Cisco Certified Internetwork Expert (CCIE) Enterprise Infrastructure — Practice Set 1

Question 1

An enterprise is migrating its campus network from a three-tier hierarchical design (core/distribution/access) to a spine-leaf (Clos) fabric. Which characteristic of the spine-leaf architecture makes it MOST suitable for east-west data center traffic compared to the three-tier model?

Accepted Answer

In a spine-leaf (Clos) topology, every leaf switch connects to every spine switch, ensuring that any server-to-server (east-west) communication traverses exactly two hops (leaf → spine → leaf), resulting in uniform, predictable latency across the fabric. Equal-cost multi-path (ECMP) over all available spine paths provides high bandwidth and load balancing. The three-tier model has variable hop counts and traffic bottlenecks at distribution and core layers for east-west flows. Spine-leaf typically uses ECMP routing (not STP) at Layer 3 or VXLAN/BGP EVPN at Layer 2/3. Spine-leaf fabrics generally require more switches than a minimal three-tier design. Spine-leaf optimizes east-west traffic, not north-south.

Question 2

A network architect is designing a Cisco SD-WAN deployment. The company requires that branch sites establish direct IPsec tunnels to each other (spoke-to-spoke) without routing all traffic through the hub data center. Which SD-WAN component facilitates the on-demand creation of spoke-to-spoke tunnels by providing NHRP-like next-hop resolution?

Accepted Answer

In Cisco SD-WAN, the vSmart controller distributes OMP (Overlay Management Protocol) routing information to all vEdge devices, including TLOC (Transport Location) information — the IP address and transport color of each edge's WAN interfaces. When a branch vEdge needs to reach another branch directly, it uses the TLOC information from vSmart to establish a direct IPsec data plane tunnel to the peer vEdge without routing through the hub. This is analogous to NHRP's spoke-to-spoke tunnel resolution in DMVPN Phase 2/3. vManage is the management plane and does not facilitate real-time tunnel establishment. vBond assists with initial device onboarding and NAT traversal during initial connection, but ongoing spoke-to-spoke tunnels rely on vSmart-distributed TLOC data. vEdge devices do not broadcast to discover peers.

Question 3

An enterprise runs GLBP version 1 on a /24 subnet with four routers. The network engineer wants to verify load balancing. Which GLBP load-balancing method assigns different virtual MAC addresses to each AVF and distributes ARP replies in a round-robin fashion to hosts?

Accepted Answer

GLBP supports three load-balancing methods. Round-robin (the default) causes the AVG (Active Virtual Gateway) to respond to ARP requests by cycling through the virtual MAC addresses of all AVFs sequentially, distributing hosts evenly. Host-dependent returns the same virtual MAC to the same host (based on client IP), providing consistency for stateful applications. Weighted assigns gateway MAC addresses in proportion to each router's configured weight value. There is no 'least-loaded' method in GLBP — traffic counters are not used for ARP assignment.

Question 4

A CCIE candidate reviews an SD-Access deployment. The show output from a fabric Edge Node displays the following LISP mapping:

EID-prefix: 10.0.1.15/32
  Locator: 192.168.100.5  Priority/Weight: 1/50
  State: up

What does the Locator value (RLOC 192.168.100.5) represent?

Accepted Answer

In LISP (Locator/ID Separation Protocol), EID (Endpoint Identifier) is the endpoint's IP address (10.0.1.15 in this case), and RLOC (Routing Locator) is the routable IP address of the LISP tunnel endpoint (xTR — typically the Edge Node's underlay/transport interface) that connects to the underlay IP network. When a remote node needs to reach EID 10.0.1.15, it encapsulates the packet with the RLOC 192.168.100.5 as the outer destination. The RLOC is not the DNA Center address, not a VNI (which is a VXLAN integer identifier), and not the endpoint's address.

Question 5

A network engineer configures VRF-Lite on a Cisco router to support two customers sharing a common CE router. Each VRF requires a unique Route Distinguisher (RD) and Route Target (RT). What is the functional difference between a Route Distinguisher and a Route Target in an MPLS/VRF context?

Accepted Answer

In BGP/MPLS VPN, the Route Distinguisher (RD) is prepended to an IPv4 prefix to create a globally unique 96-bit VPN-IPv4 address in the MP-BGP table, allowing PE routers to distinguish otherwise identical prefixes from different VPNs. The RD does not control which VRFs receive the route. The Route Target (RT) is a BGP extended community used for import/export policy: a VRF exports routes with a specific RT value, and other VRFs configured to import that RT will receive those routes, controlling VPN topology (hub-spoke, full-mesh, extranet). These are distinct mechanisms with different roles.

Question 6

A network engineer examines a DMVPN Phase 3 deployment. A spoke router receives the following NHRP redirect from the hub:

%NHRP-5-NHRPRESOLREPLY: Via 10.1.1.1 NHRP resolution reply from 172.16.10.2

What does this log message indicate about DMVPN Phase 3 operation?

Accepted Answer

In DMVPN Phase 3, when the hub receives a packet from Spoke A destined for Spoke B, it forwards the packet (the hub is always the next hop in the mGRE tunnel due to `ip nhrp redirect` and `ip nhrp shortcut`), and simultaneously sends an NHRP Traffic Indication (Redirect) back to Spoke A. This redirect contains Spoke B's NBMA (public) IP address. Spoke A uses this information to send an NHRP Resolution Request directly to Spoke B, which replies with its own NBMA address. After resolution, Spoke A builds a direct mGRE tunnel to Spoke B and installs a shortcut route, bypassing the hub for future traffic. The log message indicates this redirect process — not registration or a Phase 3 failure.

Question 7

A network engineer reviews OSPF LSA types in a multi-area network. Router R1 is an ASBR in Area 1. It redistributes external routes into OSPF. Router R2 is the ABR between Area 1 and Area 0. Router R3 is in Area 2. Which LSA type does R3 receive to learn the external routes originated by R1?

Accepted Answer

OSPF Type 5 AS External LSAs are generated by ASBRs to advertise routes redistributed from external routing domains. Unlike Types 1, 2, and 3 which are area-scoped, Type 5 LSAs are flooded throughout the entire OSPF autonomous system (excluding stub areas and NSSAs). R3 in Area 2 receives the Type 5 LSA flooded from the ASBR in Area 1 via the backbone. Type 4 (ASBR Summary LSA) is generated by ABRs to advertise the reachability of the ASBR itself (so other areas know how to reach it to calculate Type 5 next-hops) — it does not contain the external routes. Type 7 is only used within NSSAs. Type 1 is area-local only.

Question 8

A CCIE candidate is troubleshooting a BGP route policy. The following route-map is applied outbound to an eBGP peer:

route-map EXPORT permit 10
   match ip address prefix-list ALLOWED
   set as-path prepend 65001 65001 65001
  route-map EXPORT deny 20

The prefix-list ALLOWED contains the entry `permit 192.168.0.0/16 le 24`. What is the effect of this policy on a prefix 192.168.5.0/24 advertised to the peer?

Accepted Answer

The prefix-list `permit 192.168.0.0/16 le 24` matches any prefix that is a subnet of 192.168.0.0/16 with a prefix length between /16 and /24 inclusive. 192.168.5.0/24 is within 192.168.0.0/16 and has a /24 length, so it matches the prefix-list. Route-map sequence 10 permits it and applies `set as-path prepend 65001 65001 65001`, which appends 65001 three times to the beginning of the existing AS path — making the path appear three AS hops longer to the receiving peer (a technique to make a route less preferred for inbound traffic from the peer's AS). `le 24` means 'less than or equal to 24', so /24 is included. `set as-path prepend` adds to the existing path, not replaces it. Sequence 20 is a deny catchall for anything not matched by sequence 10.

Question 9

A network engineer examines the following BGP table output on Router R1:

R1# show ip bgp 10.0.0.0/24
  BGP routing table entry for 10.0.0.0/24
  Paths: (2 available, best #2)
    Advertised to update-groups:
       1
  65002
    192.168.1.1 from 192.168.1.1 (192.168.1.1)
      Origin IGP, metric 0, localpref 100, valid, external
      Community: 65001:100
  65003
    192.168.2.1 from 192.168.2.1 (192.168.2.1)
      Origin IGP, metric 0, localpref 150, valid, external, best

Why is the path via 192.168.2.1 selected as best?

Accepted Answer

BGP best-path selection follows a specific order: Weight (highest preferred, Cisco-proprietary, local to router) → Local Preference (highest preferred, shared within AS) → Locally Originated → AS Path Length (shortest) → Origin code → MED → eBGP over iBGP → IGP metric to next-hop → Router ID. In this output, both paths have equal Weight (default 0), but Local Preference differs: 192.168.2.1 has localpref 150 vs. 100 for 192.168.1.1. Local Preference is the second criterion (after Weight) and higher is better, so the path via 192.168.2.1 is selected. BGP communities are used for policy tagging but are not a best-path selection criterion. Both paths are eBGP, so that criterion does not differentiate them.

Question 10

A CCIE candidate is troubleshooting OSPF redistribution. Two ASBR routers redistribute the same external network (172.20.0.0/16) into OSPF. Both generate Type 5 LSAs for this prefix. Router R3, which is neither ASBR, has both Type 5 LSAs in its LSDB. Which router does R3 prefer to reach 172.20.0.0/16, and why?

Accepted Answer

When multiple Type 5 LSAs exist for the same external prefix, OSPF first compares the metric type: E1 routes (which include the internal cost to the ASBR + the external metric) are always preferred over E2 routes (only external metric, ignoring internal cost). If both ASBRs advertise with the same metric type and equal external metrics, OSPF prefers the ASBR with the lowest internal (intra-area or inter-area) cost to reach it — i.e., the cheapest intra-AS path to the forwarding ASBR. Router ID is only a tiebreaker when all other criteria are equal. LSA sequence numbers indicate recency of the LSA, not path preference. OSPF does not inherently install both as ECMP unless the total metrics (E1) or the ASBR intra-AS costs (E2) are equal.

Question 11

A network engineer reviews the following switch output:

SW1# show spanning-tree vlan 10
  VLAN0010
    Spanning tree enabled protocol rstp
    Root ID    Priority   4106
               Address    0011.2233.4455
               This bridge is the root
    Bridge ID  Priority   4106
               Address    0011.2233.4455

Interface      Role  Sts  Cost    Prio.Nbr  Type
  Gi0/1          Desg  FWD  4       128.1     P2p
  Gi0/2          Desg  FWD  4       128.2     P2p Edge

The priority of 4106 for VLAN 10 is unusual. What does this value indicate?

Accepted Answer

Cisco switches use the IEEE 802.1t Extended System ID feature, which encodes the VLAN ID into the lower 12 bits of the 16-bit Bridge Priority field. This means the bridge priority must be a multiple of 4096 (the remaining 4 bits), and the VLAN ID is added to that value. In this case: 4096 (configured priority increment) + 10 (VLAN ID) = 4106. The default STP bridge priority is 32768, so the administrator has explicitly configured this switch as root with a priority of 4096 (which displays as 4096+10=4106 for VLAN 10). This is standard behavior on all modern Cisco IOS switches and is not a manual override of 4106 directly.

Question 12

An enterprise QoS policy uses CBWFQ with three classes. The interface is a 100 Mbps GigabitEthernet link. The policy-map allocates: Class VOIP: `priority 10000` (LLQ), Class DATA: `bandwidth percent 40`, Class DEFAULT: `fair-queue`. Under heavy congestion, what is the MAXIMUM guaranteed bandwidth for Class DATA?

Accepted Answer

In Cisco MQC, `bandwidth percent <value>` allocates a percentage of the total interface bandwidth — not the remaining bandwidth after LLQ. `bandwidth percent 40` on a 100 Mbps interface guarantees 40 Mbps for Class DATA during congestion. The `priority` (LLQ) class has strict priority and is serviced first, but the `bandwidth percent` guarantee for CBWFQ classes is calculated against the total interface bandwidth. The LLQ allocation does not reduce the denominant for bandwidth percent calculations. If the LLQ class does not use its full allocation, the unused bandwidth is available to other classes, but the guaranteed minimum for DATA remains 40% of interface bandwidth = 40 Mbps.

Question 13

A CCIE candidate examines EIGRP DUAL (Diffusing Update Algorithm). A successor route to 10.0.5.0/24 fails. The router checks its topology table for a feasible successor. The feasible condition requires that the Reported Distance (RD) of the neighbor is less than the current Feasible Distance (FD). Which value represents the Feasible Distance stored in the EIGRP topology table?

Accepted Answer

In EIGRP DUAL, the Feasible Distance (FD) is the best known metric (lowest composite metric value) from the local router to the destination network — it is the metric of the currently installed successor route. The Reported Distance (RD), also called Advertised Distance (AD), is the metric to the destination as reported by the neighbor (the cost from the neighbor to the destination). The Feasible Condition (FC) states: a neighbor is a feasible successor if its RD < the current FD. This guarantees loop-free alternate paths. The FD is not the sum of individual link costs (that's the composite metric calculation) — the FD is a single stored value representing the best known total path metric.

Question 14

A network engineer configures OSPF authentication on all routers in area 0 to prevent unauthorized OSPF neighbor formation. Which IOS configuration correctly enables MD5 authentication on interface GigabitEthernet0/0 with key ID 1 and password 'CiscoOSPF'?

Accepted Answer

`ip ospf authentication message-digest` enables MD5 authentication on the interface (overriding any area-level setting). `ip ospf message-digest-key md5 ` defines the key ID and password used for MD5 hashing of OSPF packets. Both commands are entered under interface configuration mode. Option B uses `ip ospf authentication md5` which is not valid syntax (`message-digest` is the correct keyword, not `md5`). Option C uses `area 0 authentication md5` which enables MD5 for the entire area but still requires the `ip ospf message-digest-key` command on each interface — the key definition under `router ospf` is not a valid syntax. Option D omits the `ip` prefix which is required for these interface OSPF commands.

Question 15

A network operations engineer reviews NetFlow data exported from a border router. The collector shows an unusually high volume of UDP flows from many internal source IPs targeting a single external destination on port 53. Which type of attack does this traffic pattern MOST likely indicate?

Accepted Answer

High-volume UDP traffic from many internal source IPs to a single external destination on port 53 (DNS) is a classic indicator of a DNS amplification attack. Compromised internal hosts send small DNS queries (often to open resolvers) with spoofed source IPs set to the victim's address; the resolver returns much larger responses (amplification factor can be 50x or more) to the victim, consuming its bandwidth. NetFlow is an effective tool for detecting such volumetric anomalies. ARP poisoning operates at Layer 2 and does not generate routed flows to external IPs. OSPF uses protocol 89 (not UDP port 53). SYN floods use TCP, not UDP.

Question 16

A CCIE candidate configures SPAN on a Cisco Catalyst switch with the following commands:

monitor session 1 source interface GigabitEthernet0/1 both
  monitor session 1 destination interface GigabitEthernet0/24

The engineer connects a packet analyzer to GigabitEthernet0/24 but observes no traffic. The engineer verifies that GigabitEthernet0/1 is actively passing traffic. What is the MOST likely cause?

Accepted Answer

A SPAN destination port on Cisco Catalyst switches operates in a special mode — it cannot simultaneously carry normal network traffic (e.g., be a trunk or access port for production VLANs). If GigabitEthernet0/24 is configured as a trunk port with VLANs, IOS may not accept it as a SPAN destination, or the SPAN session may be inactive. The destination port must be a dedicated monitoring port. The `both` keyword (monitoring ingress and egress) is valid SPAN syntax. There is no `monitor session enable` command — the session is active once configured with both source and destination. SPAN source and destination ports do not need to be in the same VLAN.

Question 17

A security engineer reviews the following CoPP policy-map on a router:

class-map match-all ICMP
   match protocol icmp
  policy-map COPP_POLICY
   class ICMP
    police rate 8000 bps burst 1500
  control-plane
   service-policy input COPP_POLICY

Which type of traffic is affected by this policy, and what happens to ICMP traffic that exceeds the 8 Kbps rate?

Accepted Answer

CoPP (Control Plane Policing) applied under `control-plane` with `service-policy input` protects the route processor by rate-limiting traffic destined for the router's CPU — specifically, control plane packets punted from the line card to the route processor (e.g., ICMP echo requests to the router's own IP, routing protocol packets, ARP). Transit traffic (traffic that the router forwards between interfaces) is NOT affected by CoPP. The `police rate 8000 bps` action defaults to dropping non-conforming packets. CoPP does not affect traffic sourced by the router (that would be the `output` direction) or transit traffic.

Question 18

A network engineer deploys 802.1X with EAP-TLS on a Cisco Catalyst switch. During authentication, the supplicant presents a certificate that was issued by a CA not trusted by the RADIUS server. What is the MOST likely outcome?

Accepted Answer

EAP-TLS (EAP with TLS) is a certificate-based mutual authentication method. The RADIUS server validates the supplicant's certificate against its trusted CA list during the TLS handshake. If the certificate is issued by an untrusted CA (not in the RADIUS server's trusted root store), the TLS handshake fails, the RADIUS server sends an EAP-Failure, and the authenticator switch places the port in the unauthorized state (or applies the configured auth-fail VLAN/policy). EAP-TLS validates both the certificate issuer chain and the certificate's validity (expiry, revocation). The switch does not perform certificate validation in 802.1X — that is the authentication server's role. EAP fallback requires specific configuration and is not automatic.

Question 19

A network engineer configures a Zone-Based Firewall (ZBFW) on a Cisco IOS-XE router. Two zones are defined: INSIDE and OUTSIDE. A zone-pair is created from INSIDE to OUTSIDE with an inspect policy. Which of the following statements about ZBFW traffic flows is CORRECT?

Accepted Answer

In Cisco Zone-Based Firewall (ZBFW), when an `inspect` action is applied to a zone-pair (INSIDE to OUTSIDE), the router performs stateful inspection on outbound sessions — return traffic matching established connections is automatically permitted without requiring a reverse zone-pair. Unsolicited traffic from OUTSIDE to INSIDE that does not match an established session is dropped (by the default `drop` action on unmatched traffic). Zone-pairs are unidirectional — a zone-pair from INSIDE to OUTSIDE only affects traffic flowing in that direction. Traffic between interfaces in the same zone is permitted by default (no policy required). Interfaces not assigned to a zone are treated as the self-zone (traffic to/from the router itself) and are not freely accessible to other zones.

Question 20

A security audit finds that a Cisco router's BGP session to an ISP is vulnerable because BGP packets are not authenticated. The engineer implements MD5 authentication on the BGP session using `neighbor 203.0.113.1 password Cisco123`. The BGP session drops and does not re-establish. The ISP confirms the same password is configured on their side. What is the MOST likely cause?

Accepted Answer

BGP MD5 authentication (RFC 2385) is applied to the TCP session that carries BGP. When MD5 authentication is configured on an existing, established BGP session, the existing TCP connection — which was established without MD5 — does not automatically restart. The TCP session must be reset (cleared) so that a new TCP connection is established with MD5 protection from the start. The engineer should run `clear ip bgp 203.0.113.1` to reset the session. Once the new TCP connection is initiated, both sides negotiate MD5 and the BGP session re-establishes. BGP MD5 is supported on both eBGP and iBGP. The `neighbor password` command does not require a key ID. IOS uses MD5 for BGP TCP authentication per RFC 2385.

Question 21

A network engineer uses the Netmiko library in Python to configure multiple routers. The following code snippet runs successfully:

```python
from netmiko import ConnectHandler
device = {
    'device_type': 'cisco_ios',
    'host': '10.0.0.1',
    'username': 'admin',
    'password': 'cisco',
    'secret': 'enable_pass'
}
net_connect = ConnectHandler(**device)
net_connect.enable()
output = net_connect.send_command('show ip ospf neighbor')
```

What is the purpose of the `net_connect.enable()` call in this context?

Accepted Answer

`net_connect.enable()` is the Netmiko method that sends the `enable` command to the device and enters the `secret` password (from the device dictionary) to elevate the session from user EXEC mode (Router>) to privileged EXEC mode (Router#). This is required before running privileged commands like `show ip ospf neighbor`. The `secret` key in the device dictionary provides the enable password. Without calling `enable()`, `show ip ospf neighbor` would fail or produce an error if the initial login lands in user EXEC mode. The method has nothing to do with enabling OSPF, SSH, or network interfaces.

Question 22

A CCIE candidate writes a RESTCONF PUT request to replace the hostname of a Cisco IOS-XE router. The request URI is:

PUT https://10.0.0.1/restconf/data/Cisco-IOS-XE-native:native/hostname
  Body: {"Cisco-IOS-XE-native:hostname": "NewRouter"}

The server returns HTTP 405 Method Not Allowed. What is the MOST likely reason?

Accepted Answer

HTTP 405 Method Not Allowed indicates the HTTP method (PUT) is not supported for the targeted resource. In RESTCONF, PUT replaces the entire resource identified by the URI. For a leaf node like `hostname`, some IOS-XE implementations or YANG schema constraints may not support PUT directly on a leaf (as it would imply replacing the entire `hostname` subtree). The correct method for modifying a single leaf value is PATCH with the RESTCONF `merge` operation, which applies a partial update. Alternatively, the payload or URI may need adjustment. PUT is supported by RESTCONF in general (not universally disallowed). JSON requires `application/yang-data+json` content-type. Cisco native YANG models are supported by RESTCONF on IOS-XE.

Question 23

An automation engineer uses Ansible with the `cisco.ios.ios_command` module to collect `show version` output from 50 routers simultaneously. The playbook uses `strategy: free` and `forks: 10`. What does the combination of these settings control?

Accepted Answer

`forks` in Ansible controls the number of hosts that can be processed concurrently — setting `forks: 10` means Ansible manages up to 10 managed hosts simultaneously per task batch. The default `strategy: linear` waits for all hosts to complete each task before moving to the next. `strategy: free` removes this synchronization constraint, allowing faster hosts to proceed through subsequent tasks independently without waiting for slower hosts, improving overall playbook execution time when tasks have variable completion times. `forks` does not repeat tasks or split plays, and `strategy: free` does not disable parallelism — it enhances it.

Question 24

A YANG data model for interface configuration contains the following leaf definition:

leaf mtu {
    type uint16 {
      range "68..65535";
    }
    default "1500";
    description "MTU of the interface in bytes";
  }

A NETCONF edit-config request attempts to set the MTU to 65536. What response does the NETCONF server return?

Accepted Answer

YANG enforces type constraints at the server. The `uint16` type with `range "68..65535"` means the only valid values are integers from 68 to 65535 inclusive. A value of 65536 exceeds the uint16 maximum (65535) and violates the range constraint. The NETCONF server validates the incoming data against the YANG model before applying changes, and must return an `<rpc-error>` element with an `error-tag` of `invalid-value` (RFC 6241) — it does not silently truncate or ignore constraints. YANG constraints are enforced, not advisory. NETCONF communicates over SSH (not HTTP), so HTTP 400 is not applicable.

Question 25

A network engineer uses Python with the `ncclient` library to perform a NETCONF `` operation on a router's candidate datastore before making configuration changes. Which statement CORRECTLY describes the purpose and behavior of the `` operation?

Accepted Answer

The NETCONF `` operation (RFC 6241) grants exclusive write access to a datastore (e.g., candidate or running) to the requesting session. While the lock is held, no other NETCONF session or the CLI can modify the locked datastore — attempts to do so return an `` with `lock-denied`. This is essential for transactional consistency: the engineer can lock the candidate, make multiple `` calls, and then `` atomically, without worrying about concurrent modifications. The `` operation does not encrypt data, does not commit anything, and is not required before `` (which is a read operation).

350-401 ENCOR — Cisco Certified Internetwork Expert (CCIE) Enterprise Infrastructure