Question bank
CCIE Enterprise Infrastructure
40 CCIE Enterprise Infrastructure questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation and Programmability
6 questions in this domain
- Question 1Single Choice
What is Paramiko in the context of network automation?
- AA high-level multi-vendor SSH library
- BA low-level SSH protocol implementation for PythonCorrect answer
- CA configuration management tool that supports idempotency
- DA REST API client for Cisco devices
Why this is the answer
Paramiko is a low-level implementation of SSHv2 in Python, providing raw SSH connectivity without vendor abstraction.
- Question 2Multiple Select
Which of the following are true about Netmiko? (Select two.)
- AIt is built on top of ParamikoCorrect answer
- BIt automatically provides structured data output
- CIt supports multiple device platformsCorrect answer
- DIt enforces idempotency by default
Why this is the answer
Netmiko is built on Paramiko and provides a simplified interface for over 30 platforms, but does not return structured data or guarantee idempotency.
- Question 3Interactive
What is the return type of the `send_command()` method in Netmiko?
- AA string containing the device outputCorrect answer
- BA list of lines parsed from the output
- CA dictionary with structured data
- DA JSON object
Why this is the answer
`send_command()` returns a single string containing the raw CLI output from the device.
- Question 4Single Choice
Which Git command fetches changes from a remote repository but does NOT merge them?
- Agit pull
- Bgit fetchCorrect answer
- Cgit clone
- Dgit merge
Why this is the answer
`git fetch` downloads objects and refs from a remote repository, leaving the local branch unchanged.
- Question 5Multiple Select
Which of the following are typical stages in a CI/CD pipeline for network changes? (Select two.)
- ASyntax validation of automation codeCorrect answer
- BManual configuration of devices via CLI
- CDeployment to a staging environmentCorrect answer
- DReal-time packet capture analysis
Why this is the answer
Common stages include validation (linting) and staging deployment; manual CLI and packet capture are not pipeline stages.
- Question 6Interactive
What is the purpose of `git stash` in the scenario below?
- ATo permanently save changes to a new branch
- BTo temporarily shelve uncommitted changes while switching branchesCorrect answer
- CTo delete local changes permanently
- DTo merge changes from another branch
Why this is the answer
`git stash` temporarily saves uncommitted changes so you can switch branches without committing work-in-progress.
Network Assurance and Optimization
6 questions in this domain
- Question 7Single Choice
Which version of NetFlow introduced template-based flexible export format?
- AVersion 5
- BVersion 7
- CVersion 9Correct answer
- DVersion 10 (IPFIX)
Why this is the answer
NetFlow version 9 introduced a flexible template-based export format, which was later standardized as IPFIX (version 10).
- Question 8Multiple Select
Which of the following are features of SNMPv3 compared to SNMPv2c? (Choose two.)
- AAuthentication using MD5/SHACorrect answer
- BCommunity strings in plaintext
- CEncryption with DES/AESCorrect answer
- DUses UDP port 162 for traps
Why this is the answer
SNMPv3 adds authentication (MD5, SHA) and encryption (DES, AES), while SNMPv2c uses plaintext community strings and has no encryption.
- Question 9Interactive
Examine the IP SLA configuration snippet. What is the missing command to enable the UDP jitter probe on the destination router?
- Aip sla responderCorrect answer
- Bip sla responder udp-echo
- Cno ip sla responder
- Dip sla schedule
Why this is the answer
For UDP jitter IP SLA probes, the destination router must have the 'ip sla responder' command configured to listen and respond to the probe.
- Question 10Single Choice
Which syslog severity level indicates an emergency condition?
- A0Correct answer
- B1
- C3
- D7
Why this is the answer
Syslog severity level 0 is Emergency, the highest severity. Level 1 is Alert, level 3 is Error, level 7 is Debug.
- Question 11Multiple Select
Which statements are true about model-driven telemetry compared to SNMP polling? (Choose two.)
- AData is pushed from devicesCorrect answer
- BUses periodic polling intervals
- CSupports sub-second granularityCorrect answer
- DRequires a dedicated trap receiver
Why this is the answer
Model-driven telemetry pushes data from devices and can provide sub-second granularity, unlike SNMP polling which pulls data at coarse intervals.
- Question 12Interactive
Consider the debug command in the output. Which element is used to filter the debug to reduce CPU impact?
- AThe access list numberCorrect answer
- BThe protocol keyword 'ip'
- CThe word 'packet'
- DThe interface keyword
Why this is the answer
The 'acl 101' restricts the debug output to only packets matching access list 101, reducing CPU load.
Network Infrastructure
8 questions in this domain
- Question 13Single Choice
Which Spanning Tree Protocol variant significantly reduces convergence time by introducing edge ports and point-to-point link types?
- ASTP (802.1D)
- BRSTP (802.1w)Correct answer
- CMST (802.1s)
- DPVST+
Why this is the answer
RSTP (802.1w) reduces convergence time from up to 50 seconds to sub-second by introducing edge ports and using proposal/agreement handshakes on point-to-point links.
- Question 14Multiple Select
Select two characteristics of Multiple Spanning Tree Protocol (MST).
- AMaps multiple VLANs to a single spanning tree instanceCorrect answer
- BRequires separate BPDUs for each VLAN
- CDefines MST regions with matching name and revision numberCorrect answer
- DRuns one spanning tree per VLAN
Why this is the answer
MST maps multiple VLANs to a single instance, reducing BPDU overhead. Regions must have identical name and revision number to be part of the same region.
- Question 15Interactive
Refer to the OSPF configuration snippet. What is the OSPF network type configured on the interface?
- ABroadcast
- BPoint-to-pointCorrect answer
- CNon-broadcast
- DPoint-to-multipoint
Why this is the answer
The 'ip ospf network point-to-point' command sets the interface to point-to-point network type, which avoids DR/BDR election and uses only one neighbor.
- Question 16Single Choice
What is the default administrative distance of eBGP routes in Cisco IOS?
- A20Correct answer
- B110
- C120
- D170
Why this is the answer
eBGP routes have a default administrative distance of 20, while iBGP routes have AD 200.
- Question 17Multiple Select
Select two features that are exclusive to IGMPv3 compared to IGMPv2.
- AMembership Report messages
- BSource-specific join requests (INCLUDE mode)Correct answer
- CLeave Group messages
- DExclude mode for source filteringCorrect answer
Why this is the answer
IGMPv3 introduces INCLUDE and EXCLUDE modes for source-specific filtering, enabling SSM. Both are absent in IGMPv2.
- Question 18Interactive
Examine the PIM configuration output. What is the role of this router in the PIM-SM domain?
- ARendezvous Point (RP)Correct answer
- BFirst-hop router
- CLast-hop router
- DBootstrap Router
Why this is the answer
The command 'ip pim rp-address 192.168.1.1' statically defines the RP address, so this router is configured as the RP for the domain.
- Question 19Single Choice
What is the default hello timer interval for HSRP?
- A1 second
- B3 secondsCorrect answer
- C5 seconds
- D10 seconds
Why this is the answer
HSRP default hello interval is 3 seconds, with hold timer of 10 seconds.
- Question 20Multiple Select
Select two correct statements about GLBP.
- AThe AVG assigns virtual MACs to AVFsCorrect answer
- BGLBP uses active/standby model like HSRP
- CGLBP can load balance traffic among multiple routersCorrect answer
- DGLBP uses a single virtual MAC address
Why this is the answer
GLBP uses an AVG to assign virtual MACs to multiple AVFs, enabling load balancing across multiple routers.
Security Services
6 questions in this domain
- Question 21Single Choice
What does Control Plane Policing (CoPP) primarily protect?
- AData plane
- BControl planeCorrect answer
- CManagement plane
- DForwarding plane
Why this is the answer
CoPP protects the control plane by rate-limiting traffic destined to it, preventing CPU overload.
- Question 22Multiple Select
Which two technologies are used in Cisco TrustSec for authentication?
- A802.1XCorrect answer
- BMABCorrect answer
- CCoPP
- DMACsec
Why this is the answer
TrustSec uses 802.1X for user/device authentication and MAB as a fallback for devices without 802.1X supplicants.
- Question 23Interactive
Based on the configuration snippet, what is the purpose of the zone-pair command?
- AIt defines a security zone for interfaces.
- BIt creates a unidirectional policy link between two zones.Correct answer
- CIt assigns an interface to a zone.
- DIt enables stateful inspection for all traffic.
Why this is the answer
A zone-pair connects a source zone to a destination zone and allows application of a policy map for traffic flowing in that direction.
- Question 24Single Choice
What is the primary difference between IPS and IDS on a Cisco router?
- AIPS can drop packets; IDS can only alert.Correct answer
- BIDS can drop packets; IPS can only alert.
- CBoth can drop packets.
- DBoth can only alert.
Why this is the answer
IPS operates inline and can drop malicious packets, while IDS works in promiscuous mode and only generates alerts.
- Question 25Multiple Select
Which two protocols are commonly used for AAA in Cisco device administration?
- ATACACS+Correct answer
- BRADIUSCorrect answer
- CSNMP
- DSSH
Why this is the answer
TACACS+ and RADIUS are the primary AAA protocols used for authentication, authorization, and accounting on Cisco devices.
- Question 26Interactive
Based on the output, what is the status of the Umbrella integration?
- AThe integration is active and working.
- BThe integration is disabled.Correct answer
- CThe API token is invalid.
- DThe router is not connected to the Internet.
Why this is the answer
The output shows 'Umbrella module is disabled' which means the integration is not active.
Software-Defined Infrastructure
6 questions in this domain
- Question 27Single Choice
What is the primary function of the Control Plane node in a Cisco SD-Access fabric?
- AIt forwards data traffic between endpoints.
- BIt maintains the LISP database mapping endpoints to their location.Correct answer
- CIt provides external connectivity through Border Gateway Protocol.
- DIt manages device onboarding and template provisioning.
Why this is the answer
The Control Plane node runs LISP and maintains the EID-to-RLOC mapping, enabling endpoint location discovery without data forwarding.
- Question 28Multiple Select
Which of the following are components of a Cisco SD-WAN architecture? (Choose all that apply.)
- AvManageCorrect answer
- BvSmartCorrect answer
- CDNA Center
- DvEdgeCorrect answer
Why this is the answer
Cisco SD-WAN includes vManage (management), vSmart (control), and vEdge (data). DNA Center is part of SD-Access, not SD-WAN.
- Question 29Interactive
Examine the YANG snippet. What is the data type of the leaf 'mtu'?
- Astring
- Buint16Correct answer
- Cboolean
- Denumeration
Why this is the answer
The leaf 'mtu' is typed as uint16 in the YANG module, representing a 16-bit unsigned integer.
- Question 30Single Choice
What is the primary role of Cisco DNA Center in an SD-Access fabric?
- AIt acts as the AAA server assigning SGTs to endpoints.
- BIt provides centralized management for fabric provisioning and policy.Correct answer
- CIt forwards data packets between fabric edges and borders.
- DIt maintains the LISP mapping database for endpoint mobility.
Why this is the answer
DNA Center orchestrates the fabric lifecycle including design, provisioning, policy creation, and assurance; it does not forward data or authenticate users.
- Question 31Multiple Select
Which security features are available on a cEdge router in Cisco SD-WAN? (Choose all that apply.)
- AZone-based firewallCorrect answer
- BIntrusion Prevention System (IPS)Correct answer
- CTLS/SSL decryptionCorrect answer
- DScalable Group Tag (SGT) classification
Why this is the answer
cEdge routers support advanced security like ZBF, IPS, and TLS decryption. SGT classification is an SD-Access feature, not native to cEdge.
- Question 32Interactive
Analyze the Python snippet using netmiko. What action does this code perform?
- AIt retrieves the running configuration from the device.
- BIt sends a list of configuration commands to the device.Correct answer
- CIt tests the SSH connectivity without sending any commands.
- DIt reboots the network device.
Why this is the answer
The script uses netmiko's send_config_set() method to push a list of configuration commands to a remote device via SSH.
Transport Technologies and Solutions
8 questions in this domain
- Question 33Single Choice
Which protocol is used to distribute outer transport labels in an MPLS core?
- ALDPCorrect answer
- BBGP
- COSPF
- DIS-IS
Why this is the answer
LDP is used to distribute labels for FECs, typically for transport labels in MPLS core.
- Question 34Multiple Select
Which of the following are true about VPWS? (Select two)
- AIt requires MAC learning
- BIt is a point-to-point L2VPNCorrect answer
- CIt uses FEC 129 typically
- DIt uses FEC 128 typicallyCorrect answer
Why this is the answer
VPWS is point-to-point and typically uses FEC 128 for label signaling.
- Question 35Interactive
Examine the following configuration snippet. What is the purpose of the 'segment-routing mpls' command under IS-IS?
- AEnables LDP
- BEnables prefix-SID advertisementsCorrect answer
- CEnables SRGB
- DEnables TI-LFA
Why this is the answer
It enables IS-IS to advertise prefix-SIDs for segment routing.
- Question 36Single Choice
What is the purpose of a Route Target (RT) in MPLS L3VPN?
- AMake VPNv4 prefixes unique
- BControl import/export of routes into VRFCorrect answer
- CLabel distribution
- DEstablish MP-BGP session
Why this is the answer
RTs control which routes are imported/exported between VRFs.
- Question 37Multiple Select
Which of the following are characteristics of VPLS? (Select two)
- APoint-to-point connectivity
- BMAC learning is data-plane drivenCorrect answer
- CUses split horizon to prevent loopsCorrect answer
- DRequires FEC 128 for auto-discovery
Why this is the answer
VPLS is multipoint, uses data-plane MAC learning and split horizon.
- Question 38Interactive
Examine the following SRv6 configuration. What does the locator represent?
- AThe function
- BThe routable prefixCorrect answer
- CThe SRH
- DThe Next Header
Why this is the answer
The locator is the routable IPv6 prefix that identifies a node.
- Question 39Single Choice
What is the advantage of Penultimate Hop Popping (PHP) in MPLS?
- AIt reduces the size of the label stack
- BIt reduces the processing load on the egress PECorrect answer
- CIt eliminates the need for IP forwarding
- DIt increases security
Why this is the answer
PHP removes the outer label at the penultimate router, reducing the egress PE's workload.
- Question 40Multiple Select
Which statements are correct about FEC 128? (Select two)
- AIt is used for VPWSCorrect answer
- BIt is used with BGP auto-discovery
- CIt requires manual configuration of PW IDCorrect answer
- DIt uses a 64-bit PW ID
Why this is the answer
FEC 128 is typically used for VPWS and requires manual PW ID.
Frequently asked questions
Everything about the CCIE Enterprise Infrastructure question bank and how to use it.