CCIE Cisco Certified Internetwork Expert — Questions and Answers

Question 1: What is the role of BGP confederations in large ISP networks?

Combining multiple IGPs
Providing route redundancy
Enabling multicast routing
Dividing a large AS into sub-ASes to reduce IBGP full-mesh requirements (Correct answer)

Correct answer: Dividing a large AS into sub-ASes to reduce IBGP full-mesh requirements

BGP confederations split a large AS into smaller sub-ASes, with EBGP running between sub-ASes, reducing the full IBGP mesh required in the overall AS.

Question 2: In Python, which library is commonly used to establish NETCONF sessions and interact with Cisco IOS-XE devices?

paramiko
requests
netmiko
ncclient (Correct answer)

Correct answer: ncclient

The 'ncclient' Python library provides a high-level NETCONF client interface for establishing sessions and sending RPC operations to NETCONF-enabled devices.

Question 3: Which Cisco DNA Center feature automates network configuration based on business intent rather than device-level CLI?

APIC-EM migration
NetFlow analysis
Intent-based networking (Correct answer)
Network assurance

Correct answer: Intent-based networking

Intent-based networking in Cisco DNA Center translates high-level business policies into device-level configurations automatically.

Question 4: What is the primary function of Cisco Application Centric Infrastructure (ACI) in a data center?

Automate and manage network infrastructure (Correct answer)
Enhance server performance
Optimize storage solutions
Provide network security

Correct answer: Automate and manage network infrastructure

Cisco ACI is designed to automate and manage the network infrastructure within data centers, making it more efficient and scalable.

Question 5: In network automation, what is Infrastructure as Code (IaC) primarily about?

Converting network diagrams to code
Managing network configuration using version-controlled declarative definitions (Correct answer)
Automating hardware procurement
Running code on network devices

Correct answer: Managing network configuration using version-controlled declarative definitions

IaC treats network configurations as code stored in version control, enabling reproducible, auditable, and consistent infrastructure deployments.

Question 6: A network designer must ensure that a data center can survive the failure of an entire power zone (affecting half the physical servers). Which server connectivity design achieves this?

Dual-homed servers with NICs connected to ToR switches in different power zones (Correct answer)
Servers connected via a single high-speed uplink to the spine
All servers connected to a single ToR switch pair
Blade chassis with a single fabric module per chassis

Correct answer: Dual-homed servers with NICs connected to ToR switches in different power zones

Dual-homed NICs connecting to Top-of-Rack switches in separate power zones ensure that if one zone loses power, the surviving NIC and its ToR maintain connectivity for all servers.

Question 7: What is Segment Routing (SR) in modern service provider networks?

A QoS mechanism for traffic segmentation
A source routing architecture using segments encoded in the packet header (Correct answer)
VLAN segmentation for multi-tenant networks
A protocol for dividing networks into segments for security

Correct answer: A source routing architecture using segments encoded in the packet header

Segment Routing (SR) is a source-routing architecture where the ingress node encodes an explicit path as a list of segments (SIDs) in the packet header.

Question 8: In Cisco wireless, what is the function of the CAPWAP protocol?

Authenticating users via 802.1X
Providing tunnel between lightweight APs and WLC (Correct answer)
Distributing IP addresses to wireless clients
Encrypting client data between AP and controller

Correct answer: Providing tunnel between lightweight APs and WLC

CAPWAP (Control And Provisioning of Wireless Access Points) provides the control and data tunnel between lightweight APs and the WLC.

Question 9: Which streaming telemetry protocol provides real-time operational data using a publish-subscribe model from Cisco IOS-XE?

gRPC/gNMI model-driven telemetry (Correct answer)
Syslog
NetFlow v5
SNMP traps

Correct answer: gRPC/gNMI model-driven telemetry

gRPC-based gNMI (gNMI Subscribe) provides high-frequency, low-overhead streaming telemetry from IOS-XE, pushing YANG-modeled data to collectors in real time.

Question 10: Which design approach uses a single routing process to provide both intra-area fast convergence and scalability across multiple areas in OSPF?

Hierarchical OSPF with multiple areas (Correct answer)
OSPF stub areas replacing all non-backbone areas
Flat OSPF with area 0 only
OSPF with all routers as ABRs

Correct answer: Hierarchical OSPF with multiple areas

Hierarchical OSPF with multiple areas limits LSA flooding scope per area, enabling fast local convergence while backbone area 0 provides scalability across the domain.

Question 11: A designer is implementing BFD (Bidirectional Forwarding Detection) to accelerate OSPF convergence. Which statement correctly describes BFD's role in this design?

BFD is only supported on physical Ethernet interfaces, not subinterfaces
BFD replaces OSPF hello packets for neighbor discovery
BFD modifies OSPF SPF calculation intervals automatically
BFD provides rapid failure detection independent of OSPF timers and notifies OSPF to reroute (Correct answer)

Correct answer: BFD provides rapid failure detection independent of OSPF timers and notifies OSPF to reroute

BFD operates independently at sub-second intervals to detect link or path failures and notifies registered protocols like OSPF, triggering immediate rerouting without waiting for OSPF dead timers to expire.

Question 12: A network designer is planning IP address space for a large enterprise with 500 subnets. Which practice best supports route summarization to minimize routing table size at the core?

Use /30 point-to-point links everywhere
Deploy NAT at every distribution layer router
Allocate contiguous IP blocks aligned to summarization boundaries per site (Correct answer)
Assign subnets randomly from the available pool

Correct answer: Allocate contiguous IP blocks aligned to summarization boundaries per site

Allocating contiguous, boundary-aligned IP blocks per region or site allows a single summary route to represent hundreds of subnets, minimizing core routing table entries.

Question 13: When designing a BGP route reflector (RR) cluster, which attribute prevents routing loops between route reflectors in the same cluster?

COMMUNITY
ORIGINATOR_ID
LOCAL_PREF
CLUSTER_LIST (Correct answer)

Correct answer: CLUSTER_LIST

CLUSTER_LIST is appended by each RR as it reflects routes; a router that sees its own cluster ID in the CLUSTER_LIST discards the update, preventing intra-cluster loops.

Question 14: What does the Cisco Hyperlocation feature use to achieve sub-meter location accuracy?

GPS receivers in APs
Angle of Arrival (AoA) with dedicated antenna arrays (Correct answer)
Bluetooth beacons
RSSI triangulation only

Correct answer: Angle of Arrival (AoA) with dedicated antenna arrays

Cisco Hyperlocation uses Angle of Arrival (AoA) measurements from a specialized antenna module to achieve sub-meter location accuracy.

Question 15: In Cisco IOS, what command enables Zone-Based Firewall policy between two security zones?

zone-pair security (Correct answer)
access-list extended
policy-map type inspect
ip inspect

Correct answer: zone-pair security

The 'zone-pair security' command defines the direction of traffic flow between zones and applies the service policy map in Cisco ZBF.

Question 16: In YANG modeling, what does the 'list' node type represent?

A mandatory configuration parameter
A read-only operational data node
A sequence of list entries each identified by key leaf(s) (Correct answer)
An ordered sequence of scalar values

Correct answer: A sequence of list entries each identified by key leaf(s)

A YANG 'list' node represents a sequence of list entries (like BGP neighbors or interfaces), each uniquely identified by one or more key leaf values.

Question 17: In WPA2/802.11i, what is the 4-way handshake used to derive?

PMK (Pairwise Master Key)
Both PTK and GTK (Correct answer)
GTK (Group Temporal Key)
PTK (Pairwise Transient Key)

Correct answer: Both PTK and GTK

The 4-way handshake derives both the PTK (unicast encryption key) and distributes the GTK (multicast/broadcast encryption key) between AP and client.

Question 18: When designing OSPF for a large enterprise with 500+ routers, which design choice most effectively reduces CPU and memory consumption on all routers?

Enable OSPF fast hello packets globally
Segment routers into multiple areas with summarization at ABRs (Correct answer)
Configure all non-DR routers as stub routers
Use OSPF area 0 for all routers

Correct answer: Segment routers into multiple areas with summarization at ABRs

Multiple areas restrict LSA flooding to within each area, and ABR summarization reduces the size of the routing table and LSDB on all non-ABR routers, cutting CPU and memory usage.

Question 19: Which data encoding format uses indentation-based hierarchy and is natively used by Ansible playbooks?

XML
CSV
YAML (Correct answer)
JSON

Correct answer: YAML

YAML (YAML Ain't Markup Language) uses indentation to define structure and is the native format for Ansible playbooks and Kubernetes manifests.

Question 20: In SIP, what is the purpose of the SDP (Session Description Protocol) body in an INVITE message?

Routing the call through SIP proxies
Negotiating media parameters like codec, IP address, and port for RTP (Correct answer)
Encrypting the call signaling
Authenticating the calling party

Correct answer: Negotiating media parameters like codec, IP address, and port for RTP

The SDP body in a SIP INVITE describes the media capabilities (codecs, IP, ports) that the calling party can support, initiating codec negotiation.

Question 21: In a Cisco ACI environment, what is an "endpoint group" (EPG)?

A collection of network policies
A type of virtual machine
A set of physical servers
A logical grouping of endpoints with common policy requirements (Correct answer)

Correct answer: A logical grouping of endpoints with common policy requirements

An EPG is a logical grouping of endpoints (such as VMs, servers, or other devices) that share common network policies in Cisco ACI.

Question 22: In Ansible network automation, which connection plugin is used for NETCONF-based device management?

paramiko_ssh
ansible.netcommon.network_cli
ansible.netcommon.netconf (Correct answer)
ansible.netcommon.httpapi

Correct answer: ansible.netcommon.netconf

The 'ansible.netcommon.netconf' connection plugin enables Ansible to communicate with network devices using the NETCONF protocol over SSH.

Question 23: In MPLS L2VPN VPLS, what is a VSI (Virtual Switching Instance)?

A virtual bridge that emulates a LAN across the MPLS backbone (Correct answer)
A traffic engineering tunnel
A virtual router for L3VPN
A VLAN interface on a CE router

Correct answer: A virtual bridge that emulates a LAN across the MPLS backbone

A VSI (Virtual Switching Instance) in VPLS emulates a multi-point Ethernet LAN across the MPLS backbone by maintaining MAC address tables per service.

Question 24: In Ansible, what is the purpose of an 'inventory' file?

Encrypting sensitive variables
Storing playbook task definitions
Configuring Ansible control node settings
Defining the list of managed hosts and groupings (Correct answer)

Correct answer: Defining the list of managed hosts and groupings

The Ansible inventory file defines the managed hosts, their groupings, and host/group variables used by playbooks during automation runs.

Question 25: When redistributing rip into OSPF what routes get redistributed into OSPF(choose all that apply)

Directly connected interfaces running rip (Correct answer)
Floating routes
Null routes
Static routes
Rip routes (Correct answer)

Correct answer: Directly connected interfaces running rip

When redistributing RIP into OSPF, the routes that get redistributed into OSPF are RIP routes and directly connected interfaces running RIP. RIP routes are the routes learned through the RIP routing protocol, while directly connected interfaces running RIP are the interfaces that are directly connected to the router and are running the RIP protocol. The other options, static routes, floating routes, and null routes, are not included in the redistribution process.

Question 26: What is the function of Cisco Stealthwatch (Cisco Secure Network Analytics)?

Network behavior analytics using NetFlow to detect threats (Correct answer)
SSL certificate management
Endpoint patch management
Firewall policy management

Correct answer: Network behavior analytics using NetFlow to detect threats

Cisco Stealthwatch analyzes NetFlow/IPFIX data to establish behavioral baselines and detect anomalies indicating threats like data exfiltration or C2 communication.

Question 27: What is the purpose of a Cisco Unity Connection hunt pilot in voicemail integration?

Load balancing Cisco CUCM clusters
Routing calls to available voicemail ports for message recording (Correct answer)
Providing redundant call managers
Distributing conference resources

Correct answer: Routing calls to available voicemail ports for message recording

Unity Connection hunt pilots distribute calls across voicemail ports, ensuring incoming voicemail calls are directed to an available port for message recording.

Question 28: What is the adminitrative distance of EBGP route?

200
200
20 (Correct answer)
170
100

Correct answer: 20

The administrative distance of a route is a measure of its trustworthiness or reliability. A lower administrative distance indicates a more preferred route. In this case, the correct answer is 20, which means that EBGP (External Border Gateway Protocol) routes have an administrative distance of 20. This suggests that EBGP routes are considered very reliable and trustworthy, making them a preferred choice for routing decisions.

Question 29: In a spine-leaf data center fabric design, what is the maximum number of hops between any two endpoints regardless of the fabric size?

4 hops
1 hop
2 hops
3 hops (Correct answer)

Correct answer: 3 hops

In spine-leaf, any endpoint connects to a leaf, traffic crosses one spine, and reaches the destination leaf — always exactly 3 hops, ensuring consistent, predictable latency.

Question 30: In MPLS, which protocol uses link-state advertisements to distribute TE constraints like available bandwidth and link delay?

BGP-LS
OSPF standard
LDP
RSVP-TE with OSPF-TE/IS-IS-TE extensions (Correct answer)

Correct answer: RSVP-TE with OSPF-TE/IS-IS-TE extensions

RSVP-TE relies on OSPF-TE or IS-IS-TE extensions (opaque LSAs/TLVs) to flood TE information like bandwidth and link delay throughout the topology.

Question 31: Which transport protocol is typically used by RTP (Real-time Transport Protocol) for voice media streams?

TLS
SCTP
TCP
UDP (Correct answer)

Correct answer: UDP

RTP uses UDP for voice media because UDP's lower overhead and lack of retransmission is better suited to real-time media than TCP's reliable delivery.

Question 32: What is Ethernet VPN (EVPN) primarily used for in service provider and data center networks?

Multi-homed Layer 2 VPN with BGP control plane for MAC/IP learning (Correct answer)
BGP route filtering
Layer 3 VPN between branch offices
MPLS tunnel encryption

Correct answer: Multi-homed Layer 2 VPN with BGP control plane for MAC/IP learning

EVPN uses BGP as the control plane for MAC/IP address learning, providing multi-homed active-active L2 VPN with efficient flooding suppression.

Question 33: A designer needs to segment a campus network so that finance and HR traffic is isolated at Layer 3 without deploying separate physical switches. Which technology best satisfies this requirement?

Port-based VLAN ACLs
Private VLANs (PVLAN)
VLAN pruning on trunks
VRF-Lite (Correct answer)

Correct answer: VRF-Lite

VRF-Lite creates multiple independent routing tables on a single router or Layer 3 switch, providing complete Layer 3 isolation between departments without additional hardware.

Question 34: What does the Cisco DNA Center API use as its primary authentication mechanism?

SSH key pairs
OAuth 2.0 bearer token obtained via /dna/system/api/v1/auth/token (Correct answer)
RADIUS
SNMP community strings

Correct answer: OAuth 2.0 bearer token obtained via /dna/system/api/v1/auth/token

Cisco DNA Center API uses token-based authentication where a POST to /dna/system/api/v1/auth/token returns a time-limited JWT token for subsequent API calls.

Question 35: What is BSS Coloring in 802.11ax used for?

Color-coding QoS priority levels
Reducing co-channel interference via spatial reuse (Correct answer)
Identifying rogue APs
Assigning colors to SSIDs for visual management

Correct answer: Reducing co-channel interference via spatial reuse

BSS Coloring assigns unique color bits to overlapping BSSs, allowing stations to identify and ignore foreign-BSS transmissions, enabling spatial reuse.

Question 36: What is the purpose of Cisco pyATS (Python Automated Test System) in network automation?

Ansible module development
Providing a REST API framework
YANG model validation
Network test and verification framework with device abstraction (Correct answer)

Correct answer: Network test and verification framework with device abstraction

Cisco pyATS is a test framework providing device abstraction (Genie), state comparison, and automated testing for network verification and regression testing.

Question 37: Which BGP feature allows ISPs to aggregate customer routes and prevent specific customer prefixes from being advertised to the internet?

BGP confederation
BGP communities
BGP route reflectors
BGP aggregate-address with summary-only (Correct answer)

Correct answer: BGP aggregate-address with summary-only

The 'aggregate-address' command with 'summary-only' suppresses more-specific component routes and advertises only the aggregate to reduce internet routing table size.

Question 38: In SIP, which message type is used to initiate a call session?

OPTIONS
SUBSCRIBE
REGISTER
INVITE (Correct answer)

Correct answer: INVITE

The SIP INVITE message initiates a call session by requesting the establishment of a media session with the called party.

Question 39: In a dual-stack IPv4/IPv6 network design, which transition mechanism translates IPv6 packets to IPv4 at the network edge to allow IPv6-only hosts to communicate with IPv4-only destinations?

6to4 tunneling
ISATAP
NAT64 with DNS64 (Correct answer)
Dual-stack lite (DS-Lite)

Correct answer: NAT64 with DNS64

NAT64 translates IPv6 source addresses to IPv4 at the border, while DNS64 synthesizes AAAA records for IPv4-only destinations, enabling seamless communication from IPv6-only clients.

Question 40: What is the primary difference between stateful and stateless firewalls?

Stateful firewalls track connection state; stateless only inspect individual packets (Correct answer)
Stateful firewalls are faster
Stateful firewalls only work at Layer 3
Stateless firewalls support more protocols

Correct answer: Stateful firewalls track connection state; stateless only inspect individual packets

Stateful firewalls maintain a connection table to track session state, allowing return traffic automatically; stateless firewalls inspect each packet in isolation.

Question 41: What is the default administrative distance for OSPF in Cisco IOS?

120
110 (Correct answer)
90
100

Correct answer: 110

OSPF has a default administrative distance of 110 in Cisco IOS, making it less preferred than EIGRP (90) but more preferred than RIP (120).

Question 42: A designer must ensure that a campus network can recover from a distribution-layer switch failure in under 1 second. Which combination of technologies best achieves this?

STP PortFast on uplinks with HSRP preempt
StackWise Virtual with ECMP and BFD-triggered BGP (Correct answer)
VRRP with 3-second hello timers
HSRP with default timers and Rapid PVST+

Correct answer: StackWise Virtual with ECMP and BFD-triggered BGP

StackWise Virtual eliminates the virtual gateway failover step entirely, while BFD provides sub-second failure detection and ECMP uses all uplinks simultaneously for instant path switching.

Question 43: What protocol does Cisco SD-WAN use to exchange routing information between vSmart controllers and WAN Edge routers?

OMP (Correct answer)
BGP
EIGRP
OSPF

Correct answer: OMP

Overlay Management Protocol (OMP) is the routing protocol used within Cisco SD-WAN between vSmart controllers and WAN Edge devices.

Question 44: Which Cisco platform provides a model-driven programmability interface supporting NETCONF, RESTCONF, and gRPC?

Cisco ACI APIC only
Cisco IOS-XE with YANG data models (Correct answer)
Cisco NX-OS traditional CLI
Cisco DNA Center API only

Correct answer: Cisco IOS-XE with YANG data models

Cisco IOS-XE supports model-driven programmability through NETCONF (port 830), RESTCONF (HTTPS), and gRPC-based gNMI interfaces using YANG data models.

Question 45: What is the purpose of Cisco TrustSec SGT (Security Group Tags)?

Encryption of data center traffic
Load balancing across ASA clusters
VLAN assignment for QoS
Policy enforcement based on user/device identity rather than IP (Correct answer)

Correct answer: Policy enforcement based on user/device identity rather than IP

SGTs tag traffic with a security group identifier, enabling policy enforcement based on identity (user/device role) rather than IP address or VLAN.

Question 46: Which codec provides toll-quality voice at 64 kbps and is used as the baseline for voice quality in PSTN?

Opus
G.722
G.711 (Correct answer)
G.729

Correct answer: G.711

G.711 uses PCM at 64 kbps and provides toll-quality voice, serving as the baseline codec for PSTN and high-quality VoIP connections.

Question 47: What cryptographic protocol flaw makes TLS 1.0 and 1.1 deprecated for enterprise use?

Key length limitations only
Incompatibility with modern hardware
Vulnerability to POODLE, BEAST, and other attacks due to weak cipher suites and CBC mode (Correct answer)
Lack of certificate support

Correct answer: Vulnerability to POODLE, BEAST, and other attacks due to weak cipher suites and CBC mode

TLS 1.0/1.1 are deprecated due to vulnerabilities like POODLE and BEAST that exploit weaknesses in CBC mode and RC4 cipher suites.

Question 48: What is Cisco's Umbrella used for in a security architecture?

DNS-layer security and cloud-delivered secure internet gateway (Correct answer)
On-premises firewall management
Endpoint antivirus
Network access control

Correct answer: DNS-layer security and cloud-delivered secure internet gateway

Cisco Umbrella acts as a DNS-layer security solution, blocking malicious domains before connections are established, functioning as a cloud-delivered SIG.

Question 49: Which BGP attribute is used to influence inbound traffic by advertising a less specific prefix from a multi-homed AS?

AS-path prepending (Correct answer)
MED
Local preference
Weight

Correct answer: AS-path prepending

AS-path prepending artificially lengthens the AS path on specific advertisements to make that path less preferred for inbound traffic.

Question 50: When designing a campus network for 802.1X port-based authentication, which component acts as the central policy decision point that evaluates authentication requests from network access devices?

RADIUS proxy on the authenticating switch
DHCP server with option 82 snooping
Cisco ISE (Identity Services Engine) (Correct answer)
TACACS+ server for device administration

Correct answer: Cisco ISE (Identity Services Engine)

Cisco ISE functions as the RADIUS server and policy decision point, evaluating 802.1X supplicant credentials, posture, and profiling data to return dynamic authorization policies to switches.

Question 51: In a Cisco ACI (Application Centric Infrastructure) design, what is the function of the Endpoint Group (EPG)?

A logical grouping of endpoints with shared policy applied through contracts (Correct answer)
A physical grouping of servers by rack location
A VLAN pool mapped to a physical domain
A bridge domain with a single subnet

Correct answer: A logical grouping of endpoints with shared policy applied through contracts

EPGs group endpoints by application role or security zone; communication between EPGs is controlled by contracts that define permitted traffic, replacing traditional VLAN-ACL policy models.

Question 52: Which design principle should be prioritized when sizing redundant power supplies and cooling in a network equipment room to meet 'five nines' (99.999%) availability?

N+1 redundancy (one spare per component)
N redundancy (one spare total)
N-1 redundancy (operate at reduced capacity)
2N redundancy (fully duplicated systems) (Correct answer)

Correct answer: 2N redundancy (fully duplicated systems)

2N redundancy provides a fully independent duplicate of every power and cooling component, ensuring no single failure — including entire PSU or cooling unit failure — causes downtime.

Question 53: Which Cisco platform serves as the primary call processing engine in a Cisco Unified Communications deployment?

Cisco Expressway
Cisco Unity Connection
Cisco Unified Communications Manager (CUCM) (Correct answer)
Cisco Webex Calling

Correct answer: Cisco Unified Communications Manager (CUCM)

Cisco CUCM (CallManager) is the core call processing platform managing call routing, device registration, and dial plan in a UC deployment.

Question 54: In Cisco SD-WAN, which plane is responsible for distributing routing and policy information between WAN Edge routers?

Orchestration plane
Control plane (Correct answer)
Management plane
Data plane

Correct answer: Control plane

The control plane (vSmart) distributes routing and policy information to WAN Edge routers using OMP (Overlay Management Protocol).

Question 55: In frame relay what OSPF network type requires a neighbor statement?(choose all that apply)

Non-broadcast (Correct answer)
Point-to-point
Point-to-multipoint
Physcial
Broadcast (Correct answer)

Correct answer: Non-broadcast

"The OSPF network types that require a neighbor statement in frame relay are broadcast and non-broadcast. In a broadcast network, OSPF routers can dynamically discover their neighbors without explicitly configuring them. However, in a non-broadcast network, such as frame relay, OSPF routers cannot automatically discover their neighbors. Therefore, a neighbor statement must be configured to establish adjacency between OSPF routers in both broadcast and non-broadcast networks.

Question 56: In a Cisco Unified Communications cluster, what is the purpose of the TFTP service?

Managing user credentials
Synchronizing call detail records
Providing phone configuration files and firmware to IP phones (Correct answer)
Routing calls between clusters

Correct answer: Providing phone configuration files and firmware to IP phones

The TFTP service in CUCM delivers phone configuration XML files and firmware images to Cisco IP phones during registration and boot.

Question 57: In YANG data models, what is the 'leaf' node used for?

Defining reusable configuration blocks
Representing a single data value with a specific type (Correct answer)
Defining a list of items
Grouping related nodes

Correct answer: Representing a single data value with a specific type

A YANG 'leaf' node represents a single scalar value (like an IP address or interface name) with a specific data type.

Question 58: Which Cisco platform provides presence and instant messaging services in a Cisco UC deployment?

Cisco Meeting Server
Cisco Expressway
Cisco IM and Presence Service (IMPS) (Correct answer)
Cisco Unity Connection

Correct answer: Cisco IM and Presence Service (IMPS)

Cisco IM and Presence Service provides XMPP-based instant messaging, presence status, and persistent chat services integrated with CUCM.

Question 59: In BGP, what is the purpose of a Route Reflector (RR)?

Providing BGP authentication
Eliminating the need for full IBGP mesh by reflecting routes to clients (Correct answer)
Encrypting BGP sessions
Connecting BGP to OSPF

Correct answer: Eliminating the need for full IBGP mesh by reflecting routes to clients

Route Reflectors allow BGP routes received from one client to be reflected to other clients, eliminating the scalability problem of requiring full IBGP mesh.

Question 60: What is the maximum number of spatial streams supported by 802.11ax (Wi-Fi 6)?

4
16
8 (Correct answer)
6

Correct answer: 8

802.11ax supports up to 8 spatial streams for MU-MIMO, maintaining the same maximum as 802.11ac Wave 2.

Question 61: A company requires that customer branch offices connect to headquarters using encrypted tunnels over the internet with hub-and-spoke topology but dynamic spoke-to-spoke tunnels on demand. Which Cisco technology fits this design?

DMVPN (Dynamic Multipoint VPN) (Correct answer)
Static point-to-point GRE tunnels
IPsec tunnel mode only
MPLS L2VPN with pseudowires

Correct answer: DMVPN (Dynamic Multipoint VPN)

DMVPN uses NHRP to allow spoke routers to dynamically discover each other's tunnel endpoints and build direct IPsec tunnels without pre-configuration, supporting dynamic spoke-to-spoke communication.

Question 62: In 802.11 OFDMA (used in Wi-Fi 6), what are the sub-channel allocations called?

Channel Slots
Frequency Bins
Resource Units (RUs) (Correct answer)
Sub-bands

Correct answer: Resource Units (RUs)

OFDMA divides the channel into Resource Units (RUs), which are groups of subcarriers that can be allocated to different clients simultaneously.

Question 63: In PKI, what is the role of the Certificate Authority (CA)?

Managing firewall access control lists
Signing and issuing digital certificates that bind identities to public keys (Correct answer)
Encrypting data in transit
Storing private keys for all devices

Correct answer: Signing and issuing digital certificates that bind identities to public keys

A CA signs digital certificates that cryptographically bind an entity's identity to their public key, enabling trust in PKI-based authentication.

Question 64: What mechanism does Cisco CUCM use to ensure voice path optimization between two IP phones at the same site?

Media Resource Group (MRG)
Media Termination Point (MTP)
Codec transcoding
Region/Location with direct media (hairpin avoidance) (Correct answer)

Correct answer: Region/Location with direct media (hairpin avoidance)

Cisco CUCM uses Region/Location configurations and direct media negotiation to ensure RTP streams flow directly between endpoints, avoiding unnecessary hairpinning through the WAN.

Question 65: What is BFD (Bidirectional Forwarding Detection) used for in service provider networks?

Routing protocol configuration verification
BGP route filtering
Sub-second failure detection for routing protocol adjacencies (Correct answer)
MPLS label allocation

Correct answer: Sub-second failure detection for routing protocol adjacencies

BFD provides fast failure detection (milliseconds) for any forwarding plane path, enabling routing protocols to react to failures much faster than their own hello timers.

Question 66: Which Cisco Firepower feature provides advanced malware protection by continuously analyzing file behavior after initial inspection?

SSL decryption
AMP (Advanced Malware Protection) retrospective analysis (Correct answer)
URL filtering
Intrusion Prevention (IPS)

Correct answer: AMP (Advanced Malware Protection) retrospective analysis

AMP retrospective analysis continues monitoring files after they pass initial inspection, allowing Firepower to detect malware even after files enter the network.

Question 67: Which Cisco technology provides high-speed data center interconnect (DCI) solutions?

Cisco OTV (Overlay Transport Virtualization) (Correct answer)
Cisco ASA Firewalls
Cisco UCS (Unified Computing System)
Cisco Nexus 7000

Correct answer: Cisco OTV (Overlay Transport Virtualization)

Cisco OTV is used for high-speed data center interconnect, enabling seamless connectivity between data centers.

Question 68: What transport protocol and port does NETCONF use by default?

TELNET/23
HTTPS/443
HTTP/80
SSH/830 (Correct answer)

Correct answer: SSH/830

NETCONF uses SSH as its transport with the IANA-assigned port 830, providing secure encrypted communication for network configuration.

Question 69: In Cisco ASA failover, which unit actively processes traffic while the standby unit monitors health?

Master unit
Secondary unit
Primary unit
Active unit (Correct answer)

Correct answer: Active unit

In ASA Active/Standby failover, the active unit processes all traffic; the standby unit monitors via failover link and takes over if the active unit fails.

Question 70: Which authentication protocol is used in 802.1X deployments where clients submit credentials through an EAP tunnel?

EAP-FAST
EAP-MD5
Both PEAP and EAP-FAST use tunneling (Correct answer)
PEAP (Protected EAP)

Correct answer: Both PEAP and EAP-FAST use tunneling

Both PEAP and EAP-FAST establish an encrypted TLS tunnel before transmitting credentials, protecting inner EAP methods from eavesdropping.

Question 71: In a Cisco FlexConnect deployment, what happens to client traffic when the WAN link to the WLC is down?

Traffic is queued until WLC reconnects
Clients are deauthenticated immediately
APs switch to standalone mode and locally switch client traffic (Correct answer)
All client traffic is dropped

Correct answer: APs switch to standalone mode and locally switch client traffic

FlexConnect APs enter standalone mode when WLC connectivity is lost, locally switching traffic for pre-configured VLANs without interruption.

Question 72: What is the role of a YANG 'typedef' statement in data modeling?

Importing external YANG modules
Defining a list structure
Defining RPC operations
Creating a reusable custom type derived from a base type with constraints (Correct answer)

Correct answer: Creating a reusable custom type derived from a base type with constraints

A YANG 'typedef' creates a named, reusable custom data type derived from a base type (e.g., string with pattern constraints), promoting consistency across models.

Question 73: What is the purpose of 802.11r (Fast BSS Transition) in enterprise wireless?

Enabling 6 GHz operation
Improving channel bonding
Reducing roaming latency by pre-authenticating with target APs (Correct answer)
Faster AP boot time

Correct answer: Reducing roaming latency by pre-authenticating with target APs

802.11r enables Fast BSS Transition by allowing clients to pre-authenticate with neighboring APs before roaming, reducing handoff delay.

Question 74: MQC is a combination of which queuing mechanisms?(choose 2)

In/out
PQ
Custome Queue
CBWFQ (Correct answer)
FIFO

Correct answer: CBWFQ

"MQC (Modular QoS CLI) is a feature in Cisco IOS that allows for the configuration of quality of service (QoS) parameters on a network device. CBWFQ (Class-Based Weighted Fair Queuing) and PQ (Priority Queuing) are both queuing mechanisms that can be used with MQC. CBWFQ allows for the allocation of bandwidth to different traffic classes based on defined policies, while PQ gives priority to certain traffic classes over others. Therefore, CBWFQ and PQ are the two queuing mechanisms that can be combined with MQC. The other options, Custom Queue, FIFO, and In/out, are not specific queuing mechanisms and are not compatible with MQC.

Question 75: Which Cisco WLC feature automatically adjusts AP transmit power and channel assignment to optimize RF coverage?

RRM (Radio Resource Management) (Correct answer)
CleanAir
FastLocate
Hyperlocation

Correct answer: RRM (Radio Resource Management)

Radio Resource Management (RRM) dynamically adjusts AP transmit power and channel assignments based on RF environment analysis.

Question 76: Which NETCONF operation retrieves the current running configuration from a network device?

<commit>
<get-config> with source=running (Correct answer)
<edit-config>
<validate>

Correct answer: <get-config> with source=running

The NETCONF <get-config> operation with source='running' retrieves the currently active configuration datastore from the device.

Question 77: What does CAC (Call Admission Control) prevent in a Cisco UC deployment?

Codec mismatch between endpoints
Unauthorized user access to CUCM
Toll fraud via dial plan manipulation
Over-subscription of WAN bandwidth by concurrent voice calls (Correct answer)

Correct answer: Over-subscription of WAN bandwidth by concurrent voice calls

CAC limits the number of concurrent calls over a WAN link to prevent voice quality degradation due to insufficient bandwidth.

Question 78: In Cisco NSO (Network Services Orchestrator), what is a 'service package' used for?

Installing NSO software
Managing NSO user authentication
Providing NSO high availability
Defining reusable network service models that abstract device-specific configuration (Correct answer)

Correct answer: Defining reusable network service models that abstract device-specific configuration

NSO service packages define YANG-based service models and mapping logic that translate abstract service inputs into device-specific configurations.

Question 79: What is Cisco's SRST (Survivable Remote Site Telephony) feature used for?

Encrypting calls at remote sites
Increasing codec quality at remote sites
Enabling video conferencing at branches
Providing basic call processing at branch offices when WAN to CUCM fails (Correct answer)

Correct answer: Providing basic call processing at branch offices when WAN to CUCM fails

SRST allows a Cisco router at a remote site to provide basic call processing when WAN connectivity to the central CUCM is lost.

Question 80: What protocol does Cisco Unified IP Phones primarily use to register with CUCM in modern deployments?

SIP (Correct answer)
SCCP (Skinny)
MGCP
H.323

Correct answer: SIP

Modern Cisco IP phones use SIP for registration and call signaling with CUCM, though legacy phones may still use SCCP (Skinny Client Control Protocol).

Question 81: In Cisco ISE profiling, which probe collects device information based on DHCP option 55 (parameter request list)?

HTTP probe
DHCP probe (Correct answer)
NetFlow probe
RADIUS probe

Correct answer: DHCP probe

The DHCP probe in ISE collects device fingerprinting information including DHCP option 55 (parameter request list) to identify device types.

Question 82: In Cisco ASA, what is the default security level for the 'inside' interface?

100 (Correct answer)
50
255
0

Correct answer: 100

The inside interface on Cisco ASA has a default security level of 100 (highest), while outside is 0 (lowest), controlling traffic flow.

Question 83: In Cisco SD-Access, which node type acts as the first point of attachment for end devices and enforces policy?

Border node
Intermediate node
Edge node (Correct answer)
Control plane node

Correct answer: Edge node

Edge nodes in SD-Access are the first point of attachment for end devices, performing policy enforcement and LISP registration.

Question 84: Which Cisco technology provides identity-based network access control using 802.1X, MAB, and Web Auth?

Cisco ASA
Cisco ISE (Identity Services Engine) (Correct answer)
Cisco DNA Center
Cisco Firepower

Correct answer: Cisco ISE (Identity Services Engine)

Cisco ISE is a policy engine that provides identity-based access control using 802.1X, MAC Authentication Bypass (MAB), and Web Authentication.

Question 85: What type of LSA's are blocked in the totally stubby area? (choose all that apply)

LSA2
LSA5 (Correct answer)
LSA4
LSA1
LSA3 (Correct answer)

Correct answer: LSA5

In a totally stubby area, only LSA1 and LSA2 are allowed to propagate, while LSA3, LSA4, and LSA5 are blocked. LSA3 is a summary LSA generated by an ABR to advertise routes from outside the autonomous system (AS). LSA5 is an external LSA generated by an ASBR to advertise routes from other AS. Since a totally stubby area is designed to reduce the size of the routing table and limit external routes, LSA3 and LSA5 are blocked to prevent unnecessary routing information from entering the area. In a totally stubby area, only LSA1 and LSA2 are allowed to propagate, while LSA3, LSA4, and LSA5 are blocked. LSA3 is a summary LSA generated by an ABR to advertise routes from outside the autonomous system (AS)

Question 86: What is the purpose of Cisco Catalyst Center's (DNA Center) Intent API?

Managing Cisco software licenses
Abstracting network operations into business intent-level REST APIs (Correct answer)
Configuring individual device interfaces directly
Providing raw device CLI access

Correct answer: Abstracting network operations into business intent-level REST APIs

The Cisco Catalyst Center Intent API provides abstracted, business-level REST APIs for network operations without requiring device-level configuration knowledge.

Question 87: In Cisco UC, what is the function of a Route Pattern?

Defining codec preferences
Configuring voicemail integration
Matching dialed digits and determining call routing actions (Correct answer)
Managing phone firmware

Correct answer: Matching dialed digits and determining call routing actions

Route Patterns in CUCM match dialed digit strings and define how calls are routed, including which route list or gateway to use.

Question 88: In Cisco Firepower Management Center (FMC), what is an Access Control Policy used for?

Defining rules for traffic inspection, allowing, blocking, or redirecting traffic (Correct answer)
Configuring HA clustering
Managing SSL certificates
Managing VPN tunnels only

Correct answer: Defining rules for traffic inspection, allowing, blocking, or redirecting traffic

Access Control Policies in FMC define rules that inspect, allow, block, or redirect traffic based on various criteria including identity, application, and URL.

Question 89: In an MPLS L3VPN design, which component is responsible for maintaining per-VPN routing tables and distributing VPN routes using MP-BGP with VPNv4 address families?

RR for the underlay IGP
PE router (Provider Edge) (Correct answer)
P router (Provider core)
CE router (Customer Edge)

Correct answer: PE router (Provider Edge)

PE routers maintain VRF tables per customer VPN, import/export routes using Route Distinguishers and Route Targets, and exchange VPNv4 prefixes with other PEs via MP-BGP.

Question 90: What is the purpose of Cisco Expressway in a UC deployment?

Conference bridge
Voicemail storage
Internal call processing
Firewall traversal for SIP/H.323 calls and Mobile Remote Access (MRA) (Correct answer)

Correct answer: Firewall traversal for SIP/H.323 calls and Mobile Remote Access (MRA)

Cisco Expressway-E/C provides secure firewall traversal for B2B calls and Mobile Remote Access (MRA), enabling endpoints outside the enterprise to register to CUCM.

Question 91: What is the Cisco Webex Calling architecture's cloud component that handles call control for cloud-registered devices?

Webex Cloud Call Control (formerly Broadworks/BroadCloud) (Correct answer)
Cisco CUBE cloud edition
Cisco CUCM in the cloud
Cisco Unity in the cloud

Correct answer: Webex Cloud Call Control (formerly Broadworks/BroadCloud)

Webex Calling's cloud call control (built on Broadworks) handles call routing, device registration, and features for cloud-registered IP phones and soft clients.

Question 92: Which IKE version is recommended for modern IPsec VPN deployments due to improved security and mobility support?

SSL VPN only
IKEv2 (Correct answer)
IKEv1 aggressive mode
IKEv1 main mode

Correct answer: IKEv2

IKEv2 is recommended over IKEv1 as it is more efficient, supports MOBIKE for mobility, has built-in NAT-T, and is more resistant to DoS attacks.

Question 93: What is the key difference between RESTCONF and NETCONF?

RESTCONF is more secure than NETCONF
NETCONF only works on Cisco devices
RESTCONF uses HTTP/HTTPS with REST principles while NETCONF uses SSH with XML-RPC (Correct answer)
RESTCONF uses YANG while NETCONF does not

Correct answer: RESTCONF uses HTTP/HTTPS with REST principles while NETCONF uses SSH with XML-RPC

RESTCONF uses HTTP/HTTPS with REST operations (GET, PUT, POST, DELETE) while NETCONF uses SSH transport with XML-encoded RPC operations.

Question 94: Which protocol is used for centralized AAA authentication in Cisco wireless deployments?

RADIUS (Correct answer)
TACACS+
LDAP
Kerberos

Correct answer: RADIUS

RADIUS is the standard protocol used for AAA (Authentication, Authorization, Accounting) in wireless deployments, including 802.1X authentication.

Question 95: What type of attack does DHCP snooping protect against?

ARP spoofing
MAC flooding
STP manipulation
Rogue DHCP servers offering malicious IP configurations (Correct answer)

Correct answer: Rogue DHCP servers offering malicious IP configurations

DHCP snooping validates DHCP messages and blocks rogue DHCP servers on untrusted ports, preventing malicious IP address assignment.

Question 96: Which Cisco ISE feature allows guest users to self-register and have their access approved by a sponsor?

Profiling
Certificate Provisioning
Sponsored Guest Portal (Correct answer)
802.1X EAP-TLS

Correct answer: Sponsored Guest Portal

The Sponsored Guest Portal in Cisco ISE allows guests to register for network access, which is then approved or denied by a designated employee sponsor.

Question 97: Which spanning-tree feature provides rapid convergence by pre-assigning port roles before a topology change occurs?

MST
RSTP (Correct answer)
STP Loop Guard
PVST+

Correct answer: RSTP

Rapid Spanning Tree Protocol (RSTP) achieves fast convergence through pre-assigned port roles (alternate and backup) and rapid state transitions.

Question 98: Which Python library provides a higher-level abstraction for SSH-based network device management, supporting multiple vendor CLI?

pyATS
netmiko (Correct answer)
napalm
ncclient

Correct answer: netmiko

Netmiko is a Python library built on Paramiko that abstracts SSH connections to network devices, providing vendor-agnostic methods for sending CLI commands.

Question 99: Which Cisco feature detects and blocks attempts to spoof ARP replies to redirect traffic?

Dynamic ARP Inspection (DAI) (Correct answer)
Port Security
IP Source Guard
DHCP snooping

Correct answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies.

Question 100: Which Cisco QoS marking is recommended for voice RTP media traffic in enterprise UC deployments?

DSCP AF41 (34)
DSCP CS3 (24)
DSCP EF (46) (Correct answer)
DSCP BE (0)

Correct answer: DSCP EF (46)

Voice RTP media is marked DSCP EF (Expedited Forwarding, decimal 46) to receive the lowest latency and jitter treatment in the QoS architecture.

CCIE Cisco Certified Internetwork Expert

The CCIE (Cisco Certified Internetwork Expert) is Cisco's highest expert-level certification, validating advanced skills in designing, implementing, and troubleshooting complex enterprise network solutions across multiple technology tracks including Infrastructure, Security, Collaboration, and Automation.

100

Questions

120 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds