Question bank
CCNP Enterprise
40 CCNP Enterprise questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Architecture
6 questions in this domain
- Question 1Single Choice
In Cisco SD-Access architecture, which node type is responsible for connecting the fabric to external networks outside the fabric?
- AFabric Border NodeCorrect answer
- BControl Plane Node
- CFabric Edge Node
- DWireless LAN Controller
Why this is the answer
The Fabric Border Node is the exit point from the SD-Access fabric to external networks. A Control Plane Node maps endpoints and does not route traffic outside the fabric.
- Question 2Multiple Select
In SD-Access, which two functions are associated with the Control Plane Node?
- ALISP Map-Server and Map-Resolver servicesCorrect answer
- BExternal BGP peering with WAN routers
- CInternal endpoint mapping databaseCorrect answer
- DPer-AP SSID assignment
Why this is the answer
The Control Plane Node uses LISP Map-Server and Map-Resolver functions and holds the endpoint mapping database. External routing and wireless SSID provisioning are not its role.
- Question 3Interactive
Look at the LISP output excerpt. Which SD-Access component stores these LISP endpoint mappings?
- AControl Plane NodeCorrect answer
- BFabric Border Node
- CFabric Edge Node
- DWireless LAN Controller
Why this is the answer
The Control Plane Node maintains the LISP EID-to-locator database and provides mapping services to other fabric devices.
- Question 4Single Choice
Which type of Cisco SD-Access fabric node directly connects wired endpoint devices?
- AFabric Edge NodeCorrect answer
- BFabric Border Node
- CControl Plane Node
- DCisco ISE
Why this is the answer
Fabric Edge Nodes are the access switches that physically connect wired endpoints. Border nodes connect the fabric outward, and ISE manages policies.
- Question 5Multiple Select
Which two statements correctly describe how SD-Access wireless operates?
- AAn SSID can be centrally defined and delivered through the fabric.Correct answer
- BEach AP must receive its own separate SSID configuration.
- CThe fabric-enabled WLC provides control and policy integration.Correct answer
- DWireless clients bypass all group-based policy enforcement.
Why this is the answer
SD-Access wireless is centrally controlled; the same SSID is distributed through the fabric and the WLC communicates with fabric components. It is not configured separately on each AP.
- Question 6Interactive
In the LISP show output, which value represents the endpoint identifier (EID) prefix?
- A10.100.10.0/24Correct answer
- B192.168.10.1
- Cinstance 100
- DLISP 0
Why this is the answer
LISP separates endpoint identifiers EIDs from routing locators. In the output, 10.100.10.0/24 is the EID prefix while 192.168.10.1 is the locator.
Automation
6 questions in this domain
- Question 7Single Choice
In a Cisco SD-Access fabric, which node type is responsible for connecting the fabric to networks outside the SD-Access domain?
- AFabric Edge Node
- BFabric Border NodeCorrect answer
- CControl Plane Node
- DWireless LAN Controller
Why this is the answer
The Fabric Border Node is the gateway between the SD-Access fabric and external Layer 3 networks. Control Plane Nodes handle mapping, not external connectivity.
- Question 8Multiple Select
Which two statements correctly describe the difference between Fabric Border Nodes and Control Plane Nodes in SD-Access?
- AControl Plane Node maps endpoint locationCorrect answer
- BFabric Border Node connects externallyCorrect answer
- CFabric Border Node registers all endpoints
- DControl Plane Node forwards all user data
Why this is the answer
Control Plane Nodes act as the LISP map server and maintain endpoint location mappings. Fabric Border Nodes route traffic outside the fabric; they do not register endpoints or forward all user data.
- Question 9Interactive
Review the device-role table in the code block. Which device is the Control Plane Node?
- AFAB-1
- BCP-1Correct answer
- CEDGE-1
- DEDGE-2
Why this is the answer
The table identifies CP-1 as the Control Plane Node because it performs LISP endpoint registration and mapping. FAB-1 is the Border Node, while EDGE-1 and EDGE-2 attach endpoints.
- Question 10Single Choice
In the SD-Access wireless architecture, where should a WLAN or SSID be configured for client access?
- AIndividually on each AP
- BCentrally on the wireless controllerCorrect answer
- CSeparately on every edge switch
- DOnly at the border node
Why this is the answer
SD-Access wireless uses central WLAN management. A fabric-enabled AP receives the centrally managed SSID profile, so a separate SSID is not configured on every AP.
- Question 11Multiple Select
Which two statements about SD-Access wireless are true?
- AWLAN profile centralized at controllerCorrect answer
- BSame SSID used across fabric APsCorrect answer
- CEach AP locally defines SSID
- DFabric APs ignore central profiles
Why this is the answer
Central WLAN profiles remove per-AP SSID configuration in SD-Access. APs join the fabric, and the controller delivers the shared WLAN configuration to them.
- Question 12Interactive
The code block shows a central WLAN profile for a fabric SSID. What does this information indicate about AP SSID configuration?
- AMust be recreated on every AP
- BDelivered to all fabric-mode APsCorrect answer
- COverridden by local AP config
- DApplied only at the border
Why this is the answer
The displayed central profile is pushed by the wireless controller to fabric-enabled APs. It does not have to be configured locally on every AP.
Infrastructure
12 questions in this domain
- Question 13Single Choice
Which responsibility belongs to the Fabric Border Node in an SD-Access fabric?
- AConnect the fabric to outside Layer 3 networksCorrect answer
- BRun the LISP Map Server and Resolver
- CAttach wireless access points to the fabric
- DAssign security group tags to endpoints
Why this is the answer
The Fabric Border Node connects the SD-Access fabric to external Layer 3 networks. LISP mapping and security group assignment are handled by other components.
- Question 14Multiple Select
Which two functions are performed by a Control Plane Node in an SD-Access fabric?
- AAct as the LISP Map ServerCorrect answer
- BMaintain EID-to-RLOC mappingsCorrect answer
- CConnect the fabric to external networks
- DConfigure wireless SSIDs
Why this is the answer
The Control Plane Node provides LISP Map Server and Map Resolver services and keeps EID-to-RLOC mappings. External connectivity is a Fabric Border function.
- Question 15Interactive
The code block maps SD-Access node roles to functions. Which role performs the LISP Map Server function?
- AControl Plane NodeCorrect answer
- BFabric Border Node
- CFabric Edge Node
- DWireless Controller
Why this is the answer
The code block identifies the control_plane role as LISP Map Server and Map Resolver. This corresponds to the SD-Access Control Plane Node.
- Question 16Single Choice
Which mechanism allows a host to move between Fabric Edge nodes while keeping its IP address in SD-Access?
- ALISPCorrect answer
- BSpanning Tree Protocol
- CDHCP
- DSNMP
Why this is the answer
LISP maintains the endpoint identifier and routing locator mapping, so a host can move between Fabric Edge nodes and remain reachable at the same IP address.
- Question 17Multiple Select
Which two statements are true about SSID configuration in SD-Access wireless?
- ASSIDs are configured centrally in Cisco DNA CenterCorrect answer
- BFabric policies define SSID behavior per siteCorrect answer
- CEvery AP needs a separate local SSID configuration
- DSSIDs are configured on each AP console
Why this is the answer
In SD-Access wireless, the SSID is part of a centrally managed fabric policy. Separate local SSID configuration on each AP is a common mistake.
- Question 18Interactive
The code block outlines an SD-Access wireless deployment. Where is the corporate SSID configured in this design?
- ACisco DNA Center network profileCorrect answer
- BLocal AP configuration
- CFabric Border Node CLI
- DLISP Map Server database
Why this is the answer
The code block places the SSID in a network profile managed by Cisco DNA Center, not in a per-AP local configuration.
- Question 19Single Choice
Why is Cisco ISE required in an SD-Access solution that uses group-based policies?
- AIt supplies identity groups for policy enforcementCorrect answer
- BIt runs the LISP Map Server
- CIt connects the fabric to the WAN
- DIt controls AP transmit power
Why this is the answer
Cisco ISE provides identity and security group context. Without it, SD-Access cannot enforce group-based micro-segmentation policies.
- Question 20Multiple Select
Which two elements are essential when micro-segmentation is enforced in SD-Access?
- ACisco ISE integrationCorrect answer
- BSecurity group tag assignmentCorrect answer
- CPer-AP local SSID configuration
- DFabric Border Node as LISP Map Server
Why this is the answer
SD-Access uses Cisco ISE and SGTs to enforce micro-segmentation. Local AP SSID configuration is not a policy requirement.
- Question 21Interactive
The code block represents a group-based policy object. Which SD-Access component is needed to enable this policy type?
- ACisco ISECorrect answer
- BLISP Map Server
- CWireless LAN Controller
- DDNS server
Why this is the answer
The policy object uses security groups. Cisco ISE supplies the identity and SGT context needed to enforce this kind of SD-Access policy.
- Question 22Single Choice
What is the purpose of an EID-to-RLOC mapping in LISP?
- ATrack where an endpoint is attached in the fabricCorrect answer
- BDefine AP radio channels
- CAssign IP addresses to endpoints
- DSelect the default interface VLAN
Why this is the answer
An EID-to-RLOC mapping tells the fabric where an endpoint currently is attached, which supports mobility and correct forwarding.
- Question 23Multiple Select
Which two tasks are typical responsibilities of the Fabric Border Node in SD-Access?
- AExchange routes with external Layer 3 domainsCorrect answer
- BForward traffic between the fabric and outside networksCorrect answer
- CRun LISP Map Server and Resolver services
- DPerform endpoint EID tracking
Why this is the answer
Fabric Border Nodes connect the fabric to outside networks and exchange external routing information. LISP mapping and endpoint tracking belong to other roles.
- Question 24Interactive
The code block lists properties assigned to a node role. Which property belongs to a Fabric Border Node?
- AExternal Layer 3 connectivityCorrect answer
- BLISP EID-to-RLOC mapping
- CWireless AP management
- DLocal SSID configuration
Why this is the answer
The code block shows fabric_border with external Layer 3 connectivity. LISP mapping and other functions are assigned to other node roles.
Network Assurance
6 questions in this domain
- Question 25Single Choice
Which SD-Access fabric node is responsible for operating the LISP mapping database and processing endpoint registrations?
- AControl Plane NodeCorrect answer
- BFabric Border Node
- CFabric Edge Node
- DWireless LAN Controller
Why this is the answer
Control Plane Nodes run the LISP Map-Server and Map-Resolver functions and keep the database that maps endpoint identifiers to fabric edge locators.
- Question 26Multiple Select
Which two statements correctly describe integrated SD-Access wireless? (Choose two.)
- AA fabric-enabled WLC centrally manages SSID and policy profiles for wireless fabric operation.Correct answer
- BEach AP must have its own separate SSID created before it can provide fabric services.
- CWireless clients can receive group-based policy through the same fabric control plane used for wired clients.Correct answer
- DIn SD-Access wireless, every SSID must use an autonomous AP configuration.
Why this is the answer
SD-Access wireless does not require per-AP SSID configuration. The fabric WLC manages SSIDs centrally and integrates wireless clients with fabric policy and segmentation.
- Question 27Interactive
The output below was captured while validating an SD-Access control plane service. Which function is shown?
- AForwarding packets between external Layer 3 networks and the fabric
- BMaintaining LISP endpoint-to-locator mappings and answering map requestsCorrect answer
- CTerminating AP control sessions for wireless clients
- DAssigning user credentials before network access
Why this is the answer
The output displays map-server registration and map-request activity. This indicates a Control Plane Node providing LISP mapping services.
- Question 28Single Choice
Which platform is required for an SD-Access deployment to enforce group-based policy and micro-segmentation?
- ACisco Prime Infrastructure
- BCisco ISECorrect answer
- CCisco DNA Center by itself
- DNetFlow Collector
Why this is the answer
Cisco ISE is required as the identity and policy source for SGT-based micro-segmentation and group policy in an SD-Access fabric.
- Question 29Multiple Select
Which two statements correctly describe LISP host mobility in an SD-Access fabric? (Choose two.)
- AA host can move between fabric edge nodes and keep the same IP address.Correct answer
- BThe control plane mapping must reflect the new fabric edge location after the host moves.Correct answer
- CA host must request a new IP from the new edge subnet to keep communicating.
- DLISP mobility is available only to wireless clients, never wired clients.
Why this is the answer
LISP separates endpoint identity from location. A host may retain its IP while moving between fabric edges, and the control plane updates the EID-to-RLOC mapping.
- Question 30Interactive
The output below describes a wireless SSID profile used in an SD-Access deployment. Which two statements are supported by the output? (Choose two.)
- AThe SSID is managed by the fabric WLC instead of being configured directly on each AP.Correct answer
- BEvery AP must be configured with a different SSID name.
- CWireless clients are outside the SD-Access policy domain.
- DAfter authentication, wireless clients can participate in SGT group policy.Correct answer
Why this is the answer
The output shows fabric mode enabled, a policy profile, and 802.1X with ISE as AAA. Therefore, the SSID is centrally managed and wireless clients can receive SGT policy.
Security
6 questions in this domain
- Question 31Single Choice
Which SD-Access node provides the connection between the fabric overlay and Layer 3 networks outside the fabric?
- AFabric Border NodeCorrect answer
- BControl Plane Node
- CFabric Edge Node
- DWireless LAN Controller
Why this is the answer
The Fabric Border node connects the fabric overlay to networks outside the SD-Access fabric. The Control Plane Node is responsible for mapping endpoints to locations instead.
- Question 32Multiple Select
Which two statements correctly distinguish the Control Plane Node from the Fabric Border Node in SD-Access?
- AControl Plane Node maps EIDs to RLOCs.Correct answer
- BFabric Border Node provides external Layer 3 connectivity.Correct answer
- CFabric Border Node maintains all LISP mappings.
- DControl Plane Node provides external Layer 3 connectivity.
Why this is the answer
The Control Plane Node handles LISP mapping between endpoint identifiers and routing locators. The Fabric Border Node connects the fabric to outside Layer 3 networks.
- Question 33Interactive
According to the role definition in the code block, which SD-Access node is described?
- AFabric Border NodeCorrect answer
- BControl Plane Node
- CFabric Edge Node
- DCisco ISE
Why this is the answer
The block describes the fabric-border role, which is responsible for connectivity to Layer 3 domains outside the SD-Access fabric.
- Question 34Single Choice
How should wireless SSIDs be handled in an SD-Access wireless deployment?
- AConfigure centrally on the WLC.Correct answer
- BConfigure separately on each AP.
- CUse only non-fabric SSIDs.
- DConfigure on the Fabric Border only.
Why this is the answer
SD-Access wireless uses a fabric-enabled controller. SSIDs are configured centrally on the WLC and are not configured one-by-one on each AP.
- Question 35Multiple Select
Which two statements about Cisco ISE in SD-Access group-based policies are true?
- AISE is required for SGT micro-segmentation.Correct answer
- BISE provides endpoint identity and SGT grouping.Correct answer
- CISE acts as the LISP Control Plane Node.
- DISE replaces the Fabric Border Node.
Why this is the answer
Cisco ISE provides identity classification and Security Group Tags, which are required for group-based micro-segmentation. ISE does not perform LISP mapping or fabric border routing.
- Question 36Interactive
Based on the policy definition in the code block, which component is required to enforce this policy?
- ACisco ISECorrect answer
- BFabric Border Node
- CControl Plane Node
- DWireless LAN Controller
Why this is the answer
Group-based micro-segmentation policies in SD-Access rely on Cisco ISE as the identity and policy source for Security Group Tags.
Virtualization
4 questions in this domain
- Question 37Single Choice
What is the primary role of a Fabric Border node in an SD-Access fabric?
- AConnect the fabric to outside networksCorrect answer
- BMaintain endpoint-to-locator mappings
- CRegister endpoints in the LISP database
- DAct as a wireless access point controller
Why this is the answer
The Fabric Border node is the gateway between the SD-Access fabric and external networks. Mapping and endpoint registration are performed by the Control Plane Node.
- Question 38Multiple Select
Select two responsibilities that belong to the SD-Access Control Plane Node.
- AMaintain the EID-to-RLOC mapping databaseCorrect answer
- BAnswer requests for an endpoint's RLOC locationCorrect answer
- CLink the fabric to external Layer 3 networks
- DCreate a wireless SSID for every AP
Why this is the answer
The Control Plane Node acts as the LISP map server and map resolver for the fabric. Fabric Border nodes provide connectivity to networks outside the fabric.
- Question 39Interactive
Using the node roles shown in the code block, which SD-Access component connects the fabric to external networks?
- AFabric Border NodeCorrect answer
- BControl Plane Node
- CFabric Edge Node
- DWireless Controller
Why this is the answer
The Fabric Border Node is responsible for connecting the SD-Access fabric to networks outside the fabric. The Control Plane Node maintains mappings, and the Fabric Edge Node connects endpoints.
- Question 40Single Choice
What mobility capability does LISP provide in Cisco SD-Access?
- AHost mobility between different fabric edgesCorrect answer
- BMobility only within a single fabric edge
- CMobility without the use of an overlay network
- DMobility that requires a new IP address each time
Why this is the answer
LISP supports host mobility across different fabric edges. The playbook warns against misunderstanding the range of IP mobility supported by LISP.
Frequently asked questions
Everything about the CCNP Enterprise question bank and how to use it.