CCIE Cisco Certified Internetwork Expert — Questions and Answers

Question 1: Which Cisco QoS marking is recommended for voice RTP media traffic in enterprise UC deployments?

DSCP EF (46) (Correct answer)
DSCP BE (0)
DSCP CS3 (24)
DSCP AF41 (34)

Correct answer: DSCP EF (46)

Voice RTP media is marked DSCP EF (Expedited Forwarding, decimal 46) to receive the lowest latency and jitter treatment in the QoS architecture.

Question 2: What is the role of a YANG 'typedef' statement in data modeling?

Defining a list structure
Defining RPC operations
Creating a reusable custom type derived from a base type with constraints (Correct answer)
Importing external YANG modules

Correct answer: Creating a reusable custom type derived from a base type with constraints

A YANG 'typedef' creates a named, reusable custom data type derived from a base type (e.g., string with pattern constraints), promoting consistency across models.

Question 3: What protocol does Cisco SD-WAN use to exchange routing information between vSmart controllers and WAN Edge routers?

OSPF
BGP
EIGRP
OMP (Correct answer)

Correct answer: OMP

Overlay Management Protocol (OMP) is the routing protocol used within Cisco SD-WAN between vSmart controllers and WAN Edge devices.

Question 4: In a spine-leaf data center fabric design, what is the maximum number of hops between any two endpoints regardless of the fabric size?

4 hops
2 hops
3 hops (Correct answer)
1 hop

Correct answer: 3 hops

In spine-leaf, any endpoint connects to a leaf, traffic crosses one spine, and reaches the destination leaf — always exactly 3 hops, ensuring consistent, predictable latency.

Question 5: Which feature allows Cisco UCS servers to dynamically share storage resources across multiple servers?

FCoE (Fibre Channel over Ethernet)
SAN Fabric
Virtual Interface Card (VIC) (Correct answer)
UCS Central

Correct answer: Virtual Interface Card (VIC)

The Cisco UCS Virtual Interface Card (VIC) enables servers to dynamically share storage resources, providing flexible connectivity options.

Question 6: In a Cisco UCS environment, what component is responsible for managing server profiles and configurations?

Nexus Switch
MDS Director
Fabric Interconnect
UCS Manager (Correct answer)

Correct answer: UCS Manager

UCS Manager is the component responsible for managing server profiles, configurations, and policies in a Cisco UCS environment.

Question 7: In Cisco NSO (Network Services Orchestrator), what is a 'service package' used for?

Providing NSO high availability
Installing NSO software
Defining reusable network service models that abstract device-specific configuration (Correct answer)
Managing NSO user authentication

Correct answer: Defining reusable network service models that abstract device-specific configuration

NSO service packages define YANG-based service models and mapping logic that translate abstract service inputs into device-specific configurations.

Question 8: A network designer is planning IP address space for a large enterprise with 500 subnets. Which practice best supports route summarization to minimize routing table size at the core?

Use /30 point-to-point links everywhere
Deploy NAT at every distribution layer router
Assign subnets randomly from the available pool
Allocate contiguous IP blocks aligned to summarization boundaries per site (Correct answer)

Correct answer: Allocate contiguous IP blocks aligned to summarization boundaries per site

Allocating contiguous, boundary-aligned IP blocks per region or site allows a single summary route to represent hundreds of subnets, minimizing core routing table entries.

Question 9: What is Cisco's SRST (Survivable Remote Site Telephony) feature used for?

Increasing codec quality at remote sites
Providing basic call processing at branch offices when WAN to CUCM fails (Correct answer)
Encrypting calls at remote sites
Enabling video conferencing at branches

Correct answer: Providing basic call processing at branch offices when WAN to CUCM fails

SRST allows a Cisco router at a remote site to provide basic call processing when WAN connectivity to the central CUCM is lost.

Question 10: In Cisco ASA failover, which unit actively processes traffic while the standby unit monitors health?

Master unit
Active unit (Correct answer)
Primary unit
Secondary unit

Correct answer: Active unit

In ASA Active/Standby failover, the active unit processes all traffic; the standby unit monitors via failover link and takes over if the active unit fails.

Question 11: Which Cisco technology provides identity-based network access control using 802.1X, MAB, and Web Auth?

Cisco Firepower
Cisco DNA Center
Cisco ISE (Identity Services Engine) (Correct answer)
Cisco ASA

Correct answer: Cisco ISE (Identity Services Engine)

Cisco ISE is a policy engine that provides identity-based access control using 802.1X, MAC Authentication Bypass (MAB), and Web Authentication.

Question 12: In a Cisco ACI (Application Centric Infrastructure) design, what is the function of the Endpoint Group (EPG)?

A bridge domain with a single subnet
A logical grouping of endpoints with shared policy applied through contracts (Correct answer)
A physical grouping of servers by rack location
A VLAN pool mapped to a physical domain

Correct answer: A logical grouping of endpoints with shared policy applied through contracts

EPGs group endpoints by application role or security zone; communication between EPGs is controlled by contracts that define permitted traffic, replacing traditional VLAN-ACL policy models.

Question 13: In MPLS, what is the label imposed at the ingress PE router called?

Penultimate label
EXP label
VPN label
Transport label (Correct answer)

Correct answer: Transport label

The transport (outer) label is imposed at the ingress PE and used by the MPLS core (P routers) for forwarding decisions.

Question 14: In YANG data models, what is the 'leaf' node used for?

Grouping related nodes
Defining reusable configuration blocks
Representing a single data value with a specific type (Correct answer)
Defining a list of items

Correct answer: Representing a single data value with a specific type

A YANG 'leaf' node represents a single scalar value (like an IP address or interface name) with a specific data type.

Question 15: Which protocol does Cisco ACI use for its policy enforcement mechanism?

EIGRP
OSPF
BGP
VXLAN (Correct answer)

Correct answer: VXLAN

Cisco ACI uses VXLAN (Virtual Extensible LAN) for its policy enforcement mechanism to provide scalable and flexible network segmentation.

Question 16: When designing OSPF for a large enterprise with 500+ routers, which design choice most effectively reduces CPU and memory consumption on all routers?

Enable OSPF fast hello packets globally
Configure all non-DR routers as stub routers
Segment routers into multiple areas with summarization at ABRs (Correct answer)
Use OSPF area 0 for all routers

Correct answer: Segment routers into multiple areas with summarization at ABRs

Multiple areas restrict LSA flooding to within each area, and ABR summarization reduces the size of the routing table and LSDB on all non-ABR routers, cutting CPU and memory usage.

Question 17: In Cisco CUCM, what is a Calling Search Space (CSS)?

A list of codecs in priority order
An ordered list of partitions that defines which destinations a device can reach (Correct answer)
A group of devices sharing the same configuration
A bandwidth pool for call admission control

Correct answer: An ordered list of partitions that defines which destinations a device can reach

A CSS is an ordered list of partitions assigned to devices or lines, determining which route patterns and directory numbers the device can call.

Question 18: Which Cisco Firepower feature provides advanced malware protection by continuously analyzing file behavior after initial inspection?

SSL decryption
URL filtering
Intrusion Prevention (IPS)
AMP (Advanced Malware Protection) retrospective analysis (Correct answer)

Correct answer: AMP (Advanced Malware Protection) retrospective analysis

AMP retrospective analysis continues monitoring files after they pass initial inspection, allowing Firepower to detect malware even after files enter the network.

Question 19: What does the Cisco DNA Center API use as its primary authentication mechanism?

OAuth 2.0 bearer token obtained via /dna/system/api/v1/auth/token (Correct answer)
SSH key pairs
RADIUS
SNMP community strings

Correct answer: OAuth 2.0 bearer token obtained via /dna/system/api/v1/auth/token

Cisco DNA Center API uses token-based authentication where a POST to /dna/system/api/v1/auth/token returns a time-limited JWT token for subsequent API calls.

Question 20: What is the purpose of Cisco Catalyst Center's (DNA Center) Intent API?

Abstracting network operations into business intent-level REST APIs (Correct answer)
Managing Cisco software licenses
Providing raw device CLI access
Configuring individual device interfaces directly

Correct answer: Abstracting network operations into business intent-level REST APIs

The Cisco Catalyst Center Intent API provides abstracted, business-level REST APIs for network operations without requiring device-level configuration knowledge.

Question 21: In YANG modeling, what does the 'list' node type represent?

A read-only operational data node
An ordered sequence of scalar values
A mandatory configuration parameter
A sequence of list entries each identified by key leaf(s) (Correct answer)

Correct answer: A sequence of list entries each identified by key leaf(s)

A YANG 'list' node represents a sequence of list entries (like BGP neighbors or interfaces), each uniquely identified by one or more key leaf values.

Question 22: What is Segment Routing (SR) in modern service provider networks?

VLAN segmentation for multi-tenant networks
A QoS mechanism for traffic segmentation
A source routing architecture using segments encoded in the packet header (Correct answer)
A protocol for dividing networks into segments for security

Correct answer: A source routing architecture using segments encoded in the packet header

Segment Routing (SR) is a source-routing architecture where the ingress node encodes an explicit path as a list of segments (SIDs) in the packet header.

Question 23: What is the purpose of Cisco TrustSec SGT (Security Group Tags)?

Encryption of data center traffic
Load balancing across ASA clusters
Policy enforcement based on user/device identity rather than IP (Correct answer)
VLAN assignment for QoS

Correct answer: Policy enforcement based on user/device identity rather than IP

SGTs tag traffic with a security group identifier, enabling policy enforcement based on identity (user/device role) rather than IP address or VLAN.

Question 24: In Cisco UC, what is the function of a CUBE (Cisco Unified Border Element)?

Providing conference bridging
Managing endpoint firmware
Acting as a back-to-back user agent for SIP trunks between UC systems (Correct answer)
Providing SRST functionality

Correct answer: Acting as a back-to-back user agent for SIP trunks between UC systems

CUBE is a SIP back-to-back user agent (B2BUA) that provides interoperability, security, and demarcation between enterprise UC systems and SIP trunks.

Question 25: When designing a campus network for 802.1X port-based authentication, which component acts as the central policy decision point that evaluates authentication requests from network access devices?

DHCP server with option 82 snooping
RADIUS proxy on the authenticating switch
Cisco ISE (Identity Services Engine) (Correct answer)
TACACS+ server for device administration

Correct answer: Cisco ISE (Identity Services Engine)

Cisco ISE functions as the RADIUS server and policy decision point, evaluating 802.1X supplicant credentials, posture, and profiling data to return dynamic authorization policies to switches.

Question 26: In MPLS L3VPN, which protocol is used to distribute VPN labels and VPNv4 routes between PE routers?

OSPF
LDP
MP-BGP (Correct answer)
RSVP

Correct answer: MP-BGP

Multiprotocol BGP (MP-BGP) with the VPNv4 address family distributes customer routes and associated VPN labels between PE routers across the MPLS backbone.

Question 27: In PKI, what is the role of the Certificate Authority (CA)?

Storing private keys for all devices
Managing firewall access control lists
Signing and issuing digital certificates that bind identities to public keys (Correct answer)
Encrypting data in transit

Correct answer: Signing and issuing digital certificates that bind identities to public keys

A CA signs digital certificates that cryptographically bind an entity's identity to their public key, enabling trust in PKI-based authentication.

Question 28: Which protocol is used for centralized AAA authentication in Cisco wireless deployments?

TACACS+
Kerberos
LDAP
RADIUS (Correct answer)

Correct answer: RADIUS

RADIUS is the standard protocol used for AAA (Authentication, Authorization, Accounting) in wireless deployments, including 802.1X authentication.

Question 29: Which authentication protocol is used in 802.1X deployments where clients submit credentials through an EAP tunnel?

EAP-MD5
Both PEAP and EAP-FAST use tunneling (Correct answer)
EAP-FAST
PEAP (Protected EAP)

Correct answer: Both PEAP and EAP-FAST use tunneling

Both PEAP and EAP-FAST establish an encrypted TLS tunnel before transmitting credentials, protecting inner EAP methods from eavesdropping.

Question 30: Which Cisco platform serves as the primary call processing engine in a Cisco Unified Communications deployment?

Cisco Webex Calling
Cisco Expressway
Cisco Unified Communications Manager (CUCM) (Correct answer)
Cisco Unity Connection

Correct answer: Cisco Unified Communications Manager (CUCM)

Cisco CUCM (CallManager) is the core call processing platform managing call routing, device registration, and dial plan in a UC deployment.

Question 31: What is the primary function of Cisco Application Centric Infrastructure (ACI) in a data center?

Provide network security
Enhance server performance
Optimize storage solutions
Automate and manage network infrastructure (Correct answer)

Correct answer: Automate and manage network infrastructure

Cisco ACI is designed to automate and manage the network infrastructure within data centers, making it more efficient and scalable.

CCIE Cisco Certified Internetwork Expert

The CCIE (Cisco Certified Internetwork Expert) is Cisco's highest expert-level certification, validating advanced skills in designing, implementing, and troubleshooting complex enterprise network solutions across multiple technology tracks including Infrastructure, Security, Collaboration, and Automation.

Questions

35 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds