Network Infrastructure

CCIE · 90 questions

• An emergency-management office must harden VTY access the same way on every Catalyst access stack before a weekend cutover. Which practice best delivers consistent management-plane access without turning each stack into a full AAA redesign?
• A county courts campus runs Catalyst stacks and debates whether stack members should share one management IP or keep per-member addresses for outage recovery. What is the soundest operational trade-off for day-to-day management versus member failure?
• A city clerk reports one-way fiber between wiring closets: frames leave one switch but never return. Which Layer-2 feature is specifically meant to detect that unidirectional condition?
• An airport authority must inventory mixed-vendor cameras on access ports and wants standards-based neighbor discovery rather than a Cisco-only protocol. Which approach fits?
• A port authority must keep police records and public Wi-Fi on separate broadcast domains in the same closet, then carry both upstream. Which design choice correctly achieves that separation?
• A housing authority enabled a VTP mode that can overwrite the VLAN database across the domain and later found a VLAN pruned from an uplink after a mismatched revision. Which statement best captures the risk and safer practice?
• A sanitation department is replacing analog phones with IP phones that share a cable with data PCs. How should the access switch typically separate voice and data traffic on that single drop?
• A fire district wants to bundle two 10G uplinks toward a distribution pair and must choose how the EtherChannel negotiates. Which choice best reduces silent misconfiguration risk during onboarding?
• A police records bureau sees backup flows hashing unevenly across a port-channel even though all members are up. Which factor most directly governs how frames are distributed across members?
• A municipal hospital campus still runs classic PVST+ and wants faster reconvergence after a closet uplink failure without redesigning VLAN topology. Which change best addresses that goal?
• A community college district collapses dozens of VLAN STP instances into a few MST instances to cut CPU on older access switches. What is the primary purpose of that MST mapping?
• A regional planning commission needs a predictable STP root for the civic core and must stop a rogue closet switch from winning root. Which feature specifically guards against superior BPDUs on a designated port toward that closet?
• A 911 PSAP connects a temporary event switch and wants edge ports to go forwarding without classic listening and learning delays. Which pairing correctly speeds edge forwarding while still protecting against an accidental loop?
• An election office sees access ports errdisabled after link-flap events during a stadium Wi-Fi surge and wants a controlled return to service. Which operational approach fits?
• A tax assessor extends one VLAN across multiple buildings on trunks and asks when that pattern becomes an operational smell. What is the core concern?
• A building-permits desk depends on a port-channel between city halls and must keep the logical channel up if one member fiber fails. What behavior should operators expect from a correctly formed EtherChannel?
• A fleet garage security review wants CDP disabled on public-facing kiosk ports while still allowing LLDP for IP phones on trusted desk ports. Which approach matches that intent?
• A wastewater plant wants spanning tree to prefer a dark-fiber ring over a slower microwave backup without disabling loop protection. Which mechanism correctly biases the path?
• A stormwater bureau learns the same prefix from OSPF and from a floating static route. Which path installs in the RIB under default administrative distances?
• A public-health clinic must isolate SCADA from corporate users on the same PE-CE style routers without running MPLS in the campus. Which construct provides separate routing tables on those shared boxes?
• An animal-control HQ needs to discard traffic for a withdrawn public range during a spoofing incident. Which static-routing pattern is commonly used to blackhole that prefix?
• A museums department must force permit-office laptop traffic through a DPI path while leaving servers on normal destination-based routing. Which feature applies that exception?
• County IT must advertise a shared DNS prefix into two VRFs without merging the full routing tables. What is the appropriate technique?
• City public-works must stop a stub clinic from advertising a learned default route into the county core. Which control best prevents that unwanted advertisement?
• A municipal library consortium summarizes many branch /24s into a /16 toward the core to shrink the civic RIB. What trade-off must designers respect?
• A township board mutually redistributes EIGRP and OSPF at the boundary routers and then sees the same prefixes bounce back into each domain. Which control best reduces redistribution loop risk while still allowing selected prefixes to pass?
• A transit authority requires keyed authentication on IGP adjacencies after an audit of closet routers. What primary risk does enabling IGP authentication address?
• A water utility needs sub-second failure detection over a Metro-E handoff where shortening IGP hello timers alone is too blunt and CPU-heavy. Which mechanism best provides fast liveness detection for the routing adjacency?
• A school district accidentally redistributes the same Internet prefixes into OSPF that edge routers already learn via eBGP. Operators want the BGP-learned paths to remain preferred in the RIB. Which statement best explains the default administrative-distance behavior they should verify?
• A parks department installs a floating static default toward LTE failover that must stay out of the RIB while the primary fiber-learned route remains valid. How should the floating static be designed?
• An emergency-management office cannot form EIGRP neighbors on a transit link after a change window. Investigation shows passive-interface was applied to that transit interface. What is the direct effect causing the adjacency failure?
• A county courts campus enables keyed MD5 authentication on named-mode EIGRP, after which one peer remains down while others form. What should operators treat as the most likely adjacency blocker?
• A city clerk notices that a path with higher raw interface bandwidth loses to another path with a lower EIGRP composite metric. Which explanation best matches EIGRP best-path selection?
• An airport authority wants to nudge EIGRP traffic away from a congested microwave hop during fair season without tearing down the adjacency. Which tool best applies a controlled metric increase to selected prefixes?
• A port authority must stop a sensitive /32 in a justice VRF from leaving via EIGRP while keeping the EIGRP adjacency up. Which approach best meets that requirement?
• A housing authority wants unequal-cost load sharing across two WAN links with different EIGRP metrics. Which condition is required for a secondary path to participate with variance?
• A sanitation department runs DMVPN with EIGRP and needs multiple loop-free paths advertised toward spokes rather than only the single best path. Which EIGRP capability addresses advertising additional paths in that design?
• A fire district is migrating classic EIGRP address-family style configs into named mode. What is the primary operational benefit of named-mode EIGRP for this redesign?
• A police records bureau marks remote clinic routers as EIGRP stubs so a WAN flap does not query the entire county. What primary problem does the stub feature mitigate?
• A municipal hospital campus summarizes a site in EIGRP but must still advertise one more-specific /32 for a critical PSAP host. Which feature combination best achieves that exception?
• A community college district must keep a remote site as an EIGRP stub yet still advertise one redistributed LTE prefix outward. Which pattern supports that limited exception?
• A regional planning commission evaluates EIGRP IP FRR (single-hop) to pre-arm a backup next hop for a civic core link. What is the core idea of this fast-reroute approach?
• A 911 PSAP engineer confuses EIGRP passive-interface with interface shutdown on a link that should advertise its subnet but not form a neighbor. Which statement correctly contrasts the two?
• An election office asks when EIGRP can fail over to a backup path without entering active query state. Which condition describes that loop-free backup?
• A tax assessor’s EIGRP domain grew by dozens of neighborhood prefixes, and query scope is becoming painful. How does summarization at distribution primarily help scalability here?
• A building permits desk sees OSPF neighbors stuck in 2-WAY on a shared Ethernet segment that already has a DR and BDR. Two additional routers remain DR-other. Is this necessarily a failure?
• A fleet garage configures one side of a /30 fiber as OSPF broadcast and the other as point-to-point, and the adjacency never fully forms. What is the most accurate operational impact?
• A wastewater plant places remote clinics in a totally stubby OSPF area so they only need a default from the ABR. Which behavior should operators expect inside that area?
• A stormwater bureau sees an intra-area OSPF path and an external path to the same prefix; the external appears “shorter” by raw bandwidth. Which path preference should expert operators expect OSPF to apply first?
• A public health clinic network enables the Generic TTL Security Mechanism (GTSM) on OSPF to harden adjacency formation. What is GTSM’s primary purpose in this design?
• Animal control HQ must take an OSPF core router offline for a firmware window without black-holing traffic mid-drain. Which technique lets neighbors reconverge away from the box before adjacencies are torn down?
• A museums and culture department saw CPU spikes when a flapping WAN link churned OSPF. Which tuning goal should they pursue with SPF and LSA throttle timers?
• County IT wants to gradually divert traffic off a core OSPF router before it is powered down for replacement. Which stub-router technique should they advertise first?
• City public-works wants sub-second local repair on its civic OSPF ring when a primary next hop fails. What does enabling Loop-Free Alternate (LFA) primarily provide?
• A municipal library consortium wants a smaller OSPF LSDB and less attack surface from transit link addresses, while still advertising router loopbacks for management. Which feature matches that goal?
• A township board is adding IPv6 dual-stack on the same campus where OSPFv2 already carries IPv4. Which statement correctly describes the OSPF design?
• A transit authority needs to inject a local LTE backup prefix into OSPF inside a stub-like area without opening that area to every external LSA from the backbone. Which area type fits?
• After a rushed township annexation, a water utility finds two Area 0 fragments separated by a non-backbone area. What is the sound design takeaway before considering a virtual link?
• A school district wants faster failure detection on Metro Ethernet links between OSPF routers. How should they compare sub-second OSPF hellos with BFD?
• A parks department upgraded campus uplinks from 1 Gbps to 100 Gbps and noticed OSPF still treats many links as equal-cost. What should they recalculate so interface costs stay meaningful?
• An emergency-management office peers city edge routers to two ISPs with eBGP and uses route reflection for iBGP inside the civic ASN. Which behavioral contrast should engineers keep foremost?
• County courts need all routers in the civic ASN to exit via the ISP that offers the better SLA, without using MED toward customers. Which BGP attribute should they set for outbound preference inside the AS?
• A city clerk wants ISP-A to prefer the northern civic entrance for return traffic when both entrances advertise the same prefixes. Which attribute is the classic weak hint for that inbound preference?
• An airport authority uses route-maps to attach BGP communities that later drive whether traffic exits early (hot-potato) or rides farther (cold-potato). What role do those communities play?
• A port authority wants inbound Internet traffic to prefer the primary ISP link and treat the secondary as backup. Which AS-path manipulation is the usual approach on the backup advertisement?
• A housing authority must scale iBGP so closet PE routers do not require a full mesh to every other iBGP speaker. What is the primary purpose of deploying route reflectors?
• A sanitation department aggregates provider-independent space before advertising upstream but must avoid leaking more-specifics that would undermine that traffic engineering. What should operators watch for?
• A fire district sources iBGP sessions from loopback addresses on each router. What dependency must remain true for those sessions to stay up and for next hops to resolve?
• A police records bureau hardens its civic Internet edge. Which inbound eBGP practice best matches filtering bogon and unallocated space?
• On a municipal hospital campus, engineers set Cisco Weight on one border router to prefer an ISP. Why does that choice fail to steer the rest of the ASN the same way?
• A community college district must adjust inbound BGP policy without flapping sessions. Which contrast should they recall between soft reconfiguration and route-refresh?
• A regional planning commission merged township networks that used private ASNs and now advertises to the public Internet from a public ASN. What must happen to those private ASNs before updates leave the public edge?
• A 911 PSAP needs a special extranet peering where routes legitimately return with the PSAP’s own ASN in the path, which normal loop detection would drop. How should allowas-in be treated?
• An election office wants to harden eBGP sessions to external ISPs against multihop spoofed BGP packets. Which mechanism fits?
• A tax assessor’s border routers see two candidate BGP paths that are equal through AS-path length and origin. Before router-ID becomes the tie-break, which earlier decision steps should the engineer still expect in Cisco’s best-path order?
• A building permits desk streams council meetings and wants desktops to express interest in a specific encoder source rather than any sender to the group. Which IGMP version and capability should the edge design require?
• A fleet garage floods mDNS-like multicast onto every access port until operators enable a Layer-2 feature that learns interested ports from IGMP joins. What does that feature primarily accomplish?
• A wastewater plant has receiver VLANs with no multicast router attached, yet access switches still need periodic membership queries to refresh IGMP snooping state. Which role should be enabled on a switch in each such VLAN?
• A stormwater bureau sees multicast video arrive at a router but get discarded before replication. Operators notice the source’s unicast best path is a different interface than the one that received the packet. What control-plane check most likely caused the drop?
• A public health clinic network has sparse civic camera viewers across sites and wants shared-tree pull toward an RP instead of dense flood-and-prune. Which PIM mode best matches that requirement?
• An animal control HQ must choose how multi-site county routers learn which router is the RP for camera groups. Which comparison correctly describes static RP, Auto-RP, and BSR?
• A museums and culture department needs many sensors to talk to many collectors on the same groups without building a separate (S,G) tree per sender. Which PIM variant is designed for that many-to-many pattern?
• A county IT team moves IPTV-style briefing channels to Source-Specific Multicast so receivers join explicit (S,G) channels. What must be true for that model to work at the edge?
• A city public-works team must keep administratively scoped site-local multicast groups from being forwarded onto the WAN. Which mechanism directly enforces that containment?
• A municipal library consortium places the same RP address on two core routers in different data centers and peers them with MSDP so active sources remain known after one DC fails. What is the primary purpose of that design?
• A township board extends briefing channels to IPv6 endpoints on the LAN edge. Which protocol fills the receiver-signaling role that IGMP provides for IPv4?
• A transit authority runs a Layer-2 core and wants to stop flooding PIM Hellos and Joins to every switch port in the VLAN. Which optimization specifically constrains that multicast control traffic on L2?
• A water utility wants high-rate camera groups to use one RP and low-rate SCADA sensor groups to use another so shared-tree load is engineered separately. What configuration concept enables that separation?
• A school district has equal-cost civic core links and wants multicast flows hashed across those paths where the platform supports it. What capability is the team seeking?
• A parks department sees rogue Auto-RP announcements sourced from a lab closet switch and must stop those mappings from influencing production routers. Which control best protects the multicast RP control plane?