CCNA Infrastructure Questions

The 'mls qos trust dscp' command configures the interface to trust the DSCP value in incoming packets. This means the switch will use the existing DSCP marking for classification and queuing, rather than overwriting it. This is appropriate when the server is already marking its traffic with DSCP EF, as it preserves the marking and ensures proper treatment across the network.

By default, the stack retains the MAC address of the original active switch for a period defined by the stack MAC persistence timer (default 4 minutes). If the failover occurs and the timer has not expired, the new active switch continues using the same stack MAC address, minimizing disruption to neighboring devices and avoiding MAC address table changes.

EVPN acts as the control plane for VXLAN, using MP-BGP to advertise MAC and IP addresses (Type 2 and Type 5 routes) to other VTEPs. This allows each VTEP to build a forwarding table for remote hosts, eliminating the need for flooding to learn MAC addresses and enabling optimal forwarding across the Layer 3 underlay.

This sequence correctly enables OSPFv2 SHA-256 HMAC authentication. The interface command ip ospf authentication key-chain references a key chain, which must be defined globally with a key that specifies the cryptographic algorithm hmac-sha-256 and a password. This provides stronger security than MD5. The key chain allows for key rollover and multiple keys with different lifetimes, which is essential for operational flexibility.

This is correct because an SVI provides Layer 3 processing for a VLAN, and enabling IP routing on the stack allows inter-VLAN traffic to be routed internally. The stack acts as a single logical switch, so SVIs are active on the stack master and traffic between VLANs is routed without an external router.

The fabric border node is responsible for bridging the SD-Access fabric to external networks. It translates fabric VXLAN encapsulation to traditional networking protocols and vice versa, allowing endpoints inside the fabric to reach destinations outside. It also advertises fabric prefixes to external networks. This is the primary role of a border node in Cisco SD-Access.

In a VXLAN fabric, a distributed anycast gateway uses the same virtual IP and virtual MAC for the default gateway on every edge node that hosts the subnet. A roaming host sees no change in gateway identity, so ARP entries remain valid. This provides seamless mobility and optimal forwarding without tromboning traffic to a central gateway.

The command 'ipv6 ospf 1 area 0' is used in interface configuration mode to enable OSPFv3 on that interface and assign it to area 0. The process ID '1' must match the OSPFv3 process configured globally with 'ipv6 router ospf 1'. This command allows the interface to form adjacencies and participate in OSPFv3. Without it, OSPFv3 will not run on the interface, even if the global process is configured.

This configuration allows the switch port to carry data traffic for the PC in the access VLAN (untagged) and voice traffic for the phone in the voice VLAN (tagged with 802.1Q). The 'switchport voice vlan' command instructs the switch to use CDP to tell the phone which VLAN to use for voice. This is the standard and recommended method for connecting Cisco IP phones and PCs on the same port.

The ingress network device is responsible for classifying traffic and imposing the SGT. It receives the SGT value from ISE during authentication, then inserts the tag into the packet using inline tagging (Cisco Metadata or 802.1AE) or propagates the mapping via SXP to devices that do not support inline tagging. This is the enforcement point for tag imposition.

VXLAN encapsulates Layer 2 frames in UDP, and the IANA-assigned default destination port is 4789. Cisco platforms use this port by default when sending VXLAN-encapsulated traffic. If a firewall or ACL is in the path, it must permit UDP 4789 so that the tunnel traffic is not dropped. Changing the port is possible but uncommon and must match on all VTEPs.

A trunk port tags frames with 802.1Q VLAN identifiers, allowing multiple VLANs to traverse one physical link to the router. Access ports carry only a single untagged VLAN, so they cannot satisfy the multi-VLAN requirement.

The router uses the longest prefix match rule. The specific route 10.1.1.0/24 has a prefix length of 24, while the default route has a prefix length of 0. The more specific route wins, so the packet is forwarded using the static route for 10.1.1.0/24 via 192.168.1.1.

DHCP option 66 is used to specify the TFTP server name or IP address. In Cisco IOS, this is configured with the 'option 66 ip <ip-address>' command within the DHCP pool. This option is commonly used for IP phones and other devices that need to download configuration files from a TFTP server. Therefore, it is the correct choice to provide the TFTP server address.

This configuration sets the port as an access port for data VLAN 100 and enables voice VLAN 200 for tagged voice traffic from the IP phone. The phone will tag voice frames with VLAN 200, while the PC sends untagged frames that are placed in VLAN 100. This is the standard Cisco IP phone configuration.

OSPF DR/BDR election is based first on interface priority, then on Router ID. The highest priority wins. Priority 255 is the maximum value and ensures Router A has the highest priority on the segment, making it the DR provided no other router has the same priority with a higher Router ID. This is the standard way to force a router to become DR.

vSmart is the control plane controller that uses the Overlay Management Protocol (OMP) to distribute routing, policy, and security information to WAN edge devices. It maintains a centralized view of the overlay and ensures consistent policy enforcement. It does not handle device authentication; that is vBond's role. vSmart is essential for dynamic path selection and policy application across the SD-WAN fabric.

The VNI is a 24-bit identifier that segments the VXLAN overlay. Each VNI represents a Layer 2 or Layer 3 segment. It is used to identify the tenant or subnet. Without VNIs, there is no separation of traffic. In SD-Access, VNIs are mapped to VRFs and subnets. They are required to differentiate traffic in the overlay. Therefore, VNI is a required component.

The NVE interface must be configured with a source-interface (typically a loopback) and the VNI must be associated with the correct VLAN. Without this mapping, VXLAN encapsulation or decapsulation fails, preventing communication between hosts on different VTEPs. This is a common misconfiguration that directly causes the described symptom, making this the correct action to resolve the issue.

This configuration enables NAT overload (PAT) by translating all internal addresses matching the access list to the outside interface's IP address. The overload keyword allows multiple hosts to share the same public IP. Marking interfaces as inside and outside is essential for NAT to function correctly. This meets the requirements.

This configuration creates a standard ACL that permits the 10.10.10.0/24 subnet and applies it inbound to the VTY lines with access-class. This restricts SSH and Telnet access to only that subnet, meeting the requirement. The implicit deny at the end of the ACL blocks all other sources.

BSR is a standards-based mechanism for dynamic RP discovery. It uses candidate RPs and a Bootstrap Router to distribute RP information to all routers in the PIM domain. Routers receive BSR messages and automatically learn the RP mappings. This is a valid method for dynamic RP discovery, making BSR correct.

This access list defines the inside local addresses that are eligible for NAT translation. It permits the entire 192.168.1.0/24 subnet. The NAT command references this list to identify which traffic should be translated. Without this access list, the NAT configuration would not know which addresses to translate. Therefore, it is a required command.

The command 'interface vlan 1' is used to create or enter the configuration mode for the switched virtual interface (SVI) associated with VLAN 1. This allows the administrator to assign an IP address to the VLAN interface, enabling management access to the switch. This is the correct command to configure a management IP on VLAN 1.

Cisco StackWise uses a ring topology to connect stack members. This provides redundancy because if one stack cable fails, the ring can still forward traffic in the opposite direction. StackWise-480 and StackWise-1T are common on Catalyst 9000 switches, offering high bandwidth (480 Gbps or 1 Tbps) and efficient use of stack ports. A ring topology is the standard and most efficient for StackWise.

This configuration enables AAA, sets the default login authentication method list to use TACACS+ first and then local as fallback, defines the TACACS+ server, and creates a local username. This ensures that if the TACACS+ server is unreachable, the router will use the local database for authentication.

MP-BGP EVPN is the control plane that distributes MAC and IP reachability information, including VTEP IP addresses, between VXLAN tunnel endpoints. It allows dynamic discovery of remote VTEPs and their associated MAC addresses, eliminating the need for flood-and-learn. This is the standard Cisco SD-Access and data center VXLAN control plane.

PortFast allows a port to transition immediately to the forwarding state when the link comes up, bypassing listening and learning. BPDU Guard disables the port if it receives a BPDU, protecting against accidental loops if a switch is connected. Together, they meet the requirements for fast server connectivity and loop protection.

The VNI is a 24-bit identifier that uniquely identifies a VXLAN segment. It provides isolation for tenants by separating traffic into distinct logical networks. Each VNI maps to a specific Layer 2 or Layer 3 domain, ensuring that traffic from different tenants remains isolated even when using the same underlay.

The netconf-yang command enables NETCONF over SSH on port 830 and activates the Cisco IOS XE YANG data models. Using the candidate datastore allows a client to stage edits and then apply them with a commit, which provides atomic transaction semantics: either all changes apply or none do. This directly satisfies the standards-based model and atomic commit requirements described.

The 'show nve peers' command displays the state of VXLAN tunnel endpoints (VTEPs) and their peer relationships. It shows the IP address of each peer, the VNI, and the state (Up/Down). This directly verifies if VTEPs can communicate over the underlay, which is essential for VXLAN operation.

VTP client mode allows the switch to receive and synchronize VLAN information from VTP servers but prevents it from creating, modifying, or deleting VLANs. This exactly matches the requirement: the switch cannot make VLAN changes but will stay synchronized with the VTP server.

VXLAN uses MAC-in-UDP encapsulation, with the outer UDP destination port typically set to 4789 (IANA-assigned). The VTEP encapsulates the original Layer 2 frame, adds an outer IP header with the source and destination VTEP addresses, and forwards the packet based on the underlay routing table. This allows Layer 2 segments to be stretched over a Layer 3 underlay.

The default-router command inside the DHCP pool configuration specifies the default gateway address that clients receive. Since the router's interface on the subnet is 10.1.1.1, this command ensures clients are configured with that address as their gateway, which is essential for proper routing.

VXLAN encapsulates original Layer 2 Ethernet frames within UDP packets, typically using UDP port 4789. This allows Layer 2 segments to be extended over a Layer 3 underlay network. The encapsulation includes a VXLAN header with the VNI, and the outer IP header enables routing across the underlay. This is the core mechanism of VXLAN.

This configuration sets the port as an access port for data VLAN 10 and enables voice VLAN 200 for tagged voice traffic. The switchport voice vlan command instructs the switch to use 802.1Q tagging for voice frames while data frames remain untagged. This is the standard Cisco configuration for connecting an IP phone with a PC attached, meeting the requirements.

EVPN uses MP-BGP with the EVPN address family to distribute MAC and IP reachability information among VTEPs. This provides a control plane for VXLAN, enabling features like ARP suppression, optimal forwarding, and multi-homing. The BGP EVPN routes include MAC/IP advertisement routes, IMET routes for multicast, and Ethernet segment routes. This is a fundamental aspect of EVPN-based VXLAN.

On a VTEP, the mapping of VLANs to VNIs is configured in the VNI-to-VLAN mapping table. When a frame enters an access port on a VLAN, the VTEP looks up the corresponding VNI and encapsulates the frame with a VXLAN header containing that VNI. This mapping is essential for bridging VLANs across the VXLAN overlay. Thus, this component is responsible for the mapping.

CoS 5 combined with DSCP EF (Expedited Forwarding, DSCP 46) is the industry-standard marking for voice bearer traffic in a campus network. This dual marking ensures that voice frames are placed in the strict-priority queue at both Layer 2 and Layer 3, providing the low latency, low jitter, and minimal packet loss that real-time audio requires. The EF PHB (Per-Hop Behavior) is designed to guarantee a configured bandwidth and queue service, while CoS 5 aligns with the Cisco-recommended voice VLAN and switch port trust settings, making this the only correct answer.

In a StackWise stack, the standby switch is a hot-standby that continuously synchronizes its configuration and state with the active switch. If the active switch fails, the standby switch quickly becomes the new active switch, minimizing disruption. This is the correct description of the standby switch's role, ensuring high availability and rapid failover.

Setting the OSPF priority to 0 on an interface prevents that router from being elected as DR or BDR. The priority value is used in the DR election process; routers with priority 0 are ineligible. This is the correct method to ensure the router does not become DR or BDR while still participating in OSPF on that network.

A trunk port with 802.1Q encapsulation carries multiple VLANs over one physical link, tagging frames with the appropriate VLAN ID. Restricting allowed VLANs to 10, 20, and 30 matches the router's subinterfaces and prevents unnecessary broadcast flooding. This is the standard router-on-a-stick configuration and satisfies the multi-VLAN uplink requirement.

This sequence enters interface configuration mode, sets the port to access mode, and assigns it to VLAN 20. The 'switchport mode access' command forces the port to operate as an access port, and 'switchport access vlan 20' associates it with VLAN 20. This is the standard method to configure an access port on a Cisco switch.

The underlay is typically a Layer 3 routed network that uses a routing protocol to ensure loop-free paths. It does not rely on Spanning Tree Protocol, which is a Layer 2 loop prevention mechanism. This is a correct characteristic of the SD-Access underlay.

Within the DHCP pool configuration mode, the 'dns-server' command specifies the DNS server IP address that DHCP clients will receive. This is the correct command to provide DNS information to clients. It is configured under 'ip dhcp pool' and can list multiple DNS servers. This ensures clients can resolve domain names. The command is essential for proper network operation when DHCP is used for address assignment.

The 'bandwidth percent 30' command guarantees that the class AF31 receives at least 30% of the interface bandwidth during congestion. This is a CBWFQ configuration that provides a minimum bandwidth guarantee, ensuring that AF31 traffic is prioritized while allowing other classes to use the remaining bandwidth. It directly satisfies the requirement.

Using a loopback interface as the VTEP source ensures high availability because it remains up as long as any path to the underlay exists. Advertising the loopback IP into OSPF makes it reachable by remote VTEPs, enabling VXLAN tunnels to form. This is the recommended design for VXLAN in Cisco Nexus environments.

VXLAN encapsulates Layer 2 frames in UDP and uses a 24-bit VXLAN Network Identifier (VNID), which provides up to 16,777,216 unique segments. This scalability is a key advantage over VLANs, which are limited to 4094. The large VNID space supports multi-tenant data centers and large-scale segmentation in SD-Access.

HSRP requires all participants to be in the same Layer 2 broadcast domain because hello messages are multicast onto the local VLAN. The multicast destination is 224.0.0.2 (HSRPv1) or 224.0.0.102 (HSRPv2) with a TTL of 1; if the interfaces reside in different VLANs, the broadcast domains are isolated, so the hellos never reach the peer and no HSRP adjacency forms. The virtual IP must also belong to the same IP subnet as the real interface IPs, and that subnet maps to exactly one VLAN; different VLANs imply different subnets and break the redundant gateway function.

The 'ip dhcp excluded-address' command is used to specify a range of IP addresses that the DHCP server should not assign to clients. This is typically used for addresses that are statically assigned to servers, printers, or other network devices. It ensures that the DHCP server does not hand out these addresses, preventing conflicts.

This configuration sets the access VLAN to 60 for the PC and the voice VLAN to 50 for the phone. The phone will use VLAN 50 for voice traffic and pass untagged PC traffic to VLAN 60. This is the standard Cisco configuration for a phone with a PC attached.

The VTEP is responsible for encapsulating original Layer 2 frames into VXLAN UDP packets, adding a VXLAN header, and forwarding them across the IP underlay network. It also decapsulates received VXLAN packets, making it the core component for overlay connectivity.

The command 'switchport mode trunk' configures the interface to operate as a trunk, allowing it to carry traffic for multiple VLANs. This is necessary for connecting a WLC that needs to support multiple VLANs. It is the standard command to set a port to trunk mode on Cisco switches, enabling 802.1Q encapsulation.

In Cisco SD-Access, the fabric control plane node runs the LISP map-server and map-resolver functions, maintaining the endpoint identifier (EID) to routing locator (RLOC) mappings for all fabric endpoints. This provides host tracking, location, and a unified control plane for both wired and wireless clients. The control plane node is essential for scalable fabric operations and policy enforcement through group-based policies.

This access list defines the inside local addresses that will be translated. The wildcard mask 0.0.0.255 matches the entire 192.168.1.0/24 subnet. The access list is then referenced in the ip nat inside source list command to specify which traffic should be translated.

To mark traffic from a subnet, you must classify it with a class map, define the marking action in a policy map using 'set dscp af31', and attach the policy to the ingress interface with 'service-policy input'. This ensures packets are marked at ingress, and subsequent devices can trust the DSCP if configured to do so.

The command vrrp 1 priority 150 sets the VRRP priority to 150 for group 1 on the interface. A higher priority makes the router more likely to become the master. The default priority is 100, and the range is 1–254. Priority 150 is higher than default, so this router will become master if it is the highest priority in the group. This command is entered in interface configuration mode.

This is the correct command to map a VLAN to a VXLAN VNI on a Cisco Catalyst switch. Under 'vlan configuration 10', the 'vn-segment 10010' command associates VLAN 10 with VNI 10010. This enables the VTEP to encapsulate frames from VLAN 10 into VXLAN packets with VNI 10010, allowing Layer 2 extension across the IP network.

Setting the OSPF priority to 0 on an interface makes that router ineligible to become DR or BDR. This is the correct way to prevent a router from participating in the DR/BDR election. The router will still form adjacencies and exchange routing information, but it will remain a DROTHER. This setting is commonly used on routers that should not be DR/BDR, such as those with lower processing power or at the edge of the network.

LLQ combines CBWFQ with a strict priority queue. It allows VoIP traffic to be placed in a priority queue that is serviced before other queues, ensuring minimal delay and jitter. LLQ is the recommended mechanism for prioritizing real-time traffic like VoIP during congestion.

The BGP EVPN address family carries MAC and IP address reachability information in the form of EVPN routes, such as Type 2 and Type 5 routes. This allows VTEPs to learn about remote hosts and VTEPs, facilitating the creation of VXLAN tunnels and enabling efficient forwarding without flooding.

This configuration enters VLAN 10 SVI, assigns the physical IP 10.10.10.2, then enables VRRP group 10 with virtual IP 10.10.10.1 and priority 110. In VRRP, the highest priority becomes the master; 110 exceeds the default 100, making this switch the master. The syntax matches Cisco IOS VRRP commands exactly.

Fabric edge nodes are responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border. They act as VTEPs, mapping endpoint IP addresses to fabric locators and tunneling traffic across the underlay. This design provides policy enforcement and segmentation, ensuring that employee traffic destined for external networks is properly encapsulated and sent to the border for routing.

This sequence enters interface configuration mode, sets the port to access mode, and assigns VLAN 20. It is the correct and standard method to configure an access port on a Cisco Catalyst switch. The port will carry untagged traffic for VLAN 20, and any existing VLAN 1 assignment is overridden.

This configuration enables OSPF MD5 authentication on the interface and defines the key with ID 1 and password 'Cisco123'. The 'ip ospf authentication message-digest' command activates MD5 authentication for OSPF on that interface, and the 'ip ospf message-digest-key' command specifies the key. This is the correct method to configure MD5 authentication on a per-interface basis in Cisco IOS.

VXLAN encapsulates Layer 2 frames into UDP packets. The standard destination UDP port is 4789, as assigned by IANA. This encapsulation allows Layer 2 segments to be stretched over a Layer 3 network. The source port is dynamically chosen to provide entropy for ECMP hashing.

This command configures AAA authentication for login using TACACS+ first, then falls back to the local database if the TACACS+ server is unreachable. The 'local' keyword ensures that local authentication is attempted only if the TACACS+ servers do not respond, providing a failover mechanism for management access.

This configuration enables OSPF on the router, advertises the internal subnet, and sets all interfaces to passive by default. The 'no passive-interface GigabitEthernet0/0' command re-enables OSPF hello processing only on the internal interface, allowing adjacencies to form there while suppressing them on the DMZ and Internet interfaces. This matches the requirement exactly.

MP-BGP EVPN is a control plane protocol that allows VTEPs to exchange MAC address and IP address reachability information. It provides a scalable way to dynamically learn remote VTEP mappings, eliminating the need for flood-and-learn. In a VXLAN EVPN setup, MP-BGP EVPN is used to distribute MAC/IP bindings, enabling efficient and scalable overlay networks. This is the correct protocol for dynamic learning.

SLAAC allows hosts to automatically generate their own IPv6 addresses using the network prefix from Router Advertisement messages and their interface identifier (often derived from the MAC address via EUI-64). No DHCPv6 server is needed, satisfying the requirement. The router sends RA messages with the A flag set to 1, instructing hosts to use stateless autoconfiguration. This method is ideal for simple deployments where centralized address management is not required.

DHCP snooping builds a binding table of IP address, MAC address, VLAN, and interface by snooping DHCP conversations. Dynamic ARP inspection uses this table to validate ARP packets on untrusted ports. Enabling DHCP snooping on the access switches provides the required bindings automatically, minimizing manual configuration while allowing DAI to block ARP spoofing.

The command 'netconf-yang' enables the NETCONF subsystem on a Cisco IOS XE router. It starts the NETCONF server and allows the router to be managed via NETCONF over SSH. This command is essential for enabling programmatic access to the router's configuration and operational data using YANG models. Without this command, the router will not accept NETCONF sessions, even if SSH is configured.

This command configures the interface as a DHCP client, allowing it to dynamically request an IPv4 address, subnet mask, default gateway, and DNS servers from the ISP's DHCP server. It satisfies the requirement to obtain the WAN address dynamically without manual configuration, and is the standard Cisco IOS method for client-side DHCP on an interface.

Inaccessible Authentication Bypass (IAB) allows a port to grant access when the authentication server is unreachable. It can be configured to assign the port to a critical VLAN or apply a specific policy. This matches the requirement to allow devices to connect with limited access when ISE is down.

The authentication event server dead action authorize vlan 100 command instructs the switch to place the port into VLAN 100 if the RADIUS server is considered dead (unreachable). This provides a fallback for users when the authentication server cannot be contacted, allowing limited access as defined by the guest VLAN. This is the correct feature for the scenario.