Router R1 Cannot Reach R3 Practice Questions

Drag and drop the steps to configure OSPF on a Cisco router into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
1. Enable OSPF routing process (router ospf [process-id]). 2. Configure Router ID (router-id [id]). 3. Advertise networks (network [network] [wildcard] area [area]).
This is the correct order because you must first enable the OSPF process, then optionally set a specific router ID before advertising networks, as the router ID is used in neighbor establishment and link-state advertisements.
B
1. Configure Router ID (router-id [id]). 2. Enable OSPF routing process (router ospf [process-id]). 3. Advertise networks (network [network] [wildcard] area [area]).
Why it fails: This is incorrect because you cannot configure a router ID without first enabling the OSPF process; the router-id command is entered in OSPF router configuration mode, which requires the process to be active.
C
1. Enable OSPF routing process (router ospf [process-id]). 2. Advertise networks (network [network] [wildcard] area [area]). 3. Configure Router ID (router-id [id]).
Why it fails: This is incorrect because although technically you can set the router ID after network statements, best practice and the standard order in Cisco documentation is to configure the router ID before network statements to ensure a stable router ID during neighbor formation.
D
1. Advertise networks (network [network] [wildcard] area [area]). 2. Enable OSPF routing process (router ospf [process-id]). 3. Configure Router ID (router-id [id]).
Why it fails: This is incorrect because you cannot advertise networks or configure a router ID before the OSPF process is enabled; network statements are entered in router configuration mode, which only exists after the process is started.

Question 2mediummultiple choice

An engineer is writing a Python script using the Cisco DevNet sandbox to configure OSPF on a CSR1000v via RESTCONF. What authentication method is typically used for RESTCONF requests?

A
No authentication
Why it fails: RESTCONF runs over HTTPS and requires credentials; unauthenticated requests to a CSR1000v return 401. The sandbox still enforces AAA. No authentication applies only to deliberately open lab endpoints or initial discovery of the RESTCONF root, not configuration pushes.
B
OAuth2
Why it fails: IOS XE RESTCONF uses HTTP Basic authentication against the local or AAA user database; OAuth2 requires an authorisation server issuing bearer tokens, which the CSR1000v does not provide natively. OAuth2 is correct for controller-based APIs such as Cisco DNA Center, not device-level RESTCONF.
C
API token only
Why it fails: RESTCONF on IOS XE authenticates each request with HTTP Basic credentials (username and password), not a bearer token; there is no token-issuing endpoint. API tokens fit platforms such as Meraki or DNA Center, where a token is issued and presented in a header.
D
Basic authentication over HTTPS
RESTCONF requests to the CSR1000v sandbox carry an HTTP Basic authentication header containing base64-encoded username and password, transported inside the TLS tunnel that HTTPS provides. No OAuth token exchange or certificate-based mutual authentication is required.

Study the full Python automation breakdown →

Question 3mediummultiple choice

A developer writes a Python script using Cisco's pyATS framework to test network reachability after a configuration change. What is a key advantage of using pyATS over a simple script that uses ping?

A
pyATS requires less code than a ping script
Why it fails: Code volume is not the advantage; a ping script can be equally short. pyATS wins because it parses device output into structured objects and validates state programmatically, which ping's raw text cannot. It is tempting because pyATS's abstraction layers can reduce boilerplate when building larger test suites.
B
pyATS can test multiple devices in parallel
Why it fails: Parallel execution across devices is a genuine pyATS capability, but the question asks for an advantage over ping for reachability testing after a configuration change, where structured parsing and validation of device state is the differentiator. It is tempting because parallel execution does reduce runtime when polling many devices.
C
pyATS allows writing reusable test scripts with built-in test libraries
pyATS provides reusable test scripts with built-in libraries such as Genie, offering structured parsing, assertions and reporting across devices. A plain ping script returns only reachability output, so pyATS satisfies the stem's need for maintainable, repeatable post-change verification rather than ad hoc checks.
D
pyATS automatically generates test reports
Why it fails: Report generation is a pyATS feature, yet it does not explain why pyATS outperforms ping for verifying reachability after a configuration change; the advantage lies in structured, programmatic validation of parsed device output. It is tempting because automated reporting genuinely saves manual documentation effort during test runs.

Question 4hardmultiple choice

A security team is developing an application that collects network alerts from Cisco Firepower Management Center (FMC) API. The API requires OAuth2 authorization code grant flow. After obtaining an authorization code, what must the application do to get an access token?

A
Resend the authorization request with the code included in the redirect URI.
Why it fails: Repeating the authorization request with the code in the redirect URI does not yield a token; the code must be POSTed to the token endpoint with the client ID, secret and redirect URI for validation. It is tempting because the redirect URI is where the code arrived, but that endpoint only issues codes, never tokens.
B
Decode the authorization code using base64 to extract the access token.
Why it fails: The authorization code is an opaque, server-issued reference, not a base64-encoded container holding an access token; decoding yields meaningless bytes. It must be exchanged at the token endpoint. It is tempting because JSON Web Tokens are base64url-encoded and decodable, but OAuth2 authorization codes are not JWTs and carry no embedded claims.
C
Use the authorization code directly in subsequent API requests as a bearer token.
Why it fails: The authorization code is a short-lived, single-use credential that must be exchanged at the token endpoint, authenticated with the client credentials, for an access token. Sending it as a bearer token fails because FMC rejects it as an invalid token. It is tempting because the code looks like a credential, but it is only an intermediate artefact.
D
Exchange the authorization code for an access token by calling the token endpoint with the code and client credentials.
In the OAuth2 authorization code grant, the code is only an intermediate credential; the client must POST it to the token endpoint along with its client credentials so the authorisation server can validate it and return the access token.

Read the full wireless explanation →

Question 5easymultiple choice

Which of the following is a non-overlapping channel in the 2.4 GHz Wi-Fi band?

A
Channel 3
Why it fails: Channel 3 overlaps channels 1 and 6 because each 2.4 GHz channel spans roughly 22 MHz while centre frequencies are only 5 MHz apart. Only 1, 6 and 11 are non-overlapping. Channel 3 would be chosen only where deliberate partial overlap with adjacent cells is acceptable.
B
Channel 6
In the 2.4 GHz band, only channels 1, 6 and 11 are conventionally non-overlapping, each separated by five 5 MHz steps so their 22 MHz-wide signals do not overlap. Channel 6 sits between 1 and 11, satisfying the stem's non-overlapping requirement.
C
Channel 12
Why it fails: Channel 12 overlaps channel 11 and sits outside the US regulatory range, so it is not a non-overlapping 2.4 GHz channel. Only 1, 6 and 11 avoid mutual overlap. Channel 12 is usable in regions permitting channels 12–13, where it may reduce interference from neighbouring 1/6/11 networks.
D
Channel 9
Why it fails: Channel 9 sits between channels 7 and 11, so its 22 MHz-wide signal overlaps both neighbours in the 2.4 GHz band. Only channels 1, 6 and 11 are conventionally non-overlapping there. Channel 9 would be usable where overlapping co-channel interference is tolerable, such as a single-AP home deployment.

Question 6hardmulti select

Which THREE factors influence the convergence time of OSPF in a large enterprise network? (Choose three.)

A
CPU processing power for SPF calculations
SPF computation time affects convergence.
B
Hello and dead interval timers
Shorter timers speed failure detection.
C
Bidirectional Forwarding Detection (BFD) implementation
Why it fails: BFD is not part of OSPF itself.
D
DUAL algorithm processing time
Why it fails: DUAL is used by EIGRP, not OSPF.
E
LSA propagation delay across the network
Flooding LSAs takes time.

Study the full Python automation breakdown →

Question 7hardmultiple choice

A developer is building a Python application that must handle configuration data in multiple formats (JSON, YAML, XML) and provide a consistent interface for reading and writing. The application may add new formats later. Which design pattern best supports this extensibility while keeping the client code decoupled from concrete implementations?

A
Singleton pattern with a global configuration manager
Why it fails: A Singleton ensures a single instance but does not address format extensibility or decoupling. Adding a new format would require modifying the global manager, violating the open-closed principle. It also introduces global state, making testing harder and reducing flexibility.
B
Observer pattern to notify components when configuration changes
Why it fails: The observer pattern is about one-to-many dependency and event notification, not about creating or selecting parsers. It does not address the need for a consistent interface across multiple formats or extensibility for new formats. Using it here would add unnecessary complexity without solving the core problem.
C
Adapter pattern to convert each format to a common internal representation
Why it fails: The adapter pattern is useful for making incompatible interfaces work together, but it does not inherently provide a creation mechanism for selecting the appropriate parser. The client would still need to choose the adapter, coupling it to concrete implementations. It is better suited for legacy integration than for format extensibility.
D
Factory method pattern with an abstract parser interface
The factory method pattern defines an interface for creating objects, allowing subclasses to decide which concrete parser to instantiate. The client code depends only on the abstract parser interface, so new formats can be added by creating new factory subclasses without modifying existing client code, directly supporting extensibility and decoupling.

Study the full ACL explanation →

Question 8hardmultiple choice

A network engineer is troubleshooting an issue where a client cannot reach a web server at 203.0.113.10. The engineer runs a traceroute from the client and sees that the path stops at a router with IP 198.51.100.1, which is the last hop before the destination. The engineer suspects that the router is dropping packets due to an ACL. Which command should the engineer use on the router to verify if an ACL is blocking traffic to the web server?

A
show ip interface
Why it fails: The show ip interface command displays IP interface status and may show which ACLs are applied to interfaces, but it does not show the contents of the ACLs or whether they are matching traffic. It can indicate that an ACL is applied, but to verify if it is blocking specific traffic, the engineer must examine the ACL entries and potentially use debug or logging. This command alone is insufficient for the task.
B
show ip route 203.0.113.10
Why it fails: The show ip route command displays the routing table entry for the destination, which can confirm if a route exists. However, it does not show ACL configurations or whether traffic is being filtered. While useful for verifying reachability at Layer 3, it does not address the suspicion of an ACL blocking traffic. The engineer needs to inspect ACLs, not just routing.
C
show ip access-lists
The show ip access-lists command displays the configured ACLs and their entries, including match counters if the ACL has been applied and is counting matches. By examining the ACL entries, the engineer can see if there is a deny statement that would block traffic from the client to the web server. The match counters can also indicate if packets are hitting a particular entry, which helps confirm if the ACL is the cause of the problem.
D
debug ip packet
Why it fails: The debug ip packet command can show IP packets as they are processed, but it is very resource-intensive and can severely impact router performance, especially in production. It may not directly show ACL matches and is not the recommended first step for verifying ACL blocks. While it can provide detailed information, it is generally used with caution and often with an ACL filter to limit output. It is not the best choice for this scenario.

Question 9hardmulti select

An engineer is troubleshooting a network issue where a client cannot reach a server. The client uses HTTPS. Which TWO factors are essential for a successful TLS handshake?

A
The server must have a valid digital certificate
The certificate proves the server's identity.
B
The handshake uses UDP for faster negotiation
Why it fails: TLS typically runs over TCP.
C
The client must present a certificate to the server
Why it fails: Client certificates are optional, not required for a basic TLS handshake.
D
The client must have a public key to encrypt the session
Why it fails: The client uses the server's public key (from certificate) to encrypt the pre-master secret.
E
The server's private key is used to decrypt the pre-master secret
Only the server's private key can decrypt the pre-master secret.

Question 10hardmultiple choice

A DevOps team is developing a CI/CD pipeline for a microservices application that uses Cisco NSO (Network Services Orchestrator) for network configuration. The application code is stored in a Git repository. The pipeline must automatically trigger a test suite when a pull request is merged to the main branch, but only if the tests pass, then deploy to a staging environment. The team is using Jenkins. A junior engineer suggests using a single Jenkinsfile with a declarative pipeline that includes all stages. However, a senior engineer notes that the pipeline should be designed for reusability and maintainability, especially as the number of microservices grows. Which approach best meets these requirements?

A
Use shared libraries to define common stages like testing and deployment, and reference them in each microservice's Jenkinsfile.
Shared libraries extract common pipeline stages into a versioned, centrally maintained repository, so each microservice's Jenkinsfile references them rather than duplicating logic. This directly satisfies the reusability and maintainability constraint as the number of microservices grows, unlike a single monolithic declarative pipeline.
B
Create separate Jenkinsfiles for each microservice and call them from a main pipeline using the "build" step.
Why it fails: Nested Jenkinsfiles invoked via the build step recompile each microservice's pipeline separately, so shared stage logic and credentials are duplicated rather than inherited, defeating the reusability the stem demands. It suits teams wanting per-repo autonomy over independent pipelines, not centralised orchestration of a growing microservice fleet.
C
Use a single scripted pipeline that uses "parallel" for microservices and "stage" for testing and deployment.
Why it fails: A single scripted pipeline duplicates stage logic across every microservice, so changes must be replicated manually and reusability suffers as services grow. Shared libraries or templated declarative pipelines centralise that logic. Scripted pipelines with parallel stages suit one-off, highly bespoke workflows rather than a growing multi-service estate.
D
Use a single declarative pipeline with all stages defined in the Jenkinsfile and use "when" conditions to control execution.
Why it fails: A single declarative pipeline duplicates every stage across each microservice's Jenkinsfile, so a change to the test or deploy logic must be edited in every repository. Shared libraries exist precisely for this reuse; they would be correct when pipelines share common stages across many repositories.

Question 11easymultiple choice

A network technician runs the command 'ping 8.8.8.8' from a workstation and receives 'Reply from 192.168.1.1: Destination host unreachable.' What does this indicate?

A
There is a routing issue beyond the local network.
The reply originates from the local gateway 192.168.1.1, meaning the packet reached the default router but no route existed onward to 8.8.8.8. This confirms a routing failure beyond the local subnet, matching the stem's destination-unreachable output.
B
DNS resolution is failing.
Why it fails: The reply came from the local gateway, proving the packet left the host and DNS was never consulted — ping used a literal IP address, so name resolution plays no part. DNS failure would instead produce a name-resolution error for a hostname, not an ICMP unreachable from 192.168.1.1.
C
The default gateway is misconfigured.
Why it fails: The gateway answered, so it is reachable and configured; the unreachable message means it has no route to 8.8.8.8 or its own upstream path failed. A misconfigured gateway would typically yield no reply at all, or a reply from a different address.
D
The workstation has no internet connectivity.
Why it fails: The gateway responded, proving the workstation reached its default router and holds a valid local configuration; the failure lies in forwarding beyond it, such as a missing route or upstream outage. It is tempting because the ping failed, but no internet connectivity is correct when the workstation cannot even reach its own gateway.
E
The remote server is down.
Why it fails: The reply originates from the local gateway 192.168.1.1, which cannot forward the packet or resolve a route to 8.8.8.8; the destination itself was never contacted, so its operational state is unknown. It is tempting because unreachable destinations often are offline, and a down server is correct when the echo request reaches the host and receives no response.

Question 12mediummulti select

Which THREE are characteristics of OSPF? (Choose three.)

A
It is a distance-vector routing protocol
Why it fails: OSPF is link-state.
B
It uses cost as the metric
Cost is derived from bandwidth.
C
It uses hop count as the metric
Why it fails: OSPF uses cost based on bandwidth.
D
It is a link-state routing protocol
OSPF is link-state.
E
It supports Variable-Length Subnet Mask (VLSM)
OSPF includes subnet mask in LSAs.

Review the full routing breakdown →

Question 13hardmultiple choice

An application sends a packet with destination IP 10.0.0.10. The sending host's routing table has a default gateway of 10.0.0.1. The host's ARP cache is empty. What is the next step after the host determines the packet should go to the default gateway?

A
Sends an ARP request for 10.0.0.1
With the destination off-subnet, the host must forward the frame to 10.0.0.1, but its ARP cache holds no MAC mapping for that gateway. ARP resolves the gateway's link-layer address, so the host broadcasts a request for 10.0.0.1 before it can encapsulate and transmit the packet.
B
Sends the packet to the DNS server
Why it fails: DNS is not involved in the routing or ARP process.
C
Sends the packet directly to 10.0.0.10
Why it fails: Sending directly to 10.0.0.10 bypasses the default gateway, which is required because the destination sits outside the local subnet. It is tempting when source and destination share a subnet, where direct delivery after ARP resolution would be correct.
D
Sends an ARP request for 10.0.0.10
Why it fails: Sending an ARP request for 10.0.0.10 targets the packet's final destination rather than the next hop, so the gateway's MAC address is never resolved and the frame cannot be built. ARP for the destination IP applies only when the destination sits on the same subnet, where no gateway is involved.

Review the full routing breakdown →

Question 14mediumdrag order

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
Enter global configuration mode, then configure the static route using the ip route command with the destination network, subnet mask, and next-hop address, then verify with the show ip route command
This is the correct order because you must first enter global configuration mode to allow configuration commands, then issue the ip route command to define the static route, and finally verify the route with show ip route to ensure it is installed in the routing table.
B
Configure the static route using the ip route command first, then enter global configuration mode, then verify with show ip route
Why it fails: This is incorrect because the ip route command is a global configuration command and must be issued while in global configuration mode; attempting to configure it before entering that mode will result in an error.
C
Enter global configuration mode, then verify with show ip route, then configure the static route using the ip route command
Why it fails: This is incorrect because verifying the route before configuring it serves no purpose; the route cannot exist until it is configured. The verification step should come after configuration to confirm the route was added.
D
Verify with show ip route, then enter global configuration mode, then configure the static route using the ip route command
Why it fails: This is incorrect because verification should occur after configuration, not before. Also, entering global configuration mode after verification does not affect the order, but verifying before configuring is the logical error.