CCIE Cisco Certified Internetwork Expert — Questions and Answers

Question 1: In YANG data models, what is the 'leaf' node used for?

Defining a list of items
Grouping related nodes
Defining reusable configuration blocks
Representing a single data value with a specific type (Correct answer)

Correct answer: Representing a single data value with a specific type

A YANG 'leaf' node represents a single scalar value (like an IP address or interface name) with a specific data type.

Question 2: In Cisco IOS, what command enables Zone-Based Firewall policy between two security zones?

policy-map type inspect
access-list extended
zone-pair security (Correct answer)
ip inspect

Correct answer: zone-pair security

The 'zone-pair security' command defines the direction of traffic flow between zones and applies the service policy map in Cisco ZBF.

Question 3: Which Cisco WLC feature automatically adjusts AP transmit power and channel assignment to optimize RF coverage?

CleanAir
RRM (Radio Resource Management) (Correct answer)
FastLocate
Hyperlocation

Correct answer: RRM (Radio Resource Management)

Radio Resource Management (RRM) dynamically adjusts AP transmit power and channel assignments based on RF environment analysis.

Question 4: In SIP, what is the purpose of the SDP (Session Description Protocol) body in an INVITE message?

Authenticating the calling party
Encrypting the call signaling
Routing the call through SIP proxies
Negotiating media parameters like codec, IP address, and port for RTP (Correct answer)

Correct answer: Negotiating media parameters like codec, IP address, and port for RTP

The SDP body in a SIP INVITE describes the media capabilities (codecs, IP, ports) that the calling party can support, initiating codec negotiation.

Question 5: Which QoS queuing mechanism is recommended for voice traffic in an enterprise WAN design to guarantee bandwidth and minimize jitter?

Weighted Fair Queuing (WFQ)
Custom Queuing (CQ)
Low Latency Queuing (LLQ) (Correct answer)
FIFO queuing

Correct answer: Low Latency Queuing (LLQ)

LLQ combines Priority Queuing for strict latency-sensitive traffic (like voice) with class-based WFQ for other classes, guaranteeing bandwidth while preventing queue starvation.

Question 6: What transport protocol and port does NETCONF use by default?

HTTP/80
SSH/830 (Correct answer)
TELNET/23
HTTPS/443

Correct answer: SSH/830

NETCONF uses SSH as its transport with the IANA-assigned port 830, providing secure encrypted communication for network configuration.

Question 7: How can summarization be done in OSPF? (choose all that apply)

Area range (Correct answer)
Summary address (Correct answer)
Nssa
Virtual link
Stub

Correct answer: Area range

Summarization in OSPF can be achieved through the use of "area range" and "summary address". The "area range" command allows the aggregation of multiple subnets into a single summary route within an OSPF area. This helps in reducing the size of the routing table and improving network efficiency. Similarly, <br>the "summary address" command can be used to summarize routes at the boundary between OSPF areas, allowing for efficient routing and reducing the number of entries in the routing table. Summarization in OSPF can be achieved through the use of "area range" and "summary address". The "area range" command allows the aggregation of multiple subnets into a single summary route within an OSPF area.

Question 8: Which Cisco platform provides presence and instant messaging services in a Cisco UC deployment?

Cisco IM and Presence Service (IMPS) (Correct answer)
Cisco Expressway
Cisco Meeting Server
Cisco Unity Connection

Correct answer: Cisco IM and Presence Service (IMPS)

Cisco IM and Presence Service provides XMPP-based instant messaging, presence status, and persistent chat services integrated with CUCM.

Question 9: What protocol does Cisco Unified IP Phones primarily use to register with CUCM in modern deployments?

MGCP
H.323
SIP (Correct answer)
SCCP (Skinny)

Correct answer: SIP

Modern Cisco IP phones use SIP for registration and call signaling with CUCM, though legacy phones may still use SCCP (Skinny Client Control Protocol).

Question 10: What is the primary difference between stateful and stateless firewalls?

Stateful firewalls only work at Layer 3
Stateful firewalls are faster
Stateless firewalls support more protocols
Stateful firewalls track connection state; stateless only inspect individual packets (Correct answer)

Correct answer: Stateful firewalls track connection state; stateless only inspect individual packets

Stateful firewalls maintain a connection table to track session state, allowing return traffic automatically; stateless firewalls inspect each packet in isolation.

Question 11: What is the key difference between RESTCONF and NETCONF?

RESTCONF uses YANG while NETCONF does not
NETCONF only works on Cisco devices
RESTCONF uses HTTP/HTTPS with REST principles while NETCONF uses SSH with XML-RPC (Correct answer)
RESTCONF is more secure than NETCONF

Correct answer: RESTCONF uses HTTP/HTTPS with REST principles while NETCONF uses SSH with XML-RPC

RESTCONF uses HTTP/HTTPS with REST operations (GET, PUT, POST, DELETE) while NETCONF uses SSH transport with XML-encoded RPC operations.

Question 12: Which transport protocol is typically used by RTP (Real-time Transport Protocol) for voice media streams?

UDP (Correct answer)
SCTP
TLS
TCP

Correct answer: UDP

RTP uses UDP for voice media because UDP's lower overhead and lack of retransmission is better suited to real-time media than TCP's reliable delivery.

Question 13: In 802.11 security, what protocol replaced TKIP for stronger encryption in WPA2?

WEP
3DES
RC4
AES-CCMP (Correct answer)

Correct answer: AES-CCMP

AES-CCMP replaced TKIP/RC4 in WPA2, providing much stronger encryption using the AES block cipher with CCMP mode.

Question 14: Which authentication protocol is used in 802.1X deployments where clients submit credentials through an EAP tunnel?

PEAP (Protected EAP)
Both PEAP and EAP-FAST use tunneling (Correct answer)
EAP-FAST
EAP-MD5

Correct answer: Both PEAP and EAP-FAST use tunneling

Both PEAP and EAP-FAST establish an encrypted TLS tunnel before transmitting credentials, protecting inner EAP methods from eavesdropping.

Question 15: When designing a WAN with diverse provider circuits for redundancy, which BGP attribute should be manipulated on inbound traffic to prefer one ISP over another without changing outbound path selection?

MED (MULTI_EXIT_DISC) (Correct answer)
AS_PATH prepending
LOCAL_PREF
WEIGHT

Correct answer: MED (MULTI_EXIT_DISC)

MED is advertised to neighboring ASes to suggest a preferred entry point into your AS, influencing how external providers forward traffic to you on inbound paths.

Question 16: Which design approach uses a single routing process to provide both intra-area fast convergence and scalability across multiple areas in OSPF?

Hierarchical OSPF with multiple areas (Correct answer)
OSPF with all routers as ABRs
Flat OSPF with area 0 only
OSPF stub areas replacing all non-backbone areas

Correct answer: Hierarchical OSPF with multiple areas

Hierarchical OSPF with multiple areas limits LSA flooding scope per area, enabling fast local convergence while backbone area 0 provides scalability across the domain.

Question 17: What is the purpose of Cisco pyATS (Python Automated Test System) in network automation?

Ansible module development
Providing a REST API framework
YANG model validation
Network test and verification framework with device abstraction (Correct answer)

Correct answer: Network test and verification framework with device abstraction

Cisco pyATS is a test framework providing device abstraction (Genie), state comparison, and automated testing for network verification and regression testing.

Question 18: Which design consideration is most critical when deploying Cisco SD-WAN (Viptela) to replace a legacy MPLS WAN for a 200-site enterprise?

Deploying vEdge routers only at hub sites
Designing the vSmart controller placement for low-latency OMP route distribution (Correct answer)
Replacing BGP with OSPF at all CE devices
Ensuring all sites use the same ISP provider

Correct answer: Designing the vSmart controller placement for low-latency OMP route distribution

The vSmart controller distributes OMP routes and policies to all vEdge devices; poorly placed controllers introduce latency in policy enforcement and route convergence across all 200 sites.

Question 19: In Cisco CUCM, what is a Calling Search Space (CSS)?

An ordered list of partitions that defines which destinations a device can reach (Correct answer)
A bandwidth pool for call admission control
A group of devices sharing the same configuration
A list of codecs in priority order

Correct answer: An ordered list of partitions that defines which destinations a device can reach

A CSS is an ordered list of partitions assigned to devices or lines, determining which route patterns and directory numbers the device can call.

Question 20: In WPA2/802.11i, what is the 4-way handshake used to derive?

PMK (Pairwise Master Key)
Both PTK and GTK (Correct answer)
GTK (Group Temporal Key)
PTK (Pairwise Transient Key)

Correct answer: Both PTK and GTK

The 4-way handshake derives both the PTK (unicast encryption key) and distributes the GTK (multicast/broadcast encryption key) between AP and client.

Question 21: What is the primary benefit of Target Wake Time (TWT) in 802.11ax for IoT devices?

Wider channel support
Scheduled wake/sleep cycles for improved battery life (Correct answer)
Better interference immunity
Faster data rates

Correct answer: Scheduled wake/sleep cycles for improved battery life

TWT allows APs to schedule specific wake times for clients, enabling IoT devices to sleep longer and significantly extend battery life.

Question 22: In Cisco ASA, what is the default security level for the 'inside' interface?

255
50
100 (Correct answer)
0

Correct answer: 100

The inside interface on Cisco ASA has a default security level of 100 (highest), while outside is 0 (lowest), controlling traffic flow.

Question 23: What QoS mechanism is used by service providers to guarantee bandwidth and bound latency for real-time traffic like voice?

DiffServ with Per-Hop Behaviors (EF for voice) (Correct answer)
FIFO queuing
Best-effort forwarding
IntServ RSVP for all traffic

Correct answer: DiffServ with Per-Hop Behaviors (EF for voice)

DiffServ Expedited Forwarding (EF) PHB provides a low-latency, low-loss queue for voice traffic by guaranteeing bandwidth and using strict priority queuing.

Question 24: Which Cisco feature detects and blocks attempts to spoof ARP replies to redirect traffic?

Port Security
IP Source Guard
DHCP snooping
Dynamic ARP Inspection (DAI) (Correct answer)

Correct answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies.

Question 25: What does the Cisco DNA Center API use as its primary authentication mechanism?

SNMP community strings
SSH key pairs
RADIUS
OAuth 2.0 bearer token obtained via /dna/system/api/v1/auth/token (Correct answer)

Correct answer: OAuth 2.0 bearer token obtained via /dna/system/api/v1/auth/token

Cisco DNA Center API uses token-based authentication where a POST to /dna/system/api/v1/auth/token returns a time-limited JWT token for subsequent API calls.

Question 26: Which Cisco technology provides a centralized controller-based approach for managing enterprise SD-WAN deployments?

Cisco ISE
Cisco Prime Infrastructure
Cisco DNA Center
Cisco vManage (Correct answer)

Correct answer: Cisco vManage

Cisco vManage is the centralized NMS and controller for SD-WAN deployments, providing policy, monitoring, and orchestration.

Question 27: Which Cisco ISE feature allows guest users to self-register and have their access approved by a sponsor?

802.1X EAP-TLS
Certificate Provisioning
Profiling
Sponsored Guest Portal (Correct answer)

Correct answer: Sponsored Guest Portal

The Sponsored Guest Portal in Cisco ISE allows guests to register for network access, which is then approved or denied by a designated employee sponsor.

Question 28: Which design principle should be prioritized when sizing redundant power supplies and cooling in a network equipment room to meet 'five nines' (99.999%) availability?

N-1 redundancy (operate at reduced capacity)
N+1 redundancy (one spare per component)
2N redundancy (fully duplicated systems) (Correct answer)
N redundancy (one spare total)

Correct answer: 2N redundancy (fully duplicated systems)

2N redundancy provides a fully independent duplicate of every power and cooling component, ensuring no single failure — including entire PSU or cooling unit failure — causes downtime.

Question 29: Which data encoding format uses indentation-based hierarchy and is natively used by Ansible playbooks?

JSON
CSV
YAML (Correct answer)
XML

Correct answer: YAML

YAML (YAML Ain't Markup Language) uses indentation to define structure and is the native format for Ansible playbooks and Kubernetes manifests.

Question 30: What is the adminitrative distance of EBGP route?

100
20 (Correct answer)
170
200
200

Correct answer: 20

The administrative distance of a route is a measure of its trustworthiness or reliability. A lower administrative distance indicates a more preferred route. In this case, the correct answer is 20, which means that EBGP (External Border Gateway Protocol) routes have an administrative distance of 20.<br> This suggests that EBGP routes are considered very reliable and trustworthy, making them a preferred choice for routing decisions.

Question 31: What is the role of the Cisco Nexus 9000 series switches in a data center environment?

They manage wireless network traffic.
They are used for firewall security.
They provide advanced routing capabilities.
They are designed for high-performance, low-latency data center networks. (Correct answer)

Correct answer: They are designed for high-performance, low-latency data center networks.

The Cisco Nexus 9000 series switches are optimized for high-performance, low-latency applications in data centers.

CCIE Cisco Certified Internetwork Expert

The CCIE (Cisco Certified Internetwork Expert) is Cisco's highest expert-level certification, validating advanced skills in designing, implementing, and troubleshooting complex enterprise network solutions across multiple technology tracks including Infrastructure, Security, Collaboration, and Automation.

Questions

35 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds