Cisco Certified Network Professional (CCNP) Enterprise — Practice Set 1

Question 1

A network architect is designing a new campus network using the three-tier hierarchical model. Which layer is responsible for high-speed switching between distribution layer devices and provides redundant connections to the distribution switches?

Accepted Answer

The core layer in the three-tier hierarchical model (core/distribution/access) provides high-speed, resilient switching between distribution layer devices. It is designed for maximum throughput with minimal latency and should not perform complex policy operations. The access layer connects endpoints. The distribution layer aggregates access traffic and enforces policies (routing, ACLs, QoS). The spine layer is part of the leaf-spine (Clos) data center fabric model, not the traditional three-tier campus model.

Question 2

An enterprise deploys Cisco SD-WAN. A network engineer needs to identify which SD-WAN component is responsible for centralized policy configuration and is the single management plane for the entire SD-WAN overlay.

Accepted Answer

vManage is the centralized NMS (Network Management System) for Cisco SD-WAN and serves as the single management plane — providing the GUI for policy configuration, device onboarding, monitoring, and troubleshooting. vEdge (or Cisco IOS-XE SD-WAN devices) are the data plane devices at customer sites. vBond is the orchestration plane component that authenticates and facilitates the initial connection between vEdge and vSmart/vManage. vSmart is the control plane controller that distributes routing and security policies to vEdge devices using OMP (Overlay Management Protocol).

Question 3

An enterprise deploys Cisco SD-Access. A network engineer is reviewing the fabric role assignments. Which SD-Access fabric node is responsible for mapping endpoint IP addresses and MAC addresses to fabric node locations using the LISP control plane?

Accepted Answer

In SD-Access, the Control Plane Node runs the LISP (Locator/ID Separation Protocol) Map-Server (MS) and Map-Resolver (MR) functions — it maintains the mapping database (EID-to-RLOC) that maps endpoint identifiers (IP/MAC) to the fabric node locations (RLOCs). Edge Nodes connect endpoints to the fabric and register their endpoints with the Control Plane Node. Border Nodes connect the fabric to external Layer 3 networks (such as the WAN or non-fabric subnets). Cisco DNA Center is the management and automation platform, not the LISP mapping database.

Question 4

A network engineer needs to compare HSRP, VRRP, and GLBP for First Hop Redundancy. Which statement CORRECTLY differentiates GLBP from HSRP and VRRP?

Accepted Answer

GLBP (Gateway Load Balancing Protocol) is Cisco-proprietary and uniquely provides both redundancy and load balancing by allowing multiple routers to simultaneously forward traffic as active virtual forwarders (AVFs) under a single virtual IP — each AVF responds to ARP requests with a different virtual MAC. HSRP (Cisco-proprietary) and VRRP (IEEE open standard — RFC 5798) both use a single active/master forwarder while other routers remain in standby/backup, with no native load balancing. HSRP supports HSRPv2 for IPv6; VRRP supports VRRPv3 for IPv6. GLBP also supports IPv6.

Question 5

A network engineer configures VRF (Virtual Routing and Forwarding) on a Cisco router to support multiple customers on shared infrastructure. Which IOS command creates a VRF named 'CUSTOMER_A' and assigns it a route distinguisher of 65000:1?

Accepted Answer

Modern Cisco IOS/IOS-XE uses `vrf definition ` (replacing the legacy `ip vrf ` command). Within the VRF definition, `rd ` sets the Route Distinguisher, and `address-family ipv4` activates the VRF for IPv4 routing. The legacy `ip vrf ` followed by `rd ` (Option A) is valid on older IOS but does not support multi-protocol VRFs. Option C puts the rd on the same line as `ip vrf`, which is not valid IOS syntax. Option D uses `route-distinguisher`, which is not the correct IOS subcommand (it is `rd`).

Question 6

An enterprise data center network uses VXLAN with BGP EVPN as the control plane. What is the primary role of the BGP EVPN control plane in a VXLAN fabric?

Accepted Answer

In VXLAN with BGP EVPN (Ethernet VPN), the BGP EVPN control plane distributes MAC and IP address reachability information (EVPN Type-2 routes) between VTEPs (VXLAN Tunnel Endpoints), replacing the traditional flood-and-learn mechanism. This allows VTEPs to build their forwarding tables proactively without flooding unknown unicast traffic. VXLAN encapsulation (Layer 2 over UDP) is the data plane function, not BGP EVPN. VNI assignment is a configuration task done by the operator. VXLAN itself does not provide encryption — MACsec is used for data plane encryption.

Question 7

A network engineer is troubleshooting OSPF. Two routers are connected on a broadcast multi-access network. The engineer runs `show ip ospf interface` and sees the following:

Router1: Priority 0
  Router2: Priority 1

What is the result of the DR/BDR election on this segment?

Accepted Answer

An OSPF interface priority of 0 explicitly excludes a router from participating in DR/BDR elections — it can only become a DROther (non-DR/BDR neighbor). Router2 with priority 1 will be elected DR (the only eligible candidate). If another router with a higher priority were on the segment, it would win. OSPF DR/BDR elections do apply to broadcast networks (and NBMA). With only Router2 eligible, it becomes DR and there is no BDR (there is no second eligible candidate). Priority takes precedence over Router ID in the election process.

Question 8

An OSPF network has the following area types. A router receives a Type 3 (Summary) LSA but does not receive Type 5 (AS External) LSAs. It also does not originate a default route automatically. In which OSPF area type is this router MOST likely located?

Accepted Answer

A Stub area blocks Type 5 AS External LSAs (redistributed external routes) from entering the area, reducing the LSDB size. Type 3 Summary LSAs are still allowed. The ABR automatically originates a Type 3 default route (0.0.0.0/0) into the stub area so internal routers can reach external destinations. A Totally Stubby area blocks both Type 3 and Type 5 LSAs, with only a single Type 3 default route injected. An NSSA blocks Type 5 LSAs but allows Type 7 LSAs (converted at the ABR) and may or may not have an automatic default route. Area 0 has no restrictions.

Question 9

A network engineer configures eBGP between two routers and observes that the BGP session is established but routes from the peer are not being installed in the routing table. The engineer runs `show ip bgp` and sees the routes are present in the BGP table with a next-hop of 203.0.113.1. The local router has no route to 203.0.113.1. Which BGP feature should the engineer configure to resolve this?

Accepted Answer

BGP installs a route in the routing table only if the BGP next-hop is reachable (resolvable in the routing table). If the next-hop 203.0.113.1 is not reachable, the route is marked as invalid and not installed. The fix is to ensure next-hop reachability — either by adding a static route to 203.0.113.1 or by having the IGP advertise a route to it. `next-hop-self` is used in iBGP scenarios where the eBGP-learned next-hop is not reachable by iBGP peers — it is not directly applicable here. Redistributing BGP into OSPF would cause route loops and is not a recommended fix. `bgp next-hop unchanged` preserves the original eBGP next-hop when advertising to iBGP peers.

Question 10

An enterprise BGP network has multiple exit points to the internet. The network engineer wants iBGP peers within the AS to prefer one specific exit router for all outbound traffic. Which BGP attribute should the engineer manipulate to influence outbound path selection from within the AS?

Accepted Answer

Local Preference is a well-known discretionary BGP attribute used to influence outbound traffic from within an AS. It is shared with all iBGP peers (but not sent to eBGP peers), and the path with the highest Local Preference is preferred. The default value is 100. Setting a higher Local Preference on the preferred exit router causes all iBGP peers to prefer that path. MED influences how traffic enters the AS from a neighboring AS (inbound influence on the neighbor). AS Path prepending is also used to influence inbound traffic from other ASes. Weight is Cisco-proprietary and is only locally significant to the router on which it is configured — it does not propagate to iBGP peers.

Question 11

A network engineer is reviewing RSTP (Rapid Spanning Tree Protocol, 802.1w) port roles. A switch port that is neither a root port nor a designated port, and provides an alternate path to the root bridge, is in which RSTP port role?

Accepted Answer

In RSTP (802.1w), port roles are: Root Port (best path to root bridge), Designated Port (best port on each segment toward leaves), Alternate Port (alternate path to root bridge — equivalent to STP blocking state, replaces failed root port immediately), and Backup Port (redundant path to the same segment as a designated port on the same switch). A non-designated port is not an RSTP role term — it is used in legacy 802.1D. The Alternate port is the key RSTP innovation enabling rapid convergence because it can transition to Root Port without waiting for a timer.

Question 12

A network engineer is implementing QoS using MQC (Modular QoS CLI). The policy must match all traffic with DSCP EF (46) and place it in a Low Latency Queue (LLQ) with a guaranteed bandwidth of 1 Mbps. Which IOS configuration correctly implements this?

Accepted Answer

In Cisco MQC, LLQ (Low Latency Queuing) is configured using the `priority <kbps>` command under the class in a policy-map — this allocates guaranteed bandwidth with strict priority queuing. `match dscp ef` matches traffic marked with DSCP EF (value 46). The `service-policy output` applies the policy to outbound traffic. Option B uses `bandwidth` instead of `priority` — `bandwidth` provides CBWFQ (Class-Based Weighted Fair Queuing), which allocates minimum bandwidth but does not provide strict priority (no LLQ). `match dscp 46` is also valid (numeric form), but `match dscp ef` with the named keyword is the preferred form. Option C uses `llq` which is not a valid MQC subcommand. Option D is not valid IOS syntax.

Question 13

An enterprise network redistributes OSPF into BGP and BGP into OSPF on the same router. A network engineer is concerned about routing loops. Which mechanism does OSPF use to prevent routes learned from BGP (via redistribution) from being redistributed back into BGP?

Accepted Answer

When redistributing from OSPF into BGP and from BGP into OSPF on the same router, potential loops arise because OSPF may re-learn routes it originally sent to BGP. The recommended prevention mechanism is to use route-maps with `match tag` statements during redistribution: when redistributing BGP into OSPF, set a specific OSPF tag on the routes; when redistributing OSPF into BGP, use a route-map to deny routes with that tag. OSPF does not automatically tag routes with the BGP AS number. Administrative distance controls route preference in the local routing table but does not prevent redistribution loops. OSPF Type 5 LSAs are not automatically filtered at the BGP redistribution boundary.

Question 14

A network engineer configures multicast routing on a Cisco router using PIM Sparse Mode. Which statement correctly describes PIM Sparse Mode operation?

Accepted Answer

PIM Sparse Mode (PIM-SM) uses an explicit join model — routers send PIM Join messages toward the Rendezvous Point (RP) to join the shared (*,G) tree. Multicast traffic is only sent to branches where receivers have explicitly joined; no flooding occurs by default. PIM Dense Mode (PIM-DM) uses a flood-and-prune model. The RP is a required component in PIM-SM — it acts as the meeting point for sources and receivers. PIM-SM can build source-specific shortest-path trees (SPTs) after initial traffic flows through the RP, but it does not build only source-based trees and it still requires an RP.

Question 15

A network engineer configures IP SLA to continuously monitor the reachability of a remote host at 10.1.1.1 using ICMP echo. Which IOS commands correctly configure an IP SLA operation with ID 10, set a frequency of 30 seconds, and schedule it to start immediately?

Accepted Answer

Modern Cisco IOS IP SLA configuration uses `ip sla ` to enter the SLA configuration context, `icmp-echo ` to define the operation type, `frequency ` to set the probe interval, and `ip sla schedule life forever start-time now` to start the operation immediately and run indefinitely. Option B uses the legacy `ip sla monitor` syntax (deprecated in IOS 12.4+). Option C incorrectly tries to configure everything on one line. Option D is not valid IOS syntax.

Question 16

A network engineer needs to capture traffic on a switch for analysis but cannot connect a sniffer directly to the source port. Which Cisco switch feature mirrors traffic from a source port to a monitoring port on the same switch?

Accepted Answer

SPAN (Switched Port Analyzer) is a local port mirroring feature that copies traffic from one or more source ports (or VLANs) to a destination port on the same switch, where a protocol analyzer can be connected. RSPAN (Remote SPAN) extends mirroring across multiple switches using a dedicated RSPAN VLAN — it is used when the analyzer is not on the same switch as the source. IP SLA measures performance metrics but does not capture raw packet traffic. NetFlow exports flow statistics to a collector but does not provide full packet captures.

Question 17

A network engineer deploys 802.1X port-based authentication on a Cisco Catalyst switch. A supplicant connects to the switch. Which component in the 802.1X framework is the switch acting as?

Accepted Answer

In 802.1X, the three entities are: the Supplicant (end device requesting access), the Authenticator (network device — the switch — that enforces access control and relays credentials between supplicant and server via EAPOL and RADIUS), and the Authentication Server (typically a RADIUS server such as Cisco ISE that validates credentials). The switch is the Authenticator — it controls physical access to the network based on the authentication server's decision. The RADIUS client functionality is part of the Authenticator role, but the switch does not authenticate users directly — it forwards credentials to the server.

Question 18

A network engineer configures DHCP Snooping on a Cisco switch to prevent rogue DHCP servers. Which statement CORRECTLY describes DHCP Snooping operation?

Accepted Answer

DHCP Snooping works by classifying switch ports as trusted or untrusted. By default, all ports are untrusted. Untrusted ports drop DHCP server messages (OFFER, ACK, NAK) — only ports explicitly configured as trusted (typically uplinks toward the legitimate DHCP server) can forward DHCP server replies. Untrusted ports can still forward DHCP client messages (DISCOVER, REQUEST). This prevents rogue DHCP servers connected to untrusted ports from assigning addresses. DHCP Snooping operates at Layer 2. The DHCP Snooping binding table (IP-to-MAC-to-port mappings) is also used by Dynamic ARP Inspection (DAI).

Question 19

A security engineer configures Control Plane Policing (CoPP) on a Cisco router to protect the router's CPU from DoS attacks. In the MQC-based CoPP policy, how is the policy applied?

Accepted Answer

Control Plane Policing (CoPP) uses the Modular QoS CLI (MQC) framework, but the policy-map is applied to the logical `control-plane` entity (accessed via the `control-plane` global configuration command) using `service-policy input` — not to physical interfaces. This protects the route processor by rate-limiting or dropping traffic destined for the control plane (e.g., routing protocol packets, SSH, ICMP, BGP). Applying to individual physical interfaces would be interface-level policing, not CoPP. The loopback interface is not the correct application point. CoPP requires explicit configuration — it is not automatically enabled.

Question 20

A network engineer enables uRPF (Unicast Reverse Path Forwarding) on an internet-facing interface to prevent IP address spoofing. Which uRPF mode is MOST appropriate for an internet edge router with asymmetric routing paths?

Accepted Answer

uRPF loose mode verifies that the source IP address exists somewhere in the routing table (via any interface) — it does not require the packet to arrive on the same interface as the best return path. This makes it suitable for internet-edge environments where asymmetric routing is common (traffic arrives on a different interface than it would leave). Strict mode requires the source to be reachable via the exact same interface the packet arrived on — it drops packets where asymmetric routing exists, causing false positives on asymmetric paths. Feasible mode and Network mode are not valid uRPF modes in Cisco IOS.

Question 21

A security engineer needs to mitigate ARP spoofing attacks on a Cisco switch. Which feature inspects ARP packets on untrusted ports and validates them against the DHCP Snooping binding table?

Accepted Answer

Dynamic ARP Inspection (DAI) mitigates ARP spoofing (ARP poisoning) by intercepting ARP packets on untrusted switch ports and validating the sender's IP-to-MAC binding against the DHCP Snooping binding table. ARP packets that do not match the binding table are dropped. Port Security limits MAC addresses but does not validate ARP content. IP Source Guard uses the DHCP Snooping binding table to filter IP packets (not ARP) — it prevents IP address spoofing. DHCP Snooping prevents rogue DHCP servers but does not inspect ARP packets.

Question 22

A network engineer uses an Ansible playbook with the `cisco.ios.ios_config` module to push configuration to multiple Cisco IOS devices. Which Ansible parameter ensures that the module only makes changes if the configuration is not already present (idempotent behavior)?

Accepted Answer

The `cisco.ios.ios_config` module achieves idempotency by comparing the `lines` to be configured against the current running configuration. When `parents` is specified, the module checks whether the given lines exist under the specified configuration context. If the lines are already present, no change is made and the task reports 'ok' rather than 'changed'. Using `lines` and `parents` correctly is key to idempotent IOS configuration via Ansible. `check_mode: yes` performs a dry run (reports what would change but makes no changes) — it does not make the module idempotent in subsequent runs. `replace: block` replaces the entire configuration block and can cause unintended changes.

Question 23

A network engineer uses NETCONF to retrieve the running configuration of a Cisco IOS-XE router. Which NETCONF operation and RPC element correctly retrieves the running datastore?

Accepted Answer

The NETCONF `` operation is used to retrieve configuration data from a specific datastore. The `` element specifies `` to retrieve the running configuration. The complete RPC is wrapped in `` and `` tags with a message-id attribute. `` (Option B) retrieves both configuration and state data but does not take a datastore source — it uses `` to select specific data, and `type='running'` is not a valid filter attribute. `` is not a valid NETCONF operation. `` copies from one datastore to another (e.g., running to startup) — it does not retrieve data.

Question 24

A network engineer writes an EEM (Embedded Event Manager) applet on a Cisco router to automatically send a syslog message whenever interface GigabitEthernet0/0 goes down. Which IOS configuration correctly implements this?

Accepted Answer

The EEM `event syslog pattern` event detector triggers the applet when a syslog message matching the specified regular expression appears. IOS generates syslog messages such as '%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down' when an interface goes down — matching this with a pattern is the standard EEM approach. Option A attempts to use `event interface` with `parameter linkstate`, which is not valid EEM syntax in standard IOS (the correct IOS event is `event syslog` or `event track`). Option C uses IP SLA tracking, which requires a separate `track` object configuration. Option D uses `event none` (manual trigger) and an invalid `cli command` syntax.

Question 25

A Python script uses the `ncclient` library to connect to a Cisco IOS-XE router via NETCONF and edit the device configuration. The script calls `manager.edit_config(target='running', config=xml_payload)`. Which NETCONF capability must the device advertise (in its hello message) for the script to edit the running datastore directly?

Accepted Answer

The NETCONF `writable-running` capability (urn:ietf:params:netconf:capability:writeable-running:1.0) allows a NETCONF client to write directly to the running datastore using `<edit-config>`. Without this capability, only the candidate datastore can be written to (if supported). The base capability (1.0 or 1.1) is required for basic NETCONF operation but does not specifically allow editing the running datastore. The `candidate` capability allows edits to a candidate datastore (a copy of running) which can then be committed. The `rollback-on-error` capability defines error handling behavior on edit-config failures.

350-401 ENCOR — Cisco Certified Network Professional (CCNP) Enterprise