SNMP and Syslog practice questions

A network engineer configures SNMPv2c on a Cisco router to monitor CPU and memory utilization. The NMS is reachable and configured with the same community string 'public'. However, the NMS receives no traps from the router. The engineer verifies that the router's SNMP configuration includes 'snmp-server enable traps' and 'snmp-server host 192.168.1.100 version 2c public'. What is the most likely cause of the missing traps?

Trap 1: The router's SNMP agent is disabled.

Incorrect because 'snmp-server enable traps' implies the agent is enabled; the issue is with specific trap generation.

Trap 2: The community string 'public' is not defined on the router.

Incorrect because the community string is used in the trap destination command; it must be defined with 'snmp-server community public RO' or similar.

Trap 3: The NMS is using SNMPv3, which is incompatible with SNMPv2c traps.

Incorrect because the NMS is configured for SNMPv2c as per the host command; compatibility is not an issue here.

A
The router's SNMP agent is disabled.
Why wrong: Incorrect because 'snmp-server enable traps' implies the agent is enabled; the issue is with specific trap generation.
B
The community string 'public' is not defined on the router.
Why wrong: Incorrect because the community string is used in the trap destination command; it must be defined with 'snmp-server community public RO' or similar.
C
The router lacks specific trap configuration for CPU and memory utilization.
Correct because 'snmp-server enable traps' alone does not enable all traps; specific traps like 'snmp-server enable traps cpu threshold' and 'snmp-server enable traps memory' are needed.
D
The NMS is using SNMPv3, which is incompatible with SNMPv2c traps.
Why wrong: Incorrect because the NMS is configured for SNMPv2c as per the host command; compatibility is not an issue here.

Question 2mediummultiple choice

An engineer is troubleshooting a syslog issue on a Cisco switch. The switch is configured with 'logging host 10.1.1.1' and 'logging trap informational'. The syslog server at 10.1.1.1 receives messages from other devices but not from this switch. The engineer can ping 10.1.1.1 from the switch. What is the most likely cause?

Trap 1: The syslog server is configured to accept messages only from a…

Incorrect because the scenario does not indicate server-side filtering; the issue is on the switch.

Trap 2: The 'logging trap informational' command is incorrect; it should be…

Incorrect because 'informational' is a valid severity level (level 6); the command is syntactically correct.

Trap 3: The switch uses UDP port 514, but the server listens on TCP port…

Incorrect because syslog typically uses UDP; the switch defaults to UDP, and the server must match.

A
The syslog server is configured to accept messages only from a specific source IP address.
Why wrong: Incorrect because the scenario does not indicate server-side filtering; the issue is on the switch.
B
The switch's logging process is disabled by default and must be enabled with 'logging on'.
Correct because 'logging on' is required to start the syslog logging process; without it, no messages are sent even if hosts are configured.
C
The 'logging trap informational' command is incorrect; it should be 'logging trap 6'.
Why wrong: Incorrect because 'informational' is a valid severity level (level 6); the command is syntactically correct.
D
The switch uses UDP port 514, but the server listens on TCP port 514.
Why wrong: Incorrect because syslog typically uses UDP; the switch defaults to UDP, and the server must match.

Question 3hardmultiple choice

A network engineer configures SNMPv3 on a Cisco router for secure monitoring. The configuration includes 'snmp-server group ADMIN v3 priv', 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456', and 'snmp-server host 10.1.1.2 version 3 priv admin'. The NMS is configured with the same credentials. However, the NMS cannot poll the router. The engineer verifies that the router's SNMP agent is enabled. What is the most likely cause?

Trap 1: The SNMPv3 user is not associated with the group correctly.

Incorrect because the user 'admin' is assigned to group 'ADMIN' with the correct privileges.

Trap 2: The 'priv' keyword in the host command should be 'auth' instead.

Incorrect because 'priv' indicates both authentication and privacy, which matches the user configuration.

Trap 3: The AES encryption key must be exactly 16 characters.

Incorrect because AES keys can be of varying lengths; the issue is not key length.

A
The SNMPv3 user is not associated with the group correctly.
Why wrong: Incorrect because the user 'admin' is assigned to group 'ADMIN' with the correct privileges.
B
The NMS must be configured with the router's SNMP engine ID.
Correct because SNMPv3 uses engine IDs for authentication; if the NMS does not have the correct engine ID, it cannot authenticate.
C
The 'priv' keyword in the host command should be 'auth' instead.
Why wrong: Incorrect because 'priv' indicates both authentication and privacy, which matches the user configuration.
D
The AES encryption key must be exactly 16 characters.
Why wrong: Incorrect because AES keys can be of varying lengths; the issue is not key length.

Question 4easymultiple choice

An engineer notices that syslog messages from a Cisco router are not timestamped correctly. The router is configured with 'service timestamps log datetime msec' and 'logging host 10.1.1.1'. The syslog server shows messages with the correct time but the local logs on the router show incorrect timestamps. What is the most likely cause?

Trap 1: The 'service timestamps log datetime msec' command is not supported…

Incorrect because this command is widely supported on Cisco IOS-XE.

Trap 2: The syslog server is overwriting the timestamps.

Incorrect because the question states local logs are incorrect; the server may use its own time, but local logs are from the router.

Trap 3: The 'logging host' command must include the 'transport tcp' option.

Incorrect because transport type does not affect timestamps.

A
The 'service timestamps log datetime msec' command is not supported on this platform.
Why wrong: Incorrect because this command is widely supported on Cisco IOS-XE.
B
The router's system clock is not synchronized via NTP or manual setting.
Correct because timestamps are based on the router's clock; if it's incorrect, local logs will have wrong timestamps.
C
The syslog server is overwriting the timestamps.
Why wrong: Incorrect because the question states local logs are incorrect; the server may use its own time, but local logs are from the router.
D
The 'logging host' command must include the 'transport tcp' option.
Why wrong: Incorrect because transport type does not affect timestamps.

Question 5mediummultiple choice

A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS at 192.168.1.100 with community 'monitor'. The engineer also configures 'snmp-server enable traps snmp linkdown linkup'. The NMS receives link traps but not authentication failure traps. The engineer has not configured any access control. What is the most likely reason?

Trap 1: The NMS is not configured to receive authentication failure traps.

Incorrect because the NMS receives other traps; the issue is on the switch.

Trap 2: The community string 'monitor' has read-write access, which…

Incorrect because community string access level does not affect trap generation.

Trap 3: The switch must be configured with 'snmp-server trap-source' to…

Incorrect because trap-source is for source interface, not for enabling specific traps.

A
Authentication failure traps are disabled by default and must be explicitly enabled.
Correct because 'snmp-server enable traps snmp authentication' is needed to send authentication failure traps.
B
The NMS is not configured to receive authentication failure traps.
Why wrong: Incorrect because the NMS receives other traps; the issue is on the switch.
C
The community string 'monitor' has read-write access, which suppresses authentication traps.
Why wrong: Incorrect because community string access level does not affect trap generation.
D
The switch must be configured with 'snmp-server trap-source' to send authentication traps.
Why wrong: Incorrect because trap-source is for source interface, not for enabling specific traps.

Question 6easymultiple choice

An engineer is configuring syslog on a Cisco router to send messages to two servers: 10.1.1.1 (primary) and 10.1.1.2 (secondary). The configuration includes 'logging host 10.1.1.1' and 'logging host 10.1.1.2'. The engineer wants messages to be sent to both servers simultaneously. However, only the first server receives messages. What is the most likely cause?

Trap 1: The second syslog server is not reachable from the router.

Incorrect because the engineer verified reachability via ping.

Trap 2: The 'logging host' command for the second server must be entered…

Incorrect because the order does not affect delivery.

Trap 3: The router requires 'logging on' to send to multiple hosts.

Incorrect because 'logging on' is already implied since the first host works.

A
The second syslog server is not reachable from the router.
Why wrong: Incorrect because the engineer verified reachability via ping.
B
The router's syslog process sends messages to all configured hosts by default; the issue is that the second server is not configured to accept syslog messages.
Correct because the server-side configuration is missing; the router is sending but the server is not listening.
C
The 'logging host' command for the second server must be entered before the first.
Why wrong: Incorrect because the order does not affect delivery.
D
The router requires 'logging on' to send to multiple hosts.
Why wrong: Incorrect because 'logging on' is already implied since the first host works.

Question 7hardmultiple choice

A network engineer configures SNMPv3 on a Cisco router with the following: 'snmp-server group GRP v3 priv', 'snmp-server user usr GRP v3 auth sha pass1 priv aes 128 pass2'. The NMS is configured with the same credentials. However, the NMS cannot perform SNMP walks. The engineer notices that the router's SNMP agent is responding to queries from other devices. What is the most likely cause?

Trap 1: The user's authentication key is too short.

Incorrect because SHA keys can be of varying lengths; the issue is not key length.

Trap 2: The NMS is using SNMPv2c community strings instead of SNMPv3.

Incorrect because the NMS is configured with SNMPv3 credentials as per the scenario.

Trap 3: The router's SNMP engine ID has changed since the user was created.

Incorrect because the user is created on the router; the engine ID is automatically used.

A
The user's authentication key is too short.
Why wrong: Incorrect because SHA keys can be of varying lengths; the issue is not key length.
B
The group 'GRP' is not associated with a view that allows read access to the MIB tree.
Correct because without a view, the group may have no access; 'snmp-server group GRP v3 priv read VIEW' is needed.
C
The NMS is using SNMPv2c community strings instead of SNMPv3.
Why wrong: Incorrect because the NMS is configured with SNMPv3 credentials as per the scenario.
D
The router's SNMP engine ID has changed since the user was created.
Why wrong: Incorrect because the user is created on the router; the engine ID is automatically used.

Question 8mediummultiple choice

An engineer configures syslog on a Cisco router with 'logging host 10.1.1.1' and 'logging trap warnings'. The engineer wants to receive only messages with severity warning (4) and higher (0-4). However, the syslog server receives messages with severity debug (7). What is the most likely cause?

Trap 1: The 'logging trap warnings' command sets the severity for console…

Incorrect because 'logging trap' applies to syslog hosts by default.

Trap 2: The syslog server is configured to accept all messages regardless…

Incorrect because the filtering is done on the router, not the server.

Trap 3: The 'logging trap' command must be followed by a number, not a word.

Incorrect because 'warnings' is a valid keyword for level 4.

A
The 'logging trap warnings' command sets the severity for console logging, not for syslog hosts.
Why wrong: Incorrect because 'logging trap' applies to syslog hosts by default.
B
The syslog server is configured to accept all messages regardless of severity.
Why wrong: Incorrect because the filtering is done on the router, not the server.
C
The router's logging buffer is set to debug, and the syslog host inherits that level.
Correct because if 'logging buffered debugging' is configured, the syslog host may receive all messages due to the buffer setting overriding the trap level.
D
The 'logging trap' command must be followed by a number, not a word.
Why wrong: Incorrect because 'warnings' is a valid keyword for level 4.

Open the full VLAN trunking answer →

Question 9easymultiple choice

A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS. The engineer uses 'snmp-server community public RO' and 'snmp-server host 10.1.1.1 version 2c public'. The NMS receives traps, but the engineer notices that the traps contain the IP address of the management interface (VLAN 1) instead of the loopback interface (Loopback0) that is used for management. The engineer wants the traps to use the loopback IP as the source. What should the engineer do?

Trap 1: Configure 'snmp-server source-interface traps Loopback0'.

Incorrect because the correct command is 'snmp-server trap-source'.

Trap 2: Configure 'ip snmp source-interface Loopback0'.

Incorrect because this is not a valid Cisco command.

Trap 3: Change the management interface IP to match the loopback.

Incorrect because that would be inefficient and not a proper solution.

A
Configure 'snmp-server source-interface traps Loopback0'.
Why wrong: Incorrect because the correct command is 'snmp-server trap-source'.
B
Configure 'snmp-server trap-source Loopback0'.
Correct because this command sets the source IP for all SNMP traps to the loopback interface.
C
Configure 'ip snmp source-interface Loopback0'.
Why wrong: Incorrect because this is not a valid Cisco command.
D
Change the management interface IP to match the loopback.
Why wrong: Incorrect because that would be inefficient and not a proper solution.

Review the full OSPF breakdown →

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2      1   FULL/DR         00:00:38    10.0.0.2        GigabitEthernet0/0
192.168.1.3      1   2WAY/DROTHER    00:00:32    10.0.0.3        GigabitEthernet0/0

Based on this output, what can be concluded?

Trap 1: R1 is the Designated Router (DR) on this segment.

R1 is not the DR because the neighbor 192.168.1.2 is shown as DR in the State column.

Trap 2: R1 is a DROTHER on this segment.

A DROTHER would have a 2WAY state with the DR and BDR, not a FULL state with the DR.

Trap 3: The OSPF network type is point-to-point.

Point-to-point networks do not have DR/BDR elections; the output shows DR and DROTHER states, indicating a broadcast or NBMA network type.

A
R1 is the Designated Router (DR) on this segment.
Why wrong: R1 is not the DR because the neighbor 192.168.1.2 is shown as DR in the State column.
B
R1 is the Backup Designated Router (BDR) on this segment.
R1 has a FULL adjacency with the DR (192.168.1.2) and a 2WAY adjacency with the DROTHER (192.168.1.3), which is characteristic of a BDR.
C
R1 is a DROTHER on this segment.
Why wrong: A DROTHER would have a 2WAY state with the DR and BDR, not a FULL state with the DR.
D
The OSPF network type is point-to-point.
Why wrong: Point-to-point networks do not have DR/BDR elections; the output shows DR and DROTHER states, indicating a broadcast or NBMA network type.

Open the full VLAN trunking answer →

Question 11mediummultiple choice

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports

---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 10 Sales active Gi0/4, Gi0/5 20 Engineering active Gi0/6 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup

Based on this output, what can be concluded?

Trap 1: VLAN 20 is not operational because it has only one port assigned.

A VLAN can be operational with a single port; the 'active' status indicates it is working.

Trap 2: The switch supports FDDI and Token Ring VLANs.

The 'act/unsup' status means the VLANs are present but unsupported on this switch.

Trap 3: VLAN 10 has more broadcast traffic than VLAN 20.

The output does not provide any traffic statistics; it only shows VLAN membership.

A
VLAN 20 is not operational because it has only one port assigned.
Why wrong: A VLAN can be operational with a single port; the 'active' status indicates it is working.
B
The switch supports FDDI and Token Ring VLANs.
Why wrong: The 'act/unsup' status means the VLANs are present but unsupported on this switch.
C
Port Gi0/6 is an access port in VLAN 20.
The output shows Gi0/6 assigned to VLAN 20, and since no trunking is indicated, it is likely an access port in VLAN 20.
D
VLAN 10 has more broadcast traffic than VLAN 20.
Why wrong: The output does not provide any traffic statistics; it only shows VLAN membership.

Open the full BGP breakdown →

Question 12hardmultiple choice

A network engineer runs the following command on Router R2:

R2# show ip bgp summary

BGP router identifier 10.0.0.2, local AS number 65002 BGP table version is 10, main routing table version 10 4 network entries using 576 bytes of memory 4 path entries using 320 bytes of memory 3/2 BGP path/bestpath attribute entries using 456 bytes of memory 1 BGP AS-PATH entries using 24 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 1376 total bytes of memory BGP activity 6/2 prefixes, 6/2 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4        65001    1024    1020       10    0    0 02:15:30        3
192.168.1.3     4        65003       0       0        0    0    0 00:00:12   Idle (Admin)

Based on this output, what can be concluded?

Trap 1: The BGP session to 192.168.1.3 is down due to a network failure.

The '(Admin)' flag indicates administrative shutdown, not a network failure.

Trap 2: Router R2 has received 3 routes from 192.168.1.1.

The output shows PfxRcd=3 for 192.168.1.1, meaning 3 prefixes were received, but the question asks about the conclusion from the output, and the admin shutdown is the key observation.

Trap 3: The BGP table version is 10, meaning 10 routes are in the table.

The BGP table version is a version number, not a count of routes. The output shows 4 network entries.

A
The BGP session to 192.168.1.3 is down due to a network failure.
Why wrong: The '(Admin)' flag indicates administrative shutdown, not a network failure.
B
The BGP session to 192.168.1.3 has been manually disabled.
The Idle state with '(Admin)' is a clear indication that the neighbor has been administratively shut down.
C
Router R2 has received 3 routes from 192.168.1.1.
Why wrong: The output shows PfxRcd=3 for 192.168.1.1, meaning 3 prefixes were received, but the question asks about the conclusion from the output, and the admin shutdown is the key observation.
D
The BGP table version is 10, meaning 10 routes are in the table.
Why wrong: The BGP table version is a version number, not a count of routes. The output shows 4 network entries.

Study the full multicast explanation →

Question 13mediummultiple choice

A network engineer runs the following command on Router R3:

R3# show interfaces GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up Hardware is ISR4331-2x1GE, address is aabb.cc00.0300 (bia aabb.cc00.0300) Internet address is 10.0.0.3/24 MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 1000 bits/sec, 2 packets/sec 5 minute output rate 2000 bits/sec, 3 packets/sec 12345 packets input, 1234567 bytes, 0 no buffer Received 123 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 12345 packets output, 2345678 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out

Based on this output, what can be concluded?

Trap 1: The interface has experienced a hardware failure.

The interface is up/up, so no hardware failure is present. The reset count is low and may be due to a transient event.

Trap 2: The interface is experiencing high input errors.

Input errors are 0, so there are no input errors.

Trap 3: The interface is operating at half-duplex.

The output clearly states 'Full-duplex'.

A
The interface has experienced a hardware failure.
Why wrong: The interface is up/up, so no hardware failure is present. The reset count is low and may be due to a transient event.
B
The interface has had one reset since the last counter clear.
The output shows '1 interface resets', which is a counter that increments each time the interface is reset.
C
The interface is experiencing high input errors.
Why wrong: Input errors are 0, so there are no input errors.
D
The interface is operating at half-duplex.
Why wrong: The output clearly states 'Full-duplex'.

Open the full VLAN trunking answer →

Question 14hardmultiple choice

A network engineer runs the following command on Switch SW2:

SW2# show spanning-tree vlan 10

VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address aabb.cc00.0100 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address aabb.cc00.0200 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec

Interface           Role Sts Cost      Prio.Nbr Type

------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Gi0/3 Desg FWD 19 128.3 P2p

Based on this output, what can be concluded?

Trap 1: SW2 is the root bridge for VLAN 10.

SW2 has a root port (Gi0/1), so it is not the root bridge. The root bridge has a lower MAC address (aabb.cc00.0100).

Trap 2: Port Gi0/2 is in forwarding state.

Gi0/2 is shown as 'Altn BLK', meaning alternate (blocking) state.

Trap 3: The STP priority for VLAN 10 is 32768.

The priority shown is 32778, which is 32768 + 10 (VLAN ID). The base priority is 32768, but the effective priority includes the VLAN ID.

A
SW2 is the root bridge for VLAN 10.
Why wrong: SW2 has a root port (Gi0/1), so it is not the root bridge. The root bridge has a lower MAC address (aabb.cc00.0100).
B
The root bridge for VLAN 10 has MAC address aabb.cc00.0100.
The Root ID shows the root bridge's MAC address as aabb.cc00.0100.
C
Port Gi0/2 is in forwarding state.
Why wrong: Gi0/2 is shown as 'Altn BLK', meaning alternate (blocking) state.
D
The STP priority for VLAN 10 is 32768.
Why wrong: The priority shown is 32778, which is 32768 + 10 (VLAN ID). The base priority is 32768, but the effective priority includes the VLAN ID.

Read the full EtherChannel explanation →

Question 15mediummultiple choice

A network engineer runs the following command on Switch SW3:

SW3# show etherchannel summary

Flags: D - down P - in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator

M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port

Number of channel-groups in use: 1 Number of aggregators: 1

Group Port-channel Protocol Ports ------+-------------+-----------+--------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D)

Based on this output, what can be concluded?

Trap 1: All three ports are actively participating in the EtherChannel.

Gi0/3 is shown as (D) which means down, so it is not active.

Trap 2: The EtherChannel is a Layer 3 port-channel.

The flag 'SU' indicates Layer 2 (S) and in use (U). Layer 3 would be 'RU'.

Trap 3: Port Gi0/3 is in standby mode.

Standby mode is indicated by 'H' (Hot-standby) for LACP, but Gi0/3 shows 'D' for down.

A
All three ports are actively participating in the EtherChannel.
Why wrong: Gi0/3 is shown as (D) which means down, so it is not active.
B
The EtherChannel is using LACP protocol.
The Protocol column shows 'LACP'.
C
The EtherChannel is a Layer 3 port-channel.
Why wrong: The flag 'SU' indicates Layer 2 (S) and in use (U). Layer 3 would be 'RU'.
D
Port Gi0/3 is in standby mode.
Why wrong: Standby mode is indicated by 'H' (Hot-standby) for LACP, but Gi0/3 shows 'D' for down.

Question 16mediummultiple choice

A network engineer runs the following command on Router R4:

R4# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.168.1.10:1024 10.0.0.10:1024 203.0.113.5:80 203.0.113.5:80 tcp 192.168.1.10:1024 10.0.0.10:1024 203.0.113.5:80 203.0.113.5:80 --- 192.168.1.11:2048 10.0.0.11:2048 198.51.100.2:443 198.51.100.2:443

Based on this output, what can be concluded?

Trap 1: Both translations are dynamic NAT entries.

The first entry has '---' in the protocol field, indicating a static NAT entry, not dynamic.

Trap 2: The router is performing PAT for both translations.

The ports are shown, but the first entry has no protocol, so it is not necessarily PAT. PAT would show 'tcp' or 'udp' with port numbers.

Trap 3: The outside global address is the same as the outside local address…

For the first entry, outside local and outside global are both 203.0.113.5:80, but for the second, they are both 198.51.100.2:443. This is common, but not a conclusion about the NAT type.

A
Both translations are dynamic NAT entries.
Why wrong: The first entry has '---' in the protocol field, indicating a static NAT entry, not dynamic.
B
The translation for 10.0.0.10 is a static NAT entry.
The absence of a protocol (---) and the presence of an inside global address that does not change indicates a static NAT.
C
The router is performing PAT for both translations.
Why wrong: The ports are shown, but the first entry has no protocol, so it is not necessarily PAT. PAT would show 'tcp' or 'udp' with port numbers.
D
The outside global address is the same as the outside local address for both entries.
Why wrong: For the first entry, outside local and outside global are both 203.0.113.5:80, but for the second, they are both 198.51.100.2:443. This is common, but not a conclusion about the NAT type.

Read the full MPLS explanation →

Question 17hardmultiple choice

A network engineer runs the following command on Router R5:

R5# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.5:0 TCP connection: 10.0.0.2.646 - 10.0.0.5.646 State: Oper; Msgs sent/rcvd: 123/120; Downstream Up time: 01:23:45 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.0.1.2 Addresses bound to peer LDP Ident:

10.0.0.2        10.0.1.2        192.168.1.1

Based on this output, what can be concluded?

Trap 1: The LDP session is down because the state is 'Oper'.

'Oper' means operational, not down.

Trap 2: The local LDP identifier is 10.0.0.2:0.

The local LDP Ident is 10.0.0.5:0, as shown in the first line. The peer LDP Ident is 10.0.0.2:0.

Trap 3: The LDP session has been up for 1 hour 23 minutes 45 seconds.

The up time is 01:23:45, which is 1 hour, 23 minutes, and 45 seconds. This is true, but not the best conclusion; the question asks for what can be concluded from the output, and the interface information is more specific.

A
The LDP session is down because the state is 'Oper'.
Why wrong: 'Oper' means operational, not down.
B
The LDP neighbor is reachable via GigabitEthernet0/0.
The LDP discovery sources show GigabitEthernet0/0 with source IP 10.0.1.2, indicating the neighbor is reachable through that interface.
C
The local LDP identifier is 10.0.0.2:0.
Why wrong: The local LDP Ident is 10.0.0.5:0, as shown in the first line. The peer LDP Ident is 10.0.0.2:0.
D
The LDP session has been up for 1 hour 23 minutes 45 seconds.
Why wrong: The up time is 01:23:45, which is 1 hour, 23 minutes, and 45 seconds. This is true, but not the best conclusion; the question asks for what can be concluded from the output, and the interface information is more specific.

Study the full multicast explanation →

Question 18hardmultiple choice

A network engineer runs the following command on Router R6:

R6# show ip pim neighbor

PIM Neighbor Table Mode: B - Bidir Capable, DR - Designated Router, N - Default DR Priority, S - State Refresh Capable, G - GenID Capable, L - DR Load Balancing Capable

Neighbor Address     Interface          Uptime    Expires    Mode
10.0.0.2             GigabitEthernet0/0 02:15:30  00:01:25   DR (DR)
10.0.0.3             GigabitEthernet0/0 02:15:28  00:01:27   B S

Based on this output, what can be concluded?

Trap 1: Router R6 is the PIM Designated Router on this segment.

The neighbor 10.0.0.2 is marked as DR, so R6 is not the DR.

Trap 2: The neighbor 10.0.0.3 supports bidirectional PIM.

The mode 'B' indicates Bidir capable, but the question asks for a conclusion from the output, and the DR designation is the primary observation.

Trap 3: Both neighbors are capable of state refresh.

Only 10.0.0.3 has 'S' for state refresh. 10.0.0.2 does not have 'S' in its mode.

A
Router R6 is the PIM Designated Router on this segment.
Why wrong: The neighbor 10.0.0.2 is marked as DR, so R6 is not the DR.
B
The neighbor 10.0.0.2 is the PIM Designated Router.
The mode column shows 'DR' for 10.0.0.2, indicating it is the DR.
C
The neighbor 10.0.0.3 supports bidirectional PIM.
Why wrong: The mode 'B' indicates Bidir capable, but the question asks for a conclusion from the output, and the DR designation is the primary observation.
D
Both neighbors are capable of state refresh.
Why wrong: Only 10.0.0.3 has 'S' for state refresh. 10.0.0.2 does not have 'S' in its mode.

Question 19mediummultiple choice

Given the following SNMP configuration on a Cisco IOS-XE router:

snmp-server community public RO
snmp-server community private RW
snmp-server location Building-A
snmp-server contact admin@example.com
snmp-server enable traps snmp linkdown linkup
snmp-server host 192.168.1.100 version 2c public

What is the effect of this configuration?

Trap 1: The router will send SNMP traps to 192.168.1.100 using community…

The 'snmp-server host' command uses community 'public', not 'private'. Also, only linkdown and linkup traps are enabled, not all traps.

Trap 2: The router will only accept SNMP read requests using community…

While 'public' is RO and 'private' is RW, the question asks about the effect of the entire configuration, which includes trap generation. This option is incomplete.

Trap 3: The router will send SNMPv3 traps to 192.168.1.100 using…

The configuration uses 'version 2c', not SNMPv3. No authentication is configured.

A
The router will send SNMP traps to 192.168.1.100 using community string 'public' for linkdown and linkup events.
The 'snmp-server enable traps snmp linkdown linkup' enables those traps, and the 'snmp-server host' command sends them to 192.168.1.100 with community 'public'.
B
The router will send SNMP traps to 192.168.1.100 using community string 'private' for all SNMP traps.
Why wrong: The 'snmp-server host' command uses community 'public', not 'private'. Also, only linkdown and linkup traps are enabled, not all traps.
C
The router will only accept SNMP read requests using community 'public' and write requests using community 'private'.
Why wrong: While 'public' is RO and 'private' is RW, the question asks about the effect of the entire configuration, which includes trap generation. This option is incomplete.
D
The router will send SNMPv3 traps to 192.168.1.100 using authentication.
Why wrong: The configuration uses 'version 2c', not SNMPv3. No authentication is configured.

Question 20mediummultiple choice

Consider the following partial syslog configuration on a Cisco IOS-XE switch:

logging host 10.10.10.1 transport udp port 514
logging trap 6
logging source-interface Loopback0
logging on

Which statement is true about this configuration?

Trap 1: Syslog messages with severity level 7 (Debugging) will be sent to…

The 'logging trap 6' command sets the severity level to 6, meaning only messages with severity 0-6 are sent. Level 7 (Debugging) is excluded.

Trap 2: The syslog server must be configured to receive messages on TCP…

The configuration explicitly uses 'transport udp port 514', so UDP is used, not TCP.

Trap 3: Only syslog messages with severity level 6 (Informational) will be…

The 'logging trap 6' sends messages with severity 0-6, not just level 6. Level 6 is the highest severity included.

A
Syslog messages with severity level 7 (Debugging) will be sent to 10.10.10.1.
Why wrong: The 'logging trap 6' command sets the severity level to 6, meaning only messages with severity 0-6 are sent. Level 7 (Debugging) is excluded.
B
Syslog messages will be sourced from the IP address of Loopback0 interface.
The 'logging source-interface Loopback0' command makes all syslog messages use the IP address of Loopback0 as the source.
C
The syslog server must be configured to receive messages on TCP port 514.
Why wrong: The configuration explicitly uses 'transport udp port 514', so UDP is used, not TCP.
D
Only syslog messages with severity level 6 (Informational) will be sent.
Why wrong: The 'logging trap 6' sends messages with severity 0-6, not just level 6. Level 6 is the highest severity included.