CCIE practice questions
Cisco · 350-401 · 300 questions
Original practice questions covering expert-level Cisco enterprise infrastructure skills across network architecture, SD-Access and SD-WAN, transport technologies, security and services, and infrastructure automation. Aligned to the CCIE Enterprise Infrastructure practical exam topics v1.1.
This course contains the use of artificial intelligence.
About the 350-401 exam
- Exam fee
- $400 USD
- Time allowed
- 2 hours
- Languages
- English, Japanese
- Format
- Proctored (Pearson VUE); v1.1
Schedule this exam The certification this earns
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Network Infrastructure · 90 questions
- An emergency-management office must harden VTY access the same way on every Catalyst access stack before a weekend cutover. Which practice best delivers consistent management-plane access without turning each stack into a full AAA redesign?
- A county courts campus runs Catalyst stacks and debates whether stack members should share one management IP or keep per-member addresses for outage recovery. What is the soundest operational trade-off for day-to-day management versus member failure?
- A city clerk reports one-way fiber between wiring closets: frames leave one switch but never return. Which Layer-2 feature is specifically meant to detect that unidirectional condition?
- An airport authority must inventory mixed-vendor cameras on access ports and wants standards-based neighbor discovery rather than a Cisco-only protocol. Which approach fits?
- A port authority must keep police records and public Wi-Fi on separate broadcast domains in the same closet, then carry both upstream. Which design choice correctly achieves that separation?
- A housing authority enabled a VTP mode that can overwrite the VLAN database across the domain and later found a VLAN pruned from an uplink after a mismatched revision. Which statement best captures the risk and safer practice?
- A sanitation department is replacing analog phones with IP phones that share a cable with data PCs. How should the access switch typically separate voice and data traffic on that single drop?
- A fire district wants to bundle two 10G uplinks toward a distribution pair and must choose how the EtherChannel negotiates. Which choice best reduces silent misconfiguration risk during onboarding?
- A police records bureau sees backup flows hashing unevenly across a port-channel even though all members are up. Which factor most directly governs how frames are distributed across members?
- A municipal hospital campus still runs classic PVST+ and wants faster reconvergence after a closet uplink failure without redesigning VLAN topology. Which change best addresses that goal?
- A community college district collapses dozens of VLAN STP instances into a few MST instances to cut CPU on older access switches. What is the primary purpose of that MST mapping?
- A regional planning commission needs a predictable STP root for the civic core and must stop a rogue closet switch from winning root. Which feature specifically guards against superior BPDUs on a designated port toward that closet?
- A 911 PSAP connects a temporary event switch and wants edge ports to go forwarding without classic listening and learning delays. Which pairing correctly speeds edge forwarding while still protecting against an accidental loop?
- An election office sees access ports errdisabled after link-flap events during a stadium Wi-Fi surge and wants a controlled return to service. Which operational approach fits?
- A tax assessor extends one VLAN across multiple buildings on trunks and asks when that pattern becomes an operational smell. What is the core concern?
- A building-permits desk depends on a port-channel between city halls and must keep the logical channel up if one member fiber fails. What behavior should operators expect from a correctly formed EtherChannel?
- A fleet garage security review wants CDP disabled on public-facing kiosk ports while still allowing LLDP for IP phones on trusted desk ports. Which approach matches that intent?
- A wastewater plant wants spanning tree to prefer a dark-fiber ring over a slower microwave backup without disabling loop protection. Which mechanism correctly biases the path?
- A stormwater bureau learns the same prefix from OSPF and from a floating static route. Which path installs in the RIB under default administrative distances?
- A public-health clinic must isolate SCADA from corporate users on the same PE-CE style routers without running MPLS in the campus. Which construct provides separate routing tables on those shared boxes?
- An animal-control HQ needs to discard traffic for a withdrawn public range during a spoofing incident. Which static-routing pattern is commonly used to blackhole that prefix?
- A museums department must force permit-office laptop traffic through a DPI path while leaving servers on normal destination-based routing. Which feature applies that exception?
- County IT must advertise a shared DNS prefix into two VRFs without merging the full routing tables. What is the appropriate technique?
- City public-works must stop a stub clinic from advertising a learned default route into the county core. Which control best prevents that unwanted advertisement?
- A municipal library consortium summarizes many branch /24s into a /16 toward the core to shrink the civic RIB. What trade-off must designers respect?
- A township board mutually redistributes EIGRP and OSPF at the boundary routers and then sees the same prefixes bounce back into each domain. Which control best reduces redistribution loop risk while still allowing selected prefixes to pass?
- A transit authority requires keyed authentication on IGP adjacencies after an audit of closet routers. What primary risk does enabling IGP authentication address?
- A water utility needs sub-second failure detection over a Metro-E handoff where shortening IGP hello timers alone is too blunt and CPU-heavy. Which mechanism best provides fast liveness detection for the routing adjacency?
- A school district accidentally redistributes the same Internet prefixes into OSPF that edge routers already learn via eBGP. Operators want the BGP-learned paths to remain preferred in the RIB. Which statement best explains the default administrative-distance behavior they should verify?
- A parks department installs a floating static default toward LTE failover that must stay out of the RIB while the primary fiber-learned route remains valid. How should the floating static be designed?
- An emergency-management office cannot form EIGRP neighbors on a transit link after a change window. Investigation shows passive-interface was applied to that transit interface. What is the direct effect causing the adjacency failure?
- A county courts campus enables keyed MD5 authentication on named-mode EIGRP, after which one peer remains down while others form. What should operators treat as the most likely adjacency blocker?
- A city clerk notices that a path with higher raw interface bandwidth loses to another path with a lower EIGRP composite metric. Which explanation best matches EIGRP best-path selection?
- An airport authority wants to nudge EIGRP traffic away from a congested microwave hop during fair season without tearing down the adjacency. Which tool best applies a controlled metric increase to selected prefixes?
- A port authority must stop a sensitive /32 in a justice VRF from leaving via EIGRP while keeping the EIGRP adjacency up. Which approach best meets that requirement?
- A housing authority wants unequal-cost load sharing across two WAN links with different EIGRP metrics. Which condition is required for a secondary path to participate with variance?
- A sanitation department runs DMVPN with EIGRP and needs multiple loop-free paths advertised toward spokes rather than only the single best path. Which EIGRP capability addresses advertising additional paths in that design?
- A fire district is migrating classic EIGRP address-family style configs into named mode. What is the primary operational benefit of named-mode EIGRP for this redesign?
- A police records bureau marks remote clinic routers as EIGRP stubs so a WAN flap does not query the entire county. What primary problem does the stub feature mitigate?
- A municipal hospital campus summarizes a site in EIGRP but must still advertise one more-specific /32 for a critical PSAP host. Which feature combination best achieves that exception?
- A community college district must keep a remote site as an EIGRP stub yet still advertise one redistributed LTE prefix outward. Which pattern supports that limited exception?
- A regional planning commission evaluates EIGRP IP FRR (single-hop) to pre-arm a backup next hop for a civic core link. What is the core idea of this fast-reroute approach?
- A 911 PSAP engineer confuses EIGRP passive-interface with interface shutdown on a link that should advertise its subnet but not form a neighbor. Which statement correctly contrasts the two?
- An election office asks when EIGRP can fail over to a backup path without entering active query state. Which condition describes that loop-free backup?
- A tax assessor’s EIGRP domain grew by dozens of neighborhood prefixes, and query scope is becoming painful. How does summarization at distribution primarily help scalability here?
- A building permits desk sees OSPF neighbors stuck in 2-WAY on a shared Ethernet segment that already has a DR and BDR. Two additional routers remain DR-other. Is this necessarily a failure?
- A fleet garage configures one side of a /30 fiber as OSPF broadcast and the other as point-to-point, and the adjacency never fully forms. What is the most accurate operational impact?
- A wastewater plant places remote clinics in a totally stubby OSPF area so they only need a default from the ABR. Which behavior should operators expect inside that area?
- A stormwater bureau sees an intra-area OSPF path and an external path to the same prefix; the external appears “shorter” by raw bandwidth. Which path preference should expert operators expect OSPF to apply first?
- A public health clinic network enables the Generic TTL Security Mechanism (GTSM) on OSPF to harden adjacency formation. What is GTSM’s primary purpose in this design?
- Animal control HQ must take an OSPF core router offline for a firmware window without black-holing traffic mid-drain. Which technique lets neighbors reconverge away from the box before adjacencies are torn down?
- A museums and culture department saw CPU spikes when a flapping WAN link churned OSPF. Which tuning goal should they pursue with SPF and LSA throttle timers?
- County IT wants to gradually divert traffic off a core OSPF router before it is powered down for replacement. Which stub-router technique should they advertise first?
- City public-works wants sub-second local repair on its civic OSPF ring when a primary next hop fails. What does enabling Loop-Free Alternate (LFA) primarily provide?
- A municipal library consortium wants a smaller OSPF LSDB and less attack surface from transit link addresses, while still advertising router loopbacks for management. Which feature matches that goal?
- A township board is adding IPv6 dual-stack on the same campus where OSPFv2 already carries IPv4. Which statement correctly describes the OSPF design?
- A transit authority needs to inject a local LTE backup prefix into OSPF inside a stub-like area without opening that area to every external LSA from the backbone. Which area type fits?
- After a rushed township annexation, a water utility finds two Area 0 fragments separated by a non-backbone area. What is the sound design takeaway before considering a virtual link?
- A school district wants faster failure detection on Metro Ethernet links between OSPF routers. How should they compare sub-second OSPF hellos with BFD?
- A parks department upgraded campus uplinks from 1 Gbps to 100 Gbps and noticed OSPF still treats many links as equal-cost. What should they recalculate so interface costs stay meaningful?
- An emergency-management office peers city edge routers to two ISPs with eBGP and uses route reflection for iBGP inside the civic ASN. Which behavioral contrast should engineers keep foremost?
- County courts need all routers in the civic ASN to exit via the ISP that offers the better SLA, without using MED toward customers. Which BGP attribute should they set for outbound preference inside the AS?
- A city clerk wants ISP-A to prefer the northern civic entrance for return traffic when both entrances advertise the same prefixes. Which attribute is the classic weak hint for that inbound preference?
- An airport authority uses route-maps to attach BGP communities that later drive whether traffic exits early (hot-potato) or rides farther (cold-potato). What role do those communities play?
- A port authority wants inbound Internet traffic to prefer the primary ISP link and treat the secondary as backup. Which AS-path manipulation is the usual approach on the backup advertisement?
- A housing authority must scale iBGP so closet PE routers do not require a full mesh to every other iBGP speaker. What is the primary purpose of deploying route reflectors?
- A sanitation department aggregates provider-independent space before advertising upstream but must avoid leaking more-specifics that would undermine that traffic engineering. What should operators watch for?
- A fire district sources iBGP sessions from loopback addresses on each router. What dependency must remain true for those sessions to stay up and for next hops to resolve?
- A police records bureau hardens its civic Internet edge. Which inbound eBGP practice best matches filtering bogon and unallocated space?
- On a municipal hospital campus, engineers set Cisco Weight on one border router to prefer an ISP. Why does that choice fail to steer the rest of the ASN the same way?
- A community college district must adjust inbound BGP policy without flapping sessions. Which contrast should they recall between soft reconfiguration and route-refresh?
- A regional planning commission merged township networks that used private ASNs and now advertises to the public Internet from a public ASN. What must happen to those private ASNs before updates leave the public edge?
- A 911 PSAP needs a special extranet peering where routes legitimately return with the PSAP’s own ASN in the path, which normal loop detection would drop. How should allowas-in be treated?
- An election office wants to harden eBGP sessions to external ISPs against multihop spoofed BGP packets. Which mechanism fits?
- A tax assessor’s border routers see two candidate BGP paths that are equal through AS-path length and origin. Before router-ID becomes the tie-break, which earlier decision steps should the engineer still expect in Cisco’s best-path order?
- A building permits desk streams council meetings and wants desktops to express interest in a specific encoder source rather than any sender to the group. Which IGMP version and capability should the edge design require?
- A fleet garage floods mDNS-like multicast onto every access port until operators enable a Layer-2 feature that learns interested ports from IGMP joins. What does that feature primarily accomplish?
- A wastewater plant has receiver VLANs with no multicast router attached, yet access switches still need periodic membership queries to refresh IGMP snooping state. Which role should be enabled on a switch in each such VLAN?
- A stormwater bureau sees multicast video arrive at a router but get discarded before replication. Operators notice the source’s unicast best path is a different interface than the one that received the packet. What control-plane check most likely caused the drop?
- A public health clinic network has sparse civic camera viewers across sites and wants shared-tree pull toward an RP instead of dense flood-and-prune. Which PIM mode best matches that requirement?
- An animal control HQ must choose how multi-site county routers learn which router is the RP for camera groups. Which comparison correctly describes static RP, Auto-RP, and BSR?
- A museums and culture department needs many sensors to talk to many collectors on the same groups without building a separate (S,G) tree per sender. Which PIM variant is designed for that many-to-many pattern?
- A county IT team moves IPTV-style briefing channels to Source-Specific Multicast so receivers join explicit (S,G) channels. What must be true for that model to work at the edge?
- A city public-works team must keep administratively scoped site-local multicast groups from being forwarded onto the WAN. Which mechanism directly enforces that containment?
- A municipal library consortium places the same RP address on two core routers in different data centers and peers them with MSDP so active sources remain known after one DC fails. What is the primary purpose of that design?
- A township board extends briefing channels to IPv6 endpoints on the LAN edge. Which protocol fills the receiver-signaling role that IGMP provides for IPv4?
- A transit authority runs a Layer-2 core and wants to stop flooding PIM Hellos and Joins to every switch port in the VLAN. Which optimization specifically constrains that multicast control traffic on L2?
- A water utility wants high-rate camera groups to use one RP and low-rate SCADA sensor groups to use another so shared-tree load is engineered separately. What configuration concept enables that separation?
- A school district has equal-cost civic core links and wants multicast flows hashed across those paths where the platform supports it. What capability is the team seeking?
- A parks department sees rogue Auto-RP announcements sourced from a lab closet switch and must stop those mappings from influencing production routers. Which control best protects the multicast RP control plane?
Software Defined Infrastructure · 75 questions
- A fire district is building Cisco SD-Access and must ensure every fabric edge can reach every other fabric node’s underlay IP before any overlay VN comes up. What underlay design requirement does that statement describe?
- A police records bureau will fabric-enable a small annex and must choose between controller LAN automation and a hand-built underlay. Which statement best captures the trade-off?
- A municipal hospital campus must explain to leadership why both LISP and VXLAN appear in the SD-Access fabric story. Which division of roles is accurate?
- A community college district wants payment kiosks micro-segmented inside the SD-Access fabric using scalable group tags. What role do SGTs play in that design?
- A regional planning commission can build one campus fabric now or plan multi-site fabrics tied together later for sister cities. Which design distinction matters most for that choice?
- A 911 PSAP must inventory campus switches in Catalyst Center with working credentials before those devices can be assigned fabric roles. Why is discovery and inventory a prerequisite?
- An election office is assigning SD-Access fabric roles on a county campus. Which mapping of roles to purposes is correct?
- A tax assessor needs to add a new closet switch to an existing SD-Access fabric without rebuilding the campus underlay from scratch. What approach aligns with incremental fabric expansion?
- A building permits desk onboards wired PCs into SD-Access so each authenticates into the correct virtual network based on identity and port assignment. What is the essential onboarding outcome?
- A fleet garage must hand fabric traffic to a traditional non-fabric data center. Which border approach correctly describes an IP transit handoff?
- A wastewater plant must extend one legacy process VLAN into the SD-Access fabric for a phased migration. Which border approach fits that use case while still requiring careful flood-domain planning?
- A stormwater bureau wants OT/SCADA endpoints kept out of the same routed fabric space as office users. Which SD-Access construct provides that macro segmentation?
- A public health clinic places clinicians and guest kiosks in the same Virtual Network but must still block kiosk-to-EHR traffic unless policy allows it. Which fabric capability provides that micro-segmentation?
- An animal-control HQ wants fabric edges to enforce Scalable Group Tags that reflect how each endpoint authenticated. Which companion platform normally classifies those endpoints into SGTs for the fabric to consume?
- After a stadium event, a museums-and-culture department’s wireless clients fail to roam cleanly inside the SD-Access fabric. Which Catalyst Center capability should operators use first to inspect network and client health in context?
- County IT sees intermittent overlay drops for fabric clients while underlay pings between edges succeed at small sizes. Which Assurance-driven conclusion best links those symptoms?
- City public-works needs SD-Access at a small town-hall footprint where collapsing fabric roles onto fewer platforms is acceptable. Which design pattern matches that constraint?
- A municipal library consortium wants LISP map-server/map-resolver services to survive a single control-plane node failure. What redundancy approach aligns with SD-Access fabric design?
- A township board asks why user VLANs in SD-Access terminate at the fabric edge instead of spanning through the campus core. What is the correct explanation?
- A transit authority must offer shared DNS and DHCP to endpoints in multiple Virtual Networks. Which border-oriented pattern addresses that shared-services reachability?
- A water utility wants wireless SSIDs to land clients into the same Virtual Networks and policies used by wired users. What fabric wireless integration concept should guide WLC placement and SSID mapping?
- A school district wants day-0 underlay configuration landed automatically on new access switches before they become fabric edges. Which approach matches that SD-Access operational goal?
- A parks department onboards contractor tablets into the fabric and must ensure they cannot reach finance servers. Which policy approach best expresses that least-privilege intent?
- An emergency-management office operates two city SD-Access fabrics and wants site-to-site fabric connectivity without hair-pinning all inter-site traffic through the data center. Which transit approach targets that goal?
- Before cutover, county courts must confirm the campus underlay can carry fabric overlay traffic. Which MTU validation focus is most appropriate for SD-Access VXLAN encapsulation?
- A city clerk’s office is expanding SD-Access and must onboard badge-authenticated wired PCs first. Which blueprint check best confirms the wired host-onboarding path before wireless expansion?
- An airport authority is designing the civic data-center handoff from SD-Access and must distinguish border responsibilities. Which statement correctly contrasts internal and external border roles at a conceptual level?
- A port authority’s operators struggle to reason about routing tables and policy after dozens of near-duplicate Virtual Networks were created. What VN design hygiene should leadership enforce?
- During a helpdesk escalation, a housing authority needs one laptop’s fabric path and authentication trail quickly. Which Assurance capability best matches that request?
- A sanitation department runs two SD-Access fabrics that may merge later. Which planning practice best reduces renumbering chaos at merge time?
- A fire district is building the SD-Access underlay and wants a stable IGP. Which prefix policy correctly reflects underlay design intent?
- A police records bureau depends on group-based policy across fabric hops. What must remain true for Scalable Group Tag information as traffic traverses the fabric?
- A municipal hospital campus is bringing up SD-Access and wants a safe build order. Which sequencing best matches common fabric deployment practice?
- A community-college host cannot reach a shared service in another VN even though underlay ping between locators works. Which overlay troubleshooting focus is most appropriate?
- A regional planning commission is drowning in per-IP extended ACLs for municipal apps and wants a more scalable SD-Access alternative. Which approach best replaces that ACL sprawl?
- A 911 PSAP fabric edge shows different VN bindings than Catalyst Center inventory after a weekend of CLI troubleshooting. What should the municipal network team treat as the authoritative fabric inventory source?
- An election office SD-Access fabric must hand off traffic to a traditional WAN edge that is not fabric-aware. Which border design provides IP connectivity without requiring the WAN edge to understand fabric overlays?
- A tax assessor’s SD-Access design must isolate a new third-party appraisal SaaS VRF-style tenancy from staff while still tagging fine-grained roles inside the staff network. When is a new Virtual Network (VN) warranted instead of only adding an SGT inside an existing VN?
- After a mass firmware upgrade weekend, a building permits desk wants to know whether fabric sites recovered cleanly. Which Catalyst Center capability best summarizes post-change site and device health for operators?
- A fleet garage auditor asks for evidence of SD-Access segmentation intent without receiving live ISE policy tree exports. What documentation artifact best captures VN and SGT design for civic compliance?
- A wastewater plant wants dual underlays from each civic site so SCADA can prefer a private MPLS path while guest and SaaS can use public Internet. In Cisco SD-WAN design terms, what should planners assign to distinguish those transports?
- A stormwater bureau is deploying Cisco SD-WAN controllers. Which role assignment correctly matches the control and management plane functions?
- A public health clinic network must onboard a remote library WAN Edge into the SD-WAN overlay. Which onboarding requirement is essential for trust and inventory before the Edge joins?
- An animal control HQ has a WAN Edge behind NAT that cannot present a public TLOC the way a directly addressed Edge can. Which SD-WAN construct helps that constrained attachment still participate in the overlay?
- A museums and culture department asks what OMP contributes in Cisco SD-WAN. Which statement best describes OMP’s role?
- County IT redistributes service-side BGP prefixes into OMP at a regional SD-WAN hub. What concern should engineers prioritize?
- A city public-works team wants repeatable WAN Edge builds across many yards instead of unique CLI pastes. Which SD-WAN configuration approach best supports that scale?
- A municipal library consortium needs voice queues to survive last-mile congestion on each WAN Edge. Which policy scope applies QoS scheduling and queuing on the box locally?
- A township board wants SCADA traffic to prefer MPLS while guest traffic prefers Internet across the SD-WAN overlay. Which policy type primarily influences that overlay pathing from the controllers?
- A transit authority wants Microsoft Teams traffic to move off a transport when loss or latency SLAs are breached. Which SD-WAN feature measures underlay performance and can shift application traffic accordingly?
- A water utility wants audit-sensitive spoke-to-spoke flows forced through a hub while camera streams may use direct tunnels. Which SD-WAN capability expresses those different topology intents?
- A school district wants SaaS and general Internet to exit locally at each branch while private district apps still go to the hub. Which SD-WAN pattern enables that local Internet exit?
- A parks department sees overlay brownouts that correlate with one transport color flapping BFD while vSmart control connections stay up. What is the most accurate first troubleshooting framing?
- An emergency-management office wants MPLS and broadband both forwarding with preference rather than leaving broadband cold until MPLS dies. Which dual-transport approach matches that intent?
- County courts need consistent SD-WAN configs for many fire-station platform models. How should feature templates be used?
- A city clerk’s office is scaling vSmart controllers and needs a clear data-plane versus control-plane boundary. Which statement is correct?
- An airport authority brings up a new WAN Edge and must reach the SD-WAN controllers for the first time. Which controller’s primary role is initial authentication and orchestrating discovery of the other controllers?
- A port authority wants one operational surface for SD-WAN templates, policies, and monitoring. Which component is that single pane of glass?
- A housing authority engineer sees suboptimal SD-WAN paths and inspects OMP routes. Which attributes are most relevant when diagnosing why one path wins over another?
- A sanitation department must ensure WAN Edge to controller sessions cannot be trivially spoofed or read on the underlay. Which control-plane security property should they verify?
- A fire district designs Cisco SD-WAN so transport underlays stay separate from departmental overlay routing. Which model correctly separates those planes?
- A police records bureau needs shared directory services reachable from multiple service VPNs at the hub without merging those VRFs site-wide. Which approach fits Cisco SD-WAN intent?
- A municipal hospital campus must choose where SD-WAN policy decisions are authored versus where they are applied on the Edge. Which statement is accurate?
- A community college district wants to migrate classic DMVPN spokes to SD-WAN Edges without a single cutover for every campus. Which migration approach best matches that goal?
- A regional planning commission needs civic multicast streams to traverse the SD-WAN overlay where design requires it. What should planners treat as a first-order design consideration?
- A 911 PSAP places SD-WAN controllers so Internet-transported Edges can reach them securely. What reachability design principle should lead?
- An election office wants one device template to onboard many firehouse Edges. Which elements are typically supplied as device-specific variables?
- A tax assessor tunes Application-Aware Routing so path switches follow underlay quality. Which telemetry inputs typically drive those AAR decisions on transport colors?
- A building permits desk contrasts SD-WAN control policy with data policy. Which distinction is correct?
- A fleet garage needs a temporary construction-trailer subnet restricted on one Edge without rewriting the district-wide centralized policy. Which mechanism fits?
- A wastewater plant wants a rural clinic’s traffic to prefer a regional hub as its primary exit. Which SD-WAN construct commonly steers that preference?
- A stormwater bureau must renew Edge certificates before expiry. What operational risk does letting Edge certificates expire typically create?
- A public health clinic network maps each underlay attachment for policy matching. What construct identifies those transport attachments in Cisco SD-WAN policy?
- An animal control HQ uses vManage to find sites with a degraded underlay path. Which operational signal commonly highlights that condition for a transport color?
- A museums and culture department needs transit between SD-Access fabric sites across the metro region. How does SD-WAN commonly fit that design?
Transport Technologies and Solutions · 45 questions
- A parks department traces a civic packet between PE and P routers and sees multiple MPLS labels. What do those stacked labels typically represent?
- An emergency-management office relies on the MPLS underlay to forward labeled unicast traffic across the county core. What is LDP’s primary role in that design?
- County courts staff suspect a departmental VPN is down. What should they verify before blaming PE-CE routing?
- A city clerk must separate underlay label-switched path problems from CE routing problems. Which tools are purpose-built for LSP validation?
- An airport authority isolates department networks across a shared county MPLS core. Which architecture provides that separation?
- A port authority exchanges VPN routes between PE routers for civic VRFs. Which control-plane mechanisms distinguish and control those customer tables?
- A housing authority must extend IPv6 civic services across an MPLS core. Which approaches are conceptually appropriate at the PE layer?
- A sanitation department attaches a partner agency VRF that needs rich routing policy at the edge. Which PE-CE protocol is the usual fit?
- A fire district attaches a township that already standardized on EIGRP at the edge to an MPLS L3VPN PE. Which concern should designers keep in mind at a conceptual level?
- A police records bureau attaches an OSPF CE domain to an MPLS VPN PE. Which loop-prevention concepts should engineers keep in view?
- A municipal hospital campus needs a joint city-county CMDB application to reach a shared prefix that must remain in both the clinical VRF and the county-admin VRF without merging the rest of those tables. What MPLS L3VPN mechanism enables that controlled sharing?
- A community college district attaches identical RFC1918 CE prefixes into several VRFs and needs those routes to remain unique inside MP-BGP. What is the primary purpose of assigning a unique route distinguisher per VRF attachment?
- A regional planning commission wants clinic spoke sites to reach only a central hub VRF, not each other, over an MPLS L3VPN. How should route-target import and export be arranged?
- A 911 PSAP MPLS core team wants transit routers that only label-switch packets and never hold VRF or VPNv4 state. Which role correctly describes those devices?
- An election-office engineer packet-captures near an egress PE and notices the top transport label is already gone one hop before that PE. Which MPLS behavior most likely explains the missing top label?
- A tax-assessor VPN complaint shows missing labels between PEs even though VPNv4 routes look present on the route reflector. What should operators verify first as the foundation for MPLS L3VPN forwarding?
- A building-permits desk is reading a PE forwarding table while troubleshooting an L3VPN and must interpret how VPN labels were assigned. At a conceptual level, what does per-prefix label allocation mean?
- A fleet-garage PE is at risk of exhausting memory because one chatty CE floods excessive prefixes into its VRF. What control best protects the PE while keeping the L3VPN design intact?
- A wastewater plant edge PE must offer civic Internet exit for one VRF’s users. Which design choice correctly frames Internet in a VRF versus the global routing table?
- A stormwater bureau needs civic voice packets to keep class treatment across an MPLS core that forwards on labels. What QoS concept maps packet DSCP into the MPLS header for core classification?
- A public-health clinic network has multiple equal-cost transport LSPs between PEs carrying VPN traffic. How does ECMP typically behave for that MPLS VPN load sharing?
- An animal-control HQ PE should not import every extranet VPNv4 route advertised in the autonomous system. What control limits which VPN routes that PE accepts?
- A museums-and-culture department CE begins advertising a recursive default into the VRF and black-holes civic traffic. What PE-CE hygiene best stops that behavior?
- County IT dual-homes a city-hall CE to two PEs so a single PE failure does not isolate the site. What design outcome does that multi-homing primarily provide?
- City public-works users on an L3VPN report loss of connectivity. Which troubleshooting order best separates underlay from overlay problems?
- A municipal library consortium builds DMVPN Phase 3 so after initial hub contact, spoke libraries can build direct tunnels to each other. Which behavior characterizes that Phase 3 shortcut model?
- A township board’s DMVPN spokes still hair-pin all spoke-to-spoke traffic through the hub. Which missing Phase 3 features are the most likely cause?
- A transit authority places two DMVPN hubs on one shared mGRE cloud for hub redundancy across the county WAN. What trade-off does that dual-hub single-cloud design primarily involve?
- A water utility separates DMVPN hubs onto dual mGRE clouds so public-safety sites keep an independent path if one overlay fails. What resiliency pattern does that describe?
- A school district runs EIGRP over DMVPN Phase 3 and must keep spoke routes usable without classic hub split-horizon or next-hop problems. Which design consideration is most accurate?
- A parks department runs OSPF over DMVPN mGRE and needs stable adjacencies without treating the overlay like a broadcast LAN full of unexpected DR elections. Which approach is most appropriate?
- An emergency-management office wants scalable spoke routing on DMVPN without flooding IGP queries across every site. Why is BGP often chosen as the overlay routing protocol?
- County courts are migrating DMVPN IPsec protection from IKEv1 to IKEv2. What is a primary reason to prefer IKEv2 for modern crypto hygiene on the overlay?
- A city clerk’s office runs DMVPN over Internet transports and must encrypt mGRE overlay traffic. What mechanism binds that encryption to the tunnels?
- An airport authority hub must stop one chatty library spoke from consuming the entire hub uplink on a DMVPN WAN. Which QoS approach directly addresses that risk?
- A port authority builds Phase 3 DMVPN so branch spokes register to hub NHS addresses over the tunnel. What NHRP roles must the design assign for registration to succeed?
- A housing authority spoke stops registering to the DMVPN hub after the branch firewall’s NAT pool changes. What registration detail should engineers verify first?
- A sanitation department needs modular IKEv2 profiles that can cover both site-to-site branches and certain remote-access clients on the same crypto headend. Which approach best matches that requirement versus classic DMVPN Phase 3?
- A fire district standardizing future branch crypto VPNs wants reusable IKEv2 configuration blocks and less dependence on mGRE/NHRP for every new site type. When should the architects favor FlexVPN over classic DMVPN Phase 3?
- A police records bureau sees large civic GIS file transfers stall across DMVPN because IPsec-plus-GRE overhead shrinks effective path MTU. What tuning most directly addresses the symptom?
- A municipal hospital campus plans to add fifty volunteer-fire DMVPN spokes to existing hubs. What capacity concern should sizing review first?
- A community college district wants spoke routers to keep small routing tables while still reaching other campuses across DMVPN. What hub routing pattern best supports that goal?
- A regional planning commission does not want DMVPN spokes to carry full Internet tables. How should hubs steer general Internet-bound traffic from those spokes?
- A 911 PSAP runs DMVPN over dual underlays (MPLS and Internet) and must prefer MPLS when healthy. What design element correctly expresses that preference?
- An election office must ensure only approved site subnets are protected in the DMVPN IPsec SAs rather than encrypting unintended flows. What control should they apply carefully?
Infrastructure Security and Services · 45 questions
- A museums and culture department sees SNMP and SSH floods driving high CPU on civic core routers while transit forwarding still matters. Which feature most directly rate-limits abusive traffic to the route processor?
- A county IT team wants switch administrators to authenticate with individual accounts and centralized authorization instead of shared local passwords. Which approach meets that goal?
- A city public-works user VLAN shows lateral SMB scanning between endpoints that share the same L2 segment. Which control filters that east-west traffic inside the VLAN?
- A municipal library consortium’s parking-garage switch is overwhelmed by broadcasts from a failing IoT NIC. What feature limits that storm on the access port?
- A township board finds a contractor’s rogue DHCP appliance answering on an access port. What DHCP snooping trust model stops offers from that port while allowing the real server path?
- A transit authority wants the DHCP server to assign addresses based on which switch and port a rider Wi-Fi or kiosk attaches to. Which relay feature supplies that location context?
- A water utility wants access ports to forward only traffic sourced from IP addresses learned via legitimate DHCP for that port. Which feature depends on the DHCP snooping binding table to enforce that?
- A school district needs to block ARP poisoning between kiosk VLAN hosts. Which feature validates ARP against the DHCP snooping database?
- A parks department lobby port was overloaded after someone daisy-chained a hub with many MACs. What access-layer control limits learned MAC count and defines a violation action?
- An emergency-management office places cameras on one subnet but must stop east-west traffic between them while still reaching a shared gateway. Which Private VLAN roles fit that design?
- A county courts edge router should accept management protocols only from the jump-host subnet as defense in depth. What ACL pattern best supports that goal?
- A city clerk’s peering edge receives packets with source addresses that do not match a plausible reverse path. Which feature drops many of those spoofed sources?
- An airport authority must stop rogue IPv6 Router Advertisements from appearing on access ports serving passenger and staff devices. Which feature is designed for that threat?
- A port authority needs to block unauthorized DHCPv6 servers on the same Layer-2 segment as legitimate clients. Which control parallels IPv4 DHCP snooping’s goal for IPv6?
- A housing authority uses IPv6 device tracking to build binding tables and wants to constrain which source addresses may leave an access port. Which conceptual control applies those bindings?
- A sanitation department sees rogue IPv6 Neighbor Advertisements claiming city gateway MACs on access VLANs. Which switch feature should the team enable to inspect and validate Neighbor Discovery messages and mitigate ND spoofing?
- A fire district is documenting wired 802.1X at closet switches. Which role mapping is correct for the endpoint, the access switch, and the RADIUS/ISE server?
- A police records bureau needs one authenticated IP phone plus an attached PC on desk drops, but open conference rooms must allow several devices after the first success. Which 802.1X host-mode pairing fits those layouts?
- A municipal hospital campus sees a new laptop fail wired 802.1X before any authorization ACL is applied. Where should engineers first confirm the EAP exchange is progressing?
- A community college district is retiring cleartext device management. Which change best replaces insecure protocols for civic network device access and file transfer?
- A regional planning commission wants automation to manage IOS XE boxes with YANG models while operators keep CLI for break-glass work. What should the team enable alongside CLI?
- A 911 PSAP is migrating NMS polling off SNMPv2c community strings. Which SNMPv3 security level best protects credentials and payload confidentiality for civic monitoring?
- An election office must centralize device logs after an incident and keep timelines trustworthy while cutting noise. Which operational practice best fits?
- A tax assessor must classify civic voice and SCADA into DiffServ PHBs on IOS XE edge routers. Which MQC structure correctly implements that classification and marking?
- A building permits desk marks voice with CoS on campus Catalyst switches, but the routed WAN edge forwards IP. What must operators ensure at the L2/L3 boundary?
- A fleet garage must mark popular SaaS applications for QoS even when clients use ephemeral destination ports. Which approach recognizes those applications beyond static port ACLs?
- A wastewater plant’s Metro-E handoff is sub-rate to a CIR below line rate. Mid-day drops spike when the edge hard-polices bursts. Which behavior should they prefer at the civic edge?
- A stormwater bureau needs low-latency treatment for voice while bulk backup flows share remaining bandwidth fairly on the same uplink. Which congestion-management approach fits?
- A public health clinic receives a 1 Gbps Ethernet handoff but buys only a 200 Mbps CIR from the carrier. How should hierarchical QoS typically be applied?
- An animal control HQ wants first-hop redundancy for city VLANs on a pair of distribution switches with a virtual gateway IP. Which FHRP choice and behavior match a classic active/standby design?
- A museums and culture department needs first-hop redundancy for IPv6 clients that learn default routers from Router Advertisements. Which approach aligns with dual distribution switches?
- A county IT team needs device clocks to agree so syslog and AAA records correlate, and they want protection against rogue time sources. Which practice best meets both goals?
- A city public-works campus uses centralized DHCP servers while dual distribution switches run HSRP for access VLANs. How should DHCP relay typically be designed?
- A municipal library consortium is dual-stacking a staff VLAN and must choose how hosts obtain IPv6 addressing and options. Which statement correctly contrasts SLAAC and stateful DHCPv6?
- A township board needs a remote clinic firewall to receive a delegated IPv6 block from upstream so it can number internal VLANs without manual per-site prefixes. Which mechanism fits?
- A transit authority must let guest users share a public IPv4 address outbound while publishing one civic web portal on a fixed public IP. Which NAT combination matches those goals?
- A water utility runs overlapping RFC1918 spaces in separate VRFs that both need Internet egress. Why enable VRF-aware NAT?
- A school district steers a floating static default via a primary Metro path and must withdraw it when that path fails end-to-end. Which feature pairing drives that change?
- A parks department must identify which internal host is saturating a public-safety WAN link during an incident. Which visibility tool best exports flow records for top-talker analysis?
- An emergency-management office must mirror a suspect access port to a packet broker. The broker sits across a Layer-3 boundary from the source switch. Which capture method applies?
- A county courts site needs packet captures on a remote branch router where no SPAN destination switch exists. Which on-box approach best meets that need without hauling traffic to a distant analyzer?
- A city clerk reports that a policy on an IOS XE edge router drops a specific flow, but show access-lists counters are inconclusive. Which diagnostic best shows where in the forwarding path the drop occurs?
- An airport authority must enable platform debugs on a busy Catalyst during an intermittent guest-Wi-Fi incident without hammering production CPU. Which practice best keeps troubleshooting safe?
- After an external scan of the civic ASN, a port authority wants layered protection for router control planes without turning the project into a full firewall-centric Security redesign. Which combination best reflects EI defense-in-depth on the network devices?
- A housing authority dual-homes a staff VLAN behind two first-hop routers and must keep DHCP, time sync, and gateway failover coordinated during maintenance. Which integration best supports clean failover?
Infrastructure Automation and Programmability · 45 questions
- A election office automation team must integrate county scripts with a controller northbound API that returns structured objects for inventory and health. Which data encoding is the most common fit for that REST-style integration?
- A tax assessor validates an interface change on IOS XE over NETCONF and must inspect the protocol replies. Which encoding should the engineer expect in those NETCONF messages?
- A building permits desk wants engineers to hand-edit site inventory—hostnames, management IPs, and uplink roles—before generating device configs. Which encoding best fits that human-centric workflow?
- A fleet garage automation team must pick encodings for three jobs: REST controller calls, NETCONF device edits, and hand-maintained inventory files. Which mapping best matches common practice?
- A wastewater plant script receives a JSON health payload from a controller and must decide whether to open a change ticket. How should that payload typically appear after parsing in Python?
- A stormwater bureau stores per-site variables in YAML and needs consistent IOS XE configs for dozens of pump-station routers. Which concept best describes generating those configs from the data?
- A public health clinic needs on-box automation so that when a critical uplink flaps three times, onsite staff get an immediate notification without waiting for an off-box controller. Which approach best fits?
- An animal control HQ must automatically adjust a routing metric toward a PSAP when IP SLA detects brownout, without deploying an off-box controller. Which pattern best achieves that?
- A museums and culture department wants to run a small Python helper on a Catalyst for local enrichment near the device, not only from a central jump host. Which on-box environment best provides that Linux userspace?
- County IT runs Python inside Guest Shell and must gather show-command output safely for a compliance script. Which approach best fits controlled on-box command execution?
- A city public-works team finds TCL-only EEM applets too limited for a remediation that needs richer parsing. Which pattern best extends on-box automation?
- A municipal library consortium enables Guest Shell on compact Catalyst access switches and must avoid starving forwarding resources. Which operational concern is most important?
- A township board wants engineers to prototype a vManage GET for device list data in a GUI client before locking the call into Python. Which workflow best matches that approach?
- A transit authority NOC dashboard must show SD-WAN tunnel health without SSH into every edge. Which vManage capability best supplies that operational telemetry?
- A water utility must push a template-driven SD-WAN change across many pump sites and wants to avoid one-off SSH snowflake configs. Which approach best fits?
- A school district script fails against vManage because each request looks unauthenticated after the first call. Which practice correctly handles API authentication/session behavior?
- A parks department helpdesk portal must display wireless client health pulled from the campus controller platform. Which integration best fits EI programmability practice?
- An emergency-management office automation job must read intent objects from Catalyst Center without changing them, then later create an update when operators approve. Which HTTP verb pairing is appropriate?
- County courts must produce weekly compliance evidence of network inventory from Catalyst Center using Python. Which pattern best fits?
- A city clerk must change an interface configuration on IOS XE using model-driven automation with Python rather than raw SSH expect scripts. Which approach best matches that goal?
- An airport authority needs a Python script that reads interface operational state from IOS XE over HTTPS using JSON or XML without opening a NETCONF SSH session. Which approach fits that tooling model?
- A port authority is automating VLAN and interface configuration on Catalyst IOS XE and must target the correct config tree. Which practice best ensures the script edits the intended YANG model family?
- A housing authority wants interface-down events to reach the collector as soon as they happen, not on a fixed poll timer. Which model-driven telemetry design meets that need?
- A sanitation department’s WAN Edges churn counters and path quality quickly, and frequent SNMP polls are loading the devices and still lagging. What is the strongest reason to move those Edges to streaming telemetry?
- A fire district’s Ansible playbook must be safe to re-run after a partial failure without creating duplicate VRFs on the same routers. Which automation design best provides that safety?
- A police records bureau’s scripts call a network controller API and sometimes receive HTTP 401, 429, or 5xx responses. Which client behavior is most appropriate?
- A municipal hospital campus must inventory thousands of devices from a controller API without client timeouts. Which retrieval pattern best scales?
- A community college district wants civic automation scripts to fail loudly when a controller OpenAPI or device YANG schema drifts incompatibly. What practice best enforces that contract?
- A regional planning commission needs a local, sub-second reaction on one router when a tracked object fails, while still using off-box controllers for fleet-wide template changes. How should those tools be split?
- A 911 PSAP tooling team prefers simple HTTPS/JSON clients for routine reads but needs transactional candidate/running datastore commits for complex multi-leaf changes on IOS XE. Which protocol pairing matches those needs?
- An election office updates SD-WAN device templates through vManage APIs and must avoid promoting untested changes into production. Which pipeline practice is soundest?
- A tax assessor WAN team wants a ticket opened automatically when vManage monitoring APIs show sustained loss on a transport color. Which approach best matches event-driven ops?
- A building permits desk standardizes access switches from templates but suspects engineers applied one-off CLI. How should automation detect that drift?
- A fleet garage automation developer keeps crafting NETCONF edit-config XML by hand and hits unexpected RPC errors around namespaces. What is the soundest mitigation?
- A wastewater plant’s Python requests scripts call controller HTTPS APIs and must trust only the civic PKI. Which TLS practice is correct?
- A stormwater bureau’s network automation guild needs shared, executable examples of controller API calls for onboarding. Which artifact best serves as living documentation?
- A public health clinic runs helper scripts in IOS XE Guest Shell and must plan for device reloads. What understanding should guide redeployment?
- An animal control HQ collector will consume interface statistics from model-driven telemetry and must choose an encoding the collector stack supports. What should guide GPB versus JSON selection?
- A museums and culture department polls thousands of SD-WAN Edges through vManage APIs and starts receiving rate-limit responses. Which client strategy is most appropriate?
- A county IT team runs the same automation code against lab and production network controllers. How should credentials be handled?
- A city public-works network inventory in Ansible YAML has grown clever anchors and merges that junior operators struggle to edit safely. What guidance best balances encoding power with operations?
- A municipal library consortium enables on-change model-driven telemetry but must keep collector and WAN volume manageable. Which subscription practice helps most?
- A township board uses Cisco DNA Center–style intent for campus segmentation and wants automation to verify policy state. Which verification approach aligns with intent-based operations?
- A transit authority automation job must confirm whether an interface is currently up/down and separately whether the intended interface config is present. How should model-driven access treat those needs?
- A water utility wants a maintainable NetDevOps loop that combines structured encoding, local on-box reaction, and controller APIs for fleet changes. Which integrated approach best fits?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.