Cisco Certified Network Professional (CCNP) Automation — Practice Set 1

Question 1

In a Cisco SD-WAN deployment, which component is responsible for authenticating and onboarding vEdge routers to the overlay fabric?

Accepted Answer

vBond is the SD-WAN orchestration plane component that authenticates all SD-WAN devices and facilitates the initial connection between vEdge routers and the other SD-WAN controllers. It acts as a NAT traversal facilitator and load balancer for vSmart controllers. vManage is the management plane NMS, while vSmart handles the control plane policy distribution.

Question 2

In Cisco SD-Access, which device role runs the LISP control plane and maintains the endpoint-to-RLOC mapping database?

Accepted Answer

The Control Plane Node (Map Server/Map Resolver) in SD-Access runs the LISP control plane and maintains the mapping database that maps endpoint identifiers (EIDs) to routing locators (RLOCs). Edge Nodes register their connected endpoints with the Control Plane Node. Border Nodes connect the SD-Access fabric to external networks, and Intermediate Nodes provide simple Layer 3 transit.

Question 3

A network engineer is comparing HSRP and GLBP for a campus distribution layer. Which statement correctly differentiates GLBP from HSRP?

Accepted Answer

GLBP uses an Active Virtual Gateway (AVG) that responds to ARP requests and distributes unique virtual MAC addresses among Active Virtual Forwarders (AVFs). This allows all routers in the GLBP group to forward traffic simultaneously, providing true load balancing. HSRP and VRRP only allow one active router at a time with the others in standby. GLBP does support preemption.

Question 4

An engineer is designing a campus wireless network. The requirement is for lightweight APs to be managed centrally and for all client data traffic to be centrally switched through the WLC. Which deployment mode satisfies this requirement?

Accepted Answer

Local mode (the default CAPWAP deployment mode) tunnels all client data traffic back to the WLC where it is centrally switched. This gives the WLC full visibility and control over client traffic. FlexConnect mode allows APs to locally switch traffic when the WLC connection is lost. Autonomous mode APs do not use CAPWAP. Monitor mode is used for rogue AP detection only.

Question 5

Which IOS-XE command creates a VRF named CUSTOMER_A using the modern vrf definition syntax?

Accepted Answer

The modern IOS-XE syntax for creating a VRF is 'vrf definition ', which supports both IPv4 and IPv6 address families. The legacy command 'ip vrf ' is still functional but only supports IPv4 and is considered deprecated. After creating the VRF, you must configure address families (address-family ipv4 / address-family ipv6) and then assign interfaces with 'ip vrf forwarding '.

Question 6

An engineer configures a GRE tunnel between two routers. The tunnel source is interface GigabitEthernet0/0 (IP 10.1.1.1) and the tunnel destination is 10.2.2.2. Which configuration is correct for Tunnel0 on the local router?

Accepted Answer

The correct GRE tunnel configuration uses 'tunnel source' referencing the local interface or IP and 'tunnel destination' referencing the remote endpoint IP. The command 'tunnel mode gre ip' is the default and can be omitted but explicitly declares IPv4 GRE encapsulation. Option B has source and destination reversed. Option C uses 'encapsulation gre' which is not valid IOS-XE tunnel syntax. Option D uses non-existent commands.

Question 7

Which statement best describes the role of VTEP in a VXLAN fabric?

Accepted Answer

A VXLAN Tunnel Endpoint (VTEP) is a data-plane component that encapsulates Ethernet frames in VXLAN headers and transports them over the UDP/IP underlay using destination port 4789. Each VTEP has an IP address in the underlay and one or more VXLAN Network Identifiers (VNIs) for the overlay segments it serves. The VTEP handles both encapsulation (ingress) and decapsulation (egress) of VXLAN traffic.

Question 8

Which OSPF LSA type describes routes external to the OSPF domain that are redistributed into OSPF by an ASBR?

Accepted Answer

Type 5 LSAs (AS External LSAs) are generated by ASBRs and carry routes that originate outside the OSPF domain. They are flooded throughout the entire OSPF domain except stub areas. Type 1 LSAs describe a router's directly connected links. Type 3 LSAs carry inter-area summary routes. Type 4 LSAs describe the location of an ASBR so that routers in other areas can find a path to it.

Question 9

An OSPF router shows the following output:

Router# show ip ospf neighbor
  Neighbor ID   Pri  State     Dead Time  Address      Interface
  192.168.1.2   1    EXSTART/  00:00:38   10.0.0.2     Gi0/0

What is the most likely cause of the neighbor being stuck in EXSTART state?

Accepted Answer

EXSTART is the state where two OSPF routers negotiate the master/slave relationship and begin Database Description (DBD) packet exchange. A common cause of being stuck in EXSTART/EXCHANGE is an MTU mismatch — if the two routers have different interface MTUs, the DBD packets may be fragmented or dropped. Mismatched area IDs would prevent reaching even the INIT state. Mismatched timers would result in neighbors not forming at all (stuck in DOWN/INIT).

Question 10

A network engineer needs to configure eBGP between Router A (AS 65001, IP 10.0.0.1) and Router B (AS 65002, IP 10.0.0.2). Which configuration on Router A correctly establishes the eBGP session?

Accepted Answer

eBGP is established when the remote-as differs from the local AS. Router A in AS 65001 must specify neighbor 10.0.0.2 with remote-as 65002. Option A specifies the same AS (65001) which would create iBGP, not eBGP. Option C adds update-source Loopback0 which is typically used for iBGP and would require ebgp-multihop for loopback-to-loopback eBGP. Option D sets ebgp-multihop 1 which is the default and redundant, but option B is the minimal correct configuration.

Question 11

Which BGP attribute is used by an AS to influence inbound traffic from neighboring ASes, and what is the preference behavior?

Accepted Answer

MED (metric) is the BGP attribute used to suggest to external neighbors which path they should use to enter the local AS. A lower MED value is preferred. It is advertised to eBGP peers and is not propagated beyond the directly connected AS by default. LOCAL_PREF influences outbound traffic selection within an AS (higher is better). WEIGHT is locally significant and Cisco-proprietary (higher is better). AS_PATH prepending lengthens the path to make it less preferred for inbound traffic.

Question 12

An engineer applies the following QoS configuration to an interface:

class-map match-all VOICE
   match dscp ef
  !
  policy-map WAN_POLICY
   class VOICE
    priority 512
   class class-default
    fair-queue
  !
  interface Serial0/0
   service-policy output WAN_POLICY

Which statement correctly describes the behavior of this configuration?

Accepted Answer

The 'priority' command in a policy-map creates a Low Latency Queue (LLQ), which is a strict-priority queue. The value (512) is in kbps. Traffic in the LLQ is always serviced first to minimize latency, but if the traffic rate exceeds the configured bandwidth, excess traffic is policed (dropped) to prevent starvation of other queues. The class-default with fair-queue uses WFQ for the remaining traffic. The unit is kbps, not Mbps.

Question 13

In RSTP (802.1w), which port role forwards traffic and is the best port on a non-root switch for reaching the root bridge?

Accepted Answer

The Root Port is the port on each non-root switch with the lowest cost path to the root bridge. It is always in the forwarding state. The Designated Port is the port on each network segment that provides the lowest-cost path toward the root for that segment (also forwarding). The Alternate Port provides an alternate path to the root and is in the discarding state. The Backup Port is a backup for a designated port on the same shared segment.

Question 14

Which two commands must be configured on an access port to enable RSTP PortFast and protect against unauthorized BPDUs? (Choose 2)

Accepted Answer

PortFast ('spanning-tree portfast') allows a port to skip the listening and learning states and transition directly to forwarding, which is appropriate for end-device ports. BPDU Guard ('spanning-tree bpduguard enable') shuts down the port if a BPDU is received, protecting against unauthorized switches. Root Guard protects against a port becoming a root port. PortFast trunk applies PortFast to trunk ports. BPDU Filter suppresses BPDU sending and receiving, which can be dangerous.

Question 15

An engineer configures PIM Sparse Mode on a network. The Rendezvous Point (RP) is at 10.255.255.1. When a new multicast source begins sending, which sequence of events correctly describes how the first-hop router (FHR) builds the multicast distribution tree?

Accepted Answer

In PIM Sparse Mode, when a new source begins sending, the FHR encapsulates the multicast data in a unicast PIM Register message and sends it to the RP. The RP decapsulates the data, creates (S,G) state, and sends a PIM Join back toward the source to build the source tree (SPT). Once the RP can receive native multicast from the source via the SPT, it sends a Register-Stop to the FHR to stop the encapsulated Register messages. The RP then forwards traffic down the shared tree (*,G) to receivers.

Question 16

An EIGRP named-mode configuration is required. Which command sequence correctly enters EIGRP named mode for AS 100 and sets the hello interval to 10 seconds on GigabitEthernet0/1?

Accepted Answer

EIGRP named mode is entered with 'router eigrp ' where the name is an alphanumeric string (not an AS number). The address family is then configured with 'address-family ipv4 unicast autonomous-system '. Within the address family, interface-specific settings go under 'af-interface ' where 'hello-interval ' is set. Option A uses a numeric process ID which creates classic EIGRP mode, not named mode. Options C and D use incorrect syntax.

Question 17

Which IOS-XE configuration correctly creates an IP SLA probe that sends an ICMP echo to 8.8.8.8 every 60 seconds, scheduled to start immediately and run indefinitely?

Accepted Answer

The correct IOS-XE IP SLA syntax uses 'ip sla ' to enter the SLA configuration, 'icmp-echo ' to define the probe type (entered as a sub-command), and 'frequency ' as a parameter under the icmp-echo block. The 'ip sla schedule start-time now life forever' activates the probe immediately with no end time. Option B omits 'life forever'. Option C uses the legacy IOS SLA monitor syntax. Option D incorrectly places 'frequency' in the schedule command.

Question 18

A network engineer wants to export NetFlow records to a collector at 192.168.100.50, UDP port 9995. Which IOS-XE configuration accomplishes this?

Accepted Answer

Modern IOS-XE uses Flexible NetFlow (FNF) which requires configuring a flow exporter with destination and transport, a flow monitor that references the exporter and a flow record, and then applying the monitor to an interface. Option A uses the legacy 'ip flow-export' syntax that works on older IOS versions but is superseded by FNF on IOS-XE. Options C and D use entirely invalid commands.

Question 19

Which SPAN configuration mirrors traffic from VLAN 10 on a local switch to a monitoring device connected to GigabitEthernet0/24?

Accepted Answer

IOS-XE SPAN is configured using 'monitor session source' to define what traffic to capture and 'monitor session destination interface' to define where the mirrored traffic is sent. VLAN-based SPAN (VSPAN) allows capturing all traffic on a specific VLAN as the source. Option B has source and destination reversed. Options C and D use non-existent IOS-XE syntax.

Question 20

An engineer is enabling 802.1X on a switch port. Which global configuration command must be enabled first before 802.1X authentication can function on any port?

Accepted Answer

The global command 'dot1x system-auth-control' must be enabled to globally activate 802.1X on the switch. Without this command, even if individual port configurations are applied, 802.1X will not function. While 'aaa new-model', RADIUS server configuration, and AAA authentication methods are all required for a complete 802.1X deployment, 'dot1x system-auth-control' is the specific command that enables the 802.1X feature globally.

Question 21

Which statement correctly describes the purpose of Control Plane Policing (CoPP) on an IOS-XE router?

Accepted Answer

Control Plane Policing (CoPP) uses MQC (Modular QoS CLI) to apply rate-limiting policies to traffic that is destined for or generated by the router's control plane (CPU). It protects the router CPU from being overwhelmed by excessive traffic such as routing protocol floods, SNMP queries, or DoS attacks. CoPP only affects traffic going to/from the control plane, not transit data plane traffic. It does not provide encryption.

Question 22

Which command enables DHCP snooping for VLAN 10 on an IOS-XE switch?

Accepted Answer

DHCP snooping requires two steps: first 'ip dhcp snooping' to globally enable the feature, and second 'ip dhcp snooping vlan <vlan-id>' to enable it per VLAN. Only option B shows the correct per-VLAN enabling syntax. Option A only enables the global feature but does not activate snooping on any VLAN. Options C and D use invalid syntax. Additionally, trusted uplink ports must be configured with 'ip dhcp snooping trust' interface command.

Question 23

Dynamic ARP Inspection (DAI) is enabled on VLAN 20. An engineer notices that legitimate ARP replies from a trusted DHCP server (connected to GigabitEthernet0/1) are being dropped. What is the correct fix?

Accepted Answer

DAI validates ARP packets against the DHCP snooping binding table, dropping ARP packets that do not have a matching entry. For trusted devices (such as DHCP servers, routers, or servers with static IPs) that may not have entries in the snooping binding table, the connected interface must be configured as a DAI trusted port using 'ip arp inspection trust' under the interface. This is an interface-level command, not a global VLAN command. DHCP snooping trust and DAI trust are independent settings.

Question 24

A Python script uses netmiko to push configuration changes to a Cisco IOS-XE device. Which method correctly sends multiple configuration lines stored in a list called 'config_commands'?

Accepted Answer

The netmiko method 'send_config_set()' accepts a list of configuration commands and sends them to the device after entering configuration mode. It automatically issues 'configure terminal' before sending the commands and 'end' afterward. 'send_command()' is used for show commands and operational commands that do not require config mode. 'send_config_list()' and 'push_config()' are not valid netmiko methods.

Question 25

An engineer writes an EEM applet to automatically log a message and shut down an interface when a specific syslog pattern is detected. Which configuration correctly triggers the applet when the syslog message 'LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to down' appears?

Accepted Answer

EEM applets use 'event syslog pattern ' to match syslog messages using regular expressions. The pattern 'UPDOWN.*GigabitEthernet0/2.*down' uses regex wildcards to match the relevant syslog message. Actions must use 'action cli command' to execute IOS commands, and CLI actions that require configuration mode must first enter 'enable' and 'conf t'. Option B uses a non-existent event type. Option C uses 'event syslog id' which is not valid IOS-XE EEM syntax. Option D uses 'event track' for IP SLA tracking, not syslog.

350-401 ENCOR — Cisco Certified Network Professional (CCNP) Automation