SkillTestPro | CCNP 350-401 ENCOR Practice Test 1

CCNP ENCOR 350-401 Practice Test 1 (Hard)

CCNP Enterprise logo

1 / 90

In a two-tier (collapsed core) campus architecture, which layer combines the traditional distribution and core layer functions into a single layer?

The leaf layer

The collapsed core (distribution/core) layer

The WAN edge layer

The access layer

The data center core layer

The spine layer

2 / 90

Which Cisco SD-Access fabric component is responsible for encapsulating and forwarding traffic between fabric edge nodes using VXLAN?

The fabric control plane (LISP)

The fabric policy plane (Cisco TrustSec/SGT)

The identity services engine alone

The border node alone

The fabric management plane (DNA Center)

The fabric data plane (VXLAN)

3 / 90

Which Cisco SD-Access fabric component uses LISP to maintain a mapping of endpoint identity to its current location within the fabric?

The fabric control plane (LISP)

The fabric policy plane (Cisco TrustSec/SGT)

The fabric management plane (DNA Center)

The fabric edge node alone

The intermediate node alone

The fabric data plane (VXLAN)

4 / 90

On a Cisco IOS-XE switch, which type of VLAN interface is required to allow inter-VLAN routing to occur on a Layer 3 switch, without using a router-on-a-stick configuration?

An access port alone

A trunk port alone

An EtherChannel port alone

A switch virtual interface (SVI)

A routed port alone

A subinterface alone

5 / 90

Which First Hop Redundancy Protocol (FHRP) is a Cisco-proprietary protocol that allows multiple routers to share a virtual IP and MAC address, with one active and others in standby?

BFD

LACP

GLBP alone

HSRP (Hot Standby Router Protocol)

STP

VRRP

6 / 90

Which First Hop Redundancy Protocol allows multiple routers to simultaneously load balance traffic across all group members, rather than having only one active router at a time?

HSRP

VRRP

GLBP (Gateway Load Balancing Protocol)

BFD

LACP

STP

7 / 90

Which technology allows a network to detect a link or forwarding failure between two adjacent devices much faster than standard routing protocol hello timers alone?

NAT

HSRP

LACP

GLBP

BFD (Bidirectional Forwarding Detection)

STP

8 / 90

Which wireless LAN controller deployment model has APs establish a CAPWAP tunnel to a controller that may be located anywhere in the network, rather than in the same physical location?

A mesh deployment alone

A FlexConnect (local mode at branch) deployment

An embedded wireless deployment alone

A mobility express deployment alone

An autonomous AP deployment

A centralized (cloud-based or centralized) WLC deployment

9 / 90

Which QoS mechanism identifies and categorizes traffic, typically at the network edge, so that appropriate policies can later be applied to it?

Traffic policing alone

Queuing and scheduling

Congestion avoidance

Compression alone

Classification and marking

Traffic shaping alone

10 / 90

Which QoS mechanism drops or delays traffic that exceeds a defined rate, either dropping excess traffic (policing) or buffering it for later transmission (shaping)?

Compression alone

Classification and marking

Link aggregation alone

Queuing and scheduling

Traffic policing and shaping

Congestion avoidance

11 / 90

Which Cisco SD-WAN component is responsible for actually forwarding data plane traffic at a branch site, based on policy received from the control plane?

vBond

An edge device (cEdge or vEdge router)

A vPortal

vManage

vSmart

vAnalytics

12 / 90

Which cloud connectivity model involves an organization purchasing a dedicated, private circuit directly to a cloud provider's network, bypassing the public internet?

A satellite-based connectivity model

A standard internet-based VPN model

A standard cellular data connectivity model

A standard public internet browsing model

A dial-up connectivity model

A direct connect (private connectivity) model

13 / 90

Which term describes a network architecture where campus, branch, WAN, and cloud connectivity are all managed through a single, unified, intent-based approach?

An intent-based networking (IBN) architecture

A purely manual, undocumented configuration approach

A single-vendor-only hardware requirement

A traditional CLI-based, device-by-device management approach

A hardware-only architecture with no software component

A purely physical, non-virtualized architecture

14 / 90

Which Cisco DNA Center concept describes a hierarchical representation of an organization's physical locations, such as areas, buildings, and floors, used to organize network devices?

The topology map alone (a related visualization, but distinct from the organizational hierarchy concept itself)

The service catalog alone

The command runner alone

The device inventory alone

The site hierarchy

The policy matrix alone

15 / 90

Which architecture consideration involves designing a network so that a single misconfiguration or failure in one module does not cascade and affect unrelated parts of the network?

Cost optimization alone

Simplicity alone

High availability alone (a related but distinct benefit focused on redundancy rather than isolation specifically)

Vendor interoperability alone

Scalability alone

Fault isolation (a benefit of modularity and hierarchical design)

16 / 90

Which Cisco wireless architecture term describes a scenario where multiple access points work together to extend Wi-Fi coverage without requiring a wired connection at every single access point?

FlexConnect mode alone

Embedded Wireless Controller mode alone

A centralized WLC deployment alone (assumes wired connectivity to each AP)

Cisco Mobility Express alone

A wireless mesh network

An autonomous AP deployment alone

17 / 90

Which term describes an organization's overall approach to ensuring new network designs and technologies are properly tested and validated before being deployed into the live production environment?

A one-time configuration backup

Immediate, untested production rollout

A basic hardware unboxing checklist alone

A proof of concept (PoC) or pilot deployment

A basic ping test alone

A single vendor sales presentation alone

18 / 90

Which architecture principle recommends designing systems and processes so that human error has a reduced likelihood of causing a significant, network-wide outage?

Cost optimization alone

Single point of failure design alone (the opposite of what fail-safe design aims to avoid)

Vendor lock-in alone (a risk to be avoided, not a design principle to pursue)

Manual-only configuration alone (the opposite of a fail-safe, automation-supported approach)

Undocumented configuration alone

Fail-safe design

19 / 90

Which term describes a network architecture decision to standardize on a consistent hardware platform and software version across similar network roles, simplifying operations?

Cost optimization alone

Platform standardization

Modularity alone (a related but distinct broader design principle)

High availability alone

Vendor lock-in alone (a potential risk, not the same concept as intentional platform standardization for operational simplicity)

Scalability alone

20 / 90

Which Cisco SD-Access concept describes the specific policy applied to control communication between different Scalable Groups within the fabric?

A VLAN-based segmentation policy alone

A QoS policy alone

A group-based access control policy (using SGACLs)

A NAT policy alone

A routing policy alone

A VRF-based segmentation policy alone (a related, coarser Layer 3 segmentation mechanism, distinct from the finer-grained group-based policy)

21 / 90

Which term describes an organization's practice of periodically re-evaluating whether its current network architecture still meets evolving business requirements, adjusting the design as needed?

A single software upgrade alone

Architecture lifecycle review

A single vendor contract renewal alone

A single hardware refresh alone (a related but narrower activity than the broader architectural review)

A single physical security inspection alone

A one-time initial design phase alone

22 / 90

Which term describes a WAN edge design where a single router or device handles both traditional WAN connectivity and integrated security functions, such as a firewall and IPS?

A basic hub-and-spoke topology alone

A basic leased line alone

MPLS alone (a specific transport technology, not this broader unified edge/security concept)

A Secure Access Service Edge (SASE) or a unified WAN edge/security platform

A basic full-mesh topology alone

A traditional, separate router-and-firewall design alone (the older approach being contrasted against this more unified concept)

23 / 90

Which Kubernetes concept describes a persistent storage resource that exists independently of any single pod's lifecycle, allowing data to survive a pod restart?

A ConfigMap

A ReplicaSet

A Persistent Volume (PV)

A Secret

A Namespace

A DaemonSet

24 / 90

Which Kubernetes object stores non-sensitive configuration data, such as environment variables, separately from application code, allowing it to be updated without rebuilding a container image?

A DaemonSet

A Secret (used specifically for sensitive data, rather than general configuration)

A ConfigMap

A Namespace

A Persistent Volume

A ReplicaSet

25 / 90

Which Kubernetes object is specifically designed to store sensitive data, such as passwords or API keys, in a slightly more protected way than a ConfigMap?

A DaemonSet

A Namespace

A Persistent Volume

A ConfigMap (used for general, non-sensitive configuration)

A ReplicaSet

A Secret

26 / 90

Which Kubernetes object ensures that a copy of a specific pod runs on every node (or a selected subset of nodes) in a cluster, commonly used for logging or monitoring agents?

A Persistent Volume

A Namespace

A ReplicaSet (ensures a specified number of pod replicas total, not necessarily one per node)

A Secret

A DaemonSet

A ConfigMap

27 / 90

Which Kubernetes concept provides a way to logically divide a single cluster's resources among multiple teams or projects, isolating their objects from one another?

A Namespace

A Secret

A ReplicaSet

A DaemonSet

A ConfigMap

A Persistent Volume

28 / 90

Which virtualization concept describes a hypervisor dynamically adjusting the amount of RAM allocated to a virtual machine based on its actual current usage, rather than a fixed static allocation?

Memory ballooning (dynamic memory allocation)

Resource reservation alone (guarantees a fixed minimum, rather than describing dynamic adjustment)

A VM template alone

Live migration alone

A VM snapshot alone

NIC virtualization alone

29 / 90

Which term describes packaging an entire application stack, including its container images, configuration, and deployment instructions, into a single reusable unit for Kubernetes?

A DaemonSet alone

A Namespace alone

A Dockerfile alone (defines how to build one specific container image, a narrower scope than a full application stack)

A ConfigMap alone

A Helm chart

A Secret alone

30 / 90

Which term describes a virtualized environment's ability to automatically detect a failed physical host and restart its virtual machines on a different, healthy host?

A VM snapshot alone

NIC virtualization alone

Live migration alone (a planned, proactive move of a running VM, distinct from this automatic failure-response mechanism)

A VM template alone

Resource pooling alone

High availability (HA) clustering for virtual machines

31 / 90

In OSPF, which link-state advertisement (LSA) type is originated by an Area Border Router (ABR) to advertise routes for networks in one area into another area?

Type 3 (Summary LSA)

Type 2 (Network LSA)

Type 1 (Router LSA)

Type 4 (ASBR Summary LSA)

Type 5 (AS External LSA)

Type 7 (NSSA External LSA)

32 / 90

Which OSPF area type blocks Type 5 external LSAs but still allows a Type 4 ASBR Summary LSA and Type 3 summaries, if an ASBR exists reachable via another area?

Backbone area (Area 0)

Totally NSSA

Stub area (non-totally-stubby)

Regular (non-stub) area

A standard stub area does not permit an internal ASBR at all; this behavior (blocking Type 5 but still needing ASBR reachability info from elsewhere) actually describes a not-so-stubby area (NSSA) receiving external routes as Type 7, translated to Type 5 by the ABR

Totally stubby area

33 / 90

Two OSPF routers on the same multi-access segment fail to form a full adjacency and remain stuck in the 2-Way state. Both are non-DR/BDR routers. What is the most likely explanation?

A hello/dead timer mismatch is preventing the adjacency from progressing past 2-Way

The interface network type is misconfigured as point-to-point

Authentication is misconfigured on one of the two routers

An MTU mismatch is preventing the DBD exchange from completing

This is expected/normal behavior: on a broadcast multi-access network, DROTHER routers only form full adjacencies with the DR and BDR, not with each other

The routers are in different OSPF areas

34 / 90

Which EIGRP metric component, by default, has the greatest influence on the composite metric calculation in most typical configurations?

MTU

Hop count

Bandwidth (of the slowest link in the path) combined with cumulative delay - by default only these two components (K1=K3=1, others 0) are used

Load

Delay alone, independent of bandwidth

Reliability

35 / 90

In EIGRP, what is a 'feasible successor' for a given destination route?

A neighbor with a reported distance equal to the feasible distance

Any neighbor that advertises the destination prefix at all, regardless of its reported metric

A neighbor whose reported distance (advertised metric) to the destination is less than the local router's feasible distance via the current successor, making it a loop-free backup path usable immediately without recomputation

A statically configured floating route used only when EIGRP fully loses the route

A backup path that requires a full DUAL query/reply cycle before it can be used

The current best (lowest metric) path to the destination, currently installed in the routing table

36 / 90

When configuring eBGP between two routers in different autonomous systems that are not directly connected (multihop eBGP), what must typically be configured in addition to the neighbor statement?

An EIGRP redistribution statement importing all eBGP routes automatically

A GRE tunnel is mandatorily required for any multihop eBGP session

A loopback interface configured as the BGP router-id only

A route-map applying 'set weight' on every prefix received from the neighbor

The 'next-hop-self' command configured on the remote peer only

The 'ebgp-multihop' option (with an appropriate TTL value) and an IGP or static route providing reachability to the neighbor's non-directly-connected address

37 / 90

By default, when a BGP router receives multiple paths to the same prefix, which attribute is evaluated first in the standard BGP best-path selection process (after confirming the path is valid and the next hop is reachable)?

Local Preference

Origin code

Multi-Exit Discriminator (MED)

AS-Path length

Weight (Cisco-proprietary, highest preferred, local to the router)

Router ID value

38 / 90

An administrator redistributes OSPF routes into EIGRP without specifying a metric. What happens by default on most current IOS/IOS-XE implementations?

The route is redistributed using the default administrative distance value as the metric

The redistribution command is rejected or the routes are not injected until a default seed metric (or explicit 'metric' keyword values) is configured for the redistributed routes

The router automatically converts OSPF cost to an equivalent bandwidth/delay pair without any admin input

Redistribution succeeds using EIGRP's minimum possible metric so the routes are always preferred

The OSPF routes are redistributed using OSPF's own cost value directly as the EIGRP metric

EIGRP automatically assigns a metric of infinity, effectively blackholing the routes silently

39 / 90

On an 802.1Q trunk link between two Cisco switches, what happens to frames belonging to the native VLAN?

They are encapsulated with ISL instead of 802.1Q automatically

They are sent untagged across the trunk by default, while frames for all other VLANs carried on the trunk are tagged with an 802.1Q header

They are duplicated and sent on every VLAN configured on the trunk

Sent with an 802.1Q priority tag but no VLAN ID field

They are dropped unless 'vlan dot1q tag native' is explicitly disabled

They are always tagged with VLAN ID 1 regardless of the configured native VLAN

40 / 90

Which EtherChannel negotiation protocol is Cisco-proprietary and uses 'active'/'passive' modes to dynamically negotiate and maintain a bundle?

VTP (VLAN Trunking Protocol)

UDLD (UniDirectional Link Detection)

PAgP (Port Aggregation Protocol) - note: PAgP actually uses 'desirable'/'auto', while LACP uses 'active'/'passive'; the protocol using active/passive is LACP, an IEEE open standard, not Cisco-proprietary

DTP (Dynamic Trunking Protocol)

STP (Spanning Tree Protocol)

LACP (Link Aggregation Control Protocol)

41 / 90

In Rapid PVST+ (802.1w per-VLAN), which port role is assigned to a non-designated, non-root port on a switch that provides a backup path to the SAME segment as another port on the SAME switch (not toward the root)?

Edge port

Backup port

Root port

Designated port

Disabled port

Alternate port

42 / 90

What is the primary purpose of enabling BPDU Guard on a switchport configured as a spanning-tree PortFast edge port?

To automatically enable PortFast on all other switchports in the same VLAN

To rate-limit BPDU traffic rather than block the port entirely

To automatically negotiate trunk encapsulation on the port when a switch is detected

To speed up convergence by allowing the port to skip the listening and learning states permanently for all traffic types, including inter-switch links

To prevent the port from ever transmitting its own BPDUs while still processing received ones normally

To immediately error-disable the port if it receives a BPDU, protecting against an accidental or malicious switch/bridge being connected to what should be an end-host-only port

43 / 90

Which spanning-tree protection feature prevents a switch from becoming the root bridge for a VLAN by forcing a port to enter a discarding/blocking state if a superior BPDU is received on it?

UplinkFast

Loop Guard

BPDU Filter

Root Guard

BackboneFast

PortFast

44 / 90

What is the main security benefit of configuring a private VLAN (PVLAN) isolated port compared to a standard access port in the same VLAN?

Isolated ports can communicate with community ports but not with the promiscuous port

Isolated ports can communicate with the promiscuous port (e.g., a default gateway) but cannot communicate directly with each other or with community ports, even though they may share the same primary VLAN

Isolated ports automatically apply a dynamic ACL blocking all inbound traffic from the WAN

Isolated ports are placed in a completely separate VLAN with its own IP subnet from all other PVLAN port types

Isolated ports encrypt all traffic to the promiscuous port using MACsec by default

Isolated ports can communicate freely with all other ports in the same primary VLAN, including other isolated ports

45 / 90

When two switches are connected via an EtherChannel bundle carrying multiple VLANs, and STP is enabled, how many spanning-tree instances (in Rapid PVST+) treat the EtherChannel as a single logical link for topology calculations?

Only the VLAN matching the native VLAN of the trunk participates in STP over the EtherChannel

A separate spanning-tree instance is created specifically for the EtherChannel logical interface, independent of per-VLAN instances

All active VLAN spanning-tree instances treat the entire EtherChannel bundle as one logical link/port, not as separate individual physical links

Each physical link in the bundle is treated as a separate STP port with its own independent state per VLAN

STP treats the EtherChannel as a shared/hub segment requiring a backup port role

STP is automatically disabled on any interface that is a member of an EtherChannel

46 / 90

A switchport is configured as an access port in VLAN 10, but the connected VLAN 10 SVI is administratively down. What happens to hosts connected to that access port from a Layer 2 forwarding perspective?

Layer 2 switching within VLAN 10 continues to function normally between hosts in that VLAN on that switch, since SVI state affects Layer 3 (routing) reachability, not intra-VLAN Layer 2 forwarding

ARP requests within VLAN 10 are dropped by the switch's control plane globally

The switch automatically shuts down the physical access ports until the SVI recovers

Layer 2 forwarding within VLAN 10 stops completely until the SVI is brought back up

All access ports in VLAN 10 are automatically placed into an err-disabled state

The switch automatically reassigns those ports to the native VLAN of the nearest trunk

47 / 90

In wireless RF design, what does a higher Signal-to-Noise Ratio (SNR) value generally indicate about link quality?

The number of access points detected on the same channel within range

The number of spatial streams supported by the client radio

The specific channel width (20/40/80 MHz) currently in use by the client

The exact transmit power level configured on the access point, expressed in dB

A stronger, cleaner signal relative to background noise, generally correlating with higher achievable data rates and more reliable connectivity

A weaker signal that is more susceptible to interference and likely to result in lower data rates

48 / 90

Which Cisco lightweight access point mode continues to switch client data traffic locally at the AP and can also perform local authentication, specifically for use when the AP's connection back to the WLC is lost or intentionally centralized only for control traffic?

Monitor mode

Local mode

SE-Connect mode

FlexConnect mode

Rogue Detector mode

Sniffer mode

49 / 90

During the CAPWAP AP join process, what is the primary purpose of the AP discovering and selecting a Wireless LAN Controller before forming the CAPWAP tunnel?

To negotiate the RF channel and power settings directly with neighboring access points via peer-to-peer signaling

To register the AP's MAC address with an external RADIUS server before any WLC contact occurs

To obtain an IP address exclusively via static configuration, bypassing DHCP entirely

To download a full copy of the WLAN client database from every controller in the mobility group

To identify a controller that can authenticate/authorize the AP and provide the configuration, software image, and control-plane relationship needed for the AP to become operational

To establish a direct 802.1X supplicant session between the AP and the nearest upstream switch only

50 / 90

What distinguishes Layer 3 roaming from Layer 2 roaming for a wireless client moving between access points joined to the same WLC (or mobility group)?

In Layer 3 roaming, the client moves to an AP whose associated VLAN/subnet differs from its original one, so the controller must maintain reachability (e.g., via anchor/foreign controller relationship or tunneling) to preserve the client's original IP address

Layer 3 roaming is only possible if the client disables its wireless radio and re-enables it manually

Layer 2 roaming is only supported when all APs are in Monitor mode

Layer 3 roaming only occurs when the client physically leaves the RF coverage area entirely and reconnects later

Layer 2 roaming requires the client to obtain a new IP address via DHCP every time it associates to a new AP

Layer 3 roaming requires the client to re-authenticate via a completely new SSID

51 / 90

A wireless client reports intermittent connectivity and the administrator suspects excessive co-channel interference. Which troubleshooting action most directly addresses this specific symptom?

Increase the WLAN's maximum client count configured on the SSID

Review and adjust the RF channel plan (e.g., via RRM or manual channel assignment) to reduce the number of APs using the same or overlapping channels within range of each other

Increase the CAPWAP control-plane keepalive interval between the AP and WLC

Change the wireless security method from WPA2 to WPA3 on the SSID

Increase the AP's transmit power to overpower neighboring APs on the same channel

Enable band select to force all clients onto the 2.4 GHz band exclusively

52 / 90

On a Cisco router or switch configured as an NTP client, what does the 'stratum' value associated with its time source represent?

The number of NTP servers currently configured on the client, regardless of reachability

The encryption strength (in bits) used to authenticate NTP packets between client and server

The version number of the NTP protocol in use

The number of hops (in terms of NTP reference chain) the device's time source is from an authoritative reference clock (stratum 0), with lower stratum numbers indicating a source closer to the authoritative clock

The maximum allowable clock drift, in milliseconds, before the client resynchronizes

The physical distance in kilometers between the NTP client and its configured NTP server

53 / 90

When configuring NAT overload (PAT) on a Cisco router for a branch office, what uniquely distinguishes multiple internal hosts sharing the same single translated public IP address?

The combination of translated source port number (assigned uniquely per session) along with the shared public IP address, allowing the router to map return traffic back to the correct internal host and port

Each internal host is assigned a distinct public IP address from a pool, defeating the purpose of address overloading

The internal hosts' original MAC addresses are preserved and used by the router to distinguish sessions

The router relies solely on the internal hosts' TTL values to differentiate their sessions

A separate NAT table is maintained per VLAN with no reliance on port numbers at all

The internal host's DHCP lease time

54 / 90

In an HSRP (Hot Standby Router Protocol) group, what is the role of the 'preempt' configuration on a router?

It allows a router with a higher configured priority to take over the Active role from a currently Active router with lower priority once it becomes available, rather than remaining Standby indefinitely

It determines which router responds to ARP requests for the virtual IP by default

It forces the router to immediately become Active regardless of its configured priority value

It controls how frequently HSRP hello packets are sent, independent of priority

It disables HSRP hello messages to reduce control-plane overhead once a stable Active/Standby pair is established

It is required before HSRP virtual MAC addresses can be assigned to any group member

55 / 90

What is the key functional difference between SPAN and RSPAN on Cisco switches?

SPAN mirrors traffic to a destination port on the SAME local switch, while RSPAN carries mirrored traffic across a Layer 2 network to a destination port on a DIFFERENT switch using a dedicated RSPAN VLAN

SPAN can mirror traffic from any switch in the network while RSPAN is limited to one switch

SPAN requires a Layer 3 routed path between source and destination while RSPAN does not

RSPAN is limited to mirroring a single VLAN's traffic while SPAN can mirror multiple VLANs simultaneously

RSPAN encrypts mirrored traffic by default while SPAN does not

SPAN can only mirror ingress traffic while RSPAN can only mirror egress traffic

56 / 90

What additional capability does ERSPAN provide compared to RSPAN?

ERSPAN encapsulates mirrored traffic in GRE, allowing it to be transported across a routed (Layer 3) network to a remote traffic analyzer, rather than being confined to a Layer 2 domain

ERSPAN can only be configured on Nexus switches and is unavailable on IOS-XE platforms

ERSPAN requires no VLAN or GRE configuration at all, unlike RSPAN's VLAN requirement

ERSPAN automatically compresses mirrored packets to reduce bandwidth consumption

ERSPAN is capable of mirroring traffic only from wireless access points, unlike RSPAN

ERSPAN can only mirror control-plane traffic, while RSPAN mirrors only data-plane traffic

57 / 90

Which syslog severity level corresponds to messages indicating the system is unusable, representing the most critical condition?

Severity 3 - Error

Severity 0 - Emergency

Severity 1 - Alert

Severity 7 - Debugging

Severity 4 - Warning

Severity 2 - Critical

58 / 90

What is a key advantage of Flexible NetFlow over traditional (original) NetFlow on Cisco devices?

Flexible NetFlow eliminates the need for a flow exporter or collector entirely

Flexible NetFlow requires dedicated hardware NetFlow cache modules not needed by traditional NetFlow

Flexible NetFlow only operates on wireless controllers and cannot be configured on routers or switches

Flexible NetFlow allows administrators to define custom flow records using configurable key and non-key fields, rather than being limited to a fixed, predefined 7-tuple flow definition

Flexible NetFlow requires IPv4 traffic exclusively and cannot track IPv6 flows

Flexible NetFlow disables sampling and always performs full flow accounting with zero performance impact

59 / 90

What does Cisco IP SLA primarily measure when configured with an ICMP echo operation between two network devices?

Round-trip time, packet loss, and reachability for the specific path being probed, useful for proactive performance monitoring and triggering actions like route changes via tracking objects

The current BGP AS-path length between the source and destination devices

The amount of available free memory on the responding device

The exact CPU utilization of the remote device responding to the ICMP echo

The total number of active TCP sessions transiting the path between the two devices

The exact routing protocol convergence time along the path

60 / 90

In SNMPv3, what security feature is available that is NOT present in SNMPv1 or SNMPv2c?

User-based authentication and optional encryption (privacy) of SNMP messages, via configurable security levels (noAuthNoPriv, authNoPriv, authPriv)

The ability to use community strings for read-only access

Support for trap messages sent to a network management station

The ability to be transported over UDP port 161 for polling operations

The ability to poll MIB objects at all

Support for the GetBulk PDU operation to retrieve multiple MIB objects efficiently

61 / 90

What is the purpose of a 'conditional debug' (e.g., using 'debug condition interface' or similar) on a Cisco IOS/IOS-XE device compared to an unconditional debug command?

It requires the device to be in ROMMON mode before conditional debugs can be applied

It restricts debug output to only the traffic or events matching a specified condition (such as a specific interface or IP address), reducing console/log overhead compared to enabling a debug for all traffic globally

It converts debug output into SNMP trap messages instead of console/log messages

It schedules debug output to run only during a specified maintenance window

It permanently disables all debugging on the device until a reload occurs

It automatically emails the debug output to a preconfigured administrator address

62 / 90

Which northbound interface protocol pairing is most accurate: NETCONF uses which encoding, and RESTCONF uses which encoding(s), for configuration data typically modeled in YANG?

NETCONF uses JSON exclusively over HTTP, while RESTCONF uses XML exclusively over SSH

Both NETCONF and RESTCONF exclusively use YAML encoding for all payloads

RESTCONF requires a dedicated TCP port distinct from HTTP/HTTPS and cannot share port 443

NETCONF uses SNMP as its transport, while RESTCONF uses NETCONF as its transport

NETCONF primarily uses XML encoding over SSH, while RESTCONF supports both XML and JSON encoding over HTTP/HTTPS

NETCONF and RESTCONF both exclusively use binary protobuf encoding for payloads

63 / 90

In an AAA deployment using TACACS+, what is a key architectural difference from RADIUS regarding how authentication and authorization are handled?

TACACS+ operates exclusively over UDP while RADIUS operates exclusively over TCP

RADIUS encrypts the entire packet body by default while TACACS+ only encrypts the password field

RADIUS is Cisco-proprietary while TACACS+ is an open IETF standard

TACACS+ separates authentication and authorization into distinct, separately controllable processes/packets, whereas RADIUS combines authentication and authorization into a single access-request/access-accept exchange

TACACS+ only supports authorization and cannot perform authentication at all

RADIUS separates authentication and authorization while TACACS+ combines them into one exchange

64 / 90

What is the primary purpose of Control Plane Policing (CoPP) on a Cisco router or switch?

To provide QoS marking and shaping for traffic exiting a WAN interface toward remote sites

To encrypt all transit (data-plane) traffic passing through the device

To prioritize voice traffic over data traffic across the WAN using DSCP remarking

To replace ACLs entirely for controlling which hosts can reach the network

To limit the number of MAC addresses learned on an access port

To protect the device's control plane (CPU) from being overwhelmed by excessive or malicious traffic destined to the device itself, by applying rate-limiting/policy to control-plane-bound packets

65 / 90

When configuring a named extended IP ACL to permit only HTTPS traffic from a specific subnet to a specific server, which element is essential in the access-list entry?

Matching only on the source MAC address of the subnet's default gateway

Matching on the TCP protocol with destination port 443, along with the correct source subnet/wildcard and destination host address

Specifying the DSCP value used by the web server's return traffic

Matching on TCP port 80 since HTTPS is a subset of HTTP traffic

Matching on UDP port 443 rather than TCP port 443

Referencing the destination server's fully qualified domain name directly in the ACL entry

66 / 90

In 802.1X port-based authentication, what is the role of the 'supplicant'?

The network device (switch) that relays authentication requests between the client and the authentication server

The network management system that monitors 802.1X session status across the fabric

The end-device (client) software/component that provides credentials to be authenticated before being granted network access through the port

The certificate authority that issues X.509 certificates used in EAP-TLS exchanges

The policy engine that decides which VLAN to assign after authentication

The RADIUS or TACACS+ server that ultimately validates the credentials and returns an authentication decision

67 / 90

Which wireless authentication method is characterized by the client and access point/controller both deriving keys from a shared passphrase, without a per-user RADIUS exchange, making it best suited for smaller deployments rather than enterprise-scale identity-based access?

WebAuth (web-based authentication redirect)

EAP-TLS with mutual certificate authentication

WPA2/WPA3 Enterprise (802.1X/EAP)

EAP-FAST with Protected Access Credentials

Open System Authentication with no encryption

WPA2/WPA3 Personal (PSK - Pre-Shared Key)

68 / 90

What is the purpose of a DMZ (demilitarized zone) in a network security design that includes a firewall?

To function exclusively as the physical location of the organization's core routers with no security policy applied

To store backup configuration files for all firewalls in the organization

To replace the need for any firewall rules between internal and external networks entirely

To host externally accessible services (e.g., public web or email servers) in a segregated zone with restricted access to and from both the internal trusted network and the untrusted external network

To provide unrestricted, unfiltered connectivity between the internal network and the internet for troubleshooting purposes

To serve as the primary internal VLAN where all end-user workstations are placed for simplified management

69 / 90

In a Cisco next-generation firewall (or zone-based firewall) design, what does a 'zone pair' define?

A pair of redundant physical firewall appliances configured for high availability failover

A configuration linking two NTP servers for redundant time synchronization on the firewall

The specific security policy relationship and permitted traffic direction between two defined security zones (e.g., inside-to-outside), including the inspection/action rules applied to traffic crossing between them

A matched pair of VLANs that must always share the identical IP subnet

A pairing between two ACL sequence numbers used purely for documentation purposes

A pairing of two interfaces bundled together for load balancing

70 / 90

When securing access to a REST API exposed by a network controller (e.g., Cisco DNA Center), which mechanism is commonly used to authenticate API calls after an initial login, without re-sending the username/password on every request?

A token (such as a bearer token obtained after authentication) included in the Authorization header of subsequent API requests

A one-time WEP key generated fresh for each individual API request

The client's DNS hostname, resolved and validated by the controller on every call

A cookie set by the browser that expires after 24 hours regardless of activity

The client's source MAC address, which the controller uses as the sole authentication credential for all API calls

A shared SNMP community string embedded in the URL of each API request

71 / 90

What is a key difference between a standard IP ACL and an extended IP ACL on Cisco devices?

A standard ACL can filter by protocol and port while an extended ACL can only filter by source address

A standard ACL can only match on source IP address, while an extended ACL can match on source and destination IP address, protocol, and port information

Extended ACLs are limited to exactly 99 entries while standard ACLs support unlimited entries

A standard ACL supports stateful inspection while an extended ACL is always stateless

An extended ACL cannot be given a name, only a number, while a standard ACL supports named configuration

A standard ACL can be applied only outbound while an extended ACL can be applied only inbound

72 / 90

Which EAP type relies on mutual authentication using X.509 digital certificates on both the client (supplicant) and the authentication server, generally considered one of the strongest EAP methods but requiring a PKI deployment?

EAP-MD5

LEAP (Lightweight EAP)

EAP-FAST

EAP-TLS

PEAP-MSCHAPv2

PEAP (Protected EAP)

73 / 90

What does 'device hardening' typically include as a baseline security practice for network infrastructure devices?

Disabling unused services and interfaces, enforcing strong authentication, applying the principle of least privilege for administrative access, and keeping software/firmware patched

Disabling all logging and SNMP to reduce the device's attack surface entirely

Configuring every interface as a trunk port to simplify VLAN management

Enabling every available service and protocol on the device by default to maximize compatibility with future features

Removing all local user accounts, including administrative fallback accounts, to prevent local login

Configuring all management access exclusively over unencrypted Telnet for simplicity

74 / 90

In wireless security, what is the primary weakness of WEP (Wired Equivalent Privacy) that led to its deprecation in favor of WPA/WPA2/WPA3?

WEP requires a dedicated RADIUS server for every deployment, making it impractical for small networks

WEP can only be used with 2.4 GHz radios and is fundamentally incompatible with 5 GHz spectrum

WEP does not support any form of encryption at all, transmitting all wireless traffic in plaintext

WEP mandates the use of open authentication only and cannot be paired with any shared-key mechanism

WEP uses a static, relatively short RC4 key and a weak initialization vector (IV) scheme, making it vulnerable to key recovery through statistical cryptanalysis of captured traffic

WEP keys are transmitted in cleartext alongside the encrypted payload

75 / 90

What is the purpose of Dynamic ARP Inspection (DAI) on a Cisco switch?

To automatically detect and shut down any port using more than one VLAN

To dynamically assign IP addresses to hosts in place of a DHCP server

To rate-limit the number of ARP requests a host can send per second regardless of validity

To validate ARP packets against a trusted binding table (typically built from DHCP snooping) and drop ARP packets with invalid IP-to-MAC mappings, mitigating ARP spoofing/man-in-the-middle attacks

To replace Spanning Tree Protocol's loop-prevention function using ARP timing instead of BPDUs

To inspect and re-encrypt all Layer 3 routed traffic passing through the switch

76 / 90

When implementing Cisco TrustSec in an enterprise campus, what is the function of a Security Group ACL (SGACL)?

It replaces DHCP snooping as the mechanism for building the IP-to-MAC binding table

It functions only as a backup mechanism activated when RADIUS servers are unreachable

It defines permit/deny policy between Security Group Tags (SGTs), allowing access control decisions to be based on the roles/groups of source and destination traffic rather than solely on IP addresses

It defines the physical port assignment for each Security Group Tag

It is a physical ACL applied only to security camera VLANs within the campus

It defines the encryption algorithm used for MACsec links between switches

77 / 90

What is a key security consideration when exposing REST APIs on a network controller to external automation tools, beyond simply requiring authentication tokens?

Enforcing HTTPS/TLS for all API transport to protect credentials and data in transit, combined with role-based access control (RBAC) to limit what each authenticated token/user can do

Rotating the controller's IP address on a fixed schedule to prevent scanning

Allowing every authenticated user the same full administrative rights regardless of their intended automation task

Exposing the API only via SNMP traps rather than HTTP-based requests

Ensuring the API is reachable over plain HTTP for maximum compatibility with legacy automation scripts

Disabling all logging of API calls to minimize storage usage on the controller

78 / 90

In a security design using 802.1X with MAC Authentication Bypass (MAB) as a fallback, when is MAB typically invoked on a switchport?

MAB requires the connected device to have a valid digital certificate installed

MAB is only usable on trunk ports carrying multiple VLANs, never on access ports

MAB is attempted first, before any 802.1X EAP exchange is ever initiated on the port

When the connected device does not respond to 802.1X EAP requests within the configured timeout, indicating it likely lacks 802.1X supplicant capability (e.g., a printer or IP phone), prompting the switch to attempt authentication using the device's MAC address instead

MAB replaces the need for any RADIUS server, authenticating purely against a local switch database

MAB is triggered only when the switchport is manually shut down and re-enabled

79 / 90

Which data serialization format uses indentation and whitespace to represent structure, is considered highly human-readable, and is commonly used for Ansible playbooks?

XML

Protocol Buffers (protobuf)

JSON

YAML

CSV

INI

80 / 90

In a YANG data model, what is the purpose of a 'container' statement?

It groups related nodes (leaves, lists, other containers) into a single organizational structure within the model, without itself holding a value

It converts the YANG model automatically into an equivalent SNMP MIB at compile time

It encrypts the data held within the model's leaf nodes by default

It defines the specific transport protocol (NETCONF or RESTCONF) used to access the model

It specifies the maximum number of times a given node may repeat within the model

It defines a remote procedure call (RPC) that can be invoked on the device

81 / 90

When using Cisco DNA Center's REST API to retrieve a list of devices, which HTTP method is most appropriate for a read-only operation that does not modify any controller state?

POST

PATCH

DELETE

PUT

CONNECT

GET

82 / 90

What is a key architectural difference between Ansible and Puppet/Chef in terms of how they manage target devices?

Ansible requires a central master server that all nodes must poll continuously, like Puppet

Chef and Puppet do not support any form of idempotent configuration application, unlike Ansible

Puppet and Chef can only manage Windows-based infrastructure, while Ansible is Linux/Unix-only

Ansible playbooks must be written in Ruby, while Puppet manifests must be written in Python

Ansible requires a persistent agent on every managed device, while Puppet and Chef are entirely agentless

Ansible is agentless, typically using SSH (or an API) to push configuration to devices, while Puppet and Chef traditionally require an agent installed on the managed device that periodically pulls configuration from a central server

83 / 90

In Python, when using the 'requests' library to interact with a REST API, which method call would you use to submit a JSON payload to create a new resource on the server?

requests.head(url, json=payload)

requests.delete(url, json=payload)

requests.options(url, json=payload)

requests.post(url, json=payload)

requests.get(url, json=payload)

requests.put(url, json=payload) is the only correct method for any JSON submission

84 / 90

What is the primary function of an Embedded Event Manager (EEM) applet on a Cisco IOS/IOS-XE device?

To serve as the primary mechanism for pushing YANG-modeled configuration via NETCONF

To serve as a remote packet capture and analysis tool triggered by ACL matches

To act as a certificate authority issuing device identity certificates for 802.1X

To function as a graphical dashboard for visualizing network topology in real time

To define an event (such as a syslog match, interface state change, or CLI command execution) and an associated automated action (such as running CLI commands or sending a notification) directly on the device, without requiring an external controller

To replace SNMP entirely as the device's only supported monitoring protocol

85 / 90

Which statement accurately compares configuration management tools (e.g., Ansible, Puppet, Chef) to orchestration tools (e.g., Cisco NSO) in typical network automation use?

Orchestration tools can only manage a single device at a time, while configuration management tools manage entire fabrics simultaneously

Configuration management tools are always cloud-hosted, while orchestration tools are always on-premises

Configuration management tools focus on applying and maintaining consistent configuration state on individual devices, while orchestration tools coordinate and sequence workflows across multiple devices/services, often including dependency management and service-level abstraction

Configuration management tools require a GUI and cannot be invoked via CLI or API, unlike orchestration tools

Configuration management tools and orchestration tools are functionally identical and differ only in vendor branding

Orchestration tools cannot interact with YANG-modeled device interfaces under any circumstance

86 / 90

When comparing NETCONF/YANG-based automation to traditional CLI-based (screen-scraping) automation, what is a key advantage of the model-driven approach?

CLI screen-scraping automatically adapts to different software versions without any script changes required

Model-driven automation cannot be used to retrieve operational state, only configuration data

Model-driven automation eliminates the need for any authentication to the target device

CLI-based automation is inherently faster at scale than any model-driven NETCONF/YANG approach, in all cases

It provides a structured, well-defined data model with clear semantics for configuration and state data, reducing the fragility associated with parsing free-form, potentially version-dependent CLI output

Model-driven automation guarantees zero configuration drift without any verification step required

87 / 90

What is the purpose of idempotency in configuration management tools like Ansible?

Idempotency requires that tasks be executed in a randomized order on each run to avoid predictability

Idempotency guarantees that a playbook will run successfully even if the target device is completely unreachable

Idempotency is a security feature that encrypts all variables used within a playbook

Idempotency means a playbook can only be run one time ever, and will fail on any subsequent run

Idempotency means every playbook run must always make at least one change to the device, regardless of its current state

Applying the same playbook/task repeatedly against a device produces the same end-state result without making unnecessary or duplicate changes if the device is already in the desired state

88 / 90

In Cisco DNA Center automation workflows, what is the general purpose of an 'Intent API'?

To let an external system express a high-level desired outcome (the 'intent', such as provisioning a site or applying a policy) which DNA Center then translates into the specific device-level configuration needed to achieve it

To provide raw, unauthenticated SNMP access to every managed device for troubleshooting purposes

To provide direct CLI/SSH access to devices bypassing the DNA Center controller layer

To directly expose each device's running-configuration file as a downloadable text file with no abstraction

To function solely as a licensing and billing interface for DNA Center subscriptions

To replace the need for any device inventory within DNA Center

89 / 90

Which statement about JSON and XML as data formats used in network automation is accurate?

JSON generally uses less verbose syntax (key-value pairs with braces/brackets) compared to XML's tag-based structure, and is very commonly used with REST APIs, though both are capable of representing the same YANG-modeled hierarchical data

XML is exclusively used with SOAP-based APIs and has no association with NETCONF

JSON is a binary format requiring specialized parsing libraries, while XML is always plain text

XML is always more compact than JSON for the same dataset due to attribute-based encoding

XML cannot represent nested or hierarchical data structures, unlike JSON

JSON supports comments natively within the data itself, while XML does not permit any form of annotation

90 / 90

Which HTTP status code, when returned by a REST API, most directly indicates that a POST request succeeded and a new resource was created on the server?

204 No Content

200 OK

400 Bad Request

404 Not Found

301 Moved Permanently

201 Created

Your score is

The average score is 0%