concluded?

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device is experiencing frequent disconnects. Which Assurance feature should be used to view a chronological list of events related to that specific client, including association, authentication, and roaming events?

A network architect is designing a Cisco ACI fabric for a multi-tenant data center. Tenants must be isolated at Layer 3, but some tenants require shared services such as a firewall and load balancer. Which Cisco ACI construct should the architect use to allow selective communication between tenants while maintaining isolation?

Drag and drop each leased line technology on the left to its matching speed on the right.

A security team wants to protect a campus network from MAC flooding attacks that could overflow the CAM table on access switches. The requirement is to limit the number of source MAC addresses learned per switch port and to automatically err-disable a port when the limit is exceeded, while still allowing a VoIP phone and a PC on the same port. Which configuration approach meets these requirements?

A network engineer is implementing a Zone-Based Firewall (ZBFW) on a Cisco IOS XE router. The router has three interfaces: inside (GigabitEthernet0/0), outside (GigabitEthernet0/1), and DMZ (GigabitEthernet0/2). The security policy requires that traffic from the inside zone to the outside zone be inspected, traffic from the outside zone to the DMZ be allowed only for HTTP and HTTPS, and all other traffic between zones be denied by default. Which configuration step is essential to achieve this policy?

Consider the following configuration snippet: policy-map QOS_POLICY class VOICE priority percent 30 class VIDEO bandwidth percent 20 queue-limit 50 packets class class-default fair-queue queue-limit 100 packets What is the effect of this configuration?

Drag and drop the steps of NAT64 IPv6-to-IPv4 translation flow into the correct order, from first to last.

A large enterprise uses a centralized automation platform based on Ansible Tower to manage its network infrastructure. The network consists of 500 Cisco IOS XE routers and switches distributed across multiple sites. The automation team has created a playbook that configures BGP peerings on all devices. The playbook uses the ios_bgp module. Recently, during a maintenance window, the playbook was run against a subset of devices that were supposed to be upgraded to a new IOS XE version. However, after the run, several devices lost their BGP configurations entirely. The team discovers that the new IOS XE version introduced a new BGP configuration model that is not fully compatible with the ios_bgp module's expected CLI commands. The playbook failed silently on those devices, and the existing BGP configuration was removed. The team needs to prevent this from happening in future maintenance windows. Which action should be taken?

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

A network administrator is troubleshooting a Cisco Catalyst switch and suspects a Layer 2 loop. The administrator wants to verify the Spanning Tree Protocol (STP) topology and identify the root bridge. Which command should be used?

Drag and drop the steps of NUMA-aware VM placement process into the correct order, from first to last.

A network engineer is implementing a VXLAN overlay over an existing Layer 3 campus network. The requirement is to carry Layer 2 frames across the Layer 3 underlay. Which protocol is used to encapsulate the original Layer 2 frame for transport across the IP network?

A network administrator is using Cisco DNA Center to monitor a campus network. The administrator wants to receive an alert when a switch's CPU utilization exceeds 80% for more than 5 minutes. Which feature should be configured?

A network engineer is using Cisco DNA Center to manage a network with multiple sites. The engineer wants to ensure that all devices at a remote site have the same NTP server configuration. The engineer creates a network profile with the NTP settings and assigns it to the site. After provisioning, the engineer checks one of the switches and finds that the NTP configuration is missing. What should the engineer check first?

Drag and drop each REST HTTP status code on the left to its matching meaning on the right.

A company is deploying a WAN with MPLS VPN and wants to ensure that customer traffic is isolated from other customers. Which technology is used to maintain separation in the MPLS core?

A network architect is designing a campus fabric using Cisco SD-Access to centralize policy enforcement and simplify segmentation. The design must support endpoint groups for IoT devices and employees, with traffic policy applied consistently across wired and wireless. Which control plane component is responsible for maintaining the mapping between endpoint identifiers and their location in the fabric?

An enterprise network uses OSPF as its IGP. The network engineer notices that a particular route learned via OSPF is not being installed in the routing table, even though the neighbor adjacency is up and the route appears in the OSPF database. The route is an external route redistributed from EIGRP. What is the most likely cause?

A security architect is designing a network where endpoint identity and group membership must follow users and devices across both wired and wireless networks, and policy enforcement must be consistent regardless of VLAN or IP subnet. Which Cisco solution provides this identity-based, group-based access control?

Drag and drop each WAN encapsulation on the left to its matching use case on the right.

A network engineer is writing a Python script to retrieve the operational state of all GigabitEthernet interfaces from a Cisco IOS XE device using RESTCONF. The device is configured with HTTPS and the engineer has valid credentials. The script uses the 'requests' library to send a GET request to the RESTCONF API. Which HTTP header must be included in the request to specify that the client expects JSON-formatted data in the response?

A network engineer is configuring a Cisco Catalyst switch port that connects to an IP phone. The phone must place voice traffic in VLAN 200 and data traffic from a daisy-chained PC in VLAN 100. The switch port is currently configured as a static access port in VLAN 100. Which configuration must the engineer apply to meet these requirements?

Drag and drop the steps of NAPALM get_facts() retrieval from IOS-XE device into the correct order, from first to last.

A network administrator is deploying a Cisco SD-Access fabric and needs to ensure that the underlay network is properly configured. Which two statements about the underlay network in SD-Access are true? (Choose two.)

Refer to the exhibit. An engineer notices that interface resets have occurred. What is the most likely cause of the interface resets?

Which two statements about AAA authorization and accounting are true? (Choose two.)

A network engineer is configuring a new switch stack using Cisco StackWise technology. The engineer wants to ensure that if the stack master fails, another switch takes over with minimal disruption. Which statement accurately describes the failover behavior in a StackWise stack?

A network engineer is writing a Python script using the requests library to interact with a Cisco IOS XE device's RESTCONF API. The script needs to authenticate using basic authentication and retrieve interface details. The engineer writes the following code snippet: import requests url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces' headers = {'Accept': 'application/yang-data+json'} response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False) However, the script returns a 401 Unauthorized error. What is the most likely cause?

Drag and drop the steps of RPF check verification for multicast forwarding into the correct order, from first to last.

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

A network engineer is configuring control plane policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers and is managed over SSH from a jump host. After applying a new policy-map, the engineer notices that BGP sessions remain up but SSH logins intermittently time out during traffic spikes. Which action should the engineer take to resolve the SSH timeouts while preserving the CoPP protection model?

Which two statements about Python data structures used in network automation are true? (Choose two.)

Which three statements about Cisco TrustSec (CTS) are true? (Choose three.)

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The underlay is a Layer 3 routed fabric using OSPF. The engineer needs to ensure that multicast replication is not used for BUM (Broadcast, Unknown Unicast, Multicast) traffic. Which VXLAN EVPN configuration is required on the leaf switches?

Drag and drop the steps of VLAN mapping on trunk interfaces into the correct order, from first to last.

Drag and drop the steps of Cisco NSO service provisioning workflow into the correct order, from first to last.

A network automation team is evaluating YANG models to manage Cisco IOS XE devices. They need to ensure that the models they choose can be used with both NETCONF and RESTCONF. Which two statements about YANG models are true in this context? (Choose two.)

A network engineer uses the Cisco DNA Center API to trigger a provisioning workflow for a new device. The API call returns the following JSON response: { "response": { "taskId": "task-12345", "url": "/api/v1/task/task-12345" }, "version": "1.0" } The engineer then polls the task status using the URL. Which HTTP method should be used to retrieve the task status?

Which two statements about 802.1X port states and access control are true? (Choose two.)

A network administrator is configuring a new Cisco Catalyst switch and needs to ensure that the management VLAN interface is reachable from a remote subnet. The switch currently has no default gateway configured. Which command should be used to allow the switch to communicate with devices on other subnets?

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Drag and drop the steps of Cisco Flex (FlexConnect) AP mode operation into the correct order, from first to last.

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Drag and drop the steps of implementing QoS trust boundaries on a Cisco switch into the correct order, from first to last.

Drag and drop the steps of SVI configuration for inter-VLAN routing into the correct order, from first to last.

Drag and drop the steps of the QoS trust boundary configuration process into the correct order, from first to last.

A network administrator checks the AAA configuration on a router: R1# show running-config | include aaa aaa new-model aaa authentication login default group radius local aaa authentication login console local aaa authorization exec default group tacacs+ local aaa accounting exec default start-stop group radius Based on this output, what can be concluded?

Drag and drop the steps of troubleshooting an IP SLA operation into the correct order, from first to last.

A network engineer is configuring a Cisco IOS router for QoS and wants to ensure that voice traffic is prioritized and that excess traffic is dropped rather than buffered when congestion occurs. The engineer decides to use Low Latency Queueing (LLQ). Which two statements accurately describe the behavior of LLQ? (Choose two.)

An enterprise is using OSPF in a multi-area design. Area 1 is a regular area, and Area 2 is a totally stubby area. Which LSA types are present in Area 2?

A network engineer runs the following command on Switch SW9: SW9# show monitor session 9 Session 9 --------- Type : Remote Destination Session Source RSPAN VLAN : 300 Destination Ports : Gi1/0/40 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A network engineer is designing a new data center network using Cisco ACI. The engineer needs to ensure that traffic between two endpoints in different EPGs is allowed only if a contract permits it. Which ACI construct is used to define the rules that permit or deny traffic between EPGs?

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The administrator wants to protect the route processor from excessive control-plane traffic while still allowing legitimate routing protocol and management traffic. The administrator creates a class map that matches BGP, OSPF, and SSH traffic and applies a police action with a committed information rate. Which additional configuration element is required to complete the CoPP implementation?

A network team is deploying a virtualized WAN optimization appliance. The appliance must be able to process traffic at line rate on a 10 Gbps link. The hypervisor host has multiple physical NICs. Which design choice will best ensure the VM can achieve the required throughput?

Drag and drop the steps of EtherChannel troubleshooting and verification steps into the correct order, from first to last.

Drag and drop the steps of MPLS L3VPN packet forwarding steps into the correct order, from first to last.

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator wants to identify the root cause of poor wireless client experience. Which two actions can be taken within Cisco DNA Center Assurance to troubleshoot this issue? (Choose two.)

A network architect is designing a Cisco SD-Access fabric. The security team requires that endpoint traffic be segmented into separate virtual networks and that group-based policy be enforced without using traditional VLANs or ACLs between fabric edge nodes. Which two Cisco SD-Access fabric components or features support these requirements? (Choose two.)

Examine this DHCP configuration: ``` service dhcp ip dhcp pool POOL2 network 10.20.20.0 255.255.255.0 default-router 10.20.20.1 lease infinite ``` What is the effect of the 'lease infinite' command?

Drag and drop the steps of SD-WAN traffic engineering app-aware routing steps into the correct order, from first to last.

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The requirement is to allow fallback to the local database if all TACACS+ servers are unreachable. Which AAA configuration achieves this?

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

Drag and drop each MPLS role on the left to its matching function on the right.

ip vrf RED rd 200:1 route-target export 200:1 route-target import 200:1 ! interface GigabitEthernet0/1 ip vrf forwarding RED ip address 10.1.1.1 255.255.255.0 ! router bgp 65000 neighbor 192.168.1.1 remote-as 65000 neighbor 192.168.1.1 update-source Loopback0 address-family vpnv4 neighbor 192.168.1.1 activate neighbor 192.168.1.1 send-community extended ! Which statement about this configuration is true?

A network engineer is writing a Python script to retrieve the list of interfaces from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces and receives a 401 Unauthorized response. The device is reachable, and RESTCONF is enabled. The engineer verifies that the username and password are correct. Which action should the engineer take to resolve the issue?

What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet. The router must provide IP addresses, default gateway, and DNS server information to clients. Which configuration is required?

An enterprise is migrating a legacy application from a physical server to a virtual machine on a KVM-based hypervisor. The application requires direct access to a PCIe network interface card for performance reasons. The engineer needs to provide the VM with dedicated hardware access while maintaining isolation from other VMs. Which technology should the engineer use?

Drag and drop the steps of creating and applying an Ansible role for network device configuration into the correct order, from first to last.

A network architect is designing a new branch office that requires a controller-based wireless solution with centralized management, but the branch has limited bandwidth and must continue forwarding client traffic locally even if the WAN link to the headquarters controller fails. The branch has a single Cisco Catalyst 9800-L controller and several Cisco Catalyst 9100 access points. Which deployment mode should the architect choose for the access points?

A network engineer is configuring an IP SLA operation to monitor the reachability of a critical server at 10.1.1.1. The engineer wants to generate a syslog message and trigger a track object if the response time exceeds 100 ms. Which IP SLA operation type should be used?

A network engineer uses Cisco DNA Center API to retrieve the health of a device. The API call returns: ```json { "response": [ { "deviceId": "1234567890", "healthScore": 85, "overallHealth": "good", "memory": { "used": 4096, "total": 8192, "usage": 50 }, "cpu": { "usage": 25 } } ] } ``` What does the healthScore of 85 indicate?

Which two statements about Rapid PVST+ are true? (Choose two.)

A network engineer is troubleshooting a Cisco ACI environment where a tenant's application is experiencing intermittent connectivity issues. The engineer suspects that the issue is related to the ACI fabric's forwarding behavior. Which tool can be used to verify the end-to-end path and policy enforcement for a specific flow within the ACI fabric?

Drag and drop each LDP message type on the left to its matching function on the right.

Drag and drop each NFV component on the left to its matching role on the right.

Drag and drop the steps of DMVPN Phase 3 NHRP registration and spoke-to-spoke tunnel establishment into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show ip access-lists 101 Extended IP access list 101 10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches) 20 deny tcp any any eq 23 (50 matches) 30 permit ip any any (200 matches) Based on this output, what can be concluded?

A network engineer is designing a Python script that uses the YANG models supported by a Cisco IOS XE device to configure interface descriptions via RESTCONF. The engineer wants to ensure the script uses the correct data model and avoids errors. Which TWO actions should the engineer take? (Choose two.)

A network engineer is implementing VXLAN with a Layer 2 gateway on a Cisco Nexus 9000 series switch. The design uses a distributed anycast gateway to provide optimal forwarding for hosts in the same subnet across different leaf switches. The engineer needs to ensure that all leaf switches use the same virtual MAC address for the gateway. Which feature must be configured to achieve this?

A network engineer runs the following command on Router R9: R9# show ip pim neighbor PIM Neighbor Table Neighbor Address Interface Uptime Expires Mode 192.168.1.10 GigabitEthernet0/0 1w2d 00:01:30 Dense 192.168.1.11 GigabitEthernet0/0 2w0d 00:01:25 Sparse 192.168.1.12 GigabitEthernet0/1 3d04h 00:01:28 Sparse Based on this output, what can be concluded?

Drag and drop each wireless roaming method on the left to its matching 802.11 standard on the right.

A network engineer is deploying a Cisco SD-WAN solution for a global enterprise with multiple regional hubs. The engineer wants to ensure that traffic from branch offices to the internet is always forwarded directly from the branch, even if the branch has a primary MPLS link and a backup broadband link. The engineer configures the vSmart policy to direct internet-bound traffic to use the local exit at the branch. However, after deployment, the engineer notices that some internet traffic is still being sent to the regional hub before reaching the internet. What is the most likely cause of this behavior?

Drag and drop the steps of IPsec IKEv2 tunnel establishment into the correct order, from first to last.

An engineer is managing a Cisco NFVIS host running multiple virtual network functions (VNFs). The engineer needs to upgrade the NFVIS software to a new version that includes critical security patches. The upgrade process must minimize downtime. Which upgrade method should the engineer use?

A network engineer runs the following command on Router R9: R9# show ip ospf interface brief Interface PID Area IP Address/Mask Cost State Nbrs F/C Gi0/0 1 0 192.168.1.9/24 10 DR 2/2 Gi0/1 1 1 10.0.0.9/24 20 BDR 1/1 Lo0 1 0 9.9.9.9/32 1 LOOP 0/0 Based on this output, what can be concluded?

A network engineer executes the following command on Router R5: R5# show ip sla monitor configuration 4 IP SLAs Monitor Configuration Entry number: 4 Owner: Tag: Type of operation to perform: udp-jitter Target address: 192.168.5.10 Target port: 16384 Source address: 192.168.5.1 Source port: 0 Type Of Service parameter: 0x0 Request size (ARR data portion): 32 Operation timeout (milliseconds): 5000 Frequency (seconds): 60 Next Scheduled Start Time: Start Time already passed Group Scheduled : FALSE Life (seconds): Forever Entry Ageout (seconds): never Recurring (Starting Everyday, Starting Time: 00:00:01) Status of entry (SNMP RowStatus): Active Threshold (milliseconds): 5000 Distribution Statistics: Number of statistic hours kept: 2 Number of statistic distribution buckets kept: 1 Statistic distribution interval (milliseconds): 20 Enhanced History: Based on this output, what type of IP SLA operation is configured?

A network administrator is configuring a Cisco IOS XE router to act as a VPN headend with IKEv2. The security policy requires that the router authenticate to peers using a certificate from a corporate PKI, and that peers authenticate using EAP-MSCHAPv2. Which IKEv2 authentication configuration on the headend meets these requirements?

Given the following configuration on a Cisco switch: monitor session 1 source interface GigabitEthernet1/0/1 - 3 both monitor session 1 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?

A network administrator is configuring a Cisco Catalyst switch to prevent unauthorized devices from connecting to an access port. The administrator wants to ensure that only one MAC address is allowed on the port, and if a violation occurs, the port should be shut down and an SNMP trap sent. Which port security violation mode should be configured?

A network engineer is designing a model-driven telemetry solution for a large enterprise network with thousands of devices. The engineer wants to minimize the load on the network devices and the collector by sending data only when significant changes occur. The engineer decides to use on-change subscriptions. However, after deployment, the engineer notices that some subscriptions are sending updates too frequently, causing high CPU usage on the devices. What is the most likely reason for this excessive update frequency?

A network engineer is troubleshooting a connectivity problem between two hosts on the same VLAN. The engineer suspects a duplex mismatch on the switch port. Which command should be used to verify the duplex settings on a Cisco Catalyst switch interface?

What is the default OSPF hello interval on an Ethernet link?

A network administrator is configuring a Cisco Catalyst switch to allow management access only from the subnet 10.10.10.0/24. The administrator wants to apply an ACL to the VTY lines. Which command correctly applies the ACL named MGMT to the VTY lines?

Drag and drop each 802.1X component on the left to its matching role on the right.

Drag and drop the steps of TACACS+ command authorization flow into the correct order, from first to last.

A network engineer is configuring a Cisco Catalyst switch port that connects to an IP phone and a PC. The phone must tag its voice traffic with VLAN 200, and the PC must send untagged traffic that the switch places into VLAN 10. Which interface configuration accomplishes this?

Drag and drop each cisco.ios module on the left to its matching purpose on the right.

Examine the following configuration snippet applied to a Cisco IOS-XE device: interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/2 ip address 192.168.1.1 255.255.255.0 ip nat outside ! access-list 100 permit ip 10.1.1.0 0.0.0.255 any ip nat inside source list 100 interface GigabitEthernet0/2 overload What is the effect of this configuration?

A network engineer runs the following command on Router R1: R1# show crypto isakmp sa dst src state conn-id slot 10.1.1.2 10.1.1.1 MM_NO_STATE 1 0 Based on this output, what can be concluded?

Consider the following configuration on a Cisco IOS-XE router: vrf definition RED rd 100:1 route-target export 100:1 route-target import 100:1 ! interface GigabitEthernet0/2 vrf forwarding RED ip address 10.10.10.1 255.255.255.0 Which statement is true about this configuration?

A network engineer is designing a Python script that uses the YANG models supported by a Cisco IOS XE device to retrieve interface statistics via NETCONF. The engineer wants to ensure the script can parse the response and extract the operational data. Which two steps are necessary when using the ncclient library to retrieve and process the data? (Choose two.)

A network engineer is comparing first-hop redundancy options for a campus access layer. The requirement is to provide gateway redundancy for IPv6 hosts while also allowing load sharing between two routers, and the solution must use an open standard rather than a Cisco-proprietary protocol. Which FHRP should the engineer select?

A network engineer is configuring a GRE tunnel between two Cisco IOS routers to transport multicast traffic and routing protocols across an IP network. Which two statements about GRE tunnel configuration and operation are true? (Choose two.)

Drag and drop the steps of VNF service chain instantiation into the correct order, from first to last.

Drag and drop the steps of STP path cost manipulation for load balancing into the correct order, from first to last.

A network engineer is configuring MACsec on a point-to-point link between two Cisco Catalyst switches to provide Layer 2 encryption. The engineer wants to use a pre-shared key for authentication and ensure that the key is rotated periodically. Which MACsec component must be configured to specify the pre-shared key and the key rotation timer?

A network engineer is deploying a new Cisco Catalyst switch and needs to implement a loop prevention mechanism that allows rapid convergence and supports multiple VLANs. The engineer decides to use Rapid PVST+. Which statement accurately describes a characteristic of Rapid PVST+ operation?

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) for a new office. The office has a mix of corporate laptops and guest devices. The administrator wants to ensure that guest devices can only access the Internet and are isolated from the corporate network. Which WLC feature should be configured to achieve this?

A network engineer is building a Python script to configure a Cisco IOS XE device via RESTCONF. The script sends a POST request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces with the JSON payload shown. The device returns HTTP 415 Unsupported Media Type. Which change to the script will resolve the error?

An engineer retrieves telemetry data from a Cisco IOS-XE device using RESTCONF and receives the following response: ```json { "ietf-interfaces:interfaces": { "interface": [ { "name": "GigabitEthernet1", "type": "iana-if-type:ethernetCsmacd", "enabled": true, "ipv4": { "address": [ { "ip": "192.168.1.1", "netmask": "255.255.255.0" } ] } } ] } } ``` What is the correct way to access the IP address of the interface using Python?

A network engineer runs the following command on Router R3: R3# show mpls ldp bindings lib entry: 10.1.1.1/32, rev 2 local binding: label: 16 remote binding: lsr: 10.1.1.2:0, label: 17 lib entry: 10.2.2.0/24, rev 4 local binding: label: 18 remote binding: lsr: 10.1.1.2:0, label: 19 lib entry: 10.3.3.0/24, rev 6 local binding: label: 20 remote binding: lsr: 10.1.1.2:0, label: 21 Based on this output, what is true?

A network administrator is configuring a Cisco IOS router to provide DHCP services to a remote subnet. The router's interface on that subnet is configured with the address 10.1.1.1/24. Which command is required to exclude the router's own address from the DHCP pool?

An enterprise network uses OSPF in the core and EIGRP in the campus distribution layer. The engineer needs to redistribute routes between the two protocols. Which design consideration is most important to prevent routing loops?

A network engineer runs the following command on Switch SW4: SW4# show monitor session 4 Session 4 --------- Type : Local Session Source VLANs : RX Only : 10,20 Destination Ports : Gi1/0/25 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A network engineer runs the following command on Router R1: R1# show bgp summary BGP router identifier 192.168.1.1, local AS number 65001 BGP table version is 10, main routing table version 10 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 1024 1020 10 0 0 00:12:34 15 192.168.1.3 4 65003 2048 2040 10 0 0 00:24:56 20 Based on this output, what can be concluded?

Which two statements about PIM sparse mode (PIM-SM) are true? (Choose two.)

A network engineer is using the Cisco DNA Center API to initiate a network discovery. The API endpoint '/dna/intent/api/v1/discovery' is called with a POST request containing the following JSON payload: ```json { "discoveryType": "Range", "ipAddressList": "10.10.20.1-10.10.20.254", "protocolOrder": "SSH", "timeout": 5, "retryCount": 3 } ``` The API returns a 202 Accepted status code. What does this indicate?

Which two statements about using Python for network automation are true? (Choose two.)

A network engineer runs the following command on Router R1: R1# show ip route 10.1.1.0 Routing entry for 10.1.1.0/24 Known via "bgp 65001", distance 200, metric 0 Tag 65002, type external Last update from 192.168.1.2 00:00:15 ago Routing Descriptor Blocks: * 192.168.1.2, from 192.168.1.2, 00:00:15 ago Route metric is 0, traffic share count is 1 AS Hops 1 Route tag 65002 MPLS label: 18 Based on this output, what can be concluded?

A network engineer runs the following command on switch SW8: SW8# show cts role-based sgt-map 192.168.1.10 IP Address: 192.168.1.10 SGT: 10 Source: SXP Based on this output, what can be concluded?

A network administrator is deploying a new Cisco Catalyst switch in a data center. The switch must support a protocol that allows multiple physical links to be bundled into a single logical link, providing increased bandwidth and redundancy. The administrator wants to ensure that the protocol can dynamically negotiate the bundle formation with the connected device. Which protocol should be configured?

Which two statements about IPsec IKEv2 are true? (Choose two.)

Consider the following BGP configuration on a Cisco IOS-XE router: router bgp 65001 neighbor 10.0.0.2 remote-as 65002 neighbor 10.0.0.2 route-map SET_COMMUNITY out ! route-map SET_COMMUNITY permit 10 set community 65001:100 What is the effect of this configuration?

Which two statements about MPLS Layer 3 VPNs are true? (Choose two.)

A cloud provider uses Cisco ACI to automate provisioning of tenant networks. A new tenant requires a Layer 2 bridge domain that extends to an external Layer 2 network via a VPC. The engineer creates a bridge domain with the settings: Type: Regular, L2 Unknown Unicast: Flood, L3 Unknown Multicast Flood: Flood, and Multi-Destination Flooding: Flood. The VPC is configured as a virtual port channel. The tenant reports that broadcast traffic is not reaching the external network. What is the most likely cause?

A network architect is designing a new branch office that must support wired and wireless users with a single unified policy and automated onboarding for guests. The design requires centralized management, fabric-based segmentation, and the ability to enforce group-based policies without manual VLAN provisioning at the branch. Which Cisco architecture should be used?

A network administrator is implementing IP Source Guard (IPSG) on a Cisco Catalyst 3850 switch to prevent IP spoofing. The administrator enables DHCP snooping and IPSG on VLAN 10. A user connects a laptop with a statically assigned IP address 10.10.10.50/24 and gateway 10.10.10.1. The laptop cannot reach any network resources. What is the most likely reason?

A network engineer is troubleshooting a wireless network where clients in a specific area report slow speeds and frequent disconnections. The engineer uses a spectrum analyzer and finds high utilization on channel 11 in the 2.4 GHz band. The engineer also notices that several neighboring access points are using channel 11. What is the most likely cause of the issue?

Drag and drop each IP SLA tracking object on the left to its application on the right.

A network engineer is troubleshooting voice quality issues on a WAN link. The engineer notices that voice packets are being dropped during congestion. The QoS policy uses LLQ for voice traffic, but the priority queue is not providing the expected bandwidth. What is the most likely cause?

Consider the following configuration on a Cisco router: class-map match-any CRITICAL_DATA match ip dscp af21 af22 af23 policy-map QOS class CRITICAL_DATA bandwidth remaining percent 50 class class-default fair-queue interface GigabitEthernet0/0 service-policy output QOS Which statement about this configuration is true?

Which two statements about the Cisco FlexConnect architecture are true? (Choose two.)

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that the VPN tunnel uses the strongest possible encryption and authentication algorithms. The engineer configures the following: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. On the remote router, the engineer configures: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. The tunnel fails to establish. What is the most likely cause?

A network engineer is configuring a Cisco wireless LAN controller (WLC) to support a new wireless network for guests. The requirement is that guest clients must be isolated from the corporate network and only have internet access. Which feature should be configured on the WLC?

A network engineer is configuring a Cisco Catalyst switch to authenticate users via 802.1X. The switch must place authenticated users into a specific VLAN based on the RADIUS server's response, and unauthenticated users should have no network access. Which configuration element is required on the switch to support dynamic VLAN assignment?

A network engineer is deploying a new Cisco wireless network using a 9800 Series Wireless Controller. The engineer wants to ensure that the management interface is properly configured for out-of-band management. Which interface type should be configured with an IP address for management access?

Examine the following IP SLA configuration: ip sla 1 icmp-echo 10.1.1.1 frequency 10 ip sla schedule 1 life forever start-time now What is the effect of this configuration?

A network engineer is configuring an EtherChannel between two Cisco switches. The engineer wants to use LACP and ensure that the local switch is the one that determines which ports are active in the channel. Which configuration should be applied?

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces EIGRP-IPv4 Interfaces for AS(100) Interface Peers Xmit Queue Mean Pacing Time Multicast Pending Un/Reliable SRTT Un/Reliable Flow Timer Routes Gi0/0 1 0/0 12 0/10 50 0 Gi0/1 1 0/0 15 0/10 55 0 Based on this output, what can be concluded?

A network architect is evaluating Cisco SD-WAN to connect branch offices to data centers and public cloud workloads. The architect wants to understand which capabilities are provided by the Cisco SD-WAN solution. (Choose two.)

A network administrator is configuring a Cisco Catalyst 9000 switch to support a new wireless deployment. The wireless LAN controller is integrated into the switch, and the administrator needs to ensure that the switch can manage access points and provide centralized control. Which feature should be enabled on the switch?

A network engineer is analyzing the output of the show processes cpu sorted command on a Cisco Catalyst 9300 switch and notices that the CPU utilization is consistently high. Which two methods can help identify the cause of high CPU utilization? (Choose two.)

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. The engineer must ensure that the control plane and data plane are secure and that routers can authenticate to the controllers. Which two statements are true regarding the Cisco SD-WAN controller components? (Choose two.)

A network administrator is deploying Cisco Application Centric Infrastructure (ACI) and needs to allow two endpoint groups (EPGs) in different bridge domains to communicate while applying a contract that permits only TCP port 443. Which ACI construct provides the policy enforcement point where the contract is applied?

Which three statements about IPv4 ACLs on Cisco IOS are true? (Choose three.)

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to secure wireless client traffic. The requirement is to encrypt all wireless traffic between the client and the access point using a pre-shared key, without requiring a separate authentication server. Which security policy should the administrator configure on the WLC?

Drag and drop each VM network mode on the left to its matching behavior description on the right.

A network engineer is designing a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer must choose a multicast mode for BUM (Broadcast, Unknown unicast, Multicast) traffic replication. Which two statements are true regarding the use of multicast in a VXLAN EVPN fabric? (Choose two.)

Drag and drop each wireless AP mode on the left to its matching function on the right.

A network engineer runs the following command on Switch SW1: SW1# show interfaces gi0/1 trunk Port Mode Encapsulation Status Native vlan Gi0/1 desirable n-802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 1-1005 Port Vlans allowed and active in management domain Gi0/1 1,10,20 Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Based on this output, what can be concluded?

A network engineer is troubleshooting a performance issue with a virtual firewall (vFW) running on a Cisco NFVIS host. The vFW is experiencing high packet loss during peak traffic. The engineer checks the NFVIS monitoring dashboard and sees that the vFW's CPU usage is low, but the host's memory usage is high. What is the most likely cause of the packet loss?

A Cisco Catalyst 9500 switch is configured for 802.1X with MAC Authentication Bypass (MAB) fallback on a port connected to an IP phone that has a PC daisy-chained behind it. The phone authenticates successfully using 802.1X, but the PC behind the phone fails authentication and is placed in the guest VLAN. The requirement is that the PC be authenticated individually and placed in the data VLAN, while the phone remains in the voice VLAN. Which feature should be configured on the switch port to meet this requirement?

What is the maximum number of WLANs that can be configured on a single AP in a Cisco 9800 WLC deployment?

Drag and drop each EIGRP packet type on the left to its matching function on the right.

A network engineer executes the following command on Router R5: R5# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.0.0.6 1 FULL/DR 00:00:35 192.168.1.6 GigabitEthernet0/0 10.0.0.7 1 FULL/BDR 00:00:32 192.168.1.7 GigabitEthernet0/0 10.0.0.8 1 2WAY/DROTHER 00:00:38 192.168.1.8 GigabitEthernet0/0 Based on this output, what can be concluded about the OSPF network?

Which three statements about MPLS traffic engineering (MPLS-TE) are true? (Choose three.)

A network engineer is implementing a Cisco TrustSec solution. The engineer needs to classify traffic based on user identity and apply security policies accordingly. Which component is responsible for tagging packets with a Security Group Tag (SGT) at the ingress point?

Drag and drop the steps of JSON vs XML encoding selection for RESTCONF into the correct order, from first to last.

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

A network engineer is using Cisco DNA Center Assurance to troubleshoot a wireless client that frequently disconnects. The engineer wants to identify the root cause by examining relevant assurance data. Which two types of information are available in the Client 360 view to help diagnose the issue? (Choose two.)

A network engineer is deploying QoS on a Cisco Catalyst 4500 switch to support four queues per port. The engineer wants to assign voice traffic to queue 1 (priority), video to queue 2, critical data to queue 3, and best-effort to queue 4. The switch is configured with the default CoS-to-queue mapping. However, video traffic is being placed in queue 1 along with voice. What should the engineer do to separate them?

A network architect is designing a Fabric-enabled campus with Cisco SD-Access and must choose the optimal underlay routing protocol. The fabric will use VXLAN data-plane encapsulation, and the architect wants minimal configuration on the intermediate underlay devices while supporting fast convergence and equal-cost multipath. Which underlay routing approach should be recommended?

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Which two statements about Control Plane Policing (CoPP) are true? (Choose two.)

What is the default OSPF hello interval on an Ethernet link in Cisco IOS?

A network engineer is deploying Cisco DNA Center Assurance and wants to ensure that the system can accurately monitor and troubleshoot network issues. Which two statements about Cisco DNA Center Assurance are true? (Choose two.)

Drag and drop the steps of REST API call using Requests library to DNA Center into the correct order, from first to last.

A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?

A network engineer is implementing Cisco TrustSec in a campus network. The engineer needs to configure the enforcement of security group tags (SGTs) on Cisco Catalyst switches. Which two statements are true regarding SGT enforcement and propagation? (Choose two.)

A network engineer issues the following command on Router R6: R6# debug ip ospf hello OSPF: Send hello to 224.0.0.5 via GigabitEthernet0/0 (192.168.1.6) OSPF: Rcv hello from 1.1.1.1, GigabitEthernet0/0, area 0.0.0.0 Neighbor state is 2WAY, options 0x2 OSPF: End of hello processing Based on this output, what can be concluded?

A network administrator is implementing Dynamic ARP Inspection (DAI) on a Cisco Catalyst switch. The network uses DHCP for most endpoints, but a few servers have static IP addresses. Which two actions are required to ensure DAI allows legitimate traffic while blocking ARP spoofing? (Choose two.)

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer needs to specify the loopback0 interface as the source for VXLAN tunnels. Which command must be entered under the NVE interface configuration?

A network administrator is deploying a new branch office that requires a redundant default gateway for hosts on VLAN 10. The administrator wants to use a Cisco-proprietary protocol that provides sub-second failover and supports load sharing between two routers. Which First Hop Redundancy Protocol should be used?

Drag and drop each BGP attribute on the left to its matching type on the right.

What is the default lease time for a DHCP pool in Cisco IOS?

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Which two statements about using Python for network automation with Cisco devices are true? (Choose two.)

A network security team is hardening a Cisco IOS-XE router that terminates a site-to-site VPN to the internet. They want to ensure that the router itself cannot be managed from untrusted networks and that its management protocols are protected. Which two configuration actions achieve these goals? (Choose two.)

A network engineer runs the following command on Router R5: R5# show queueing interface GigabitEthernet0/1 Interface GigabitEthernet0/1 queueing strategy: weighted fair Queueing on output: Weighted Fair Queueing Current fair queue configuration: Number of queues: 256 Dynamic queues: 256 Reserved queues: 0 Current WFQ global configuration: Total dynamic queues: 256 Total reserved queues: 0 Class based weighted fair queueing: enabled Queueing on input: FIFO Based on this output, what can be concluded?

A network engineer is designing a new branch office that must support wired and wireless users with unified policy enforcement and automation. The company wants to minimize manual configuration and ensure consistent security policies across all access ports. Which Cisco architecture should the engineer recommend?

Which two statements about OSPF neighbor states are true? (Choose two.)

A network engineer runs the following command on Router R4: R4# show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type Hardware address/ User name 10.0.0.10 0063.6973.636f.2d30. Mar 01 2025 12:00 PM Automatic 3030.302e.3030.3030. 2e30.3030.312d.4574. 30 10.0.0.11 0063.6973.636f.2d30. Mar 01 2025 12:05 PM Automatic 3030.302e.3030.3030. 2e30.3030.312d.4574. 31 Based on this output, what can be concluded?

Drag and drop the steps of YANG push periodic vs on-change subscription into the correct order, from first to last.

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer must configure the NVE interface and ensure proper VXLAN data plane operation. Which two statements about VXLAN EVPN configuration on Nexus 9000 are true? (Choose two.)

A network engineer is configuring a Cisco IOS switch to use 802.1X authentication for endpoints connected to interface GigabitEthernet1/0/1. The engineer wants to ensure that if the RADIUS server is unreachable, the port will be placed in a restricted VLAN. Which command should be used?

Drag and drop the steps of using a Python REST API call to retrieve device configuration via Cisco DNA Center into the correct order, from first to last.

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs. After applying a policer to the control plane, the BGP sessions tear down repeatedly while OSPF adjacencies stay stable. The administrator confirms CPU utilization is low. Which action should be taken to resolve the issue?

Drag and drop the steps of 802.11r Fast BSS Transition (FT) roaming steps into the correct order, from first to last.

A network engineer is deploying IP SLA to monitor network performance. The engineer needs to configure an IP SLA operation that measures jitter and packet loss between two Cisco routers. Which two statements are true about configuring IP SLA for this purpose? (Choose two.)

A network engineer is configuring a Cisco IOS router to support OSPFv3 for IPv6. The router is connected to two OSPFv3 areas: area 0 and area 1. The engineer wants to summarize the IPv6 routes from area 1 into area 0 using the prefix 2001:DB8:1::/48. Which command should be used on the area border router (ABR)?

A network engineer is configuring OSPF in a multi-area design. The engineer wants to reduce the amount of LSA flooding and the size of the LSDB in area 0. Which OSPF feature should be implemented on the ABR to achieve this goal?

Drag and drop the steps of using Ansible to push a new VLAN configuration to a Cisco IOS switch into the correct order, from first to last.

Which three statements about QoS trust boundaries and marking are true? (Choose three.)

A network automation engineer is using the ncclient Python library to retrieve configuration from a Cisco IOS XE device via NETCONF. The engineer sends a <get-config> RPC with a filter for the interface configuration. The device returns a large XML response, but the engineer only needs the interface description and IP address. Which NETCONF capability should the engineer use to filter the response to only the required data?

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Drag and drop the steps of OpenConfig interface counters subscription and decode into the correct order, from first to last.

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS-XE router that also runs OSPF, BGP, and SSH management. The engineer needs to protect the control plane while ensuring that routing protocol traffic and management sessions are not disrupted. Which CoPP design approach best meets these requirements?

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

A network engineer is configuring a Cisco CSR 1000v router in a virtualized environment. The engineer needs to ensure that the router can forward traffic between multiple virtual routing and forwarding (VRF) instances while maintaining isolation. Which technology should the engineer use to allow communication between specific VRFs?

Drag and drop the steps of IP SLA HTTP operation for application monitoring into the correct order, from first to last.

Match each Cisco switch security feature to its function.

A network administrator is hardening a Cisco IOS switch that connects to user workstations. The security policy requires that when an unauthorized MAC address appears on an access port, the port must drop only the offending frames, generate a syslog message, and increment a counter, without shutting down the port or requiring administrative intervention. Which port security violation mode meets these requirements?

A network engineer is configuring a Cisco SD-WAN solution for a multinational corporation. The engineer wants to use a centralized data policy to steer all traffic from the Finance department (VPN 10) to a specific WAN link (MPLS) for security reasons. The engineer creates a policy that matches traffic from VPN 10 and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that traffic from VPN 10 is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason?

A network engineer is implementing Cisco TrustSec in a campus network. The security team wants to assign a security group tag to traffic based on the identity of the user authenticated via 802.1X, and then enforce policy based on that tag in the data center. Which Cisco TrustSec component is responsible for classifying the traffic with the appropriate security group tag at the access layer?

An engineer is using the Cisco pyATS framework to test the configuration of a new QoS policy on a router. The engineer writes a testbed file and a test script that logs into the router, applies the configuration, and then verifies the output of 'show policy-map interface'. The test script fails because the verification step cannot find the expected output. The engineer confirms that the configuration was applied successfully. What is the most likely cause of the failure?

A network engineer runs the following command on Router R1: R1# show ip pim neighbor PIM Neighbor Table Neighbor Address Interface Uptime Expires Mode 10.1.1.2 GigabitEthernet0/0 2w0d 00:01:25 DR 10.1.1.3 GigabitEthernet0/0 2w0d 00:01:20 B Based on this output, what can be concluded?

Drag and drop the steps of CoPP class-map match criteria and rate-limit application into the correct order, from first to last.

Which two statements about SD-WAN control plane components are true? (Choose two.)

A network engineer is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The engineer enters the following commands under the OSPF process: area 0 authentication message-digest, and under the interface: ip ospf message-digest-key 1 md5 Cisco123. However, the neighbor relationship does not form. What is the most likely cause?

Drag and drop the steps of IP SLA DNS lookup operation setup into the correct order, from first to last.

A network administrator is introducing infrastructure as code for Cisco IOS XE switches. The team wants to store device configurations in a version-controlled repository and apply changes only after peer review. They need a tool that can enforce the desired state and report drift without making changes during the review phase. Which tool should they use to meet these requirements?

A network architect is designing a data center fabric that must support Layer 2 extension over a Layer 3 underlay while using a control-plane protocol that advertises MAC reachability. The design requires the use of a protocol that encapsulates Layer 2 frames in IP packets and uses an EVPN address family for MAC/IP advertisement. Which technology best meets these requirements?

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor performance. The administrator wants to see detailed information about the client's connectivity, including the path taken through the network and any issues encountered. Which Cisco DNA Center Assurance feature should the administrator use?

A network engineer runs the following command on Router R1: R1# show ip eigrp neighbors detail EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:12:34 12 100 0 45 Version 2.0/2.0, Retrans: 0, Retry: 0, Maxseq: 0 Prefixes: 3 Topology ids: 0 Authentication: None Topology: base (0x0) Based on this output, what can be concluded?

A company is deploying a new data center and needs to choose between a three-tier (core, aggregation, access) and a spine-leaf architecture. The network engineer is concerned about east-west traffic patterns for server virtualization. Which architecture is most suitable and why?

A network engineer is configuring a GRE tunnel between two Cisco IOS routers to transport multicast traffic over an IP network that does not support multicast. The engineer must ensure the tunnel is operational and multicast is forwarded correctly. Which two statements are true about GRE tunnel configuration and operation? (Choose two.)

A network engineer is troubleshooting an STP issue in a network that uses Rapid PVST+. The network has a root bridge (SW1) and a secondary root bridge (SW2). The engineer notices that after a link failure between SW1 and SW2, the network takes longer than expected to converge. The engineer checks the configuration and finds that SW2 has the 'spanning-tree uplinkfast' command enabled. The engineer also notices that SW2 has a lower priority than SW1. What is the most likely cause of the slow convergence?

Drag and drop the steps of QoS policing with two-rate three-color marker (RFC 2698) into the correct order, from first to last.

An enterprise is deploying a virtual router (vRouter) as part of its NFV infrastructure. The engineer needs to ensure that the vRouter can handle a sudden spike in traffic without dropping packets. The vRouter is running on a KVM hypervisor. What should the engineer configure to guarantee CPU resources for the vRouter during peak demand?

A network engineer is implementing 802.1X authentication on a Cisco switch. The engineer wants to ensure that the switch dynamically assigns a VLAN to the port based on the user's identity, and that the VLAN assignment is enforced by the authentication server. Which two components are required to achieve this? (Choose two.)

Which two statements about IP Source Guard are true? (Choose two.)

Drag and drop the steps of micro-segmentation via SGT policy application into the correct order, from first to last.

A network engineer is configuring BGP on a router that will be used for BGP route summarization. The router receives multiple more-specific prefixes from its eBGP peers. The engineer wants to advertise a summary route to the iBGP peers without advertising the more-specific routes. Which command should the engineer use to suppress the more-specific routes while still installing them in the local routing table?

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The design requires that all VTEPs in the fabric learn the IP addresses of remote VTEPs so that BUM traffic can be replicated using ingress replication. Which control-plane component is responsible for distributing this VTEP IP address information across the fabric?

A network engineer is developing a Python script that uses the requests library to send a RESTCONF PATCH request to a Cisco IOS XE device. The script includes the header 'Content-Type: application/yang-data+json' and sends a JSON payload to update the description of an interface. The device returns HTTP 400 Bad Request. Which is the most likely cause?

A network engineer is using the ncclient Python library to send NETCONF RPCs to a Cisco IOS XE device. The engineer wants to lock the running configuration datastore before making changes to prevent other NETCONF sessions from modifying it concurrently. Which NETCONF operation should be used?

A network engineer issues the following command on Router R8: R8# show ip ospf neighbor detail Neighbor 1.1.1.1, interface address 192.168.1.1 In the area 0 via interface GigabitEthernet0/0 Neighbor priority is 1, State is FULL, 6 state changes DR is 192.168.1.2, BDR is 192.168.1.1 Options is 0x42 (L LSR LSRR L LSR) Dead timer due in 00:00:34 Neighbor is up for 00:12:45 Index 1/1/1, retransmission queue length 0, number of retransmission 0 First 0x0(0)/0x0(0)/0x0(0) Next 0x0(0)/0x0(0)/0x0(0) Last retransmission scan length is 0, last retransmission scan time is 0 msec Based on this output, what can be concluded?

A company has a large network of 500 Cisco IOS XE routers and switches spread across multiple sites. The network team wants to automate the collection of interface statistics every hour and store them in a central database for historical analysis. The team has a Linux server with Python 3 and access to all devices via SSH with key-based authentication. They have written a Python script using Netmiko to connect to each device, run 'show interfaces', and parse the output to extract key metrics (e.g., input/output errors, packets per second). The script works correctly when tested on a small subset of devices, but when run against all 500 devices, it takes too long (over 2 hours) and sometimes fails due to SSH connection timeouts. The team needs to reduce the execution time and improve reliability. Which approach should they take?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP. After applying a CoPP policy, BGP peering drops intermittently during route churn, but SSH and SNMP remain reachable. Which action should be taken to correct the issue while preserving control plane protection?

Given the following CoPP configuration: class-map match-all COPP_ICMP match access-group name ICMP_ACL ! policy-map COPP_POLICY class COPP_ICMP police 8000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP_POLICY What is the effect?

A network administrator is implementing Control Plane Policing on a Cisco IOS-XE router to protect the route processor from excessive BGP, SSH, and SNMP traffic. After applying the policy, legitimate BGP keepalives are being dropped, causing peer resets. Which action should the administrator take to resolve this while still protecting the control plane?

A network engineer runs the following command on Router R1: R1# show ip route 192.168.2.0 Routing entry for 192.168.2.0/24 Known via "ospf 1", distance 110, metric 20, type inter area Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago Routing Descriptor Blocks: * 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago Route metric is 20, traffic share count is 1 Based on this output, what can be concluded?

Match each First Hop Redundancy Protocol (FHRP) to its description.

Given the following Ansible playbook snippet: --- - name: Configure EIGRP hosts: routers gather_facts: no tasks: - name: EIGRP config ios_config: lines: - router eigrp 100 - network 192.168.1.0 parents: router eigrp 100 What is the effect of this playbook?

An engineer is designing an MPLS L3VPN service for a customer that requires overlapping IP addresses between two sites. The customer uses OSPF as the PE-CE protocol. The engineer configures VRFs on the PE routers and assigns unique route distinguishers (RDs) and route targets (RTs). However, the customer reports that routes from one site are not being installed in the other site's VRF. What is the most likely cause?

A network engineer is deploying a new Cisco Catalyst 9000 switch stack and wants to protect the control plane from excessive ARP traffic that could overwhelm the CPU during a broadcast storm. The engineer needs to limit the rate of ARP packets sent to the CPU to 500 packets per second and drop the excess. Which feature should be configured on the switch?

A network security team is deploying MACsec on a Cisco Catalyst 9300 switch connecting to a partner's Catalyst 9200 over a metro Ethernet link. The team wants to encrypt all traffic on the link and ensure that the switches mutually authenticate before any frames are forwarded. Which IEEE standard defines the key agreement and encryption used by MACsec, and which component performs the key exchange?

Drag and drop the steps of EIGRP named mode configuration steps into the correct order, from first to last.

A network engineer at a university is deploying Cisco HyperFlex to replace a legacy SAN-backed vSphere cluster. The design calls for fabric interconnects to be managed in Cisco UCS Manager, and the engineer wants the HyperFlex installer to fully configure the fabric interconnects and the UCS servers automatically. Which HyperFlex deployment model should the engineer choose?

Given the following configuration on a Cisco IOS-XE router: interface Tunnel100 ip address 10.0.0.1 255.255.255.252 tunnel source GigabitEthernet0/0/0 tunnel destination 192.168.1.1 tunnel mode ipsec ipv4 tunnel protection ipsec profile MYPROFILE What is the effect of this configuration?

A network engineer is configuring a Cisco IOS switch with 802.1X authentication. The switch is connected to a Cisco IP phone, and a PC is connected to the phone's PC port. The engineer wants to authenticate both the phone and the PC using 802.1X. Which feature should be configured to allow both devices to authenticate on the same switch port?

Given the following WLAN configuration on a Cisco 9800 WLC: wlan test-wlan 1 test-ssid client vlan VLAN10 no security wpa no security wpa2 security wpa3 no security ft What is a potential issue with this configuration?

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

A network engineer runs the following command on Switch SW7: SW7# show spanning-tree vlan 70 VLAN0070 Spanning tree enabled protocol ieee Root ID Priority 24646 Address aabb.cc00.0c00 Cost 4 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 70) Address aabb.cc00.0d00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Root FWD 4 128.1 P2p Gi0/2 Desg FWD 4 128.2 P2p Gi0/3 Altn BLK 4 128.3 P2p Based on this output, which port is the alternate port?

Which three statements about classification and marking in a QoS architecture are true? (Choose three.)

A network administrator is configuring a Cisco wireless LAN controller (WLC) to support a new employee SSID. The SSID must use WPA2-Enterprise with 802.1X authentication against an external RADIUS server. The administrator has already configured the RADIUS server on the WLC. Which additional step is required to complete the configuration?

Drag and drop the steps of SD-Access underlay provisioning via LAN Automation into the correct order, from first to last.

Drag and drop the steps of KVM VM provisioning via virsh CLI into the correct order, from first to last.

What is the default CoS-to-queue mapping on a Cisco switch that supports QoS?

Consider the following configuration: policy-map QUEUE_POLICY class VOICE priority level 1 police cir 1000000 class VIDEO priority level 2 police cir 2000000 class class-default fair-queue What is the effect of using priority level 1 and priority level 2?

A network engineer is deploying a new branch office that connects to the headquarters over an MPLS Layer 3 VPN provided by a service provider. The branch has a single CE router running eBGP with the provider PE router. The engineer wants to advertise the branch LAN prefix into the MPLS VPN while keeping the branch routing table simple. Which approach is appropriate?

A network engineer is troubleshooting a routing loop between two OSPF areas. To verify the path that packets are taking, the engineer decides to use the Cisco IOS Embedded Event Manager (EEM) to generate a syslog message when the OSPF neighbor state changes. Which EEM applet configuration is required to trigger on the OSPF neighbor state change?

A network architect is evaluating VXLAN as the data plane encapsulation for a new data center fabric. Which two statements accurately describe how VXLAN operates? (Choose two.)

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Drag and drop the steps of IP SLA scheduling with frequency and lifetime into the correct order, from first to last.

A network engineer runs the following command on Router R6: R6# show ip pim rp 239.3.3.3 RP 10.0.0.4 Info source: 10.0.0.4, via bootstrap, priority 192, holdtime 150, expires in 00:02:30 Based on this output, what can be concluded?

A network engineer is configuring a Cisco Catalyst switch to authenticate users via 802.1X. The RADIUS server is reachable at 10.10.10.5 using the key 'Cisco123'. The switch must dynamically assign VLANs based on the RADIUS attributes returned. Which configuration is required on the switch to enable dynamic VLAN assignment?

A network engineer is designing a wireless network for a large auditorium that must support high-density client access. The engineer plans to use Cisco Catalyst 9800 Series Wireless Controllers and Wi-Fi 6 access points. Which feature should be enabled to improve airtime efficiency and reduce overhead for many concurrent clients?

A Python script uses the requests library to interact with Cisco DNA Center's REST API: import requests url = "https://dna-center/api/v1/network-device" headers = { "X-Auth-Token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." } response = requests.get(url, headers=headers, verify=False) print(response.json()) What is a security concern with this script?

Which three statements about NFV and its relationship with SDN are true? (Choose three.)

A network engineer is troubleshooting a wireless network where clients in a conference room experience intermittent connectivity. The engineer notices that the access point in that room is showing a high number of CRC errors on its uplink interface. The AP is connected to a Cisco 9300 switch via a copper cable. What is the most likely cause of the CRC errors?

An enterprise is implementing Cisco TrustSec (CTS) to enforce role-based access control. The network engineer configures the switch with 'cts role-based enforcement' and 'cts manual' on an interface connecting to a trusted Cisco switch. The engineer also configures Security Group Tags (SGTs) on the RADIUS server. However, traffic between two hosts in different SGTs is not being filtered as expected. The engineer checks 'show cts role-based counters' and sees no drops. What is the most likely reason for the lack of enforcement?

A network engineer is deploying Cisco TrustSec in a campus network. The engineer needs to implement Security Group Tag (SGT) propagation and enforcement. Which two methods can be used to propagate SGTs? (Choose two.)

A network engineer configures SNMPv3 on a Cisco router with the following: 'snmp-server group GRP v3 priv', 'snmp-server user usr GRP v3 auth sha pass1 priv aes 128 pass2'. The NMS is configured with the same credentials. However, the NMS cannot perform SNMP walks. The engineer notices that the router's SNMP agent is responding to queries from other devices. What is the most likely cause?

Which three statements about FlexVPN are true? (Choose three.)

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 192.168.1.0/24 BGP routing table entry for 192.168.1.0/24, version 15 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 65050, (received & used) 10.0.1.2 from 10.0.1.2 (10.0.0.2) Origin IGP, metric 0, localpref 100, weight 0, valid, external, best rx pathid: 0, tx pathid: 0x0 Based on this output, what can be concluded?

Drag and drop each Layer 2 attack on the left to its matching mitigation feature on the right.

A network engineer runs the following command on Router R1: R1# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 100 packets, 10000 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 Based on this output, what can be concluded?

Drag and drop the steps of DNA Center network discovery and device sync into the correct order, from first to last.

A company is deploying a virtual WAN optimizer (vWAAS) on a Cisco NFVIS host. The engineer needs to ensure that the vWAAS can intercept traffic between two VNFs running on the same host. The traffic currently flows directly between the VNFs without passing through the vWAAS. What should the engineer configure to redirect the traffic?

A network engineer executes the following command on Router R2: R2# show ip sla configuration 1 IP SLAs Infrastructure Engine-II Entry number: 1 Owner: admin Tag: Type of operation to perform: icmp-echo Target address: 192.168.2.10 Source address: 192.168.2.1 Type Of Service parameter: 0x0 Request size (ARR data portion): 28 Operation timeout (milliseconds): 5000 Frequency (seconds): 60 Next Scheduled Start Time: Start Time already passed Group Scheduled : FALSE Life (seconds): Forever Entry Ageout (seconds): never Recurring (Starting Everyday, Starting Time: 00:00:01) Status of entry (SNMP RowStatus): Active Threshold (milliseconds): 5000 Distribution Statistics: Number of statistic hours kept: 2 Number of statistic distribution buckets kept: 1 Statistic distribution interval (milliseconds): 20 Enhanced History: Based on this output, what is the frequency of the IP SLA operation?

Which LACP mode must be configured on at least one side of an EtherChannel for the channel to establish?

A network engineer is designing a campus network that must support rapid convergence and load balancing across multiple links. The design uses Cisco StackWise Virtual technology on a pair of Catalyst 9000 switches. The engineer wants to ensure that the control plane remains active on both switches and that traffic can be forwarded by both switches simultaneously. Which statement accurately describes the StackWise Virtual operation?

A network engineer is configuring a Cisco router to use TACACS+ for command authorization. The engineer configures 'aaa authorization commands 15 default group tacacs+ local'. When a user with privilege level 15 tries to execute the 'reload' command, the router sends an authorization request to the TACACS+ server. The server responds with an 'Access-Accept' but the command is still denied. The engineer checks the router's configuration and sees that 'aaa accounting commands 15 default start-stop group tacacs+' is also configured. What could be the issue?

A network engineer is building a Python script to retrieve the operational status of all GigabitEthernet interfaces from a Cisco IOS XE device. The script uses the requests library and sends a GET request to the RESTCONF URL https://10.1.1.1/restconf/data/ietf-interfaces:interfaces-state. The device returns HTTP 401 Unauthorized. The engineer has verified that the RESTCONF service is enabled and the URL is correct. Which action should be taken to resolve the issue?

A network engineer is using Cisco DNA Center's Intent API to automate the configuration of a new branch site. The engineer needs to create a new site hierarchy, assign devices to the site, and apply a template that configures VLANs and QoS. The engineer writes a Python script that calls the DNA Center APIs in sequence. After running the script, the site is created, and devices are assigned, but the template application fails with an error indicating that the device is not provisioned. What is the most likely missing step in the automation workflow?

A network engineer is deploying a new branch office that uses Cisco SD-WAN with a single transport underlay. The design requires that the branch router participate in the SD-WAN fabric and establish control connections to the controllers. Which component must the engineer configure on the branch device to allow it to register with the SD-WAN controllers and receive policy from vManage?

Examine the CoPP configuration: class-map match-any COPP_SSH match access-group name SSH_ACL ! policy-map COPP_POLICY class COPP_SSH police 10000 conform-action transmit exceed-action drop class class-default police 5000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP_POLICY Which statement is true?

A network engineer writes the following Ansible playbook to configure an interface on a Cisco IOS-XE device: --- - hosts: routers gather_facts: no tasks: - name: Configure interface cisco.ios.ios_config: lines: - ip address 192.168.1.1 255.255.255.0 parents: interface GigabitEthernet0/1 What is the issue with this playbook?

Consider this VLAN configuration on a Cisco switch: vlan 10 name Sales vlan 20 name Engineering interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 What is missing if the switch needs to carry VLAN 30 traffic on this trunk?

Consider the following configuration snippet from a Cisco IOS-XE router: router eigrp 100 network 10.0.0.0 network 192.168.1.0 passive-interface default no passive-interface GigabitEthernet0/0 What is the effect of the passive-interface commands?

A network engineer runs the following command on Router R1: R1# show vrf brief Name Default RD Protocols Interfaces CUSTOMER_A 65000:100 ipv4 Gi0/0.100 CUSTOMER_B 65000:200 ipv4 Gi0/0.200 MANAGEMENT 65000:999 ipv4 Gi0/1 Based on this output, what can be concluded?

A network automation team is using the NETCONF protocol to manage a fleet of Cisco IOS XE devices. They need to ensure that configuration changes are applied atomically and that they can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities must be supported and used to achieve these requirements? (Choose two.)

Consider the following configuration snippet on a Cisco IOS-XE router: interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 ip pim sparse-mode ip igmp version 3 ! router ospf 1 network 10.1.1.0 0.0.0.255 area 0 ! What is the effect of this configuration?

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

A network engineer is analyzing traffic patterns using Cisco IOS IP Service Level Agreements (IP SLA). The engineer wants to measure the round-trip time (RTT) for HTTP traffic to a web server at 10.1.1.1. Which IP SLA operation type should be configured?

Drag and drop each EIGRP timer on the left to its matching default value on the right.

A network engineer is configuring EtherChannel between two Cisco switches using LACP. The engineer wants to ensure that if fewer than two links are operational, the EtherChannel does not come up. Which command should be configured?

Which two statements about MPLS VPN (Layer 3 VPN) are true? (Choose two.)

An Ansible playbook uses the cisco.dnac.site module to create a new building site. The playbook is: - name: Create building site cisco.dnac.site: host: "{{ dnac_host }}" username: "{{ dnac_username }}" password: "{{ dnac_password }}" validate_certs: no state: present site: name: Building-B type: building parentName: Area-1 address: "123 Main St" latitude: 37.7749 longitude: -122.4194 register: result What is the purpose of the 'parentName' parameter?

An Ansible playbook uses the uri module to make a REST API call to Cisco DNA Center: --- - hosts: localhost gather_facts: no tasks: - name: Get devices uri: url: "https://dna-center/api/v1/network-device" method: GET headers: X-Auth-Token: "{{ token }}" return_content: yes register: result - debug: var: result.json What is missing from this playbook?

Drag and drop each IP SLA reaction action on the left to its corresponding behavior on the right.

A network engineer is using a Python script with the ncclient library to retrieve interface statistics from a Cisco IOS XE router. The script connects successfully, but when it sends a <get> RPC, the router returns an error stating that the requested data model is not supported. The engineer verifies that the YANG model is present on the device. What is the most likely cause of this error?

A network engineer runs the following command on Router R5: R5# show mpls ldp discovery Local LDP Identifier: 10.5.5.5:0 Discovery Sources: Interfaces: GigabitEthernet0/0: xmit/recv LDP Id: 10.5.5.4:0, no hello (expired) GigabitEthernet0/1: xmit/recv LDP Id: 10.5.5.6:0 Based on this output, what is the state of the LDP session with neighbor 10.5.5.4?

A network engineer is troubleshooting a Cisco Nexus 9000 leaf switch in a VXLAN EVPN fabric. Hosts in VLAN 200 on one leaf cannot reach hosts in VLAN 200 on a remote leaf, although the Type 2 routes are present in the EVPN table. The engineer confirms that the local VTEP address is correct. Which action should the engineer take to verify that the VNI is properly mapped to the VLAN and that traffic is placed into the correct overlay?

Drag and drop the steps of the DiffServ traffic classification and marking pipeline into the correct order, from first to last.

Given the following configuration: interface Port-channel1 no switchport ip address 192.168.1.1 255.255.255.0 ! interface GigabitEthernet0/1 no switchport channel-group 1 mode on ! interface GigabitEthernet0/2 no switchport channel-group 1 mode on Which statement is true about this EtherChannel?

Which three statements about telemetry data collection methods are true? (Choose three.)

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 120 10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches) 20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches) 30 deny tcp any any eq 22 (2 matches) 40 permit ip any any (10 matches) Based on this output, what can be concluded?

Drag and drop the steps of multicast RP discovery using Auto-RP into the correct order, from first to last.

Drag and drop the steps of VNF life cycle management into the correct order, from first to last.

A network engineer is configuring BGP on a Cisco router that is part of an enterprise network with multiple BGP peers. The router receives routes from two different ISPs. The engineer wants to ensure that only specific prefixes from ISP-A are installed in the routing table, while all other routes from ISP-A are ignored. Additionally, the engineer wants to accept all routes from ISP-B. Which BGP feature should be used on the router for the peering with ISP-A?

A network engineer writes an Ansible playbook to gather facts from a Cisco IOS device using the ios_facts module: ```yaml --- - name: Gather IOS Facts hosts: ios_devices gather_facts: no tasks: - name: Collect facts cisco.ios.ios_facts: gather_subset: - hardware register: device_facts - name: Show serial number debug: msg: "Serial number is {{ device_facts['ansible_facts']['ansible_net_serialnum'] }}" ``` What is a potential issue with this playbook?

A network engineer issues the following command on Router R6: R6# show ip sla statistics 5 Round Trip Time (RTT) for Index 5 Latest RTT: 150 ms Latest Operation Start Time: 16:00:00.000 UTC Mon Mar 1 2021 Latest Operation Return Code: OK Number of successes: 10 Number of failures: 0 Over thresholds: 8 Based on this output, what does the 'Over thresholds: 8' indicate?

Drag and drop each telemetry protocol on the left to its matching transport on the right.

Which two statements about EIGRP feasible successors are true? (Choose two.)

An enterprise campus uses Cisco Catalyst 9000 switches in a StackWise Virtual configuration at the distribution layer. The network team wants dual-homed access switches to use all uplinks simultaneously while avoiding spanning-tree blocking, and they want the distribution pair to appear as a single logical device to routing peers. Which statement describes how StackWise Virtual supports this design?

A network engineer is implementing IPsec VPN on a Cisco IOS XE router. The design requires that traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet be encrypted, while all other traffic should be sent unencrypted. The engineer creates a crypto ACL. Which action must be taken to ensure the crypto ACL correctly identifies the traffic to protect?

Consider the following BGP configuration: router bgp 65000 bgp router-id 1.1.1.1 neighbor 10.1.1.2 remote-as 65001 neighbor 10.1.1.2 route-map SET_MED out ! route-map SET_MED permit 10 set metric 50 What is the effect of this configuration?

In Cisco TrustSec, which component is responsible for assigning a Security Group Tag (SGT) to a user or device based on authentication?

A network engineer configured a Cisco IOS-XE router with VRF CUSTOMER_A and assigned Gi0/0/1 to it. The interface is up and has an IP address, but traffic sourced from the VRF cannot reach a remote prefix that is present in the global routing table. The engineer confirms the global route exists and the next hop is reachable. What is the most likely cause?

A network engineer is using the Cisco SD-WAN vManage API to automate the creation of a new VPN template. The engineer sends a POST request to /dataservice/template/feature with a JSON body and receives an HTTP 400 Bad Request error. The JSON payload is syntactically valid. What is the most likely cause of this error?

A network engineer runs the following command on a Cisco WLC: WLC# show ap inventory all AP Inventory Information ----------------------- AP Name: AP-1 Base MAC: aabb.cc00.0100 Model: AIR-CAP3702I-A-K9 Software: 8.5.151.0 AP Name: AP-2 Base MAC: aabb.cc00.0200 Model: AIR-AP2802I-B-K9 Software: 8.5.151.0 AP Name: AP-3 Base MAC: aabb.cc00.0300 Model: AIR-AP3802I-A-K9 Software: 8.5.151.0 Based on this output, what can be concluded?

A network engineer is analyzing the output of 'show ip sla statistics' on a Cisco IOS router. The engineer notices that the SLA operation is returning 'Timeout' for several probes. Which two statements are true about the potential causes of this issue? (Choose two.)

A network engineer issues the following command on Router R3: R3# show ip bgp summary BGP router identifier 10.0.0.3, local AS number 65003 BGP table version is 12345, main routing table version 12345 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65001 12345 12345 12345 0 0 1w2d 150 192.168.1.2 4 65002 12345 12345 12345 0 0 2w0d 200 Based on this output, what can be concluded?

A network engineer is using the Cisco SD-WAN vManage REST API to retrieve a list of all devices in the overlay network. The engineer writes a Python script that sends a GET request to https://vmanage-ip/dataservice/device but receives a 401 Unauthorized error. What is the most likely reason for this error?

Drag and drop the steps of DNA Center assurance issue detection and root cause analysis into the correct order, from first to last.

A network team is using Ansible to manage a fleet of Cisco IOS XE switches. The team wants to ensure that the Ansible playbook can connect to the switches without prompting for passwords and without storing passwords in plaintext. The team has generated an SSH key pair and copied the public key to the switches. Which Ansible connection method and authentication mechanism should the team use?

A network engineer is implementing a CI/CD pipeline for network configuration changes. The pipeline uses Git for version control and Jenkins for orchestration. The engineer wants to ensure that configuration changes are validated before deployment to production devices. Which approach best integrates validation into the pipeline?

An Ansible playbook uses the cisco.nxos.nxos_config module to configure a Nexus switch: --- - hosts: nxos_switches gather_facts: no connection: network_cli tasks: - name: Configure VLAN cisco.nxos.nxos_config: lines: - vlan 100 - name Test_VLAN parents: vlan 100 What will be the result of this playbook?

Given this configuration: interface GigabitEthernet0/0 ip address 172.16.1.1 255.255.255.0 ip pim sparse-mode ! interface GigabitEthernet0/1 ip address 172.16.2.1 255.255.255.0 ip pim sparse-mode ! ip pim rp-address 172.16.1.1 What is the effect of this configuration?

A network administrator is deploying a Cisco Catalyst switch with DHCP snooping. The switch is configured with DHCP snooping globally and on VLAN 10. A DHCP server is connected to GigabitEthernet1/0/5, and client devices are connected to GigabitEthernet1/0/6 through 1/0/20. The administrator notices that DHCP offers from the server are being dropped. What is the most likely cause?

A network engineer is comparing the characteristics of agent-based and agentless automation tools for managing Cisco IOS XE devices. Which two statements accurately describe agentless automation? (Choose two.)

A network engineer needs to configure a switch port to authenticate end hosts against a RADIUS server. The requirement is that if the RADIUS server becomes unreachable, the port should place the host on a guest VLAN instead of shutting down. Which command must be added to the interface configuration?

Examine the following configuration snippet: interface GigabitEthernet0/1 ip flow monitor FLOW-MONITOR input ip flow monitor FLOW-MONITOR output ! flow monitor FLOW-MONITOR exporter EXPORTER-1 record netflow ipv4 original-input ! flow exporter EXPORTER-1 destination 192.168.1.100 transport udp 2055 ! What is the effect of this configuration?

Examine the following SD-WAN policy configuration on a Cisco vSmart controller: policy control-policy CONTROL_POLICY sequence 10 match route prefix-list PL_10 action accept set community 100:10 ! prefix-list PL_10 sequence 10 match ip-address 10.0.0.0/24 ! What is the effect of this control policy?

Drag and drop the steps of DHCP failover configuration between primary and standby into the correct order, from first to last.

A network automation team is using Cisco NSO (Network Services Orchestrator) to manage a multi-vendor network. They have created a service model in YANG and deployed it. A network engineer notices that when a device configuration is changed manually outside of NSO, NSO does not automatically correct it. Which NSO feature should be configured to ensure that NSO re-applies the intended configuration when a device drifts from the service model?

Drag and drop the steps of the QoS shaping and policing configuration sequence into the correct order, from first to last.

Which two statements about VRF configuration in Cisco IOS-XE are true? (Choose two.)

A network engineer is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF). The engineer wants to ensure that the VRF can be used for MPLS VPN and that the router can maintain separate routing tables. Which command is used to create a VRF named CUSTOMER?

Which two statements about IGMP snooping are true? (Choose two.)

Consider this configuration: interface Port-channel1 switchport mode trunk switchport trunk native vlan 999 ! interface GigabitEthernet0/1 switchport mode trunk switchport trunk native vlan 999 channel-group 1 mode active ! interface GigabitEthernet0/2 switchport mode trunk switchport trunk native vlan 999 channel-group 1 mode active What is the effect of the 'switchport trunk native vlan 999' command on the EtherChannel?

A network engineer is designing a QoS policy for a campus network. The requirement is that voice traffic must be guaranteed strict priority treatment over all other traffic types, even during congestion. Which queuing mechanism should be configured on the egress interfaces to meet this requirement?

A network engineer is using Ansible to manage a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module to push a set of configuration lines. After running the playbook, the engineer notices that the configuration changes are not being saved to the startup configuration, and the devices revert to the previous configuration after a reboot. Which parameter should be added to the 'ios_config' task to ensure the running configuration is saved to the startup configuration?

A network engineer is automating the collection of syslog messages from a Cisco ASA firewall using a Python script that connects via SSH and runs 'show log'. The script uses the paramiko library. The script works for a few minutes, but then the SSH connection drops with an error 'Server connection dropped'. The engineer suspects that the ASA is closing the connection due to inactivity. What is the best way to keep the connection alive?

A network engineer is deploying a Cisco SD-Access fabric using Cisco DNA Center. The design requires that endpoints in the same virtual network (VN) be able to communicate even when they are attached to different fabric edge nodes. Which data plane technology does SD-Access use to carry the endpoint traffic across the fabric underlay?

A service provider wants to deploy a virtualized firewall as a VNF in a service chain. The VNF must be inserted transparently into the traffic path without requiring changes to the existing IP addressing. Which service chaining method should the architect choose?

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device shows a poor health score. Which Cisco DNA Center Assurance feature should the administrator use to determine the root cause of the poor health score?

A network administrator is configuring 802.1X authentication on a Cisco switch port. The port is connected to a VoIP phone that then connects to a PC. The administrator wants to authenticate both the phone and the PC separately, with the phone using MAB and the PC using 802.1X. Which feature should be configured on the switch port to support this?

Drag and drop each DNA Center ISE integration component on the left to its matching role on the right.

Drag and drop the steps of OMP route advertisement between vSmart and vEdge into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show ip pim neighbor PIM Neighbor Table Neighbor Address Interface Uptime Expires Mode 10.0.0.2 GigabitEthernet0/0 00:10:00 00:01:30 Dense 10.0.0.3 GigabitEthernet0/1 00:20:00 00:01:20 Sparse Based on this output, what can be concluded?

A network administrator is troubleshooting an issue where OSPF routes are not being learned from a neighbor. The administrator checks the OSPF configuration and sees that both routers are in the same area. The neighbor state is stuck in EXSTART. What is the most likely cause?

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

Consider the following SPAN configuration on a Cisco IOS-XE switch: monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoint traffic is encapsulated and forwarded between fabric edge nodes. The design uses an overlay that carries Layer 2 and Layer 3 traffic over a Layer 3 underlay. Which protocol does Cisco SD-Access use for the data plane encapsulation in this fabric?

An enterprise is redesigning its WAN QoS architecture to support real-time voice, video, and critical data applications over a limited bandwidth link. The architect must ensure that voice traffic receives strict priority queuing and that video traffic is guaranteed a minimum bandwidth, while allowing best-effort traffic to use remaining capacity. Which queuing strategy should be deployed on the WAN edge routers?

In a Cisco QoS policy, what is the difference between 'bandwidth' and 'bandwidth remaining' commands?

A network engineer is configuring IPv6 First Hop Security on a Cisco switch to mitigate rogue RA attacks. The engineer enables RA guard on the switch and applies a policy that allows only the default gateway to send RAs. After configuration, hosts are unable to obtain IPv6 addresses via SLAAC. The engineer checks the switch and sees that RA guard is dropping all RAs. What is the most likely cause?

Drag and drop the steps of IP SLA tracking with static route failover into the correct order, from first to last.

A network engineer is designing a Cisco SD-WAN fabric with two data centers and 200 branch sites. The requirement is that branch sites use direct internet access for SaaS applications while business-critical traffic to the data centers traverses a secure IPsec tunnel. Which Cisco SD-WAN feature should the engineer use to define and enforce these traffic steering policies?

A network engineer issues the following command on Router R8: R8# show policy-map interface gigabitethernet 0/1 GigabitEthernet0/1 Service-policy output: SHAPE-1M Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any queue limit 64 packets (queue depth 0) (congestion occurrences) shape (average) cir 1000000, bc 10000, be 10000 target shape rate 1000000 Based on this output, what is true about the traffic shaping policy?

A network engineer is deploying VXLAN with an EVPN control plane in a data center. The underlay is a routed Layer 3 network using OSPF. The engineer must ensure that the VXLAN data plane and EVPN control plane operate correctly. Which two statements about this deployment are true? (Choose two.)

A network administrator is configuring a Cisco IOS switch to support a new voice VLAN. The administrator wants to ensure that voice traffic is tagged with CoS 5 and data traffic is untagged. Which command should be applied to the interface connected to an IP phone?

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote users. The requirement is to use a protocol that supports both IKEv2 and native IPv6 transport, and that can provide per-user policy enforcement. Which technology should the administrator implement?

A network architect is designing a new branch office that must support a single physical link carrying traffic for multiple tenants while keeping each tenant's routing and forwarding isolated. The design requires that the branch device maintain separate routing tables and forwarding instances per tenant, all on the same physical interface using 802.1Q encapsulation. Which architecture component should be implemented on the branch router to meet these requirements?

A network architect is deploying a Cisco SD-WAN fabric with a single data center and 40 branch sites. The design requires that all branch sites use a single IPsec tunnel to reach the data center VPN concentrator, and that traffic between branches must transit the data center rather than form direct site-to-site tunnels. Which Cisco SD-WAN topology should the architect select?

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

A network engineer is configuring a Cisco router to use TACACS+ for authentication and authorization of EXEC sessions. The engineer configures 'aaa new-model', 'aaa authentication login default group tacacs+ local', and 'aaa authorization exec default group tacacs+ local'. When a user tries to log in via SSH, the router prompts for username and password, but after entering correct credentials, the user is immediately disconnected. The TACACS+ server logs show that the authentication was successful. What is the most likely cause?

A network architect is designing a campus network for a large university with 10,000+ users. The design must provide high availability, minimize failure domains, and allow for easy scaling of the access layer. The core layer should be resilient and support fast convergence. Which hierarchical design model best meets these requirements?

Drag and drop each EIGRP metric component on the left to its matching K variable on the right.

Drag and drop the steps of TrustSec SGT classification and enforcement into the correct order, from first to last.

A network engineer is configuring an IPsec site-to-site VPN between two Cisco IOS-XE routers. The design requires that the data payload be encrypted and that the two peers authenticate each other using pre-shared keys without any certificate infrastructure. Which combination of IKEv2 parameters must be configured on both peers to establish the tunnel?

A network engineer runs the following command on Router R8: R8# show ip nhrp 10.0.0.1/32 via 10.0.0.1 Tunnel0 created 00:10:00, expire 01:50:00 Type: dynamic, Flags: unique registered NBMA address: 192.168.1.1 10.0.0.2/32 via 10.0.0.2 Tunnel0 created 00:05:00, expire 01:55:00 Type: dynamic, Flags: unique registered NBMA address: 192.168.1.2 Based on this output, what can be concluded?

Drag and drop each SGT value range on the left to its matching policy type on the right.

Drag and drop the steps of EIGRP variance-based unequal-cost load balancing into the correct order, from first to last.

A network engineer uses the Requests library to send a RESTCONF PATCH request to modify the hostname of a Cisco IOS-XE device: ```python import requests from requests.auth import HTTPBasicAuth url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname' headers = {'Content-Type': 'application/yang-data+json'} auth = HTTPBasicAuth('admin', 'cisco123') payload = { 'Cisco-IOS-XE-native:hostname': 'NewRouter' } response = requests.patch(url, json=payload, headers=headers, auth=auth, verify=False) print(response.status_code) ``` What is the expected HTTP status code if the request is successful?

A financial services company has deployed Cisco UCS servers with VMware vSphere 7.0 to host critical trading applications. The network uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric with BGP as the underlay. The environment includes 50 ESXi hosts, each connected via two 40G interfaces to two different leaf switches in a VPC. The VMs are spread across multiple hosts and communicate over VXLAN. Recently, the operations team migrated a set of VMs from an old VLAN-based network to a new VXLAN segment (VNI 50000). After the migration, users report intermittent connectivity issues and packet loss. The engineering team captures traffic and notices that some VMs send ARP requests that are not being replied to, even though the target VM is active. Further analysis shows that the ARP requests are being flooded to all VTEPs, but the replies are not reaching the source. The team checks the underlay and finds no issues with BGP or routing. The NVE interfaces are up, and the VNI is configured. Which of the following is the most likely cause of the issue?

Drag and drop each NAT terminology on the left to its matching definition on the right.

A network engineer runs the following command on Router R9: R9# show queueing interface GigabitEthernet0/1 Interface GigabitEthernet0/1 queueing strategy: class-based weighted fair Queueing on output: Class-based Weighted Fair Queueing Queueing on input: FIFO R9# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 100 packets, 10000 bytes 5 minute offered rate 10000 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 police cir 1000000 bc 15625 be 15625 conformed 100 packets, 10000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 200 packets, 20000 bytes 5 minute offered rate 20000 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 200/20000 bandwidth remaining percent 50 Class-map: class-default (match-any) 300 packets, 30000 bytes 5 minute offered rate 30000 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 300/30000 bandwidth remaining percent 50 Based on this output, what can be concluded?

Consider the following OSPF configuration on router R2: interface GigabitEthernet0/0 ip address 192.168.1.2 255.255.255.0 ip ospf 1 area 0 ip ospf hello-interval 5 ! router ospf 1 router-id 2.2.2.2 network 192.168.1.0 0.0.0.255 area 0 Which statement is true about this configuration?

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which IPsec configuration component defines this traffic?

A network engineer is configuring a Cisco Nexus 9000 switch in a VXLAN EVPN fabric. The engineer wants to ensure that the switch can advertise MAC addresses learned from local hosts to other VTEPs. Which EVPN route type is used to advertise MAC address reachability information?

A company is deploying an MPLS VPN to connect multiple branch sites to a central data center. The network engineer must ensure that customer traffic is isolated from other customers and that routing information is kept separate. Which two statements are correct about MPLS Layer 3 VPNs? (Choose two.)

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

A network architect is designing a data center fabric that uses VXLAN with an EVPN control plane on Cisco Nexus 9000 switches. The architect must justify why EVPN is preferred over a flood-and-learn VXLAN data plane. Which two statements correctly describe advantages of using an EVPN control plane in this design? (Choose two.)

A network engineer is troubleshooting a Cisco Wireless LAN Controller (WLC) deployment where clients cannot associate to an SSID. The SSID is configured with WPA2-Enterprise and uses a RADIUS server for authentication. The engineer verifies that the RADIUS server is reachable and the shared secret is correct. Which additional configuration on the WLC is required for clients to successfully authenticate?

Which two statements about Ansible inventory files are true? (Choose two.)

A network engineer is planning a new branch office network. The branch will have a single Cisco IOS router that connects to the internet via a GigabitEthernet interface. The engineer wants to configure NAT to allow internal hosts to access the internet. Which NAT type should be configured to allow multiple internal hosts to share the single public IP address?

A network engineer is configuring BGP on a Cisco router that connects to two ISPs. The router has a default route pointing to each ISP. The engineer wants to load balance outbound traffic across both ISPs. The router receives a default route from both ISPs. Which BGP configuration approach will allow the router to install both default routes in the routing table and load balance traffic?

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

A network automation team is using the Cisco SD-WAN vManage REST API to monitor the status of WAN Edge devices. The team writes a Python script that authenticates using basic authentication and then sends a GET request to /dataservice/device. The script receives a 401 Unauthorized error even though the credentials are correct. The team verifies that the user account has the 'admin' role. What is the most likely cause of the authentication failure?

A network engineer is deploying Cisco ACI in a data center. The requirement is to allow an external Layer 3 router to dynamically learn the endpoints that reside in a specific bridge domain (BD) and to advertise the BD's subnet to the external network. The external router is connected to a border leaf switch. Which Cisco ACI construct must be configured to meet this requirement?

Which two statements about NFV performance considerations are true? (Choose two.)

A network engineer is implementing VRF-Lite on a Cisco IOS router to separate traffic from two different departments. The router has two interfaces, GigabitEthernet0/0 and GigabitEthernet0/1, each assigned to a different VRF. The engineer wants to verify that the VRFs are properly configured and that routes are being populated. Which command displays the routing table for a specific VRF?

Which three statements about Ansible modules for Cisco IOS-XE are true? (Choose three.)

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Consider the following DHCP snooping configuration on a Cisco IOS-XE switch: ``` ip dhcp snooping ip dhcp snooping vlan 10 interface GigabitEthernet0/1 ip dhcp snooping trust ! interface GigabitEthernet0/2 ip dhcp snooping limit rate 10 ``` Which statement is true?

A network team is designing an SD-WAN overlay for a multinational enterprise with 500+ branch sites. The design must ensure that control plane traffic (e.g., OMP updates) is encrypted and authenticated between all vSmart controllers and vEdge routers, while allowing data plane traffic to use IPsec tunnels between branch sites directly. Which architectural element is responsible for orchestrating the initial authentication and certificate enrollment of all SD-WAN devices?

A company is deploying a virtualized router (CSR1000v) on VMware vSphere. The VNF must support high throughput and low latency. Which vSphere configuration option should the architect select to optimize network performance?

Drag and drop the steps of ACL reflexive access list (dynamic inspection) flow into the correct order, from first to last.

What is the default native VLAN on a Cisco switch trunk port?

Drag and drop each authentication mode on the left to its matching behavior on the right.

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive control-plane traffic. The engineer wants to rate-limit ARP and DHCP snooping-related traffic destined to the control plane while allowing routing protocol traffic without restriction. Which CoPP component must the engineer configure to classify and match this traffic before applying the policy?

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The design requires that the standby router take over if the active router fails, and that the virtual MAC address be 0000.0c07.ac0a. Which protocol and group number are being used?

A network engineer runs the following command on Router R3: R3# show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete N: NATed, L: Local, X: No Socket # Ent -> Number of NHRP entries with same NBMA peer NHS Status: E => Expecting Replies, R => Responding, W => Waiting UpDn Time -> Up or Down Time for a Tunnel ========================================================================== Interface: Tunnel0, IPv4 NHRP Details Type:Hub, NHRP Peers:2, # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 192.168.1.1 10.0.0.1 UP 00:12:34 D 1 192.168.1.2 10.0.0.2 UP 00:10:20 D Based on this output, what can be concluded?

Consider the following partial configuration for QoS on a Cisco IOS-XE router: class-map match-all VOICE match ip dscp ef ! policy-map QOS_POLICY class VOICE priority 1000 class class-default fair-queue ! interface GigabitEthernet0/0 service-policy output QOS_POLICY What is the effect of the 'priority 1000' command under class VOICE?

Drag and drop the steps of EIGRP DUAL route computation into the correct order, from first to last.

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Drag and drop the steps of DMVPN Phase 3 spoke-to-spoke shortcut creation into the correct order, from first to last.

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65000 ! Which statement about this configuration is true?

Review the following configuration: vrf definition CUSTOMER_A rd 65000:100 route-target export 65000:100 route-target import 65000:100 ! interface GigabitEthernet0/4 vrf forwarding CUSTOMER_A ip address 192.168.100.1 255.255.255.0 ! router bgp 65000 address-family ipv4 vrf CUSTOMER_A redistribute connected What is the purpose of the 'redistribute connected' command under the VRF address-family?

A network engineer runs the following command on switch SW5: SW5# show cts sxp connections SXP Connections: Peer IP Source IP Conn Status Duration 10.1.1.1 10.1.1.2 Up 2d3h 10.1.1.3 10.1.1.2 Down 0d0h Based on this output, what can be concluded?

Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.

A network architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation at Layer 2 and Layer 3 across the fabric, using a centralized control plane and policy enforcement. Which two protocols are essential for the SD-Access overlay to meet these requirements?

A network engineer is configuring a Cisco Catalyst switch to support 802.1X authentication for wired users. The company requires that if the RADIUS server becomes unreachable, devices on a critical VLAN should be allowed access to the network without authentication. Which feature should be configured on the switch to meet this requirement?

A network administrator is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The security policy requires that the VPN use IKEv2 with certificate-based authentication. Which command must be configured on both routers to specify the trustpoint that will be used for IKEv2 authentication?

Examine the following partial Cisco IOS-XE configuration: interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 ip access-group ACL_IN in spanning-tree portfast What is the effect of this configuration?

Drag and drop the steps of adding a new VLAN to a trunk link into the correct order, from first to last.

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. After applying a new CoPP policy, BGP sessions flap intermittently while SSH and SNMP continue to work. The engineer wants to confirm which traffic class is being dropped. Which action should the engineer take?

A network engineer is configuring 802.1X on a Cisco Catalyst 9300 switch for a wired network. The engineer wants to allow devices that do not support 802.1X (e.g., printers) to still access the network using MAB (MAC Authentication Bypass). The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'mab'. However, after connecting a printer, the switch logs show 'MAB failed' repeatedly. The printer's MAC address is in the RADIUS server database. What is the most likely cause?

An engineer is troubleshooting an EIGRP convergence issue in a network with redundant links. The engineer notices that when a primary link fails, the backup link takes over immediately, but the routing table shows the route with a higher metric. The engineer wants to ensure that the backup link is used only when the primary fails, and that traffic is not load-balanced. The engineer has configured 'variance 2' on all routers. What is the most likely effect of this configuration?

A network engineer is designing a new data center leaf-spine fabric using Cisco Nexus 9000 switches. The design requires that the fabric automatically discover the IP addresses of remote VTEPs participating in a VXLAN EVPN deployment. Which control-plane protocol should be enabled on the leaf switches to provide this dynamic VTEP discovery?

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. Which two statements accurately describe the roles of these controllers in the SD-WAN overlay? (Choose two.)

Drag and drop each SPAN type on the left to its correct scope description on the right.

Drag and drop the steps of IP SLA with threshold and reaction configuration into the correct order, from first to last.

A network engineer is developing a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. The script sends a GET request to the URI https://10.1.1.1/restconf/data/ietf-interfaces:interfaces. The device returns a 401 Unauthorized error. The engineer verifies that the RESTCONF API is enabled and the URI is correct. Which action should the engineer take to resolve this issue?

A network engineer runs the following command on Router R1: R1# show ip eigrp traffic EIGRP-IPv4 Traffic Statistics for AS(100) Hellos sent/received: 1000/950 Updates sent/received: 45/40 Queries sent/received: 2/3 Replies sent/received: 3/2 Acks sent/received: 50/48 Input queue high water mark: 1 Input queue depth: 0 Total packets sent: 1100 Total packets received: 1043 Based on this output, what can be concluded?

An engineer is troubleshooting multicast performance issues. The network uses PIM sparse mode with a static RP. The engineer notices that the multicast traffic from a source to a group is taking a suboptimal path, causing high latency. The engineer checks the multicast routing table on the last-hop router and sees that the (S,G) entry has an incoming interface that is not the shortest path to the source. What is the most likely reason for this suboptimal path?

A network administrator needs to configure a Cisco IOS switch to authenticate users against a RADIUS server before granting access to a switchport. The requirement is that if the RADIUS server becomes unreachable, the port should fall back to the configured access VLAN and not shut down. Which set of commands accomplishes this?

A network designer is planning a QoS policy for a campus network that carries voice, video, and critical business applications. The design must ensure that voice traffic receives priority treatment with minimal latency and jitter, while preventing starvation of other traffic. Which queuing mechanism should be used on the egress interfaces to meet these requirements?

In BGP best path selection, which of the following is compared first?

A network engineer is deploying Cisco ACI in a data center. The engineer needs to configure a bridge domain that allows traffic to be routed between two EPGs that are in different subnets. Which ACI object must be configured to enable inter-subnet routing within the bridge domain?

A network administrator is configuring a new Cisco Catalyst switch and needs to ensure that the management VLAN interface is reachable from a remote subnet. The switch is at its default configuration. Which command must be applied to the management VLAN interface to allow remote management from a different subnet?

A network engineer is configuring a new Cisco IOS router for OSPFv2 in a multi-area OSPF domain. The router will be an Area Border Router (ABR) connecting Area 0 and Area 10. The engineer must ensure that the router correctly summarizes routes from Area 10 into Area 0 and that it does not become a designated router (DR) on any broadcast network. Which two configuration steps are required to meet these requirements? (Choose two.)

Given the configuration: interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 10-20 ! interface GigabitEthernet0/1 switchport mode trunk channel-group 1 mode passive ! interface GigabitEthernet0/2 switchport mode trunk channel-group 1 mode passive What is missing for this EtherChannel to form with a neighbor that uses LACP active?

A network architect is designing a Cisco SD-WAN fabric for a company with 50 branch sites. The company wants to ensure that business-critical traffic (such as VoIP and ERP) is prioritized over best-effort traffic (such as guest internet) across the overlay. The architect plans to use the vManage controller to define an application-aware routing policy. Which component of the Cisco SD-WAN solution is responsible for enforcing the application-aware routing policy on the data plane?

A network engineer runs the following command on Router R1: R1# show ip sla summary IPSLAs Latest Operation Summary Codes: * active, ^ inactive, ~ pending ID Type Destination Stats Return Code Last 1 icmp-echo 192.168.1.10 Success OK 1 2 icmp-echo 192.168.1.20 Success OK 2 3 udp-jitter 192.168.1.30 Success OK 3 *4 icmp-echo 192.168.1.40 Success OK 10 Based on this output, what can be concluded?

Drag and drop the steps of Syslog severity filtering and rate-limiting configuration into the correct order, from first to last.

Which two statements about the Cisco QoS trust boundary are true? (Choose two.)

Drag and drop each STP port state on the left to its matching function on the right.

A network technician is configuring a new Cisco switch and needs to assign the management IP address to VLAN 1. Which command sequence is correct?

Drag and drop each PIM mode on the left to its matching traffic distribution method on the right.

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor voice quality. Which Cisco DNA Center Assurance feature should be used to analyze the issue and determine the root cause?

A network engineer runs the following command on Switch SW7: SW7# show interfaces port-channel 1 Port-channel1 is up, line protocol is up (connected) Hardware is EtherChannel, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc) Description: Link to Core Internet address is 192.168.1.1/30 MTU 1500 bytes, BW 2000000 Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, link type is auto, media type is unknown input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 1000 bits/sec, 2 packets/sec 5 minute output rate 500 bits/sec, 1 packets/sec 12345 packets input, 1234567 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 67890 packets output, 9876543 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out Based on this output, what can be concluded?

An architect is designing an SD-Access fabric for a campus network that must support dynamic endpoint grouping based on user identity and device type. The design must minimize manual policy configuration and allow the fabric to enforce access policies at the edge. Which combination of components and protocols is required to meet these requirements?

A network engineer runs the following command on Router R2: R2# show vrf detail VRF CUSTOMER-B (VRF Id = 1); default RD 65000:1; default VPNID <not set> Interfaces: GigabitEthernet0/0.200 GigabitEthernet0/1.200 Address family IPV4 unicast: Export VPN route-target communities: RT:65000:100 Import VPN route-target communities: RT:65000:100 No export route-map No import route-map Address family IPV6 unicast: Export VPN route-target communities: RT:65000:100 Import VPN route-target communities: RT:65000:100 Members: 10.0.0.0/24 Based on this output, what can be concluded?

A company is virtualizing its network functions using NFV on a KVM-based hypervisor. The design must ensure that the virtual router (CSR1000v) can handle high-throughput traffic with minimal latency. Which architectural consideration is most critical for achieving this goal?

Drag and drop the steps of VRF import/export route-target policy flow into the correct order, from first to last.

Consider the following configuration snippet: router bgp 65000 bgp router-id 192.168.1.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 timers 10 30 ! What is the effect of the 'timers 10 30' command under the BGP neighbor?

An enterprise network has two routers, R1 and R2, both running BGP. R1 is an eBGP speaker with ISP1, and R2 is an eBGP speaker with ISP2. Both routers are in the same AS 65000. The engineer wants to ensure that traffic from the enterprise to the Internet prefers the path through ISP1 when both links are up. R1 learns a default route from ISP1, and R2 learns a default route from ISP2. Which BGP attribute should the engineer modify on R1 to influence outbound traffic selection?

Drag and drop the steps of TrustSec SGT assignment and propagation via SXP into the correct order, from first to last.

A network engineer is designing a QoS policy for a WAN edge router. The requirement is to ensure that VoIP traffic receives strict priority treatment and that excess VoIP traffic is policed to prevent starvation of other traffic. Which QoS mechanism should be used?

A network engineer is analyzing traffic flows using Cisco IOS NetFlow on a router. The engineer notices that the NetFlow cache is filling up rapidly, causing older entries to be exported prematurely before they can be properly aggregated. Which NetFlow configuration parameter should the engineer adjust to control the maximum number of entries in the cache?

Which three statements about SD-WAN overlay tunnels and transport are true? (Choose three.)

A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator notices that a particular client device shows a health score of 'Poor' but the switch port statistics indicate no errors or drops. Which Cisco DNA Center Assurance feature should the administrator use to identify the root cause of the poor health score?

Consider the following configuration snippet: interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 10,20,30 ! interface GigabitEthernet0/1 channel-group 1 mode active ! interface GigabitEthernet0/2 channel-group 1 mode passive What is the effect of this configuration?

A network engineer is configuring a new Cisco Catalyst 9300 switch stack. The company requires that the native VLAN for all 802.1Q trunk ports be changed from the default to VLAN 99. The engineer enters the global configuration command vlan dot1q tag native and then configures the trunk ports with switchport trunk native vlan 99. After applying the configuration, the engineer notices that untagged frames received on the trunk are being dropped. What is the most likely cause?

Drag and drop the steps of ISE profiling-based dynamic ACL assignment into the correct order, from first to last.

A network engineer is troubleshooting a Cisco Nexus 9000 VXLAN EVPN fabric in which a host attached to leaf-1 cannot communicate with a host in the same subnet attached to leaf-2, even though both leaf switches show the VNI as up. The engineer suspects the EVPN control plane. Which two conditions must be met for the two hosts to communicate over the VXLAN overlay? (Choose two.)

A network security team deploys Cisco TrustSec on a Catalyst 9500 fabric. The team wants to enforce a policy where a user authenticated into the 'Contractor' security group tag (SGT) is denied access to servers tagged with the 'Finance' SGT, while remaining able to reach the 'Printers' SGT. Which enforcement mechanism applies the SGACL to traffic between the tagging devices?

Which of the following is a valid VLAN range that can be created on a Cisco IOS switch?

A company uses Chef to automate network device configuration. The network devices are Cisco IOS XE running in a brownfield environment. Which Chef component is used to manage the state of the devices?

Which two statements about BGP path attributes are true? (Choose two.)

A network engineer is deploying a VXLAN EVPN fabric with Cisco Nexus 9000 switches. The design requires that when a leaf switch learns a MAC address from a local host, remote leaf switches should be able to install that MAC into their forwarding tables without flooding. Which EVPN route type is used to advertise MAC address reachability?

Drag and drop the steps of troubleshooting a failed RSPAN session into the correct order, from first to last.

A network engineer is configuring a switch to support 802.1X authentication for wired clients. The requirement is to authenticate users against a centralized RADIUS server and assign dynamic VLANs based on the user's role. Which command must be configured on the switch to enable 802.1X authentication globally?

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The engineer applies a CoPP policy-map to the control plane with a class that matches BGP traffic and sets police rate 8000 conform-action transmit exceed-action drop. After applying the policy, BGP sessions intermittently flap during route convergence. Which action should the engineer take to resolve the issue while maintaining control plane protection?

An architect is designing a QoS policy for a Cisco SD-Access fabric. The policy must prioritize voice traffic from wireless clients connected to fabric-enabled access points over other traffic types. The design should use the fabric's built-in capabilities to simplify deployment. Which approach should the architect take?

An engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint in a spine-leaf fabric. The requirement is that the switch must perform VXLAN encapsulation and decapsulation in hardware without relying on the supervisor CPU, and it must support distributed anycast gateway for the tenant subnets. Which feature set must be enabled to meet these requirements?

Which three statements about syslog message severity levels are correct? (Choose three.)

Drag and drop the steps of EIGRP route summarization configuration into the correct order, from first to last.

Which statement correctly describes the difference between RADIUS and TACACS+?

A network engineer is configuring a Cisco router for AAA using a RADIUS server. The engineer wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication for console access. The engineer configures 'aaa authentication login default group radius local' and 'aaa authentication login CONSOLE local'. The console line is configured with 'login authentication CONSOLE'. However, when the RADIUS server is down, the engineer cannot log in via the console. What is the problem?

A network engineer is implementing a Python script to interact with a Cisco IOS XE device using RESTCONF. The script must authenticate using basic authentication over HTTPS and retrieve the configured hostname. Which Python code snippet correctly performs this task using the requests library?

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and runs SSH for management. The administrator wants to ensure that a sudden flood of BGP updates from a misbehaving peer does not starve the SSH management plane, while still allowing legitimate BGP traffic. Which CoPP configuration approach best meets this requirement?

What is the default IGMP version on a Cisco IOS interface when IP multicast routing is enabled?

A network engineer is troubleshooting a connectivity issue in a switched network. The network uses Rapid PVST+ with multiple VLANs. The engineer notices that a host connected to an access port on SW1 cannot communicate with the default gateway, which is on a distribution switch. The access port is configured with PortFast and BPDU Guard. The engineer checks the switch logs and sees that the port went into errdisable state. What is the most likely cause of the errdisable state?

Drag and drop the steps of RSPAN session configuration and traffic flow into the correct order, from first to last.

A network engineer is configuring a Cisco Catalyst switch to support a new wireless access point that will carry management traffic on VLAN 10 and client traffic on VLAN 20. The AP connects to a single switchport and requires both VLANs to be trunked with 802.1Q tagging, with VLAN 10 as the native VLAN. Which configuration on the switchport will meet these requirements?

spanning-tree mode rapid-pvst What is the effect of this global configuration command?

A network engineer is using Cisco DNA Center's Assurance to troubleshoot a performance issue reported by users on a specific floor. The engineer wants to analyze the path that traffic takes from a client to a server in the data center, including details of each hop such as device, interface, and any ACLs applied. Which Cisco DNA Center Assurance feature provides this information?

A network engineer is new to network automation and wants to use a declarative, agentless tool that uses YAML playbooks to push configuration to Cisco IOS devices over SSH. Which tool should the engineer choose?

A network engineer runs the following command on Router R3: R3# show ip nat statistics Total active translations: 5 (0 static, 5 dynamic; 5 extended) Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 1234 Misses: 5 CEF Translated packets: 1200, CEF Punted packets: 34 Expired translations: 10 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240 refcount 5 Based on this output, what can be concluded?

A network architect is designing a Cisco SD-Access fabric for a large campus. The architect needs to ensure that the fabric can scale to support thousands of endpoints and that the control plane uses a dedicated protocol for endpoint registration and location. Which component of the SD-Access architecture provides this control plane function?

Drag and drop each flow record field on the left to its matching category (key or non-key) on the right.

A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch router (vEdge) is not forming a control connection with the vSmart controller. The engineer verifies that the vEdge has IP reachability to the vSmart controller's public IP address on port 12346. Which additional step is required for the control connection to be established?

A network engineer is troubleshooting an issue where Cisco DNA Center is not sending configuration changes to a group of switches. The engineer checks the Provisioning dashboard and sees that the devices are in 'Pending' state. The engineer has already created the intent (network profile) and assigned it to the site. What is the most likely cause?

interface GigabitEthernet0/1 spanning-tree portfast spanning-tree bpduguard enable end What is the effect of this configuration?

Which two statements about using Python for configuration management and templating in network automation are true? (Choose two.)

Given the following configuration on a Cisco IOS-XE device: router ospf 1 network 10.0.0.0 0.255.255.255 area 0 ! interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip ospf cost 10 ! interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.0 ! Which statement is true about OSPF operation?

A network engineer runs the following command on a Cisco WLC: WLC# show ap rf-profile summary RF-Profile Name: default-rf-profile Description: Default RF Profile Band: 2.4 GHz Channel Width: 20 MHz Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps Power Level: 1 (max) RF-Profile Name: low-power Description: Low Power Profile Band: 2.4 GHz Channel Width: 20 MHz Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps Power Level: 5 Based on this output, what can be concluded?

An enterprise is migrating its data center to a leaf-spine architecture to support high east-west traffic between servers. The design must provide non-blocking forwarding and allow for easy scaling by adding more spines. Which characteristic is essential for the spine switches in this design?

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

A network administrator issues the following command on a Cisco switch: Switch# show aaa servers RADIUS: id 1, priority 1, host 192.168.1.10, auth-port 1812, acct-port 1813 State: current UP, duration 3600s, previous duration 0s Dead: total 0, retransmit 0 RADIUS: id 2, priority 2, host 192.168.1.20, auth-port 1812, acct-port 1813 State: current UP, duration 100s, previous duration 300s Dead: total 3, retransmit 2 Based on this output, what can be concluded?

Drag and drop the steps of WLC high availability SSO failover steps into the correct order, from first to last.

Which two statements about virtual machine migration (vMotion/VMware) or live migration (Hyper-V) are true? (Choose two.)

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using MD5. The engineer wants to ensure that only routers with the correct key can form adjacencies, and that the key is not sent in clear text. Which command sequence correctly enables MD5 authentication on an interface?

An enterprise network is experiencing high CPU utilization on the distribution layer switches. The design uses VLANs with SVIs for inter-VLAN routing, and HSRP for first-hop redundancy. The engineer notices that the standby switch is also experiencing high CPU. What is the most likely cause?

Which two statements about VRF-lite configuration are true? (Choose two.)

Drag and drop each YANG statement on the left to its matching function on the right.

A network engineer is deploying MACsec on a Catalyst switch uplink between two buildings to protect Layer 2 traffic. Which two statements about MACsec operation on Cisco Catalyst switches are true? (Choose two.)

A network engineer is configuring a GETVPN solution for a large enterprise with many remote sites. The engineer wants to ensure that all traffic between sites is encrypted using a common group key. The key server (KS) is a Cisco ASR 1000. After configuration, the group members (GMs) can register with the KS, but traffic between GMs is not encrypted. The engineer checks the KS configuration and sees that the crypto gdoi group has been defined with a transform set and a security association. What is the most likely missing configuration?

A network engineer is designing a Cisco SD-Access fabric for a campus network. The fabric must support both wired and wireless clients, and the engineer wants to ensure that traffic from wired endpoints is encapsulated and forwarded through the fabric without requiring the endpoints to change their IP addresses. Which component of the SD-Access architecture is responsible for encapsulating traffic from wired endpoints and forwarding it to the fabric edge?

A network engineer runs the following command on Switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi1/0/15 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

Drag and drop each SNMP operation on the left to its matching direction on the right.

Which three statements about MPLS forwarding are true? (Choose three.)

Examine the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet0/5 switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30 switchport nonegotiate What is the effect of the 'switchport nonegotiate' command?

A network engineer is deploying a new Cisco Catalyst switch and must ensure that the management VLAN 50 is the only VLAN allowed on the trunk link to the distribution switch, while also ensuring that the native VLAN matches on both ends. The distribution switch is already configured with switchport trunk native vlan 999 and switchport trunk allowed vlan 50. Which configuration on the new switch will satisfy these requirements?

Which three statements about OSPF area types are correct? (Choose three.)

A network engineer is configuring 802.1X on a Cisco switch for a voice VLAN deployment. The switchport is connected to an IP phone, which then connects to a PC. The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'switchport voice vlan 10'. The PC authenticates successfully, but the IP phone does not get an IP address from the voice VLAN. The engineer verifies that the phone is configured for 802.1X and the RADIUS server is correct. What is the most likely cause?

A network engineer is designing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer needs to perform a partial modification of the interface description without affecting other configured parameters. Which two HTTP methods and payload considerations are appropriate for this task? (Choose two.)

A network engineer is configuring a Cisco Catalyst switch to support a new wireless access point that will use 802.1X authentication with EAP-TLS. The switch port must be configured to allow multiple hosts, but only one host should be authenticated. Which command should be used to enable this behavior?

A network engineer is deploying Cisco DNA Center in a large campus network with 5000+ devices. After initial setup, the engineer notices that the Assurance module is not receiving telemetry data from many access switches. The switches are running IOS-XE 16.12 and are reachable via SNMP. What is the most likely cause of this issue?

A network engineer is designing an automation solution that uses Python with the ncclient library to manage Cisco IOS XE devices via NETCONF. The engineer needs to ensure that the solution can retrieve interface configurations, modify them, and verify the changes. Which two NETCONF operations should the engineer use to accomplish these tasks? (Choose two.)

A network administrator is configuring a Cisco IOS router to support IPsec VPN for remote workers. The security policy requires that the router authenticate users via digital certificates issued by a corporate PKI. The administrator has already configured the CA trustpoint and obtained a certificate. Which command must be used in the ISAKMP policy to specify that RSA signatures (digital certificates) should be used for authentication?

interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 mpls ip mpls label protocol ldp ! router ospf 1 network 10.1.1.0 0.0.0.255 area 0 ! router ldp interface GigabitEthernet0/1 ! What is the effect of this configuration?

Which three statements about SNMP trap and inform operations are true? (Choose three.)

A network administrator is configuring a Cisco IOS router to support NAT overload for a small office. The inside network is 10.1.1.0/24, and the outside interface is GigabitEthernet0/1 with IP address 203.0.113.5. The administrator wants all inside hosts to share the outside interface address for internet access. Which command is required to define the NAT pool or interface used for translation?

A network engineer runs the following command on Router R7: R7# show ip ospf neighbor vrf CUSTOMER-E Neighbor ID Pri State Dead Time Address Interface 10.0.0.8 1 FULL/DR 00:00:35 10.0.1.2 GigabitEthernet0/0.500 10.0.0.9 1 FULL/BDR 00:00:31 10.0.2.2 GigabitEthernet0/0.600 Based on this output, what can be concluded?

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

An enterprise is deploying Cisco SD-WAN and must ensure that data plane traffic between branch sites is encrypted and authenticated. The design must also allow the use of application-aware routing to steer traffic based on real-time performance metrics. Which component is responsible for establishing and managing the IPsec tunnels between branch routers?

A network engineer issues the following command on Router R9: R9# show ip sla configuration 7 IP SLAs Infrastructure Engine-II Entry number: 7 Owner: Tag: Type of operation to perform: icmp-echo Target address: 192.168.9.10 Source address: 192.168.9.1 Type Of Service parameter: 0x0 Request size (ARR data portion): 28 Operation timeout (milliseconds): 5000 Frequency (seconds): 30 Next Scheduled Start Time: Start Time already passed Group Scheduled : FALSE Life (seconds): 3600 Entry Ageout (seconds): never Recurring (Starting Everyday, Starting Time: 00:00:01) Status of entry (SNMP RowStatus): Active Threshold (milliseconds): 5000 Distribution Statistics: Number of statistic hours kept: 2 Number of statistic distribution buckets kept: 1 Statistic distribution interval (milliseconds): 20 Enhanced History: Based on this output, how long will this IP SLA operation run?

A network engineer is developing a Python script to configure OSPF on a Cisco IOS XE device using the NETCONF protocol. The script establishes an SSH session and sends a <edit-config> RPC with the target datastore set to 'running'. The configuration is applied successfully, but after a device reload, the OSPF configuration is missing. The engineer verifies that the <edit-config> operation included the 'default-operation' parameter set to 'merge'. What is the most likely reason for the configuration loss?

Drag and drop the steps of IP addressing scheme design and subnetting steps into the correct order, from first to last.

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

A network engineer runs the following command on switch SW1: SW1# show authentication sessions interface GigabitEthernet1/0/1 Interface: GigabitEthernet1/0/1 MAC Address: 0011.2233.4455 IP Address: 192.168.1.100 Status: Authz Success Domain: DATA Oper host mode: multi-auth Oper control dir: both Session timeout: N/A Common Session ID: 0A1B2C3D4E5F6G7H8I9J Acct Session ID: 0x0000000A Handle: 0x00000001 Current Method List: mab Method: MAB State: Authz Success Based on this output, what can be concluded?

A network engineer is configuring a new Cisco IOS switch that will be deployed in a data center. The switch must forward traffic for VLAN 10 while ensuring that the native VLAN for all trunk ports is not susceptible to VLAN hopping attacks. The engineer decides to change the native VLAN from the default to an unused VLAN 999. Which command sequence correctly configures the native VLAN on a trunk port?

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Examine the following configuration: policy-map QUEUE class GOLD bandwidth percent 25 queue-limit 64 packets class SILVER bandwidth percent 25 queue-limit 128 packets class class-default fair-queue interface GigabitEthernet0/2 service-policy output QUEUE Which statement about this configuration is true?

A network engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 switches. Hosts in VLAN 100 on different leaf switches cannot communicate, even though the EVPN control plane shows the MAC addresses. The engineer suspects a problem with the VXLAN data plane. Which command should be used to verify the VXLAN tunnel endpoints (VTEPs) and their status?

A network administrator must secure management access to a Cisco Catalyst 9300 switch so that only encrypted sessions are accepted and any Telnet attempt is refused. The administrator wants to enforce this with the fewest configuration lines on the VTY lines. Which configuration accomplishes this?

An engineer is deploying VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. Hosts in the same subnet are attached to different edge nodes. Which mechanism ensures that a host's default gateway MAC address is identical on every edge node while still allowing local forwarding?

A network architect is evaluating Cisco StackWise Virtual technology for a pair of Cisco Catalyst 9000 switches that will act as a single logical entity at the distribution layer. Which two statements accurately describe Cisco StackWise Virtual? (Choose two.)

A network engineer is configuring a new Cisco IOS switch and needs to ensure that the management VLAN is properly secured. The engineer wants to restrict management access to only the IT department subnet 10.10.10.0/24. Which configuration should be applied to the VTY lines?

A network engineer runs the following command on Switch SW2: SW2# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address aabb.cc00.0100 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address aabb.cc00.0200 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Gi0/3 Desg FWD 19 128.3 P2p Based on this output, what can be concluded?

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP) in a spine-leaf fabric. The engineer needs to verify that the NVE interface is operational and that the VNI-to-VLAN mapping is correct. Which command should the engineer use to display the VXLAN tunnel endpoints and their associated VNIs?

A network automation team is evaluating YANG as the data modeling language underpinning its Cisco IOS XE automation. Which two statements accurately describe YANG in this context? (Choose two.)

Drag and drop each hypervisor type on the left to its matching characteristic on the right.

Which two statements about SNMPv3 security models are true? (Choose two.)

A network architect is designing QoS for a converged network carrying voice, video, and data. The design must use the DiffServ model and ensure that voice traffic is marked with the highest priority and that video traffic is marked with a lower priority but still above data. Which DSCP markings should be assigned to voice and video traffic, respectively, to comply with the standard Per-Hop Behavior (PHB) definitions?

A network engineer runs the following command on a Cisco WLC: WLC# show ap stats ap-name AP-1 AP Statistics for AP-1 ---------------------- Channel Utilization: 45% Interference: 10% Noise Floor: -95 dBm Total Packets Received: 15000 Total Packets Sent: 12000 Total Errors: 200 Based on this output, what can be concluded?

A network engineer is deploying a new branch office with a Cisco Catalyst 9300 switch. The switch must participate in the corporate OSPF domain but must not become a designated router (DR) or backup designated router (BDR) on any broadcast segment. Which configuration should the engineer apply to the switch's OSPF interface?

Drag and drop the steps of Layer 3 EtherChannel (routed port-channel) setup into the correct order, from first to last.

A network engineer is implementing Cisco SD-Access and needs to configure the fabric to support both wired and wireless clients. Which two components are required to enable wireless integration in a Cisco SD-Access fabric? (Choose two.)

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

A network engineer checks the AAA server status: R1# show aaa servers RADIUS: id 1, priority 1, host 10.1.1.10, auth-port 1812, acct-port 1813 State: current DEAD, duration 0s, previous duration 500s Dead: total 1, retransmit 3 RADIUS: id 2, priority 2, host 10.1.1.20, auth-port 1812, acct-port 1813 State: current UP, duration 200s, previous duration 0s Dead: total 0, retransmit 0 Based on this output, what can be concluded?

A network engineer is using a Python script with the 'requests' library to interact with a Cisco IOS XE device via RESTCONF. The script sends a GET request to the URI 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1' but receives a 401 Unauthorized error. The engineer has verified that the RESTCONF service is enabled and the URI is correct. What is the most likely cause of the error?

A network engineer runs the following command on Switch SW1: SW1# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 0011.2233.4455 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0011.2233.4466 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Based on this output, what can be concluded?

A network architect is designing QoS for a Cisco SD-WAN deployment that uses a mix of MPLS and broadband Internet transports. The design must ensure that interactive video traffic is not delayed by large file transfers, even when the Internet link experiences congestion. Which SD-WAN policy type should the architect use to enforce this behavior?

Consider the following EIGRP configuration: router eigrp 100 metric weights 0 1 0 1 0 0 What does this configuration accomplish?

A company is deploying Cisco CSR1000v virtual routers in a KVM environment. The architect needs to ensure high availability by allowing VMs to move between physical hosts without service interruption. Which feature must be supported by the hypervisor and storage?

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Drag and drop the steps of a RESTCONF PUT transaction on IOS-XE into the correct order, from first to last.

A network engineer is designing a QoS policy for a Cisco Catalyst switch. The policy must ensure that voice traffic receives strict priority scheduling, while video and critical data traffic are guaranteed a minimum bandwidth. The engineer decides to use Modular QoS CLI (MQC) to create a policy map. Which queuing mechanism should be configured within the policy map to provide strict priority for voice traffic?

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

An engineer is deploying a Linux virtual machine on a KVM hypervisor. The VM needs to be connected to a virtual network that provides isolation from other VMs on the same host but allows communication with the host and external networks. The engineer creates a Linux bridge and attaches the VM's tap interface to it. However, the VM cannot reach the external network. The host has a physical NIC (eth0) connected to the corporate network. What is the missing configuration step?

Which component of Cisco ACI is responsible for policy enforcement and forwarding decisions?

A network administrator is analyzing NetFlow data on a Cisco IOS router to identify top talkers. The administrator notices that a large amount of traffic is being exported but the NetFlow cache is filling up quickly. Which action should the administrator take to reduce the cache size while maintaining visibility into the most significant flows?

Drag and drop the steps of ISE RADIUS policy evaluation order into the correct order, from first to last.

A network architect is designing a QoS policy for a Cisco Catalyst switch that must prioritize voice traffic over all other traffic, while ensuring that bulk data transfers do not starve other applications. The design requires strict priority for voice and a guaranteed minimum bandwidth for business-critical applications. Which two mechanisms should be used together to meet these requirements?

Which three statements about NFV use cases and deployment models are true? (Choose three.)

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer sends a GET request to the URL https://dnac.example.com/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token. What is the most likely cause of the error?

An engineer is configuring BGP on a router that will act as a route reflector to reduce iBGP peering requirements. The router has several iBGP peers. The engineer wants to ensure that the route reflector does not modify the next-hop attribute of routes it reflects to its clients. Which configuration command should the engineer use?

A network engineer runs the following command on Switch SW9: SW9# show etherchannel 4 port-channel Port-channels in the group: --------------------------- Port-channel: Po4 (Primary Aggregator) Age of the Port-channel = 0d:00h:20m:10s Logical slot/port = 16/4 Number of ports = 3 HotStandby port = null Port state = Port-channel Ag-Inuse Protocol = LACP Ports in the Port-channel: Index Load Port EC state No of bits ------+------+------+----------------+---------- 0 00 Gi0/0 Active 4 1 00 Gi0/1 Active 4 2 00 Gi0/2 Standby 4 Time since last port bundled: 0d:00h:15m:00s Gi0/1 Based on this output, what can be concluded?

Which three statements about error handling and debugging in Python network automation scripts are true? (Choose three.)

A network architect is designing a Cisco SD-WAN fabric for a company with 30 branch sites and two data centers. The architect wants to ensure that control plane information is exchanged securely and that data plane traffic can be forwarded even if the control plane is temporarily unavailable. Which component should be deployed to meet these requirements?

Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.

A network engineer wants to automate configuration backups for a fleet of Cisco IOS XE devices using Ansible. The engineer uses the ios_config module with the backup: yes option and sets the backup directory via the ANSIBLE_BACKUP_DIR environment variable. After running the playbook, the engineer finds that no backup files are created on the control node. What is the most likely cause?

A network engineer runs the following command on Switch SW6: SW6# show spanning-tree vlan 60 VLAN0060 Spanning tree enabled protocol ieee Root ID Priority 24636 Address aabb.cc00.0a00 Cost 8 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 60) Address aabb.cc00.0b00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Root FWD 8 128.1 P2p Gi0/2 Desg FWD 4 128.2 P2p Gi0/3 Altn BLK 4 128.3 P2p Gi0/4 Desg FWD 4 128.4 P2p Based on this output, what is the bridge priority of the root bridge for VLAN 60?

A network engineer is deploying a VXLAN EVPN fabric. The underlay is a routed Layer 3 network using OSPF. Hosts in the same subnet are attached to leaf switches that are not directly connected. The engineer must ensure that the fabric provides optimal forwarding for East-West traffic without tromboning through a centralized gateway. Which VXLAN component should be configured to accomplish this?

A network engineer is using the RESTCONF API on a Cisco IOS XE device to configure an interface. The engineer sends a PATCH request to the URL https://device/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 with the following JSON payload: {"ietf-interfaces:interface": {"description": "Uplink to Core"}}. The request returns a 400 Bad Request error. What is the most likely reason for this error?

Drag and drop the steps of PIM-SM join and source registration into the correct order, from first to last.

A network engineer is using the YANG Suite tool to explore YANG models on a Cisco IOS XE device. The engineer wants to retrieve the operational state of all interfaces using NETCONF. The engineer sends a <get> RPC with a filter that selects the 'interfaces-state' container from the ietf-interfaces YANG module. The device returns an empty response. The engineer confirms that interfaces are up and running. What is the most likely reason for the empty response?

A network automation team wants to programmatically configure a Cisco Catalyst 9300 switch using RESTCONF. The switch is running Cisco IOS XE 17.x. Which HTTP method should be used to create a new VLAN by sending a JSON payload to the RESTCONF URI /restconf/data/Cisco-IOS-XE-vlan:vlan?

Drag and drop the steps of DNA Center assurance issue detection and root cause into the correct order, from first to last.

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP polling. A class-map named CLASS-MGMT matches SNMP and SSH traffic, and a policy-map named COPP-POLICY applies a police rate of 8000 bps with a conform-action transmit and exceed-action drop for that class. After the policy is attached to the control plane, SNMP polling intermittently fails while BGP remains stable. Which action should the engineer take to resolve the SNMP failures while still protecting the route processor?

Drag and drop the steps of BFD session establishment for path liveliness into the correct order, from first to last.

What is the purpose of the 'aaa authorization exec default local' command?

A network engineer runs the following command on Router R2: R2# show class-map Class Map match-any VOICE (id 1) Match ip dscp ef (46) Class Map match-any DATA (id 2) Match ip dscp af31 (26) Class Map match-any class-default (id 0) Match any R2# show policy-map Policy Map QOS_POLICY Class VOICE priority level 1 police cir 1000000 bc 15625 be 15625 Class DATA bandwidth remaining percent 50 Class class-default bandwidth remaining percent 50 R2# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 (0 kbps) Class-map: class-default (match-any) 100 packets, 10000 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 bandwidth remaining percent 50 (0 kbps) Based on this output, what can be concluded?

Given the following policy-map: policy-map QOS_POLICY class VOICE priority percent 30 class VIDEO bandwidth percent 20 queue-limit 100 packets class class-default fair-queue What is the effect of the 'priority percent 30' command in the VOICE class?

Drag and drop the steps of iBGP route reflection configuration steps into the correct order, from first to last.

A security architect is designing a campus network where all access-layer switch ports must authenticate endpoints before granting any Layer 2 connectivity. The design requires the switch to communicate with Cisco ISE using EAP over RADIUS, and the endpoint must be validated before any VLAN assignment occurs. Which 802.1X component role must the access-layer switch perform in this design?

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?

A network engineer is configuring a Cisco Nexus 9000 switch with VXLAN EVPN. The engineer wants to ensure that the switch can forward traffic between VLANs that are mapped to the same VXLAN Network Identifier (VNI) but are on different leaf switches. Which component is responsible for mapping the VLAN to the VNI on the ingress leaf switch?

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

A network engineer is troubleshooting QoS on a Cisco Nexus 9000 switch. The switch is configured with a policy map that uses a class-default with a bandwidth remaining percent of 100. However, during congestion, traffic in a priority queue (class-map for EF) is experiencing drops even though the priority queue is not fully utilized. What is the most likely cause?

A security architect is designing a Zero Trust access solution for a campus using Cisco Identity Services Engine. The requirement is to enforce dynamic, identity-based segmentation without relying solely on static VLANs, and to support both wired and wireless endpoints. Which two capabilities should be leveraged? (Choose two.)

An architect is designing an SD-Access fabric for a campus with multiple buildings. The design must support wireless clients seamlessly roaming across fabric edge nodes. Which technology is used in the fabric to provide mobility for wireless endpoints?

Examine the following configuration snippet on a Cisco IOS-XE router: interface GigabitEthernet0/1 ip vrf forwarding BLUE ip address 192.168.1.1 255.255.255.0 no shutdown What is the effect of this configuration?

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on the port and to automatically shut down the port if a violation occurs. Which command set should be used?

An organization uses Chef to manage network device configurations. A cookbook that configures SNMP community strings is applied to a group of routers. After the run, one router loses SNMP access. The cookbook uses the following resource: snmp_community 'public' do action :remove end. What is the most likely cause of the issue?

A network engineer configures Control Plane Policing on a Cisco IOS XE router acting as the BGP speaker for an ISP edge. The policy must protect the route processor from CPU exhaustion while still allowing BGP keepalives, SSH management, and SNMP polling from the NOC. Which CoPP design element is required to ensure BGP, SSH, and SNMP traffic is matched and rate-limited separately from transit traffic?

A multinational organization has a BGP-based MPLS VPN network. The CE router at a branch office is connected to two PE routers (PE1 and PE2) in the service provider network. The branch uses eBGP to exchange routes with the PEs. The network administrator notices that the branch can reach some destinations but not others. The BGP table on the CE shows routes with next-hop set to the PE loopback addresses, but those loopbacks are not reachable. The CE has a default route pointing to the PEs. What is the most likely cause of the issue?

A network engineer runs the following command on Router R1: R1# show policy-map interface GigabitEthernet0/0 GigabitEthernet0/0 Service-policy input: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 31250 be 31250 conformed 0 bytes; actions: transmit exceeded 0 bytes; actions: drop violated 0 bytes; actions: drop Class-map: class-default (match-any) 100 packets, 12000 bytes 5 minute offered rate 8000 bps, drop rate 0 bps Match: any Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/12000 Based on this output, what can be concluded?

Drag and drop the steps of the 802.11 client association process into the correct order, from first to last.

A network engineer is configuring a Cisco CSR 1000v router to run multiple virtual routing and forwarding (VRF) instances. The engineer wants to ensure that traffic from VRF RED can reach the internet while traffic from VRF BLUE remains isolated. Which feature should be configured to allow VRF RED to access the global routing table?

A network engineer is configuring a Cisco IOS switch and needs to assign a specific port to VLAN 20 as an access port. The port is currently in VLAN 1 and is administratively up. Which sequence of interface configuration commands correctly places the port into VLAN 20 as an access port?

A network administrator is deploying a new branch office that requires a dynamic routing protocol supporting unequal-cost load balancing and fast convergence. The topology includes Cisco routers only. Which routing protocol should be implemented?

A network administrator is deploying a new branch office with a Cisco Catalyst 9200 switch. The security policy requires that any endpoint connecting to access ports must be authenticated before being granted network access, and unauthenticated devices must be placed into a restricted VLAN. The administrator wants to minimize configuration on the switch and rely on the authentication server to assign the VLAN dynamically. Which 802.1X feature should be configured on the switch to meet these requirements?

Consider the following configuration: ip access-list extended BLOCK_TELNET deny tcp any any eq 23 permit ip any any ! interface GigabitEthernet0/2 ip access-group BLOCK_TELNET out Which statement is true?

A data center team is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches and wants to eliminate the need for multicast underlay replication for broadcast, unknown unicast, and multicast traffic. Which mechanism should the team implement to achieve ingress replication of BUM traffic?

Drag and drop each WAN topology type on the left to its matching characteristic on the right.

A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when the number of clients on a specific wireless controller exceeds a threshold. Which feature in Cisco DNA Center Assurance should be used to configure this?

A network architect is designing a new branch office that requires a switch to be managed centrally without a dedicated physical controller appliance on-site. The switch must support fabric capabilities and be onboarded using Plug and Play. Which Cisco Catalyst switch platform should be selected?

Examine the following configuration for a Cisco IOS-XE device: interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 ipv6 address 2001:db8::1/64 ipv6 ospf 1 area 0 ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8:1::1/64 ipv6 ospf 1 area 0 ! ipv6 router ospf 1 router-id 2.2.2.2 Which statement is true about OSPFv3 operation?

A company is migrating its legacy firewall services to a virtualized environment using Cisco NFV. The network engineer deploys a virtual firewall (vFW) on an NFVIS-enabled UCS platform. After the deployment, traffic through the vFW is intermittent and performance monitoring shows high CPU usage on the host. Which action should the engineer take to improve performance?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has management SSH access, BGP peering, and SNMP monitoring. After applying a CoPP policy, the engineer notices that BGP sessions flap intermittently, but SSH and SNMP remain stable. Which action should the engineer take to resolve the BGP flapping while maintaining control plane protection?

A network architect is designing a Cisco SD-Access fabric for a hospital campus. The fabric must support wired and wireless clients, and the architect wants to ensure that all fabric edge nodes use a consistent mapping of endpoint IP addresses to fabric locations. Which control plane component is responsible for maintaining the endpoint-to-edge-node mapping database?

An engineer is using a Python script to configure a new VLAN on a Cisco Nexus 9000 switch using the NX-API REST API. The script sends a POST request to 'https://switch/api/mo/org.json' with a JSON payload containing the VLAN configuration. The switch responds with a 403 Forbidden error. What is the most likely cause?

A data center team is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches to replace an aging three-tier topology. They want to understand which functions are performed by the VXLAN tunnel endpoints and the EVPN control plane. Which two statements accurately describe VXLAN EVPN behavior? (Choose two.)

Given the following configuration: interface GigabitEthernet0/1 service-policy output QOS_POLICY Which statement is true about applying a service-policy in the output direction?

Which two statements about configuring SPAN on Cisco IOS-XE switches are true? (Choose two.)

A network engineer is deploying Cisco ACI in a data center. The engineer needs to configure a bridge domain that provides Layer 2 connectivity between endpoints in the same tenant. Which two statements about Cisco ACI bridge domains are true? (Choose two.)

A network engineer must protect the Cisco IOS control plane from an excessive volume of ARP traffic generated by a compromised host in VLAN 20. The engineer wants to limit ARP packets that are punted to the CPU, while allowing normal data forwarding to continue unaffected. Which feature should be configured to accomplish this goal?

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an endpoint device is connected to a port and later replaced by a different device, the port must automatically learn the new MAC address without administrative intervention, but a violation must generate a syslog message and increment a counter. The administrator configures the interface with the command 'switchport port-security violation restrict'. Which additional command is required to meet the requirement that the new device is learned automatically?

A company is deploying a virtualized firewall on a VMware ESXi host. The firewall VM requires high network throughput and low latency. The engineer decides to use SR-IOV to assign a virtual function (VF) from a physical NIC to the VM. After configuration, the VM can communicate, but the host's management network becomes unreachable. What is the most likely cause?

Drag and drop each Cisco security feature on the left to its matching OSI layer on the right.

A network engineer is implementing QoS on a Cisco router that connects to a service provider. The provider uses MPLS and expects the MPLS EXP bits to be set for voice traffic. The engineer configures a policy-map that sets the MPLS EXP to 5. However, the provider reports that the EXP bits are not being set. What is the most likely reason?

An engineer is deploying a Cisco SD-WAN solution using Cisco vManage. The company requires that the WAN edge devices authenticate to the controllers using certificates signed by an enterprise PKI rather than the default Cisco-signed certificates. Which component must be configured to issue and manage these certificates?

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that traffic from a specific subnet is encrypted and sent to a remote peer, while all other traffic is sent unencrypted. The engineer has configured an extended ACL for the crypto map. Which additional configuration is required to ensure that the crypto map is applied to the correct interface and that the VPN tunnel is established?

A network engineer runs the following command on Switch SW8: SW8# show spanning-tree vlan 80 VLAN0080 Spanning tree enabled protocol ieee Root ID Priority 24656 Address aabb.cc00.0e00 Cost 12 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 80) Address aabb.cc00.0f00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Root FWD 12 128.1 P2p Gi0/2 Desg FWD 4 128.2 P2p Gi0/3 Desg FWD 4 128.3 P2p Gi0/4 Altn BLK 4 128.4 P2p Based on this output, what is the cost of the root port?

Match each QoS feature to its description.

Examine the following configuration snippet: interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip ospf network point-to-point ip ospf hello-interval 10 ip ospf dead-interval 40 ! router ospf 1 network 192.168.1.0 0.0.0.255 area 0 What is the effect of this configuration?

Which two statements about Ansible automation in a Cisco environment are true? (Choose two.)

A network architect is designing a QoS policy for a campus network. The architect needs to ensure that voice traffic is prioritized over all other traffic types, even during congestion. Which queuing mechanism should be used on the egress interface to provide strict priority to voice traffic?

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to authenticate corporate users using 802.1X with a RADIUS server. The requirement is to ensure that only users with valid credentials can access the wireless network, and that the RADIUS server is reachable. Which WLC configuration step is required to enable 802.1X authentication?

A network administrator is enabling a virtual routing and forwarding instance on a Cisco IOS-XE router to separate customer traffic. The administrator issues the ip vrf forwarding CUSTOMER_A command on Gi0/0/1, and the interface immediately loses its IP address. What is the reason for this behavior?

Drag and drop the steps of SD-Access fabric border node configuration steps into the correct order, from first to last.

What is the default update interval for a Cisco IOS-XE telemetry subscription when using update-policy periodic without specifying a value?

A network security team is implementing Cisco TrustSec in a campus network. The team wants to enforce access based on a tag carried in the packet rather than by IP address, and wants the tag to be propagated across the network without per-hop reclassification. Which Cisco TrustSec component assigns and inserts the Security Group Tag (SGT) at the ingress point?

Consider the following SD-WAN configuration snippet on a Cisco IOS-XE router: interface GigabitEthernet0/0/1 ip address 10.1.1.1 255.255.255.0 tunnel-interface encapsulation ipsec color biz-internet no allow-service bgp allow-service dhcp allow-service dns allow-service icmp ! What is the effect of this configuration?

Drag and drop the steps of SNMPv3 secure agent configuration into the correct order, from first to last.

Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)

A network engineer is configuring a new Cisco Catalyst switch that will participate in a VTP domain. The engineer wants to ensure the switch can create, modify, and delete VLANs for the domain while also receiving updates. The switch must not overwrite the existing VLAN database on other switches in the domain. Which VTP mode should be configured?

Drag and drop each HTTP status code on the left to its meaning on the right.

Drag and drop each IP SLA operation type on the left to its measured metric on the right.

A network engineer runs the following command on Switch SW1: SW1# show interfaces gi0/1 switchport Name: Gi0/1 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Administrative Native VLAN tagging: enabled Voice VLAN: none Administrative private-vlan host-association: none Administrative private-vlan mapping: none Administrative private-vlan trunk native VLAN: none Administrative private-vlan trunk Native VLAN tagging: enabled Administrative private-vlan trunk encapsulation: dot1q Administrative private-vlan trunk normal VLANs: none Administrative private-vlan trunk private VLANs: none Operational private-vlan: none Trunking VLANs Enabled: ALL Pruning VLANs Enabled: 2-1001 Capture Mode Disabled Capture VLANs Allowed: ALL Based on this output, what can be concluded?

A network engineer runs the following command on Switch SW1: SW1# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 0011.2233.4455 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0011.2233.4466 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Gi0/3 Desg FWD 19 128.3 P2p Based on this output, what can be concluded?

Drag and drop the steps of OSPFv3 IPv6 neighbor adjacency formation into the correct order, from first to last.

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against control plane overload. The router has management traffic (SSH, SNMP) and routing protocol traffic (OSPF, BGP). After applying the CoPP policy, the engineer notices that OSPF adjacencies are flapping. Which action should the engineer take to resolve this issue while maintaining control plane protection?

A network engineer is implementing model-driven telemetry on a Cisco Nexus 9000 switch to monitor VLAN and STP changes. The engineer wants to use the native telemetry protocol with UDP as the transport. After configuring the telemetry subscription with the 'destination-group' and 'sensor-group', the engineer notices that the collector is not receiving any data. The collector is reachable and the UDP port is open. What is the most likely missing configuration?

A network engineer is writing a Python script to retrieve interface statistics from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces but receives an HTTP 406 Not Acceptable response. The engineer verifies that the device has RESTCONF enabled and the credentials are correct. Which action should the engineer take to resolve this issue?

Which two statements about the 'ip access-group' command are true? (Choose two.)

A network engineer is writing a Python script to query interface statistics from a Cisco IOS XE device using NETCONF. The script must establish a secure session that supports configuration and state data retrieval. Which transport protocol and port should the engineer use for the NETCONF session?

A company is deploying a new campus network with a hierarchical design (core, distribution, access). The QoS design must ensure that voice traffic is prioritized end-to-end, and that marking is trusted only on access ports connected to IP phones. Which architectural approach should the architect take for classification and marking?

Drag and drop each OSPF router role on the left to its matching function on the right.

A network engineer is writing a Python script to retrieve the operational state of a GigabitEthernet interface from a Cisco IOS XE device using RESTCONF. The script sends a GET request to https://10.1.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 but receives a 406 Not Acceptable response. The device supports RESTCONF and the interface exists. Which HTTP header should the engineer add to the request to resolve this error?

Drag and drop the steps of PIM DM (Dense Mode) flood and prune steps into the correct order, from first to last.

A network engineer is deploying a Cisco SD-Access fabric for a campus network. The fabric consists of border nodes, control plane nodes, edge nodes, and an intermediate node. The engineer needs to ensure that endpoints in the fabric can communicate with external networks such as the data center and the internet. Which component of the SD-Access architecture is responsible for providing connectivity between the fabric and external networks?

Which two statements about EIGRP stub routing are true? (Choose two.)

A network engineer is configuring a Cisco IOS XE router to support Network Address Translation (NAT) for a small office. The router has an inside interface GigabitEthernet0/0/0 and an outside interface GigabitEthernet0/0/1. The engineer wants to translate all inside hosts to the outside interface IP address using PAT. Which configuration snippet correctly implements this?

Examine this DHCP configuration: ``` ip dhcp pool POOL1 network 10.10.10.0 255.255.255.0 default-router 10.10.10.1 dns-server 8.8.8.8 lease 0 12 ! ip dhcp excluded-address 10.10.10.1 10.10.10.10 ``` Which statement is true?

A network engineer is new to automation and wants to start by writing a simple Python script to interact with a Cisco IOS XE device using RESTCONF. Which Python library is specifically designed to simplify sending HTTP requests to RESTCONF APIs?

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

A network engineer is deploying Cisco SD-Access and needs to provide fabric edge nodes with a mapping database for endpoint locations. The fabric uses LISP for control plane and VXLAN for data plane encapsulation. Which component is responsible for maintaining the endpoint-to-edge-node mapping and responding to map requests?

Drag and drop the steps of Cisco DNA Center device onboarding via PnP into the correct order, from first to last.

Which two statements about NetFlow flow records and export are correct? (Choose two.)

Drag and drop the steps of disaster recovery failover process into the correct order, from first to last.

A network engineer is deploying Cisco SD-Access and needs to integrate a new fabric site with an existing traditional network. The requirement is to allow endpoints in the fabric to communicate with external networks while preserving their fabric-assigned IP addresses and providing policy enforcement. Which component is responsible for this integration?

A network engineer is troubleshooting a Cisco Nexus 9000 leaf switch that is part of a VXLAN EVPN fabric. The engineer notices that the leaf is not learning remote MAC addresses, although the underlay is operational and BGP EVPN sessions are established. Which action should the engineer take to verify that the leaf is receiving EVPN Type 2 routes?

A network engineer is using a Python script with the ncclient library to retrieve configuration from a Cisco IOS XE device via NETCONF. The script uses the <get-config> RPC with a source of <running/> and a filter of <native xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-native"/>. The script successfully retrieves the configuration but the output is in XML format. The engineer wants to convert this XML into a Python dictionary for easier manipulation. Which Python library is specifically designed to parse XML into a dictionary structure?

Drag and drop the steps of configuring a Layer 2 EtherChannel using PAgP into the correct order, from first to last.

A network engineer is configuring 802.1X on a Cisco switch for a guest network. The engineer wants to allow guests to access the internet after authentication but restrict access to internal resources. The engineer configures the switch with 'authentication port-control auto' and a downloadable ACL (dACL) from the RADIUS server. After a guest authenticates, the engineer tests connectivity and finds that the guest can access internal servers. What is the most likely cause?

A company is consolidating branch servers onto a single physical host running a hypervisor. The administrator needs each virtual machine to have its own virtual NIC with an independent MAC address and to be isolated at Layer 2 from other virtual machines unless explicitly connected to the same virtual switch. Which component provides this function?

Examine the following configuration: interface Port-channel1 switchport mode trunk ! interface GigabitEthernet0/1 switchport mode trunk channel-group 1 mode desirable ! interface GigabitEthernet0/2 switchport mode access channel-group 1 mode desirable What is the problem with this configuration?

Examine the following HSRP configuration on a Cisco IOS-XE switch: interface Vlan10 ip address 10.0.0.2 255.255.255.0 standby 10 ip 10.0.0.1 standby 10 priority 150 standby 10 preempt What is the effect of the 'standby 10 preempt' command?

A network engineer is troubleshooting an automated configuration change that caused a routing loop. The change was pushed via an Ansible playbook that modified OSPF cost values on multiple routers simultaneously. What is the most likely reason for the loop?

Which of the following is used by EIGRP to calculate the feasible distance (FD) of a route?

Examine the following CoPP configuration on a Cisco IOS-XE router: ``` class-map match-all CONTROL-PLANE match access-group name COPP-ACL ! policy-map COPP-POLICY class CONTROL-PLANE police 1000000 200000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY ``` What is the effect of this configuration?

Given this configuration: aaa new-model aaa authentication login default group radius aaa authorization exec default group radius aaa accounting exec default start-stop group radius radius-server host 192.168.1.1 auth-port 1645 acct-port 1646 key radiuskey radius-server host 192.168.1.2 auth-port 1645 acct-port 1646 key radiuskey Which statement is true about the RADIUS server ports?

A network architect at a large university is designing a new campus network that must support seamless roaming for thousands of wireless clients across multiple buildings. The design requires a centralized control plane with a distributed data plane to avoid traffic tromboning. Which Cisco architecture should the architect implement?

A network engineer at a large enterprise is deploying a new branch office. The branch has two Cisco Catalyst switches, SW1 and SW2, that must participate in the same Layer 2 domain. SW1 is configured as the VTP server with domain 'CORP' and version 2. SW2 is a new switch with a higher VTP revision number and the same domain and password, but it has an empty VLAN database. The engineer connects SW2 to SW1 via a trunk link. What will happen to the VLAN database on SW1?

A network engineer is deploying a Cisco Nexus 9000 leaf switch in a VXLAN EVPN fabric. The underlay uses OSPF for loopback reachability, and the engineer must now enable the control plane that carries MAC and IP address reachability information for the overlay. Which technology must be enabled on the leaf switch to distribute this overlay reachability information?

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 192.168.1.0 BGP routing table entry for 192.168.1.0/24, version 10 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.0.0.2 from 10.0.1.2 (10.0.0.2) Origin IGP, metric 0, localpref 100, valid, internal rx pathid: 0, tx pathid: 0x0 Local, (received & used) 10.0.0.3 from 10.0.1.3 (10.0.0.3) Origin IGP, metric 0, localpref 200, valid, internal, best rx pathid: 0, tx pathid: 0x0 Based on this output, what can be concluded?

A network administrator is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF) for a customer. The administrator wants to ensure that traffic from the customer's VRF can reach the internet through a global routing table. Which feature should be configured to allow communication between the VRF and the global routing table?

Consider the following configuration on a Cisco IOS-XE router: ip multicast-routing ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip pim sparse-mode ip igmp static-group 239.1.1.1 ! What is the effect of the 'ip igmp static-group 239.1.1.1' command?

Which three statements about Multiple Spanning Tree Protocol (MSTP) are true? (Choose three.)

An engineer notices that syslog messages from a Cisco router are not timestamped correctly. The router is configured with 'service timestamps log datetime msec' and 'logging host 10.1.1.1'. The syslog server shows messages with the correct time but the local logs on the router show incorrect timestamps. What is the most likely cause?

Drag and drop each PIM message type on the left to its matching function on the right.

A network administrator is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. The fabric has two border nodes and four edge nodes. The administrator wants to ensure that traffic from a wired endpoint in VLAN 10 can reach a wireless endpoint in the same VLAN that is roaming between access points. Which component is responsible for mapping the endpoint's IP address to its location in the fabric?

A network engineer runs the following command on Switch SW1: SW1# show dtp interface gi0/1 DTP information on GigabitEthernet0/1: DTP: Enabled DTP mode: Desirable DTP negotiate: TRUE DTP status: Trunk DTP trunk status: Trunking DTP timer: 30 DTP max-age: 2 DTP encapsulation: 802.1q DTP refresh rate: Both DTP requests: 10 DTP errors: 0 Based on this output, what can be concluded?

Drag and drop the steps of RADIUS CoA (Change of Authorization) message flow into the correct order, from first to last.

A network administrator is configuring a VXLAN EVPN fabric. The administrator wants to optimize the forwarding of broadcast, unknown unicast, and multicast (BUM) traffic by using a multicast group per VLAN. Which VXLAN feature should be configured on the VTEPs to achieve this?

Drag and drop the steps of MPLS traffic engineering (MPLS-TE) tunnel setup into the correct order, from first to last.

A network engineer issues the following command on Router R7: R7# show ip pim tunnel Tunnel1: Type: PIM Encap Source: 10.0.0.7, Destination: 10.0.0.8 Status: up Based on this output, what can be concluded?

A network engineer runs the following command on Switch SW4: SW4# show spanning-tree vlan 40 VLAN0040 Spanning tree enabled protocol ieee Root ID Priority 24616 Address aabb.cc00.0600 Cost 8 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 40) Address aabb.cc00.0700 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Root FWD 8 128.1 P2p Gi0/2 Desg FWD 4 128.2 P2p Gi0/3 Desg FWD 4 128.3 P2p Based on this output, which port is the root port?

A network administrator is configuring a Cisco IOS router to protect the control plane from excessive CPU utilization caused by malicious traffic. The administrator wants to rate-limit specific types of traffic destined to the route processor while allowing all other traffic to pass without restriction. Which feature should be configured?

A network engineer is implementing Cisco SD-Access for a campus network. The fabric uses LISP for control plane and VXLAN for data plane. The engineer needs to ensure that endpoints in the same VLAN but on different fabric edge nodes can communicate. Which Cisco SD-Access component is responsible for mapping endpoint EIDs to RLOCs?

Which three statements about SSL VPNs are true? (Choose three.)

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The underlay network is OSPF, and the overlay uses BGP EVPN. The engineer notices that VM traffic between two hosts on different VTEPs is not being encapsulated. Which action should be taken to ensure VXLAN traffic is properly encapsulated and forwarded?

Given the following configuration snippet on a Cisco 9800 WLC: wireless profile policy test-policy no security ft aaa-override no mac-filtering no wlan-switch central-switching What is the effect of this configuration?

Drag and drop each QoS model on the left to its matching characteristic on the right.

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Drag and drop the steps of DNA Center template deployment to a device into the correct order, from first to last.

A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS. The engineer uses 'snmp-server community public RO' and 'snmp-server host 10.1.1.1 version 2c public'. The NMS receives traps, but the engineer notices that the traps contain the IP address of the management interface (VLAN 1) instead of the loopback interface (Loopback0) that is used for management. The engineer wants the traps to use the loopback IP as the source. What should the engineer do?

A network engineer runs the following command on Switch SW8: SW8# show etherchannel 2 detail | include "Port state|Port: Gi|Partner" Port: Gi0/0 Port state = Up, In-Bundle Port: Gi0/1 Port state = Up, In-Bundle Port: Gi0/2 Port state = Down, Not-In-Bundle Partner information: Gi0/0: Partner state = bndl Gi0/1: Partner state = bndl Gi0/2: Partner state = down Based on this output, what can be concluded?

Drag and drop each 802.11 standard on the left to its matching frequency band and maximum data rate on the right.

Which TWO statements about NETCONF and YANG are true?

An engineer is automating the configuration of SNMPv3 on a large number of Cisco IOS-XE devices using Ansible. The playbook uses the ios_snmp_server module. The engineer wants to ensure that the SNMP configuration is applied only if the device is running a specific IOS version that supports SNMPv3. Which Ansible feature should the engineer use to conditionally execute the task?

Given the following configuration on a Cisco IOS switch: interface GigabitEthernet0/4 switchport mode trunk switchport trunk allowed vlan except 100-200 What is the effect of this configuration?

What is the purpose of the 'ip nat inside source list' command in Cisco IOS?

Drag and drop the steps of Docker container networking with bridge mode into the correct order, from first to last.

Drag and drop the steps of FlexVPN IKEv2 spoke registration to hub into the correct order, from first to last.

Which three statements about Ansible playbooks and roles are true? (Choose three.)

A network team is designing an SD-Access fabric for a large enterprise. The design must support automated provisioning and policy management. Which management platform is essential for deploying and managing the fabric?

A company is deploying a multi-tenant data center using VMware vSphere. The architect must ensure that each tenant’s virtual machines (VMs) are isolated at Layer 2 while sharing the same physical NICs. Which design approach best meets this requirement?

A network engineer runs the following command on Switch SW1: SW1# show etherchannel summary Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/0(P) Gi0/1(P) Gi0/2(s) Gi0/3(D) Based on this output, what can be concluded?

Drag and drop each MQC command on the left to its configuration level on the right.

A service provider is migrating from a traditional IP core to an MPLS core. The engineer has configured LDP on all core routers and verified that LDP sessions are established. However, some prefixes learned via OSPF are not being assigned labels. The 'show mpls ldp bindings' command shows missing bindings for certain routes. What is the most likely cause?

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.10.10.0 BGP routing table entry for 10.10.10.0/24, version 20 Paths: (2 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 65050 65100 10.0.1.2 from 10.0.1.2 (10.0.0.2) Origin IGP, metric 0, localpref 100, weight 0, valid, external, best rx pathid: 0, tx pathid: 0x0 65050 65100 65200 10.0.1.3 from 10.0.1.3 (10.0.0.3) Origin IGP, metric 0, localpref 100, weight 0, valid, external rx pathid: 0, tx pathid: 0x0 Based on this output, what can be concluded?

Which three statements about gRPC and gNMI in the context of model-driven telemetry are true? (Choose three.)

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. The engineer needs to ensure that the data plane is secure and that tunnels are established between WAN edge devices. Which component is responsible for orchestrating the control plane and distributing policies to WAN edge devices?

Which three statements about telemetry protocols and data collection are true? (Choose three.)

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The design requires that the virtual IP address be the same as one of the physical interface addresses, and that the standby group use a virtual MAC address of 0000.0c07.acXX. Which protocol meets these requirements?

Drag and drop the steps of Ansible inventory grouping and variable inheritance into the correct order, from first to last.

An engineer is troubleshooting a network where OSPF neighbors are stuck in the EXSTART state. What is the most likely cause?

A network architect is designing a Cisco SD-Access fabric for a large enterprise. The fabric will use VXLAN encapsulation and a Layer 3 underlay. The architect must ensure that the fabric supports the separation of policy from topology and allows endpoints to be assigned to virtual networks. Which Cisco SD-Access component is responsible for maintaining the mapping between endpoint IP addresses and their fabric locators, and for providing the control plane that enables fabric edge nodes to resolve endpoint locations?

A network team is designing QoS for a Cisco SD-WAN fabric connecting multiple branch offices to a central data center. The design must ensure that VoIP traffic from branch sites receives priority treatment across the WAN overlay, regardless of the underlying transport (MPLS, Internet, LTE). Which architectural component should the team configure to enforce consistent QoS policies across all WAN edges?

A network engineer runs the following command on Switch SW1: SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 10 Sales active Gi0/4, Gi0/5 20 Engineering active Gi0/6, Gi0/7 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Based on this output, what can be concluded?

A network engineer is implementing Cisco SD-Access and needs to ensure that endpoints in a virtual network can communicate with a shared service that resides in a different virtual network. The shared service must be reachable from multiple virtual networks without duplicating the service. Which SD-Access component should be configured to provide this inter-VN communication?

A network engineer writes an Ansible playbook to configure a VLAN on a Cisco Nexus switch: ```yaml --- - name: Configure VLAN hosts: nxos_switches gather_facts: no tasks: - name: Create VLAN 100 cisco.nxos.nxos_vlan: vlan_id: 100 name: test_vlan state: present ``` What is a potential issue with this playbook?

Examine the following EIGRP configuration on a Cisco IOS-XE device: router eigrp 100 network 10.0.0.0 0.255.255.255 passive-interface default no passive-interface GigabitEthernet0/0 ! interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ! interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.0 Which statement is true?

A network engineer is designing a network that uses Cisco SD-Access with a fabric that includes a border node and control plane node. The engineer must ensure that traffic from external networks can reach endpoints within the fabric. Which function does the border node provide in this architecture?

A network engineer is learning about data models used in network automation. The engineer needs to choose a data modeling language that is human-readable, supports hierarchical data structures, and is used by NETCONF and RESTCONF to define the structure of configuration and state data. Which data modeling language should the engineer choose?

Drag and drop the steps of LISP EID-to-RLOC mapping resolution process into the correct order, from first to last.

What is the default STP port cost for a 10 Gigabit Ethernet interface?

Which TWO statements about virtual switching in a hypervisor environment are correct?

A network engineer runs the following command on Router R1: R1# show ip route vrf CUSTOMER-A VRF CUSTOMER-A: Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 10.0.1.1 to network 0.0.0.0 10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.100 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.100 B 10.0.2.0/24 [200/0] via 192.168.1.2, 00:12:34 Based on this output, what can be concluded?

Which IPsec protocol provides both encryption and authentication within a single ESP header?

A network engineer is configuring Cisco ACI to extend a Layer 2 bridge domain to an external Layer 2 network. The engineer must ensure that the ACI fabric can forward traffic between the bridge domain and the external network without routing. Which ACI construct should be configured to achieve this?

Given the following SD-WAN CLI output on a Cisco IOS-XE router: show sdwan omp routes 10.1.1.0/24, received, admin-distance: 250 via 10.0.0.1, interface GigabitEthernet0/0/1, color biz-internet, loss: 0, latency: 10 via 10.0.0.2, interface GigabitEthernet0/0/2, color 3g, loss: 1, latency: 50 Which statement is true?

Drag and drop the steps of a VM live migration process in vSphere into the correct order, from first to last.

An engineer configures IP SLA 30 to monitor the one-way delay to a remote site using UDP jitter. The operation is used to adjust routing metrics via route maps. The engineer notices that the IP SLA operation shows 'State: Active' but the one-way delay values are inconsistent, sometimes showing negative values. What is the most likely cause?

Which two statements about 802.1X port-based authentication on a Cisco switch are true? (Choose two.)

Consider the following partial configuration on Router R1: ip sla 5 icmp-echo 10.5.5.5 frequency 10 ip sla schedule 5 life forever start-time now ip sla reaction-configuration 5 react rtt threshold-type immediate threshold-value 200 action-type triggerAndReset What is the effect of the 'action-type triggerAndReset' parameter?

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN using IPsec. The engineer wants to ensure that the VPN tunnel only carries traffic for the subnet 10.1.1.0/24 to 10.2.2.0/24. Which configuration element is required to define the interesting traffic?

An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?

Drag and drop each Netmiko device type on the left to its matching operating system on the right.

Router R1 has the following OSPF configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip ospf 1 area 0 ip ospf network point-to-point ! router ospf 1 router-id 1.1.1.1 network 10.0.0.0 0.255.255.255 area 0 What is the effect of the 'ip ospf network point-to-point' command on this interface?

Examine the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet1/0/6 switchport mode access authentication port-control auto dot1x pae authenticator dot1x timeout tx-period 3 dot1x max-req 3 dot1x timeout supp-timeout 10 What is the total time the switch will wait for a supplicant to respond before failing authentication?

Drag and drop the steps of network documentation and change management workflow into the correct order, from first to last.

Drag and drop the steps of Cisco IBNS 2.0 policy configuration into the correct order, from first to last.

A network engineer is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. The fabric uses LISP for control plane and VXLAN for data plane. Which component is responsible for mapping endpoint IP addresses to fabric edge nodes?

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch uplink between two buildings to protect Layer 2 traffic. The team wants to ensure that the link encrypts traffic and that the peer is authenticated before secure communication begins. Which configuration approach meets these requirements?

interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 ip ospf network point-to-multipoint ip ospf hello-interval 30 ! router ospf 1 network 10.0.0.0 0.0.0.3 area 0 What is the effect of this configuration?

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast neighbors 10.0.1.2 advertised-routes Network Next Hop Metric LocPrf Weight Path *> 172.16.0.0/16 10.0.1.1 0 100 0 i *> 172.16.1.0/24 10.0.1.1 0 100 0 i Total number of prefixes 2 Based on this output, what can be concluded?

Drag and drop the steps of EIGRP redistribution from OSPF with metric seeding into the correct order, from first to last.

Drag and drop the steps of IPv6 ACL configuration and application into the correct order, from first to last.

What is the default SNMP trap port number?

A network engineer is implementing VXLAN with an Ethernet VPN (EVPN) control plane in a data center. The underlay is a Layer 3 IP network. The engineer wants to ensure that the VXLAN tunnel endpoints (VTEPs) can discover each other and that the fabric supports multihoming with all-active forwarding. Which technology should be used?

A large enterprise is redesigning its campus network to support 5000 users across three buildings. The design must provide high availability and fast convergence in case of a link failure. The network engineer is considering using Spanning Tree Protocol (STP) in the access layer. What is the primary design concern with using STP in this scenario?

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent for a remote subnet 10.10.10.0/24. The DHCP server is located at 172.16.1.100. The engineer issues the command 'ip helper-address 172.16.1.100' on interface GigabitEthernet0/0, which is the gateway for that subnet. However, clients on the subnet are not receiving IP addresses. What is the most likely cause?

A network engineer runs the following command on Router R4: R4# show mpls ldp neighbor vrf CUSTOMER-C Peer LDP Ident: 10.0.0.5:0; Local LDP Ident 10.0.0.4:0 TCP connection: 10.0.0.5.646 - 10.0.0.4.646 State: Oper; Msgs sent/rcvd: 500/500; Downstream Up time: 02:30:00 LDP discovery sources: GigabitEthernet0/0.300, Src IP addr: 10.0.1.2 hello sent/rcvd: 1000/1000 Addresses bound to peer LDP Ident: 10.0.1.2 10.0.2.2 Based on this output, what can be concluded?

Which two statements about Type 1 and Type 2 hypervisors are true? (Choose two.)

Which two statements about SPAN and RSPAN limitations are true? (Choose two.)

A network engineer is designing a QoS policy for a WAN edge router. The router must prioritize voice traffic with a strict priority queue and ensure that call signaling traffic is not starved. Which queuing mechanism should the engineer configure to meet these requirements?

A network engineer executes the following command on Router R8: R8# show ip sla monitor summary IP SLAs Monitor Summary Codes: * active, ^ inactive, ~ pending ID Type Destination Stats Return Code Last *1 icmp-echo 192.168.8.10 Success OK 1 ^2 udp-jitter 192.168.8.20 Success OK 2 *3 icmp-echo 192.168.8.30 Success OK 3 Based on this output, which IP SLA operations are currently active?

Which two statements about the Cisco SD-Access fabric roles are true? (Choose two.)

A network engineer is configuring IPsec VPN on a Cisco IOS router. The requirement is to encrypt traffic between two sites using IKEv2. The engineer wants to ensure that the IKEv2 proposal uses AES-256 for encryption, SHA-256 for integrity, and Diffie-Hellman group 14. Which command correctly defines the IKEv2 proposal with these parameters?

A service provider is deploying NFV to offer managed SD-WAN services to enterprise customers. The architect must place virtual network functions (VNFs) such as vEdge routers and firewalls in the provider's data center. Which VNF placement model allows the provider to chain these functions efficiently and scale per customer?

Drag and drop the steps of configuring AAA on a Cisco IOS device into the correct order, from first to last.

A network engineer runs the following command on Switch SW3: SW3# show spanning-tree vlan 30 VLAN0030 Spanning tree enabled protocol ieee Root ID Priority 24606 Address aabb.cc00.0400 Cost 12 Port 2 (GigabitEthernet0/2) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32798 (priority 32768 sys-id-ext 30) Address aabb.cc00.0500 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Desg FWD 4 128.1 P2p Gi0/2 Root FWD 12 128.2 P2p Gi0/3 Desg FWD 4 128.3 P2p Based on this output, what is the root path cost from SW3 to the root bridge for VLAN 30?

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The requirement is to provide sub-second failover for IPv4 hosts and to load-balance traffic between the two switches for different VLANs. Which protocol should be used to meet these requirements?

A network engineer needs to verify the performance of a WAN link between two Cisco routers. The engineer configures an IP SLA operation on Router A that sends ICMP echo requests to Router B every 60 seconds and stores the results. After a week, the engineer checks the results and finds that the operation has been running successfully, but no history data is available. What is the most likely reason for the lack of history data?

A network architect is designing a Python script that will retrieve interface statistics from a Cisco IOS XE device using the RESTCONF API. The script must authenticate with a username and password, and all communication must be encrypted. The device is configured with the 'restconf' and 'ip http secure-server' commands. Which HTTP method and authentication mechanism should the script use to retrieve the data?

Drag and drop each MPLS label field on the left to its matching bit size on the right.

A network engineer runs the following command on Router R7: R7# show mpls ldp capabilities LDP Capabilities: Dynamic Capability: advertised Typed Wildcard FEC: advertised MTU Signaling: advertised P2MP: not advertised MPLS OAM: advertised LDP Graceful Restart: advertised Helper mode: enabled Restart mode: enabled Reconnect time: 120 sec Recovery time: 180 sec Based on this output, which capability is NOT supported by this router?

A network engineer is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The engineer wants to view detailed hop-by-hop performance metrics for the path between the user's endpoint and the voice gateway over the last 24 hours. Which Assurance feature should the engineer use?

A network engineer is configuring a Cisco IOS router to authenticate management users against a RADIUS server. The engineer wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication using the local username database. Which configuration should be applied?

Drag and drop the steps of configuring a site-to-site IPsec VPN on Cisco IOS into the correct order, from first to last.

Drag and drop each Python library on the left to its matching network use case on the right.

A network engineer is using the YANG Suite tool to explore YANG models supported by a Cisco IOS XE device. The engineer wants to retrieve the list of available YANG modules from the device using NETCONF. Which NETCONF operation should be used to obtain this information?

Given the following partial configuration on a Cisco IOS-XE router: ip pim rp-address 10.0.0.1 10 access-list 10 permit 224.0.0.0 0.255.255.255 ! interface GigabitEthernet0/0 ip pim sparse-mode ! What is the effect of this configuration?

A network architect is designing a controller-based wireless deployment for a large campus. The customer wants centralized management, policy enforcement, and the ability to deploy a single wireless LAN controller that can handle up to 6,000 access points. Which Cisco platform should the architect recommend?

An engineer is configuring a VXLAN EVPN fabric on Cisco Nexus 9000 switches. VLAN 100 on leaf-1 must be mapped to VNI 10100, and the same Layer 2 segment must extend to leaf-2. The engineer creates VLAN 100 and enters the NVE interface configuration. Which configuration on leaf-1 correctly maps VLAN 100 to VNI 10100 so that the Layer 2 segment can be extended over the VXLAN overlay?

Which two statements about SNMPv3 security features are true? (Choose two.)

Which two statements about policing and shaping in a QoS architecture are true? (Choose two.)

An architect is designing an SD-Access fabric for a large campus network. The design must support wireless clients that roam across different access switches without requiring a centralized wireless LAN controller. Which fabric component and protocol combination should the architect use to enable this mobility?

Review the following OSPF configuration: router ospf 1 network 192.168.1.0 0.0.0.255 area 0 network 10.0.0.0 0.255.255.255 area 1 default-information originate always metric 20 metric-type 1 ! What is the effect of the 'default-information originate always metric 20 metric-type 1' command?

What is the default value of the BGP 'weight' attribute for routes learned from a neighbor?

Which two statements about SD-WAN architecture are true? (Choose two.)

What is the default syslog severity level for console logging on a Cisco IOS device?

Which three statements about RPF check in IP multicast are true? (Choose three.)

A security architect is designing segmentation for a data center using Cisco TrustSec. The requirement is that classification of traffic into Security Group Tags (SGTs) occur at the access layer based on the identity of the user or device, and that enforcement occur at the data center core where the SGT-to-SGACL matrix is applied. Which statement describes the correct deployment approach?

Drag and drop the steps of OpenAPI schema validation for DNA Center REST call into the correct order, from first to last.

Drag and drop the steps of 4G/LTE WAN failover with IP SLA tracking into the correct order, from first to last.

Examine the following EIGRP configuration snippet: interface GigabitEthernet0/0 ip bandwidth-percent eigrp 100 50 What is the effect of this command?

Which two statements about NFV architecture and components are true? (Choose two.)

A network engineer is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The engineer notices that the client's health score is low due to onboarding failures. Which component of Cisco DNA Center Assurance should be examined first to identify the root cause?

A network engineer is implementing a REST API script to retrieve interface statistics from a Cisco IOS XE device. The engineer wants to use the most efficient method that supports HTTP/2 and streaming telemetry. Which API should be used?

What is the default OSPF hello interval on an Ethernet link in a Cisco router?

Drag and drop the steps of gNMI Subscribe RPC using Python gRPC library into the correct order, from first to last.

A network engineer is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5 cryptographic authentication on an interface. The engineer enters the following commands: interface GigabitEthernet0/0, ip ospf authentication message-digest, ip ospf message-digest-key 1 md5 Cisco123. However, the OSPF adjacency with the neighbor router is not forming. Which additional configuration is required on the neighbor router to establish the adjacency?

A network security team is deploying MACsec on Cisco Catalyst switches to protect Layer 2 traffic between two distribution switches. They want to ensure that the link is encrypted and that only authorized devices can participate in the secured session. Which two statements about MACsec operation on Cisco platforms are correct? (Choose two.)

A network administrator is configuring a Cisco IOS router to authenticate management users against a centralized TACACS+ server. The administrator wants to ensure that if the TACACS+ server is unreachable, a locally configured user can still log in. Which command should be used to define the authentication method list for login?

A network engineer is implementing VXLAN in a data center to support a large number of tenants. The engineer must ensure that the VXLAN overlay supports Layer 2 connectivity over a Layer 3 underlay. Which two statements are true about VXLAN? (Choose two.)

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

A network engineer is configuring a VXLAN EVPN fabric on Cisco Nexus switches. The fabric must support Layer 2 extension across multiple leaf switches while maintaining optimal forwarding for Layer 3 traffic. Which control plane component is responsible for advertising MAC and IP address bindings to all leaf switches?

A network engineer uses the Requests library to query a Cisco IOS-XE device via RESTCONF for interface statistics: ```python import requests from requests.auth import HTTPBasicAuth url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface=GigabitEthernet1/0/1/statistics' headers = {'Accept': 'application/yang-data+json'} auth = HTTPBasicAuth('admin', 'cisco123') response = requests.get(url, headers=headers, auth=auth, verify=False) print(response.json()) ``` What is the most likely issue with this code?

Which two statements about YANG data models in model-driven telemetry are true? (Choose two.)

A network engineer is implementing QoS on a Cisco IOS router. The engineer wants to ensure that VoIP traffic is prioritized and that excess VoIP traffic is dropped when the interface is congested. Which QoS mechanism should be used?

A network automation engineer is developing a Python script using the ncclient library to configure a Cisco IOS XE device via NETCONF. The engineer wants to lock the running datastore, apply a candidate configuration, validate it, and then commit it. Which sequence of ncclient operations correctly performs this workflow?

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Which two statements about OSPF network types are true? (Choose two.)

Drag and drop the steps of Cisco DHCP snooping binding table population into the correct order, from first to last.

A network engineer is deploying a new branch office with a single Cisco Catalyst 9300 switch. The branch has three VLANs: VLAN 10 (users), VLAN 20 (voice), and VLAN 30 (management). The engineer needs to route traffic between these VLANs directly on the switch without using an external router. Which feature should be configured on the switch to enable inter-VLAN routing?

A network security engineer is configuring Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The engineer wants to rate-limit SSH traffic to 100 kbps with a burst of 8000 bytes, and ensure that any traffic exceeding the rate is dropped. The engineer applies the following policy: policy-map COPP-POLICY class SSH-CLASS police 100000 8000 exceed-action drop After applying the service-policy to the control plane, the engineer notices that SSH sessions intermittently disconnect during large file transfers over SCP. What is the most likely cause?

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN tunnel endpoint. The engineer needs to define the source IP address used for the VXLAN tunnels and ensure the switch can replicate broadcast, unknown unicast, and multicast traffic. Which configuration element must be created to source the tunnels?

A network engineer runs the following command on Router R7: R7# show crypto ikev2 sa detail IKEv2 SAs: Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1 Tunnel-id Local Remote Status Role 1 10.1.1.1/4500 10.2.2.2/4500 READY INITIATOR Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/3600 sec Child SA: Local selector 10.1.1.0/0 - 10.1.1.255/65535 Remote selector 10.2.2.0/0 - 10.2.2.255/65535 ESP spi in/out: 0x12345678/0x87654321 Based on this output, what can be concluded?

A network architect is designing a controller-based wireless deployment for a large campus. The requirement is to provide seamless roaming for voice clients across Layer 3 boundaries while keeping the client IP address unchanged. Which Cisco SD-Access fabric feature should be used to meet this requirement?

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) for a new office building. The company requires that guest users be isolated from internal users and that guest traffic be tunneled directly to the DMZ. Which feature should the administrator configure on the WLC?

A network administrator is designing a campus network that must support a single management IP address for a pair of Catalyst 9000 switches acting as a collapsed core. The design requires that both switches actively forward traffic, that the control plane operate as one logical device, and that a single configuration file be maintained. Which technology meets these requirements?

Drag and drop the steps of SNMP trap generation and forwarding into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show bgp summary BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 14, main routing table version 14 4 network entries using 1152 bytes of memory 4 path entries using 320 bytes of memory 2/1 BGP path/bestpath attribute entries using 560 bytes of memory 0 BGP route reflector client to client reflections 2 BGP community entries using 80 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.0.1.2 4 65002 2345 2346 14 0 0 00:12:34 3 10.0.1.3 4 65003 1234 1235 14 0 0 00:08:21 2 10.0.1.4 4 65004 567 568 14 0 0 00:05:45 0 Based on this output, what can be concluded?

A network engineer is designing an OSPF network with multiple areas. The engineer wants to ensure that routers in area 2 can reach networks in area 0, but they should not learn any external routes from other ASs. Which OSPF area type should be configured for area 2?

A network architect is designing a Cisco SD-Access fabric for a hospital campus. The hospital requires that guest wireless users be allowed access only to the internet, while clinical staff devices must reach internal EHR servers. The fabric uses Cisco DNA Center and Cisco Identity Services Engine for policy. Which fabric component enforces the group-based policy between these user groups?

A network engineer checks AAA accounting on a router: R1# show aaa accounting Accounting method list 'default': Type: exec Start-stop: group radius Accounting records: Total started: 10 Total stopped: 8 Total failed: 2 Last record: user 'admin', start time 00:01:00 UTC Mar 1 2023 Based on this output, what can be concluded?

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 ebgp-multihop 2 neighbor 10.0.0.2 update-source Loopback0 ! What is the purpose of the ebgp-multihop 2 command?

A network engineer is configuring a Cisco Catalyst switch to participate in a StackWise Virtual domain. The engineer needs to ensure that the two switches form a single logical entity and that the control plane is synchronized. Which statement correctly describes a requirement for StackWise Virtual operation?

A network engineer is configuring OSPF on a router that has multiple interfaces in the same area. The engineer wants to ensure that the router does not become the designated router (DR) on any of these interfaces. What should the engineer do?

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator needs to ensure that the VPN traffic is encrypted and authenticated. Which two protocols are used in IPsec to provide encryption and authentication? (Choose two.)

Drag and drop each OSPF LSA type on the left to its matching description on the right.

A network automation team is using NETCONF to configure a Cisco IOS XE device. They send an <edit-config> RPC with the default-operation set to 'merge'. The target configuration already has an interface GigabitEthernet0/1 with an IP address of 10.1.1.1/24. The RPC payload includes a new IP address of 10.1.1.2/24 for the same interface. What will be the result on the device?

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The router must use the TACACS+ server at 10.1.1.100 with the shared secret 'Cisco123'. The administrator wants to ensure that if the TACACS+ server is unreachable, authentication falls back to the local database. Which configuration is required?

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an unauthorized device connects to an access port, the port must immediately stop forwarding traffic, generate a syslog message, and increment the violation counter, while allowing the administrator to manually re-enable the port after investigation. Which port security violation mode should be configured?

Drag and drop the steps of QoS pre-classify for encrypted VPN traffic into the correct order, from first to last.

Drag and drop each Control plane protection feature on the left to its matching threat on the right.

Refer to the exhibit. R1 has two equal-cost OSPF E2 routes to 10.1.1.0/24 via two different next hops. However, when tracing to 10.1.1.1, all traffic uses the path through 10.0.1.2. What is the most likely reason?

A network engineer is using the Cisco Catalyst Center (formerly DNA Center) Intent API to retrieve a list of all network devices. The engineer sends a GET request to /dna/intent/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token from /dna/system/api/v1/auth/token. What is the most likely reason for the 401 error?

A network engineer runs the following debug on a router: R1# debug aaa authentication *Mar 1 00:01:23.456: AAA/BIND(00000001): Bind iplist *Mar 1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pick method list 'default' *Mar 1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Method=RADIUS *Mar 1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): RADIUS server 10.1.1.10:1812, timeout 5, retransmit 2 *Mar 1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Sent username 'admin', password **** *Mar 1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Received PASS response *Mar 1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pass Based on this output, what can be concluded?

Which two statements about IP SLA with object tracking are true? (Choose two.)

A network administrator runs the following debug on a router: R1# debug aaa authorization *Mar 1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Processing author request for user 'jdoe' *Mar 1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Method=TACACS+ *Mar 1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): TACACS+ server 10.1.1.10:49, timeout 5 *Mar 1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Sent author request *Mar 1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Received PASS response *Mar 1 00:02:45.678: AAA/AUTHOR/EXEC(00000002): Pass Based on this output, what can be concluded?

A network automation team is using the ncclient Python library to configure a Cisco IOS XE router via NETCONF. The engineer wants to ensure the configuration changes are applied atomically and that the device automatically rolls back if any part of the change fails. Which NETCONF capability must the engineer verify is advertised by the device before relying on this behavior?

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

A network administrator is deploying a Cisco IOS-XE router as the WAN edge. The security policy requires that the router itself be protected against brute-force SSH attacks originating from the untrusted internet, without affecting transit traffic forwarded through the router. The administrator wants to use a feature that automatically blocks the offending source IP after repeated failed login attempts. Which Cisco IOS-XE feature should be configured?

An engineer is deploying Cisco SD-Access and wants to separate the roles of the underlay and the fabric overlay. The design must provide a Layer 3 routed underlay using IS-IS, and the fabric edge nodes must register endpoint information with a fabric control-plane node. Which node type in Cisco SD-Access is responsible for mapping endpoint identity to location and answering EID-to-RLOC queries from fabric edge nodes?

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular access point is reporting a high number of client association failures. Which Cisco DNA Center Assurance feature should be used to correlate these failures with client device types and identify the root cause?

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide Layer 3 isolation between different departments while allowing them to share the same physical network. Which Cisco SD-Access component is responsible for providing this isolation?

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Which THREE of the following are benefits of implementing a spine-leaf architecture in a data center?

Drag and drop the steps of SD-Access fabric endpoint registration into the correct order, from first to last.

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.0.0.0/8 BGP routing table entry for 10.0.0.0/8, version 25 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch 1 65050 65100 10.0.1.2 from 10.0.1.2 (10.0.0.2) Origin IGP, metric 0, localpref 100, weight 0, valid, external rx pathid: 0, tx pathid: 0x0 65050 10.0.1.3 from 10.0.1.3 (10.0.0.3) Origin IGP, metric 0, localpref 100, weight 0, valid, external, best rx pathid: 0, tx pathid: 0x0 Based on this output, what can be concluded?

A network administrator is configuring a new VLAN 100 on a switch and wants to ensure that the VLAN is created and active. Which command is required to create a VLAN in the VLAN database?

A network engineer runs the following command on a Cisco WLC: WLC# show wlan summary WLAN ID SSID Status Security Interface 1 Guest Enabled Open guest-vlan 2 Corporate Enabled WPA2 corp-vlan 3 IoT Disabled WPA2 iot-vlan 4 Management Enabled WPA2 mgmt-vlan Based on this output, what can be concluded?

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 150 10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches) 20 deny tcp any any eq 23 (8 matches) 30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches) 40 deny tcp any any eq 22 (1 match) 50 permit ip any any (15 matches) Based on this output, what can be concluded?

In OSPF, which LSA type is used to describe routes to networks within the same area and is generated by the router that owns the network?

Review the following IP SLA configuration on Router R1: ip sla 3 icmp-echo 10.3.3.3 frequency 30 ip sla schedule 3 life forever start-time now ip sla reaction-configuration 3 react rtt threshold-type xof 5 threshold-value 100 action-type triggerAndReset What is the purpose of the 'threshold-type xof 5' parameter?

Drag and drop each broadband type on the left to its matching technology on the right.

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

Given the following EIGRP configuration on a router: router eigrp 200 network 192.168.1.0 0.0.0.255 network 10.0.0.0 Which statement about this configuration is true?

A network engineer configures IP SLA 20 to monitor the response time of a DNS server at 10.1.1.1 using DNS query for 'example.com'. The operation is used to influence routing decisions. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 50 ms', but the DNS server is actually down and not responding to any queries. What is the most likely reason?

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Drag and drop the steps of Private VLAN (PVLAN) configuration steps into the correct order, from first to last.

A network architect is comparing Cisco StackWise Virtual and traditional StackWise for a new data center access layer. The requirement is that the two switches operate as one logical device while remaining physically separate, with each switch having its own control plane processes that are synchronized, and that the pair support Multichassis EtherChannel to downstream servers. Which statement correctly describes Cisco StackWise Virtual in this scenario?

A network engineer is analyzing Cisco DNA Center Assurance data to troubleshoot a wireless client's poor performance. The engineer observes that the client's health score is low due to high retry rates and low SNR. Which TWO Assurance metrics should the engineer examine to further diagnose the issue? (Choose two.)

Drag and drop the steps of STP portfast and BPDU guard configuration into the correct order, from first to last.

A network administrator is analyzing traffic flows using Cisco DNA Center Assurance. The administrator wants to see which applications are consuming the most bandwidth on a specific interface of a Catalyst 9500 switch. Which feature should be enabled on the switch to provide this level of granularity?