CCIE Cisco Certified Internetwork Expert — Questions and Answers

Question 1: In a spine-leaf data center fabric design, what is the maximum number of hops between any two endpoints regardless of the fabric size?

3 hops (Correct answer)
4 hops
2 hops
1 hop

Correct answer: 3 hops

In spine-leaf, any endpoint connects to a leaf, traffic crosses one spine, and reaches the destination leaf — always exactly 3 hops, ensuring consistent, predictable latency.

Question 2: What is the Cisco Webex Calling architecture's cloud component that handles call control for cloud-registered devices?

Webex Cloud Call Control (formerly Broadworks/BroadCloud) (Correct answer)
Cisco CUBE cloud edition
Cisco CUCM in the cloud
Cisco Unity in the cloud

Correct answer: Webex Cloud Call Control (formerly Broadworks/BroadCloud)

Webex Calling's cloud call control (built on Broadworks) handles call routing, device registration, and features for cloud-registered IP phones and soft clients.

Question 3: What methods can be used to overcome IBGP full mesh requirement?(Choose Two)

Partial mesh
Point to point
Hub and spoke
Conferedation (Correct answer)
Route Reflector (Correct answer)

Correct answer: Conferedation

Route reflectors and confederations are two methods that can be used to overcome the IBGP full mesh requirement. 1. Route reflectors: In a full mesh IBGP network, every router needs to establish a direct BGP session with every other router. This can become impractical and difficult to manage in large networks. <br>Route reflectors address this issue by allowing routers to establish a BGP session with a selected set of route reflectors instead of every router in the network. The route reflectors then reflect the BGP updates to other routers, reducing the number of required BGP sessions. 2. Confederations: Similar to route reflectors, confederations also aim to reduce the number of required BGP sessions in large networks. In a confederation, the network is divided into smaller sub-autonomous systems, and each sub-autonomous system has its own internal BGP (IBGP) mesh. The sub-autonomous systems then establish external BGP (EBGP) sessions with routers in other sub-autonomous systems,

Question 4: A designer needs to segment a campus network so that finance and HR traffic is isolated at Layer 3 without deploying separate physical switches. Which technology best satisfies this requirement?

Port-based VLAN ACLs
VRF-Lite (Correct answer)
VLAN pruning on trunks
Private VLANs (PVLAN)

Correct answer: VRF-Lite

VRF-Lite creates multiple independent routing tables on a single router or Layer 3 switch, providing complete Layer 3 isolation between departments without additional hardware.

Question 5: In the context of Cisco UCS, what does "stateless computing" refer to?

Running applications without a stateful firewall
The use of cloud-based servers
Computing without the need for physical servers
The ability to manage server identities and configurations independently of physical hardware (Correct answer)

Correct answer: The ability to manage server identities and configurations independently of physical hardware

Stateless computing in Cisco UCS allows server identities, configurations, and policies to be abstracted from the physical hardware, enabling flexibility and ease of management.

Question 6: Which NETCONF operation retrieves the current running configuration from a network device?

<validate>
<commit>
<edit-config>
<get-config> with source=running (Correct answer)

Correct answer: <get-config> with source=running

The NETCONF <get-config> operation with source='running' retrieves the currently active configuration datastore from the device.

Question 7: What does CAC (Call Admission Control) prevent in a Cisco UC deployment?

Unauthorized user access to CUCM
Codec mismatch between endpoints
Over-subscription of WAN bandwidth by concurrent voice calls (Correct answer)
Toll fraud via dial plan manipulation

Correct answer: Over-subscription of WAN bandwidth by concurrent voice calls

CAC limits the number of concurrent calls over a WAN link to prevent voice quality degradation due to insufficient bandwidth.

Question 8: What is the primary difference between stateful and stateless firewalls?

Stateful firewalls track connection state; stateless only inspect individual packets (Correct answer)
Stateless firewalls support more protocols
Stateful firewalls only work at Layer 3
Stateful firewalls are faster

Correct answer: Stateful firewalls track connection state; stateless only inspect individual packets

Stateful firewalls maintain a connection table to track session state, allowing return traffic automatically; stateless firewalls inspect each packet in isolation.

Question 9: A network designer is choosing between VSS and StackWise Virtual for a campus core. What is the primary design advantage of VSS/StackWise Virtual over traditional dual-chassis designs using HSRP?

Elimination of STP blocked ports by enabling active-active forwarding (Correct answer)
Support for more VLANs per switch
Simplified SNMP trap configuration
Lower hardware cost per chassis

Correct answer: Elimination of STP blocked ports by enabling active-active forwarding

VSS and StackWise Virtual create a single logical switch that allows both uplinks to forward traffic simultaneously, eliminating STP-blocked ports and doubling usable bandwidth.

Question 10: What is the name given to the Firewall built into the Cisco IOS?

IPSEC
CBAC (Correct answer)
Lock and key
VPN
Access-list

Correct answer: CBAC

CBAC stands for Context-Based Access Control. It is a Feature built into the CISCO IOS firewall that provides advanced security capabilities. CBAC allows the firewall to inspect and control traffic based on the context of the connection, including the application layer protocols and state information. <br> It can dynamically open and close ports, keeping track of the state of the connection, and provides protection against various network attacks. CBAC is an important component of network security in Cisco devices and helps to prevent unaythorizes access and protect against potential threats

Question 11: In OSPF, what mechanism prevents routing loops by ensuring non-backbone areas communicate only through Area 0?

SPF algorithm
LSA flooding
DR/BDR election
Backbone requirement (Correct answer)

Correct answer: Backbone requirement

OSPF requires all non-backbone areas to connect to Area 0 (backbone), which prevents routing loops in multi-area OSPF designs.

Question 12: Which codec provides toll-quality voice at 64 kbps and is used as the baseline for voice quality in PSTN?

G.711 (Correct answer)
Opus
G.722
G.729

Correct answer: G.711

G.711 uses PCM at 64 kbps and provides toll-quality voice, serving as the baseline codec for PSTN and high-quality VoIP connections.

Question 13: In network automation, what is Infrastructure as Code (IaC) primarily about?

Automating hardware procurement
Converting network diagrams to code
Running code on network devices
Managing network configuration using version-controlled declarative definitions (Correct answer)

Correct answer: Managing network configuration using version-controlled declarative definitions

IaC treats network configurations as code stored in version control, enabling reproducible, auditable, and consistent infrastructure deployments.

Question 14: Which transport protocol is typically used by RTP (Real-time Transport Protocol) for voice media streams?

TLS
SCTP
UDP (Correct answer)
TCP

Correct answer: UDP

RTP uses UDP for voice media because UDP's lower overhead and lack of retransmission is better suited to real-time media than TCP's reliable delivery.

Question 15: Which Cisco technology provides identity-based network access control using 802.1X, MAB, and Web Auth?

Cisco ISE (Identity Services Engine) (Correct answer)
Cisco DNA Center
Cisco Firepower
Cisco ASA

Correct answer: Cisco ISE (Identity Services Engine)

Cisco ISE is a policy engine that provides identity-based access control using 802.1X, MAC Authentication Bypass (MAB), and Web Authentication.

Question 16: What transport protocol and port does NETCONF use by default?

TELNET/23
HTTPS/443
SSH/830 (Correct answer)
HTTP/80

Correct answer: SSH/830

NETCONF uses SSH as its transport with the IANA-assigned port 830, providing secure encrypted communication for network configuration.

Question 17: Which 802.11 amendment introduced OFDMA and multi-user MIMO for the 6 GHz band?

802.11ac
802.11ax (Wi-Fi 6/6E) (Correct answer)
802.11n
802.11ad

Correct answer: 802.11ax (Wi-Fi 6/6E)

IEEE 802.11ax (Wi-Fi 6/6E) introduced OFDMA and MU-MIMO for both uplink and downlink, with Wi-Fi 6E extending to the 6 GHz band.

Question 18: In PKI, what is the role of the Certificate Authority (CA)?

Managing firewall access control lists
Storing private keys for all devices
Encrypting data in transit
Signing and issuing digital certificates that bind identities to public keys (Correct answer)

Correct answer: Signing and issuing digital certificates that bind identities to public keys

A CA signs digital certificates that cryptographically bind an entity's identity to their public key, enabling trust in PKI-based authentication.

Question 19: What is the purpose of Cisco Catalyst Center's (DNA Center) Intent API?

Providing raw device CLI access
Configuring individual device interfaces directly
Abstracting network operations into business intent-level REST APIs (Correct answer)
Managing Cisco software licenses

Correct answer: Abstracting network operations into business intent-level REST APIs

The Cisco Catalyst Center Intent API provides abstracted, business-level REST APIs for network operations without requiring device-level configuration knowledge.

Question 20: In Cisco ASA failover, which unit actively processes traffic while the standby unit monitors health?

Primary unit
Active unit (Correct answer)
Master unit
Secondary unit

Correct answer: Active unit

In ASA Active/Standby failover, the active unit processes all traffic; the standby unit monitors via failover link and takes over if the active unit fails.

Question 21: In SIP, what is the purpose of the SDP (Session Description Protocol) body in an INVITE message?

Negotiating media parameters like codec, IP address, and port for RTP (Correct answer)
Routing the call through SIP proxies
Authenticating the calling party
Encrypting the call signaling

Correct answer: Negotiating media parameters like codec, IP address, and port for RTP

The SDP body in a SIP INVITE describes the media capabilities (codecs, IP, ports) that the calling party can support, initiating codec negotiation.

Question 22: What is the main advantage of using Cisco Fabric Path in a data center?

Layer 2 multipath Ethernet fabric (Correct answer)
Simplified VLAN management
Enhanced wireless coverage
Improved server cooling

Correct answer: Layer 2 multipath Ethernet fabric

Cisco Fabric Path provides a scalable, high-performance Layer 2 multipath Ethernet fabric for data center networks.

Question 23: Which QoS mechanism uses a token bucket algorithm to limit traffic bursts while allowing sustained rates?

FIFO
Traffic shaping (Correct answer)
Traffic policing
WRED

Correct answer: Traffic shaping

Traffic shaping buffers excess traffic and releases it smoothly using a token bucket, allowing short bursts without dropping packets.

Question 24: In the Cisco hierarchical network design model, which layer is responsible for routing between VLANs and applying QoS policies before traffic enters the core?

Access layer
Core layer
Distribution layer (Correct answer)
Collapsed core layer

Correct answer: Distribution layer

The distribution layer aggregates access-layer traffic, performs inter-VLAN routing, and applies QoS and policy enforcement before handing off to the core.

Question 25: What is the purpose of a Route Distinguisher (RD) in MPLS L3VPN?

Encrypting customer routes
Making overlapping customer IP prefixes unique in the BGP table (Correct answer)
Defining which routes to import into a VRF
Assigning MPLS labels

Correct answer: Making overlapping customer IP prefixes unique in the BGP table

An RD prepended to customer IPv4 prefixes creates unique VPNv4 routes, allowing BGP to differentiate between identical prefixes from different VPN customers.

Question 26: In Cisco ASA, what is the default security level for the 'inside' interface?

50
100 (Correct answer)
255
0

Correct answer: 100

The inside interface on Cisco ASA has a default security level of 100 (highest), while outside is 0 (lowest), controlling traffic flow.

Question 27: Which design approach uses a single routing process to provide both intra-area fast convergence and scalability across multiple areas in OSPF?

OSPF with all routers as ABRs
Hierarchical OSPF with multiple areas (Correct answer)
OSPF stub areas replacing all non-backbone areas
Flat OSPF with area 0 only

Correct answer: Hierarchical OSPF with multiple areas

Hierarchical OSPF with multiple areas limits LSA flooding scope per area, enabling fast local convergence while backbone area 0 provides scalability across the domain.

Question 28: In YANG modeling, what does the 'list' node type represent?

A read-only operational data node
A mandatory configuration parameter
A sequence of list entries each identified by key leaf(s) (Correct answer)
An ordered sequence of scalar values

Correct answer: A sequence of list entries each identified by key leaf(s)

A YANG 'list' node represents a sequence of list entries (like BGP neighbors or interfaces), each uniquely identified by one or more key leaf values.

Question 29: How can you only enable SSH connection on a Cisco Route for management?

Ssh enable
Transport output telnet
Transport input ssh (Correct answer)
No transport
Transport ssh

Correct answer: Transport input ssh

The correct answer is "transport input ssh." This command allows only SSH connections for management on a Cisco router. By specifying "ssh" as the only transport input method, other methods such as telnet or HTTP are disabled, ensuring that only SSH connections are allowed for remote management of the router.<br>The correct answer is "transport input ssh." This command allows only SSH connections fo

Question 30: What is the key difference between RESTCONF and NETCONF?

NETCONF only works on Cisco devices
RESTCONF uses YANG while NETCONF does not
RESTCONF is more secure than NETCONF
RESTCONF uses HTTP/HTTPS with REST principles while NETCONF uses SSH with XML-RPC (Correct answer)

Correct answer: RESTCONF uses HTTP/HTTPS with REST principles while NETCONF uses SSH with XML-RPC

RESTCONF uses HTTP/HTTPS with REST operations (GET, PUT, POST, DELETE) while NETCONF uses SSH transport with XML-encoded RPC operations.

Question 31: What cryptographic protocol flaw makes TLS 1.0 and 1.1 deprecated for enterprise use?

Lack of certificate support
Vulnerability to POODLE, BEAST, and other attacks due to weak cipher suites and CBC mode (Correct answer)
Key length limitations only
Incompatibility with modern hardware

Correct answer: Vulnerability to POODLE, BEAST, and other attacks due to weak cipher suites and CBC mode

TLS 1.0/1.1 are deprecated due to vulnerabilities like POODLE and BEAST that exploit weaknesses in CBC mode and RC4 cipher suites.

CCIE Cisco Certified Internetwork Expert

The CCIE (Cisco Certified Internetwork Expert) is Cisco's highest expert-level certification, validating advanced skills in designing, implementing, and troubleshooting complex enterprise network solutions across multiple technology tracks including Infrastructure, Security, Collaboration, and Automation.

100

Questions

120 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learningcontent.cisco.com — Exam information · verified Nov 2026
cisco.com — Fees, registration, renewal, score validity, test delivery, eligibility, time limit, score release, passing score, retake policy · verified Oct 2026
home.pearsonvue.com — Test delivery · verified Oct 2026