Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 676–750

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 9

Page 10 of 27

Page 11
676
Multi-Selectmedium

Which TWO commands would a network engineer use to verify SNMP agent configuration and connectivity on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show snmp
B.show snmp host
C.show snmp group
D.show snmp user
E.debug snmp packets
AnswersA, B

Displays SNMP agent statistics, community strings, and trap status.

Why this answer

The `show snmp` command displays the overall SNMP agent configuration, including contact, location, community strings, and SNMP version. The `show snmp host` command lists the configured SNMP notification receivers (trap or inform destinations) and verifies that the router is correctly configured to send SNMP messages to the management station. Together, these two commands confirm both the agent's operational state and its connectivity to remote hosts.

Exam trap

Cisco often tests the distinction between verification commands (show) and troubleshooting commands (debug), and the trap here is that candidates mistakenly choose `debug snmp packets` as a verification tool when it is actually a high-overhead diagnostic command that should only be used after initial configuration checks fail.

Full explanation →
677
Multi-Selecthard

Which TWO statements about EEM environment variables and their scoping are true? (Choose TWO.)

Select 2 answers
A.Environment variables defined using the 'event manager environment' global configuration command are available to all EEM applets on the device.
B.Variables set within an applet using the 'action set' command are automatically available to other applets running on the same device.
C.The '$_cli_msg' variable, when used with 'event cli', contains the full command line that triggered the event, including any parameters.
D.The '$_event_pub_sec' variable provides the priority and severity of the event that triggered the applet.
E.The '$_syslog_msg' variable is available only when the applet is triggered by a syslog event.
AnswersA, E

Correct. Environment variables set globally are accessible by all applets on the device.

Why this answer

The correct answers are A and E. Option A is correct because EEM environment variables set with the 'event manager environment' global configuration command are global and available to all applets on the device. Option E is correct because the '$_syslog_msg' variable is only populated when the applet is triggered by a syslog event; it is not available for other event types.

Option B is incorrect because variables set with 'action set' within an applet are local to that applet and are not automatically shared with other applets. Option C is incorrect because the '$_cli_msg' variable, when used with 'event cli', does not contain the full command line including parameters; it only contains the command keyword. Option D is incorrect because there is no standard EEM variable '$_event_pub_sec'; the correct variable for event publish security information is '$_event_pub_sec_name' or similar, but not as described.

Full explanation →
678
MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show ip access-lists CoPP-ACL extended IP access list CoPP-ACL 10 permit eigrp any any (100 matches) 20 permit ospf any any (50 matches) 30 permit bgp any any (200 matches) 40 deny ip any any (0 matches) What does this output indicate?

A.CoPP is permitting routing protocol traffic, including EIGRP, OSPF, and BGP, which are used for route summarization. No drops indicate CoPP is not blocking summarization.
B.CoPP is dropping all routing protocol traffic, preventing route summarization.
C.CoPP is only allowing BGP traffic, blocking EIGRP and OSPF summarization.
D.CoPP is not configured because the access list is empty.
AnswerA

The permit statements with matches show that routing protocol traffic is allowed, and no drops mean CoPP is not interfering.

Why this answer

This output shows an access list used for Control Plane Policing (CoPP). The match counts indicate that EIGRP, OSPF, and BGP traffic are being permitted. The absence of matches on the deny statement suggests that no traffic is being dropped, which could indicate that CoPP is not affecting route summarization traffic.

Full explanation →
679
Multi-Selecthard

Which TWO statements about the 'distance' command in Cisco IOS routing protocols are true? (Choose TWO.)

Select 2 answers
A.Under EIGRP, the 'distance eigrp <internal-distance> <external-distance>' command sets different ADs for internal and external routes.
B.Under OSPF, the 'distance ospf <intra-area> <inter-area> <external>' command sets AD for different route types.
C.The 'distance' command can be used to change the AD of connected routes.
D.The 'distance' command requires a route-map to match specific prefixes in all routing protocols.
E.The 'distance' command can be used to set an AD of 0 for a specific route.
AnswersA, B

Correct. EIGRP allows separate AD configuration for internal and external routes using the 'distance eigrp' command.

Why this answer

The distance command can be used to modify the administrative distance for routes learned via a routing protocol. It can be applied globally or with an access-list or prefix-list to match specific routes. The command does not affect the AD of routes from other protocols.

The distance value must be between 1 and 255. The command can be used under EIGRP, OSPF, RIP, and BGP, but the syntax varies slightly.

Full explanation →
680
MCQhard

In an MPLS L3VPN environment, what is the default maximum number of routes that can be installed from a single BGP peer?

A.1000
B.Unlimited
C.10000
D.5000
AnswerB

Correct. By default, there is no maximum prefix limit.

Why this answer

By default, there is no maximum limit on the number of routes from a BGP peer. The 'maximum-prefix' command is optional and not configured by default.

Full explanation →
681
MCQhard

OSPF network type mismatch on a multi-access link is causing route summarization issues. Router R1 and R2 are connected via Ethernet, but R1 has: interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 ! Router R2 has default OSPF network type (broadcast). R1 is configured with: router ospf 1 area 0 range 10.0.0.0 255.255.255.0 ! R2 shows: R2# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.0.0.1 0 FULL/ - 00:00:30 10.0.0.1 GigabitEthernet0/0 But R2 does not have the summary route in its routing table. What is the root cause?

A.R1 is not an ABR (only area 0), so the area range command does not generate a summary route.
B.The network type mismatch causes OSPF to not exchange LSAs correctly, preventing the summary.
C.The summary route is suppressed because the interface is point-to-point.
D.R2 has a static route that overrides the summary.
AnswerA

Area range only works on ABRs that connect multiple areas.

Why this answer

The network type mismatch (point-to-point on R1, broadcast on R2) prevents proper adjacency formation. Although the neighbor state shows FULL, the DR/BDR election is affected. R1's point-to-point setting means it does not participate in DR election, and R2 expects a DR.

This can cause LSA flooding issues, and the area range summary may not be advertised correctly. The summary route is generated by the ABR, but if R1 is not an ABR (area 0 only), the range command has no effect. The root cause is that R1 is not an ABR, so area range does not apply.

Full explanation →
682
MCQeasy

A network engineer runs the following command on Router R1: R1# show crypto isakmp sa dst src state conn-id slot status 10.1.1.2 10.1.1.1 QM_IDLE 1 0 ACTIVE Based on this output, which statement is correct?

A.IKE phase 1 is complete; the ISAKMP SA is established.
B.IKE phase 2 is complete; the IPsec SA is active.
C.The ISAKMP SA is in MM_NO_STATE; negotiation has failed.
D.The tunnel is down; the SA is in a dead state.
AnswerA

QM_IDLE means the SA is up and ready for quick mode (phase 2).

Why this answer

QM_IDLE indicates that IKE phase 1 (ISAKMP) is complete and the SA is idle, waiting for phase 2 negotiation. This is the normal state for an established ISAKMP SA.

Full explanation →
683
MCQeasy

A network engineer runs the following command on Router R1: R1# show crypto isakmp policy Global IKE policy Protection suite of priority 10 encryption algorithm: AES - Advanced Encryption Standard (256 bit keys). hash algorithm: Secure Hash Standard 2 (SHA256) authentication method: Pre-Shared Key Diffie-Hellman group: #14 (2048 bit) lifetime: 86400 seconds, no volume limit Protection suite of priority 20 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Secure Hash Standard 2 (SHA256) authentication method: Pre-Shared Key Diffie-Hellman group: #14 (2048 bit) lifetime: 86400 seconds, no volume limit Based on this output, which statement is correct?

A.The router has two IKE policies configured; policy 10 will be preferred.
B.The router has no IKE policies configured; the output is empty.
C.The router uses certificate-based authentication.
D.The Diffie-Hellman group is group 2 (1024 bit).
AnswerA

Lower priority number is preferred; policy 10 with AES-256 will be tried first.

Why this answer

The output shows the configured IKE policies. Both use pre-shared key authentication. This is a normal configuration for IPsec VPN.

Full explanation →
684
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip bgp 10.1.1.0/24 BGP routing table entry for 10.1.1.0/24, version 10 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.2.2.2 from 10.2.2.2 (2.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best rx pathid: 0, tx pathid: 0x0 Community: 100:200 Based on this output, what is the problem?

A.The route 10.1.1.0/24 is learned via an eBGP session and has a local preference of 100.
B.The route 10.1.1.0/24 is redistributed from an IGP into BGP, as indicated by the 'Local' path.
C.The community 100:200 is automatically assigned by BGP for all redistributed routes.
D.The route is not being advertised to any peers because it is not marked as best.
AnswerB

The 'Local' path attribute in BGP indicates the route was originated locally via network statement or redistribution from an IGP.

Why this answer

The output shows a BGP route with 'Local' as the path, meaning it was redistributed into BGP locally. The origin is IGP, and the community is 100:200. The route is valid and best.

However, the 'Local' path indicates redistribution from an IGP into BGP, which is common in redistribution scenarios.

Full explanation →
685
MCQhard

A network engineer runs the following command to debug IPv6 uRPF: R1# debug ipv6 verify IPv6 verify debugging is on *Mar 1 00:02:34.567: IPv6 verify: source 2001:DB8:4::1 on GigabitEthernet0/0 *Mar 1 00:02:34.567: no route to source What does this output indicate?

A.The packet will be dropped because uRPF cannot find a route to the source address.
B.The packet will be forwarded because uRPF only checks the destination.
C.The packet will be forwarded because the source is on the same interface.
D.The router will add a route to the source address.
AnswerA

Correct. uRPF requires a route to the source; if none exists, the packet is dropped.

Why this answer

The debug output shows that uRPF (unicast Reverse Path Forwarding) checked the source address 2001:DB8:4::1 on the incoming interface GigabitEthernet0/0 and found no route to that source in the IPv6 routing table. When uRPF is enabled and a packet arrives on an interface, the router performs a reverse path lookup: it checks whether the best return route to the source address points back to the same interface. If no route exists at all, the lookup fails, and uRPF considers the source as unreachable, causing the packet to be dropped.

This is a strict-mode uRPF behavior, and the debug message 'no route to source' confirms the packet will be discarded.

Exam trap

Cisco often tests the misconception that uRPF checks the destination address or that it only verifies the source is on the same interface without requiring a route, but the key trap here is that 'no route to source' means the packet is dropped, not forwarded, because uRPF cannot validate the source without a matching route in the routing table.

How to eliminate wrong answers

Option B is wrong because uRPF checks the source address, not the destination; it verifies that the source is reachable via the incoming interface, which is a reverse-path check. Option C is wrong because the debug output explicitly states 'no route to source', meaning the router cannot find any route to the source address, so it cannot confirm the source is on the same interface; if it were, a route would exist pointing back to that interface. Option D is wrong because uRPF does not add routes; it only performs a lookup and either permits or drops the packet based on the existence and correctness of the reverse path.

Full explanation →
686
MCQmedium

A network engineer runs the following command on Router PE2: PE2# show ip bgp vpnv4 vrf CUSTOMER_A 10.10.10.0 24 BGP routing table entry for 10.10.10.0/24, version 15 Paths: (1 available, best #1, table CUSTOMER_A) Advertised to update-groups: 1 Refresh Epoch 1 Local, imported path from 10.10.10.0/24 10.1.1.1 (metric 20) from 10.1.1.1 (10.1.1.1) Origin incomplete, metric 0, localpref 100, valid, internal, best Extended Community: RT:100:100 mpls labels in/out 18/19 Based on this output, what is the problem?

A.The route is not being advertised to any BGP peer.
B.The route is missing the required Route Target community.
C.The route is functioning correctly with no issues.
D.The route has an incorrect label binding.
AnswerC

All fields indicate a valid, best route with labels and RT.

Why this answer

The output shows a VPNv4 route for VRF CUSTOMER_A. The route is marked as 'imported path from 10.10.10.0/24', which indicates it was imported from the global table or another VRF. The route is valid and best, with labels assigned.

No problem is indicated; the route is functioning correctly.

Full explanation →
687
MCQmedium

In Cisco IOS-XE, what is the default behavior of the 'route-map' command when no 'match' or 'set' clauses are configured?

A.It denies all routes by default.
B.It permits all routes and applies no changes.
C.It permits all routes and sets the metric to 0.
D.It denies all routes and logs the action.
AnswerB

Correct. An empty permit route-map matches everything and does nothing.

Why this answer

A route-map without any match or set clauses is a permit statement that matches all routes and performs no modifications. This is a common source of unintended route filtering.

Full explanation →
688
MCQmedium

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue: R1# debug ip packet Output: IP: s=10.1.1.1 (GigabitEthernet0/1), d=10.2.2.2, len 100, rcvd 3 IP: s=10.1.1.1 (GigabitEthernet0/1), d=10.2.2.2, len 100, rcvd 4 IP: s=10.1.1.1 (GigabitEthernet0/1), d=10.2.2.2, len 100, rcvd 5 What does this output indicate?

A.The router is experiencing a routing loop, as indicated by the repeated packets with the same source and destination.
B.The router is functioning normally; these are just normal IP packets being forwarded.
C.The router is receiving multicast traffic and showing each packet individually.
D.The debug command is not working correctly because the output is too repetitive.
AnswerA

Repeated identical packets suggest a loop; debug ip packet should be used cautiously and stopped with 'undebug all'.

Why this answer

The output shows repeated packets from the same source to the same destination, which may indicate a routing loop or excessive traffic. The engineer should use 'undebug all' to stop the debug and then investigate the routing table.

Full explanation →
689
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip dhcp pool POOL1 Pool POOL1 : Utilization mark (high/low) : 100 / 0 Subnet size (first/next) : 0 / 0 Total addresses : 10 Leased addresses : 10 Pending event : none 1 subnet is currently in the pool : Current index IP address range Leased addresses 192.168.1.11 192.168.1.10 - 192.168.1.19 10 Based on this output, which statement is correct?

A.The DHCP pool has available addresses for new clients.
B.The DHCP pool is fully utilized; no more addresses are available.
C.The DHCP pool is configured with a /24 subnet.
D.The DHCP server has a pending event causing address allocation to fail.
AnswerB

Leased addresses equal total addresses.

Why this answer

The output shows that all 10 addresses in the pool (192.168.1.10–192.168.1.19) are leased, and the current index is 192.168.1.11, which is beyond the first address. This means no free addresses remain, so the pool is fully utilized. Option B correctly states this condition.

Exam trap

The trap here is that candidates often misinterpret the 'Current index' as the next available address, but it merely indicates the last allocation point; the true indicator of exhaustion is the 'Leased addresses' equaling 'Total addresses'.

How to eliminate wrong answers

Option A is wrong because the 'Leased addresses' count equals the 'Total addresses' (10), indicating zero available addresses for new clients. Option C is wrong because the IP address range 192.168.1.10–192.168.1.19 contains only 10 addresses, which corresponds to a /28 subnet mask (255.255.255.240), not a /24. Option D is wrong because the 'Pending event' field shows 'none', meaning there is no pending event causing allocation failures.

Full explanation →
690
Multi-Selectmedium

Which TWO commands can be used to verify the operational status of a manually configured IPv6 tunnel on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show interfaces tunnel 0
B.show ipv6 interface tunnel 0
C.show ipv6 route
D.show ipv6 tunnel 0
E.show running-config interface tunnel 0
AnswersA, B

Displays tunnel interface status, encapsulation, and counters.

Why this answer

The 'show interfaces tunnel 0' command displays the operational status, line protocol state, and encapsulation details of the tunnel interface, which directly verifies whether the manually configured IPv6 tunnel is up/up. The 'show ipv6 interface tunnel 0' command shows IPv6-specific information such as the IPv6 address, link-local address, and whether IPv6 is enabled on the tunnel interface, confirming that IPv6 traffic can be processed. Both commands provide essential operational verification for a manually configured IPv6 tunnel, such as a 6in4 or GRE tunnel carrying IPv6.

Exam trap

Cisco often tests the distinction between configuration verification commands (like 'show running-config') and operational status commands (like 'show interfaces' and 'show ipv6 interface'), leading candidates to mistakenly choose 'show running-config interface tunnel 0' as a verification tool for operational status.

Full explanation →
691
MCQhard

An engineer configures iBGP between two routers in the same AS. The BGP table shows the prefix, but it is not installed in the routing table. The next-hop is reachable via an IGP route. Which is the most likely explanation?

A.BGP synchronization is enabled, and the prefix is not present in the IGP.
B.The next-hop-self command is missing on the iBGP peer.
C.The prefix is filtered by an inbound route-map.
D.The maximum-paths limit is exceeded.
AnswerA

Correct. Synchronization prevents route installation if IGP does not have the prefix.

Why this answer

When BGP synchronization is enabled, the router will not install an iBGP-learned prefix into the routing table unless the same prefix is also present in the IGP (e.g., OSPF or EIGRP). Since the next-hop is reachable via IGP but the prefix itself is not in the IGP, the synchronization rule blocks the route from being installed. This is a classic scenario where the BGP table shows the prefix, but it is missing from the routing table.

Exam trap

Cisco often tests the BGP synchronization rule as a subtle cause of routes being in the BGP table but not in the routing table, leading candidates to mistakenly focus on next-hop reachability or filtering issues.

How to eliminate wrong answers

Option B is wrong because the next-hop-self command affects the next-hop attribute of routes advertised to iBGP peers, but the issue here is that the next-hop is already reachable via IGP, so missing next-hop-self would not prevent installation. Option C is wrong because if the prefix were filtered by an inbound route-map, it would not appear in the BGP table at all, yet the question states the prefix is present in the BGP table. Option D is wrong because exceeding the maximum-paths limit would affect load balancing, not the installation of a single route; the router would still install one best path.

Full explanation →
692
MCQhard

An engineer configures SNMPv2c with a community string 'public' and an ACL that permits the NMS. The NMS can poll the router. The engineer then applies a CoPP policy that drops SNMP packets (UDP port 161) from all sources except the NMS. The NMS now fails to poll. Which is the most likely explanation?

A.The CoPP policy's ACL does not include the NMS IP address, so SNMP packets from the NMS are dropped by the class-default.
B.CoPP only affects routing protocol traffic, not SNMP.
C.The SNMP community string ACL is overridden by the CoPP policy.
D.The router requires a reload for the CoPP policy to take effect.
AnswerA

CoPP policies typically have a class that matches traffic to be permitted; if the NMS is not matched, its packets fall into class-default, which may be set to drop.

Why this answer

CoPP (Control Plane Policing) applies to all traffic destined to the router's control plane, including SNMP. If the CoPP policy's ACL does not explicitly permit the NMS IP address for UDP port 161, those packets fall into the class-default, which is configured to drop them. Even though the SNMP community string ACL permits the NMS, CoPP is evaluated before the packet reaches the SNMP process, so the drop occurs first.

Exam trap

Cisco often tests the order of operations: CoPP is applied before the SNMP process, so a CoPP drop will prevent SNMP from ever seeing the packet, regardless of SNMP ACLs or community strings.

How to eliminate wrong answers

Option B is wrong because CoPP is not limited to routing protocol traffic; it polices all control plane traffic, including SNMP, SSH, and ICMP. Option C is wrong because CoPP and the SNMP community string ACL operate at different layers—CoPP drops packets before they are processed by SNMP, so the ACL is not overridden but simply never reached. Option D is wrong because CoPP policies take effect immediately upon application via the 'service-policy' command under control-plane; no reload is required.

Full explanation →
693
MCQhard

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are expected to form dynamically. However, when a spoke tries to reach another spoke, traffic is still sent through the hub. The engineer verifies that NHRP is working and that the spoke-to-spoke tunnel is up. Which is the most likely explanation?

A.The spokes are missing the 'ip nhrp shortcut' command on the tunnel interface, so they do not install the direct route.
B.The hub is configured with 'ip nhrp redirect' but the spokes are configured with 'ip nhrp server-only', which prevents them from sending redirects.
C.The tunnel interface has 'ip mtu' set too low, causing fragmentation and preventing the NHRP registration.
D.The spoke-to-spoke tunnel uses IPsec, and the transform set is mismatched, causing the tunnel to fail.
AnswerA

The 'ip nhrp shortcut' command is required on spokes to allow them to use the NHRP-learned direct path. Without it, the spoke will continue to use the hub as the next hop.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels require that the spokes have a direct route to each other's tunnel IP addresses. This is achieved through NHRP redirect and shortcut routes. However, a common edge case is that the spoke routers are configured with 'ip nhrp redirect' on the hub but the spokes are missing 'ip nhrp shortcut' on their tunnel interfaces.

Without the shortcut command, the spoke will not install the NHRP-learned route into the routing table, so traffic continues to go through the hub.

Full explanation →
694
Multi-Selecthard

Which THREE commands are used to troubleshoot VRF-Lite connectivity issues on a Cisco IOS-XE router? (Choose THREE.)

Select 3 answers
A.show ip route vrf <vrf-name>
B.ping vrf <vrf-name> <destination>
C.show vrf
D.traceroute <destination>
E.show ip cef
AnswersA, B, C

Shows the routing table for the specified VRF, critical for verifying route presence.

Why this answer

These three commands provide essential troubleshooting information: 'show ip route vrf' displays the VRF routing table, 'ping vrf' tests connectivity from within a VRF, and 'show vrf' shows VRF status and interfaces. The other options: 'traceroute' without VRF context may not work correctly, and 'show ip cef' without VRF shows global CEF, not VRF-specific.

Full explanation →
695
MCQeasy

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

A.Disable syslog logging for interface state changes.
B.Remove one of the duplicate EEM applets.
C.Change the SNMP trap destination to a different host for one applet.
D.Increase the SNMP trap queue size.
AnswerB

Correct because removing one applet eliminates the duplicate trap generation.

Why this answer

The duplicate traps are caused by two applets performing the same action. The engineer should remove one of the applets or combine them into one.

Full explanation →
696
MCQmedium

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# debug ip sla monitor trace IP SLAs Monitor trace debugging is on *Mar 1 12:34:56.789: IP SLAs Monitor: Starting operation 10 *Mar 1 12:34:56.789: IP SLAs Monitor: Sending ICMP echo request to 192.168.1.1 *Mar 1 12:34:56.790: IP SLAs Monitor: Received ICMP echo reply from 192.168.1.1 *Mar 1 12:34:56.790: IP SLAs Monitor: RTT = 12 ms *Mar 1 12:34:56.790: IP SLAs Monitor: Operation 10 completed successfully *Mar 1 12:35:56.789: IP SLAs Monitor: Starting operation 10 *Mar 1 12:35:56.789: IP SLAs Monitor: Sending ICMP echo request to 192.168.1.1 *Mar 1 12:35:56.790: IP SLAs Monitor: Received ICMP echo reply from 192.168.1.1 *Mar 1 12:35:56.790: IP SLAs Monitor: RTT = 14 ms *Mar 1 12:35:56.790: IP SLAs Monitor: Operation 10 completed successfully What does this output indicate?

A.The IP SLA monitor operation is failing because the RTT values are increasing.
B.The IP SLA monitor operation is successfully sending and receiving ICMP echo probes.
C.The IP SLA monitor operation is not configured because no configuration is shown.
D.The IP SLA monitor operation is timing out because no reply is received.
AnswerB

Each cycle shows request, reply, and 'completed successfully'.

Why this answer

This debug output shows the IP SLA monitor trace for operation 10. Each cycle shows a successful ICMP echo request/reply with RTT values, indicating the probe is working correctly.

Full explanation →
697
MCQhard

A network engineer runs the following command on Router R1: R1# show ip bgp neighbors 10.2.2.2 advertised-routes BGP table version is 10, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.1.1.0/24 0.0.0.0 0 32768 i *> 10.2.2.0/24 0.0.0.0 0 32768 i Total number of prefixes 2 Based on this output, what is the problem?

A.The routes are correctly advertised with next hop 0.0.0.0, which is normal for locally originated routes.
B.The routes are not being advertised to eBGP peers because the next hop is 0.0.0.0, which is invalid for eBGP.
C.The routes are being advertised to iBGP peers only, as indicated by the next hop 0.0.0.0.
D.The routes are redistributed from an IGP into BGP, and the next hop is correctly set to 0.0.0.0.
AnswerA

Correct. The next hop 0.0.0.0 is normal for locally originated routes, and the router will adjust it when advertising to eBGP peers.

Why this answer

The output shows that R1 is advertising two routes to the BGP neighbor 10.2.2.2. Both routes have a next hop of 0.0.0.0, which is normal for locally originated routes (e.g., via network statement or redistribution). When advertising to an eBGP peer, the router automatically changes the next hop to its own interface IP address if the next hop is not reachable via the eBGP neighbor.

However, the 'show ip bgp neighbors advertised-routes' command displays the routes as they are in the BGP table, not the actual advertisement sent. The next hop 0.0.0.0 indicates the route is local, and BGP will update it appropriately when sending to an eBGP peer. Therefore, there is no problem; the routes are being advertised correctly.

Full explanation →
698
MCQhard

After redistributing OSPF into EIGRP, an EIGRP router becomes stuck-in-active (SIA) for certain routes. Router R1 config: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 ! router ospf 1 redistribute eigrp 100 subnets R1# show ip eigrp topology 10.0.0.0/8 IP-EIGRP (AS 100): Topology entry for 10.0.0.0/8 State: Active, 0:01:15, Reply count: 0 Originating router: 10.1.1.1 Last sent query: 10.1.1.2 What is the root cause?

A.The redistributed OSPF route is a summary that causes EIGRP queries to go unanswered, leading to SIA.
B.The EIGRP metric is too high, causing the route to be unreachable.
C.The OSPF redistribution is missing the subnets keyword, causing classful behavior.
D.The EIGRP AS number is mismatched between routers.
AnswerA

Summary routes can cause queries to propagate widely; if a neighbor has no route, the query times out.

Why this answer

The EIGRP route for 10.0.0.0/8 is in Active state, meaning it is waiting for replies from neighbors. The redistribution from OSPF may be injecting a summary route that causes a query to be sent to all neighbors, but one neighbor may not have a route back, causing the query to be unanswered. The fix is to ensure that the redistributed routes are not summarized or to use a stub router to limit query scope.

Full explanation →
699
MCQhard

Router R1 and R2 are running OSPF in area 0. R1 has a loopback interface with IP 192.168.1.1/32 advertised into OSPF. R2 learns this route as an intra-area route (AD 110). R2 also runs RIP and learns the same prefix from R3 with AD 120. R2's 'show ip route 192.168.1.1' shows the RIP route. What is the root cause?

A.R2's OSPF process has 'distance 130' configured, making OSPF routes have AD 130, which is higher than RIP's AD 120.
B.The RIP route has a better metric than the OSPF route.
C.R2 has a static route with AD 1 that overrides both.
D.The OSPF route is an external route with AD 170 due to redistribution.
AnswerA

If OSPF distance is set to 130, RIP (120) becomes preferred.

Why this answer

RIP has AD 120, OSPF has AD 110, so OSPF should be preferred. If the OSPF route is not installed, it could be due to a higher metric or a filter. The correct answer is that the OSPF route is an external route (type-5) because it was redistributed from another protocol, not an intra-area route.

The scenario says intra-area, but if the loopback is not directly connected to OSPF (e.g., it is in a different VRF), it might be redistributed as external. The question states it is advertised into OSPF, but the AD for external is 110, same as intra-area. The trick is that the OSPF route might have a higher metric than the RIP route, but AD is checked first.

The most likely cause is that the OSPF route is not in the routing table due to a distribute-list or because the OSPF process has 'distance 130' configured for all routes.

Full explanation →
700
MCQhard

An engineer configures an IPv4 ACL on a router's interface to permit only HTTP traffic (TCP port 80) from a specific subnet. The ACL is applied inbound. After applying, the router's web interface (HTTPS) becomes unreachable from the same subnet. What is the most likely explanation?

A.The ACL denies HTTPS traffic because it is not explicitly permitted.
B.The ACL is applied outbound, filtering traffic to the web server.
C.The router's web server uses HTTP, not HTTPS.
D.The ACL is blocking TCP port 80 due to a typo.
AnswerA

The ACL only permits HTTP; HTTPS (port 443) is denied by the implicit deny, blocking management access.

Why this answer

The ACL is applied inbound on the router interface and only permits TCP port 80 (HTTP). HTTPS uses TCP port 443, which is not explicitly permitted. Since IPv4 ACLs end with an implicit deny any, all traffic not matching a permit statement, including HTTPS, is denied.

This causes the router's web interface (HTTPS) to become unreachable from the subnet.

Exam trap

Cisco often tests the implicit deny any behavior of ACLs and the fact that management protocols (like HTTPS, SSH, SNMP) use different ports than the permitted traffic, causing candidates to overlook the need to explicitly permit those ports.

How to eliminate wrong answers

Option B is wrong because the ACL is explicitly stated as applied inbound, not outbound; an outbound ACL would filter traffic leaving the interface, not traffic entering from the subnet. Option C is wrong because the router's web interface is accessed via HTTPS (TCP 443), not HTTP (TCP 80), and the question confirms it is HTTPS. Option D is wrong because the issue is not a typo on port 80; the ACL correctly permits HTTP, but HTTPS is blocked by the implicit deny, not by a misconfiguration of the permit statement.

Full explanation →
701
MCQmedium

Consider the following configuration on a PE router: ip vrf CUSTOMER-B rd 100:1 route-target export 100:1 route-target import 100:2 ! interface GigabitEthernet0/2 ip vrf forwarding CUSTOMER-B ip address 192.168.2.1 255.255.255.252 What is the effect of this configuration?

A.The PE will export routes from VRF CUSTOMER-B with RT 100:1 and import routes with RT 100:2.
B.The PE will export routes with RT 100:2 and import routes with RT 100:1.
C.The VRF will not work because the RD and RT must be identical.
D.The VRF will not work because route-target import and export must be configured under the BGP VRF address-family.
AnswerA

The route-target export sets the RT on exported VPNv4 routes; the route-target import filters incoming VPNv4 routes to only those with RT 100:2.

Why this answer

The VRF has a route distinguisher and route-targets. The export RT is 100:1, meaning routes from this VRF are exported with that RT. The import RT is 100:2, so only routes with RT 100:2 are imported.

This is a common setup for hub-and-spoke or inter-AS options.

Full explanation →
702
MCQmedium

Which EIGRP packet type is used to confirm receipt of an update during reliable transport?

A.Hello
B.Update
C.ACK
D.Query
AnswerC

Correct: ACK packets are sent to confirm reliable delivery of updates, queries, and replies.

Why this answer

C is correct because EIGRP uses a reliable transport protocol (RTP) to ensure delivery of certain packets like Updates, Queries, and Replies. The ACK packet is a lightweight, unreliable packet sent to explicitly acknowledge receipt of a reliable packet, confirming that the update was received without needing a full retransmission.

Exam trap

The trap here is that candidates confuse the purpose of Hello packets (which are also small and frequent) with ACK packets, forgetting that Hellos are used for neighbor discovery and keepalive, not for reliable transport acknowledgment.

How to eliminate wrong answers

Option A is wrong because Hello packets are used for neighbor discovery and keepalive, not for acknowledging reliable updates; they are sent unreliably via multicast. Option B is wrong because Update packets carry routing information and are themselves sent reliably, requiring an ACK in response rather than serving as an acknowledgment. Option D is wrong because Query packets are sent reliably to request routing information from neighbors and, like Updates, require an ACK to confirm receipt, not to acknowledge other packets.

Full explanation →
703
MCQhard

A network engineer runs the following command on Router R1: R1# show crypto ipsec sa interface: Tunnel0 Crypto map tag: DMVPN, local addr 10.1.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0) remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150 #pkts decaps: 145, #pkts decrypt: 145, #pkts verify: 145 #send errors 0, #recv errors 0 local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2 path mtu 1500, ip mtu 1500, ip mtu idb Tunnel0 current outbound spi: 0x12345678(305419896) PFS (Y/N): N, DH group: none Based on this output, what is the problem?

A.There is packet loss on the IPsec tunnel.
B.The IPsec SA is using PFS.
C.The tunnel is not encrypting traffic.
D.The remote peer is 10.1.1.1.
AnswerA

Encaps count (150) is higher than decaps count (145), indicating loss.

Why this answer

The output shows IPsec SA details for a DMVPN tunnel. The protect identity uses GRE protocol (47) and the SA is between two spoke routers (172.16.0.0/24). The packet counts show 150 encapsulated but only 145 decapsulated, indicating packet loss on the tunnel.

This could be due to MTU issues or routing problems.

Full explanation →
704
MCQhard

An enterprise is using IPv6-to-IPv4 translation tunneling (NAT64) but users report that they cannot reach IPv6-only servers. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 nat64 enable. Router R2 shows: R2# show nat64 translations % No translations. R2# debug nat64 all NAT64: No mapping found for packet. What is the root cause?

A.The NAT64 prefix is not configured under the tunnel interface.
B.The tunnel mode should be ipv6ip for NAT64 to work.
C.The IPv4 address of the destination server is not reachable.
D.NAT64 is not supported on tunnel interfaces.
AnswerA

Without a NAT64 prefix, the router cannot create mappings for translation.

Why this answer

NAT64 requires a NAT64 prefix to be explicitly configured under the tunnel interface using the 'nat64 prefix' command. Without this prefix, the router cannot construct the IPv6 representation of IPv4 destinations, so no translation mappings are created, and packets are dropped. The debug output confirms 'No mapping found for packet', which directly points to the missing prefix configuration.

Exam trap

Cisco often tests the distinction between enabling NAT64 on an interface and actually configuring the required NAT64 prefix, leading candidates to assume that 'nat64 enable' alone is sufficient.

How to eliminate wrong answers

Option B is wrong because NAT64 uses the default tunnel mode (GRE/IPv6) or 'ipv6ip' is not a valid mode for NAT64; NAT64 operates at the network layer and does not require a specific tunnel encapsulation mode beyond what is already configured. Option C is wrong because the issue is not about IPv4 reachability; the debug shows no NAT64 mappings exist, which occurs before any routing or reachability check. Option D is wrong because NAT64 is fully supported on tunnel interfaces; the problem is the missing prefix configuration, not a lack of support.

Full explanation →
705
Multi-Selecthard

Which THREE commands can be used to verify the current NTP synchronization status and configuration on a Cisco IOS router? (Choose THREE.)

Select 3 answers
A.show ntp status
B.show ntp associations
C.show ntp packets
D.show ntp statistics
E.show clock detail
AnswersA, B, D

Correct. This command displays the NTP synchronization status, including whether the clock is synchronized, the stratum level, and the reference clock.

Why this answer

The 'show ntp status' command displays the NTP synchronization status, including whether the router is synchronized to an NTP server, the stratum level, and the reference clock ID. This directly verifies the current synchronization state of the NTP process on the Cisco IOS router.

Exam trap

Cisco often tests the distinction between commands that show NTP-specific details (like 'show ntp status' and 'show ntp associations') versus general clock commands (like 'show clock detail'), and includes a nonexistent command ('show ntp packets') to trap candidates who memorize command names without verifying their validity.

Full explanation →
706
MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# debug eigrp packets EIGRP: Sending HELLO on Serial0/0/0 src 10.1.1.1, dst 224.0.0.10 EIGRP: Received UPDATE on Serial0/0/0 from 10.1.1.2 src 10.1.1.2, dst 224.0.0.10 update type: route prefix 10.0.0.0/16 metric 128576 EIGRP: Sending UPDATE on Serial0/0/0 to 10.1.1.2 update type: summary prefix 10.0.0.0/16 metric 128576 What does this output indicate?

A.R1 is receiving and re-advertising the summary route 10.0.0.0/16, likely configured with a summary address.
B.R1 is only receiving the summary route and not advertising it.
C.The summary route is being suppressed due to a route filter.
D.The summary route is learned via OSPF and redistributed into EIGRP.
AnswerA

The 'summary' update type indicates R1 is actively summarizing and advertising the route.

Why this answer

The debug output shows EIGRP packet exchanges. R1 receives an UPDATE for prefix 10.0.0.0/16 and then sends an UPDATE with type 'summary' for the same prefix. This indicates that R1 is both learning and advertising a summary route.

Full explanation →
707
MCQhard

R1 and R2 are iBGP peers in AS 65001. R1 has: neighbor 10.1.1.2 route-reflector-client. R2 advertises a prefix 10.0.0.0/8 with a community of no-export. R1 reflects this prefix to its other client R3. R3 is in a different AS (65002) via eBGP. R3 receives the prefix but does not advertise it to its eBGP neighbor R4 in AS 65003. What is the root cause?

A.The no-export community on the prefix prevents R3 from advertising it to eBGP neighbor R4.
B.R1 should have stripped the community before reflecting to R3.
C.R3 is missing the send-community command to its eBGP neighbor.
D.The route-reflector-client command on R1 should be on R2 instead.
AnswerA

no-export community means the route should not be advertised to any eBGP peers.

Why this answer

The community no-export attached to the prefix prevents it from being advertised to any eBGP peers. When R1 reflects the prefix to R3 (iBGP), the community is preserved. R3, upon advertising to R4 (eBGP), checks the community and withholds the advertisement because of the no-export community.

The root cause is that the no-export community is present on the prefix, which blocks eBGP advertisement.

Full explanation →
708
MCQhard

An engineer configures EIGRP named mode on a router. A route is learned via EIGRP, but the router does not install it in the routing table. The show ip eigrp topology shows the route in passive state with a feasible distance. Which is the most likely explanation?

A.The route is an external route and the EIGRP administrative distance is set to 255.
B.The router is configured as an EIGRP stub with 'receive-only', which prevents it from installing any EIGRP routes.
C.The 'metric weights' command is misconfigured, causing incorrect metric calculation.
D.The route is a summary route that is not advertised due to 'summary-address' configuration.
AnswerB

Stub receive-only blocks all EIGRP routes from being installed.

Why this answer

In named mode, EIGRP uses address-family configuration. The route may be learned but not installed if the 'no ip route-cache' or 'no ip routing' is misconfigured, or if the route is suppressed by a route-map. However, a common edge case is that the route is an internal route but the router is configured as a stub with 'receive-only', which prevents installing any routes.

Full explanation →
709
MCQeasy

Which LDP message type is used to request label bindings from a neighbor?

A.Label Request message
B.Label Mapping message
C.Label Withdraw message
D.Label Release message
AnswerA

The Label Request message is used to request label bindings for a FEC.

Why this answer

The Label Request message is sent by an LDP router to request a label binding for a specific FEC from its neighbor.

Full explanation →
710
Multi-Selecthard

Which TWO statements correctly describe the behavior of TTL propagation in MPLS networks? (Choose TWO.)

Select 2 answers
A.Disabling TTL propagation prevents traceroute from revealing the internal LSR hops.
B.The command 'no mpls ip propagate-ttl' is used to disable TTL propagation on a Cisco IOS router.
C.The command 'no mpls ip ttl-propagate' is used to disable TTL propagation.
D.When TTL propagation is disabled, traceroute shows every LSR hop in the MPLS core.
E.When TTL propagation is disabled, the TTL value is decremented normally at each LSR hop.
AnswersA, B

Correct. With TTL propagation disabled, traceroute shows only the ingress and egress LSRs, hiding the core.

Why this answer

In MPLS, TTL propagation can be disabled for security or to hide the core topology. When disabled, the IP TTL is copied to the MPLS label only at the ingress LSR, and at the egress LSR the MPLS TTL is copied back to the IP header. By default, TTL propagation is enabled.

The command 'no mpls ip propagate-ttl' disables it. Option A is correct because disabling TTL propagation hides the core hops from traceroute. Option B is correct because the command to disable is indeed 'no mpls ip propagate-ttl'.

Option C is false: the command is not 'no mpls ip ttl-propagate'. Option D is false: traceroute shows only the ingress and egress LSRs, not all hops. Option E is false: when disabled, the TTL is not decremented across the MPLS core.

Full explanation →
711
MCQmedium

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

A.Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
B.Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
C.Use IPv6 Source Guard to filter traffic from the secondary router.
D.Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
AnswerA

Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.

Why this answer

RA Guard with a policy that includes the primary router's MAC address in the allowed list is the most effective solution because it filters Router Advertisements (RAs) at Layer 2, permitting only RAs from the trusted primary router. This directly addresses the issue of multiple RAs causing routing instability by blocking RAs from any other source, such as the secondary router, without affecting other IPv6 traffic. RA Guard is an IPv6 First Hop Security feature designed specifically to prevent rogue or unwanted RAs from being processed by hosts.

Exam trap

Cisco often tests the distinction between IPv6 First Hop Security features, where candidates confuse RA Guard (which filters RAs) with DHCPv6 Guard (which filters DHCPv6 messages) or IPv6 Source Guard (which prevents address spoofing), leading them to select an option that addresses a different type of attack or instability.

How to eliminate wrong answers

Option B is wrong because DHCPv6 Guard blocks DHCPv6 messages (e.g., DHCPv6 Advertise/Reply), not Router Advertisements (RAs), so it does not prevent hosts from receiving multiple RAs. Option C is wrong because IPv6 Source Guard filters traffic based on source IPv6 address and MAC address bindings to prevent spoofing, but it does not inspect or filter RA messages specifically, so it cannot block unwanted RAs. Option D is wrong because configuring the switch to send its own RAs with a higher priority does not stop the secondary router from sending RAs; hosts would still receive multiple RAs, and the switch's RAs could introduce additional instability rather than resolving the issue.

Full explanation →
712
Multi-Selecthard

An engineer must configure a GRE tunnel to transport IPv6 traffic over an IPv4-only network. Which TWO configuration steps are required? (Choose TWO.)

Select 2 answers
A.Configure tunnel mode gre ip on the tunnel interface.
B.Assign an IPv6 address to the tunnel interface.
C.Configure tunnel mode ipv6ip on the tunnel interface.
D.Set the tunnel destination to the remote IPv6 address.
E.Place the tunnel interface in a VRF to separate IPv6 traffic.
AnswersA, B

Correct. GRE is the default tunnel mode for IPv6 transport; explicit configuration ensures correct operation.

Why this answer

'tunnel mode gre ip' configures the tunnel interface to use Generic Routing Encapsulation (GRE) over IPv4, which is the standard method for encapsulating any Layer 3 protocol (including IPv6) inside IPv4 packets. This mode sets the tunnel to use IP protocol 47 (GRE) and allows the transport of IPv6 traffic across an IPv4-only network.

Exam trap

Cisco often tests the distinction between GRE (tunnel mode gre ip) and IPv6-in-IPv4 manual tunneling (tunnel mode ipv6ip), where candidates mistakenly choose ipv6ip for IPv6 transport, forgetting that GRE is the standard for multiprotocol encapsulation and is required when the question explicitly mentions 'GRE tunnel'.

Full explanation →
713
Drag & Dropmedium

Drag and drop the steps to verify and validate NAT and PAT operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Verification should start with a high-level overview of translations, then check for active translations with details, then verify interface configurations, then confirm statistics for drops or failures, and finally test end-to-end connectivity.

Full explanation →
714
MCQhard

An engineer configures DHCPv6 prefix delegation on a router with multiple requesting interfaces. The router receives a /48 prefix from the server, but only one interface gets a /64 sub-prefix. Which is the most likely explanation?

A.Only one interface is configured with 'ipv6 address prefix-name ::1:0:0:0:1/64' using the delegated prefix; other interfaces lack this configuration.
B.The DHCPv6 server only delegates a single /64 prefix, not a /48.
C.The router's 'ipv6 dhcp client pd' command is missing the 'rapid-commit' option.
D.The router has 'ipv6 dhcp client information refresh' set to a high value, delaying updates.
AnswerA

Correct: The delegated prefix must be explicitly used on each interface with the appropriate 'ipv6 address' command referencing the prefix name.

Why this answer

The router receives a /48 prefix from the DHCPv6 server, but each requesting interface must explicitly reference the delegated prefix using the 'ipv6 address prefix-name' command to derive a /64 sub-prefix. If only one interface has this configuration, only that interface will obtain a /64 sub-prefix; the other interfaces lack the necessary command to consume the delegated prefix.

Exam trap

Cisco often tests the distinction between receiving a delegated prefix and actually assigning sub-prefixes to interfaces, trapping candidates who assume that receiving a /48 automatically gives every interface a /64.

How to eliminate wrong answers

Option B is wrong because the scenario states the router receives a /48 prefix, not a single /64, so the server delegation size is not the issue. Option C is wrong because the 'rapid-commit' option speeds up the DHCPv6 exchange (two-message vs. four-message) but does not affect how many interfaces receive sub-prefixes. Option D is wrong because the 'ipv6 dhcp client information refresh' timer controls how often the client refreshes its DHCPv6 lease, not the allocation of sub-prefixes to interfaces.

Full explanation →
715
MCQhard

An enterprise uses VRF-lite with IPv6. VRF A on R1 leaks routes to VRF B using route-target import/export. R1 has an IPv6 ACL applied inbound on the interface in VRF A that permits only OSPFv3 and denies all other traffic. R1's VRF B has a static default route pointing to a next-hop in VRF A. Traffic from VRF B to the internet fails. R1 shows 'ping vrf B 2001:db8:2::1' fails, but 'ping vrf A 2001:db8:2::1' succeeds. What is the root cause?

A.The ACL on the VRF A interface blocks data traffic from VRF B, which is forwarded via the leaked route.
B.Route leaking is not configured correctly; the route-target import/export is missing.
C.The static default route in VRF B has an incorrect next-hop address.
D.uRPF is enabled on the VRF A interface and drops traffic from VRF B due to source address mismatch.
AnswerA

Traffic from VRF B is forwarded into VRF A and hits the inbound ACL, which permits only OSPFv3.

Why this answer

The ACL on the VRF A interface is configured to permit only OSPFv3 (IPv6 routing protocol traffic) and deny all other traffic. When VRF B leaks routes to VRF A, data traffic from VRF B destined to the internet is forwarded via the leaked route and enters the VRF A interface. This data traffic is not OSPFv3, so it is denied by the ACL, causing the ping to fail.

The ping from VRF A succeeds because it originates within VRF A and does not traverse the ACL inbound on the same interface.

Exam trap

Cisco often tests the misconception that route leaking bypasses interface ACLs, when in fact ACLs are applied to the data plane traffic that uses the leaked routes, not just to the routing protocol updates.

How to eliminate wrong answers

Option B is wrong because the route leaking is working correctly, as evidenced by the successful ping from VRF A to the same destination, indicating the route is present in VRF A. Option C is wrong because the static default route in VRF B is not the issue; the ping from VRF B fails due to the ACL blocking the return or transit data traffic, not because of an incorrect next-hop address. Option D is wrong because uRPF (unicast Reverse Path Forwarding) would check the source address of incoming packets against the routing table; while a mismatch could occur, the question does not mention uRPF configuration, and the ACL is explicitly applied, making it the more direct cause.

Full explanation →
716
Multi-Selecthard

Which TWO statements about the default administrative distances for different route sources are correct? (Choose TWO.)

Select 2 answers
A.The default administrative distance for a connected interface is 0.
B.The default administrative distance for internal BGP (iBGP) is 20.
C.The default administrative distance for external EIGRP routes is 170.
D.The default administrative distance for RIP is 100.
E.The default administrative distance for OSPF is 90.
AnswersA, C

Correct. Connected routes have the highest trustworthiness with an AD of 0.

Why this answer

Cisco IOS assigns default AD values to various route sources. Connected interfaces have an AD of 0, static routes have 1, EIGRP summary routes have 5, internal BGP has 200, and external EIGRP has 170. OSPF has 110, and RIP has 120.

Knowing these defaults is critical for troubleshooting route selection.

Full explanation →
717
MCQmedium

An engineer configured IP SLA 60 to monitor the reachability of a WAN link's next-hop (203.0.113.1) using ICMP echo. The IP SLA is used in a track object for a floating static route. The engineer notices that the primary route (EIGRP) is present, but the floating static route is not installed when the primary fails. The track object shows 'Down' after the primary fails. What should the engineer check?

A.Verify that the static route's administrative distance is higher than the EIGRP route (e.g., 170 vs 90).
B.Check if the IP SLA probe is configured with a timeout greater than the frequency.
C.Ensure the primary route is removed from the routing table before the static route is installed.
D.Reboot the router to clear the routing table.
AnswerA

If the static route has an AD lower than EIGRP (e.g., 1), it would be installed even when the primary is up, causing issues. For a floating static, AD must be higher.

Why this answer

A floating static route with tracking requires the administrative distance to be higher than the primary route. If the AD is lower or equal, the static route will not be installed as a backup. Also, the track object must be correctly referenced.

Full explanation →
718
Multi-Selectmedium

Which TWO commands would a network engineer use to verify that syslog messages are being sent to a remote syslog server? (Choose TWO.)

Select 2 answers
A.show logging
B.debug logging
C.show running-config | include logging
D.ping <syslog-server-ip>
E.show ip route
AnswersA, C

This command shows the syslog server status, buffer contents, and logging configuration.

Why this answer

The 'show logging' command displays the current logging configuration, including the syslog server address and whether logging is enabled. The 'debug logging' command is not valid; the correct command to see real-time syslog messages is 'terminal monitor' after enabling logging. 'show run | include logging' shows the running config lines for logging. 'ping' tests reachability but not syslog functionality. 'show ip route' checks routing but not logging.

Full explanation →
719
MCQeasy

What is the default OSPF dead timer interval on a point-to-point interface within a VRF-Lite configuration?

A.30 seconds
B.40 seconds
C.120 seconds
D.10 seconds
AnswerB

The default OSPF dead timer is 40 seconds on point-to-point and broadcast interfaces.

Why this answer

OSPF defaults to a dead timer of 40 seconds on point-to-point and broadcast interfaces, which is four times the default hello timer of 10 seconds.

Full explanation →
720
MCQhard

Which MPLS label value is reserved for the Explicit NULL label and what is its purpose?

A.Label 0; used for the Explicit NULL label to indicate that the penultimate hop should pop the label.
B.Label 1; used for the Router Alert label.
C.Label 2; used for the Implicit NULL label.
D.Label 3; used for the Implicit NULL label.
AnswerA

Label 0 is the IPv4 Explicit NULL per RFC 3032.

Why this answer

Label value 0 is the IPv4 Explicit NULL label, used to signal the penultimate hop to pop the label stack and forward the packet based on the IP header.

Full explanation →
721
MCQmedium

An engineer configures Flexible NetFlow on a Cisco router to monitor traffic on GigabitEthernet0/1. The flow record is defined with 'match ipv4 source address' and 'collect counter bytes'. The flow exporter sends data to 192.168.1.10:2055. After applying the monitor to the interface, 'show flow monitor name MONITOR cache' shows zero entries. What is the most likely root cause?

A.The flow exporter is not configured with a source interface.
B.The flow monitor is applied in the wrong direction.
C.The flow record does not include 'match ipv4 protocol'.
D.The collector is unreachable, causing the router to stop caching flows.
AnswerB

If the monitor is applied ingress but traffic is egress, no flows are recorded. The engineer should check the direction.

Why this answer

Flexible NetFlow requires a flow monitor to be applied to an interface in the correct direction (ingress or egress). If the direction is not specified, the default is ingress. If traffic is only egress, the monitor will not capture any flows.

Full explanation →
722
MCQmedium

Consider this configuration on Router R5: ``` interface Tunnel0 ipv6 address 2001:DB8:7::1/64 tunnel source 192.168.10.1 tunnel destination 192.168.20.2 tunnel mode ipv6ip tunnel ttl 64 ``` What is the effect?

A.The tunnel will not work because the tunnel source is an IP address, not an interface.
B.The tunnel will work, and the TTL field in the outer IPv4 header will be set to 64.
C.The tunnel mode should be 'gre ip' for IPv6 over IPv4.
D.The tunnel will use the IPv6 TTL for the outer header.
AnswerB

The 'tunnel ttl' command sets the TTL in the outer IPv4 header.

Why this answer

The configuration creates an IPv6-over-IPv4 manual tunnel (tunnel mode ipv6ip). The tunnel source is specified as an IP address, which is valid; the router uses that address as the source of the outer IPv4 header. The 'tunnel ttl 64' command explicitly sets the Time-to-Live field in the outer IPv4 header to 64, overriding the default value.

Exam trap

Cisco often tests the misconception that the tunnel source must be an interface name, or that the outer header's TTL is inherited from the inner packet, leading candidates to incorrectly eliminate the correct answer.

How to eliminate wrong answers

Option A is wrong because the tunnel source can be either an interface name or an IP address; specifying an IP address is perfectly valid and the router will use that address as the source of the outer IPv4 header. Option C is wrong because 'tunnel mode ipv6ip' is the correct mode for IPv6-over-IPv4 manual tunnels (RFC 4213), not 'gre ip', which is used for generic routing encapsulation and does not carry the IPv6 protocol type natively. Option D is wrong because the outer IPv4 header uses its own TTL field, which is set by the 'tunnel ttl' command; the inner IPv6 packet's Hop Limit is not copied to the outer header.

Full explanation →
723
MCQhard

An engineer configures IPsec with a transform set that includes ESP-SHA-HMAC and ESP-AES-256. The VPN tunnel fails to establish, and debug shows 'transform set mismatch'. What is the most likely explanation?

A.The peer has the transform set with the same protocols but in a different order (ESP-AES-256 then ESP-SHA-HMAC), which is considered a mismatch.
B.The peer uses ESP-AES-256 with a different key length, such as 128-bit.
C.The peer has 'crypto ipsec transform-set' with 'esp-sha-hmac' and 'esp-aes 256' but also includes 'comp-lzs'.
D.The peer uses 'esp-sha-hmac' as authentication and 'esp-aes 256' as encryption, but the mode is set to transport instead of tunnel.
AnswerA

IPsec transform sets are matched exactly, including the order of protocols.

Why this answer

The transform set must match exactly on both peers, including the order of protocols. ESP-SHA-HMAC is an authentication protocol, and ESP-AES-256 is encryption. If the peer has them in a different order or uses a different combination, the negotiation fails.

Full explanation →
724
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip policy Interface Route-map GigabitEthernet0/0 PBR-TRACK R1# show route-map PBR-TRACK route-map PBR-TRACK, permit, sequence 10 Match clauses: ip address (access-lists): 170 Set clauses: ip next-hop verify-availability 10.0.0.2 10 track 2 Policy routing matches: 100 packets, 8000 bytes R1# show track 2 Track 2 IP SLA 2 reachability Reachability is Up 2 changes, last change 00:01:30 Latest operation return code: ok Tracked by: ROUTE-MAP 0 R1# show ip route 10.0.0.2 Routing entry for 10.0.0.2/32 Known via "eigrp 1", distance 90, metric 28160 Last update from 192.168.1.2 on GigabitEthernet0/1 Based on this output, what is the most likely behavior for packets matching ACL 170?

A.Packets are forwarded to 10.0.0.2.
B.Packets are forwarded using the routing table because the next-hop is not reachable.
C.Packets are dropped because the track object is not configured correctly.
D.Packets are load-balanced between the next-hop and the routing table.
AnswerA

Since track 2 is Up, the next-hop is verified as available and used for policy routing.

Why this answer

The route map uses 'ip next-hop verify-availability' with track 2. Track 2 is Up (IP SLA 2 reachability is ok). Therefore, the next-hop 10.0.0.2 is considered available, and packets matching ACL 170 are forwarded to 10.0.0.2.

Full explanation →
725
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip bgp vpnv4 vrf RED summary BGP router identifier 192.168.0.1, local AS number 65001 BGP table version is 5, main routing table version 5 4 network entries using 576 bytes of memory 4 path entries using 320 bytes of memory 2/1 BGP path/bestpath attribute entries using 320 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 1216 total bytes of memory BGP activity 4/0 prefixes, 4/0 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.1.1.2 4 65001 23 25 5 0 0 00:12:34 2 10.1.2.2 4 65002 18 20 5 0 0 00:10:15 1 Based on this output, which statement is correct?

A.Both BGP neighbors are in the Established state.
B.Neighbor 10.1.2.2 is in the Idle state.
C.The local AS number is 65002.
D.Neighbor 10.1.1.2 is in AS 65002.
AnswerA

The State/PfxRcd column shows numbers (2 and 1), indicating established state with prefixes received.

Why this answer

The 'show bgp vpnv4 vrf RED summary' command displays BGP neighbors for VRF RED. It shows two neighbors: 10.1.1.2 (AS 65001) and 10.1.2.2 (AS 65002). Both are in the Established state with prefixes received.

The neighbor 10.1.1.2 has received 2 prefixes, and 10.1.2.2 has received 1 prefix.

Full explanation →
726
MCQmedium

In DMVPN Phase 3, which NHRP feature allows spokes to learn the NBMA address of other spokes without sending a resolution request?

A.NHRP redirect
B.NHRP shortcut
C.NHRP registration
D.NHRP resolution
AnswerA

NHRP redirect is the mechanism that tells a spoke to resolve the NBMA address of another spoke directly.

Why this answer

NHRP redirect is used in Phase 3 to inform spokes about better paths. The hub sends a redirect message to a spoke when it forwards a packet to another spoke, allowing the first spoke to learn the NBMA address of the second spoke.

Full explanation →
727
MCQmedium

Consider the following EEM applet configuration: !--- event manager applet INTERFACE_DOWN event syslog pattern "%LINEPROTO-5-UPDOWN" action 1.0 if $syslog_severity eq 5 action 2.0 cli command "enable" action 3.0 cli command "clear counters" !--- What will happen when a syslog message matching the pattern is generated?

A.The applet will execute the CLI commands only if the syslog severity is exactly 5.
B.The applet will execute the CLI commands unconditionally because the 'if' action is misconfigured.
C.The applet will fail to register because the 'if' action requires an 'else' clause.
D.The applet will clear the counters only for the interface that generated the syslog message.
AnswerB

Correct. Without the 'end' statement, the 'if' block is not properly closed, and the CLI commands will be executed regardless of the condition in many IOS versions.

Why this answer

The applet uses an 'if' action to check the syslog severity. If the severity is 5 (notification), the CLI commands are executed. However, the 'if' action is not closed with an 'end' statement, which is required.

As a result, the applet will encounter a syntax error and may not execute correctly, or the CLI commands may be executed unconditionally depending on the IOS version.

Full explanation →
728
MCQhard

A network engineer configures CoPP on a router that is a DMVPN hub. The policy includes a class-map to match NHRP traffic and police it. After deployment, spoke-to-spoke tunnels fail to establish, although spoke-to-hub tunnels work. Which is the most likely explanation?

A.The CoPP policy drops IPsec packets, which are used for spoke-to-spoke encryption.
B.The CoPP policy polices NHRP traffic, causing NHRP redirect packets from the hub to be dropped, so spokes cannot learn each other's addresses.
C.The CoPP policy is applied to the tunnel interface, not the control plane.
D.The CoPP policy uses the default class class-default, which blocks NHRP.
AnswerB

NHRP redirects are essential for spoke-to-spoke communication; policing them breaks the dynamic tunnel setup.

Why this answer

In a DMVPN hub-and-spoke topology, spoke-to-spoke tunnels rely on NHRP redirect messages from the hub to learn each other's public addresses. If CoPP polices NHRP traffic too aggressively, the hub may drop NHRP redirect packets before they reach the spokes. Without these redirects, spokes cannot initiate direct tunnels, even though spoke-to-hub communication (which uses the hub as a relay) remains functional.

Exam trap

Cisco often tests the distinction between control-plane and data-plane traffic in DMVPN; the trap here is that candidates assume spoke-to-spoke failures are caused by IPsec or tunnel interface issues, when the root cause is actually the policing of NHRP control-plane messages that enable dynamic tunnel establishment.

How to eliminate wrong answers

Option A is wrong because CoPP polices control-plane traffic (like NHRP), not IPsec data-plane packets; spoke-to-spoke tunnels use IPsec for encryption, but the failure is due to missing NHRP redirects, not dropped IPsec packets. Option C is wrong because CoPP is applied to the control plane (via 'control-plane' configuration), not to a tunnel interface; applying a policy to a tunnel interface would affect data-plane forwarding, not control-plane NHRP messages. Option D is wrong because the default class class-default does not block NHRP by default; it matches all unclassified traffic and typically permits it unless explicitly configured to drop, and the question states a class-map specifically matches NHRP traffic.

Full explanation →
729
MCQhard

A router has CoPP configured with a class-map that matches all traffic and polices it to 10000 pps. The router also has IPsec configured for a site-to-site VPN. After applying CoPP, the IPsec tunnel goes up, but traffic through the tunnel is intermittently dropped. Which is the most likely explanation?

A.CoPP drops ESP packets, which are data plane traffic.
B.CoPP drops IKE packets during rekey, causing the IPsec tunnel to fail temporarily.
C.IPsec uses TCP, and CoPP only polices UDP.
D.The CoPP policy is applied to the tunnel interface, not the control plane.
AnswerB

IKE packets are control plane; if dropped, the tunnel may not rekey properly, causing traffic loss.

Why this answer

CoPP polices control plane traffic, and IKE (UDP 500/4500) is control plane traffic. During IPsec rekey, IKE packets are sent to the router's control plane for processing. If CoPP drops these IKE packets due to the 10000 pps policer, the rekey fails, causing the IPsec tunnel to temporarily go down until the next rekey attempt.

The tunnel itself stays up initially, but traffic is intermittently dropped because the tunnel fails during rekey events.

Exam trap

Cisco often tests the distinction between control plane and data plane traffic, and the trap here is that candidates mistakenly think CoPP affects all traffic (including ESP data plane) rather than only control plane traffic like IKE.

How to eliminate wrong answers

Option A is wrong because ESP packets (IP protocol 50) are data plane traffic, not control plane traffic; CoPP by default polices only control plane traffic destined to the router itself, not transit data plane traffic like ESP. Option C is wrong because IPsec does not use TCP; IKE uses UDP (ports 500 and 4500), and ESP is IP protocol 50, neither of which is TCP. Option D is wrong because CoPP is applied globally to the control plane via the 'service-policy input' command under 'control-plane', not to a tunnel interface; applying a policy to a tunnel interface would affect data plane traffic on that interface, not control plane traffic like IKE.

Full explanation →
730
MCQeasy

Which DHCPv4 message type does a client send to request a specific IP address previously offered?

A.DHCPDISCOVER
B.DHCPOFFER
C.DHCPREQUEST
D.DHCPACK
AnswerC

DHCPREQUEST is sent by the client to request the offered IP address.

Why this answer

The DHCPREQUEST message is used by the client to formally request the specific IP address that was previously offered by the DHCP server in a DHCPOFFER. This occurs during the DHCP lease selection phase, where the client broadcasts or unicasts a DHCPREQUEST to accept the offered IP address and bind the lease.

Exam trap

Cisco often tests the distinction between DHCPREQUEST used for initial lease selection versus DHCPREQUEST used for lease renewal, where the trap is that candidates confuse the client's request for a specific offered address with the server's acknowledgment (DHCPACK) or the initial discovery (DHCPDISCOVER).

How to eliminate wrong answers

Option A is wrong because DHCPDISCOVER is the initial broadcast sent by the client to locate available DHCP servers, not to request a specific offered address. Option B is wrong because DHCPOFFER is sent by the DHCP server to propose an IP address to the client, not by the client to request it. Option D is wrong because DHCPACK is sent by the server to acknowledge and finalize the lease assignment after receiving the DHCPREQUEST, not by the client.

Full explanation →
731
MCQhard

A network engineer is troubleshooting suboptimal routing in a DMVPN Phase 2 deployment. Hub router R1 has the following configuration: route-map SET-NEXT-HOP permit 10 match ip address prefix-list SPOKE-NET set ip next-hop 10.0.0.1. Spoke R2 shows: 'show ip route 192.168.1.0' points to the hub (R1) instead of directly to another spoke (R3). R2's NHRP shows 'show dmvpn' with no spoke-to-spoke tunnels established. What is the root cause?

A.The route-map SET-NEXT-HOP incorrectly sets the next-hop to the hub, preventing NHRP from establishing direct spoke-to-spoke tunnels.
B.The prefix-list SPOKE-NET does not include the network 192.168.1.0.
C.The NHRP authentication is mismatched between R2 and R3.
D.The tunnel interface on R2 is not configured with ip nhrp redirect.
AnswerA

By setting the next-hop to the hub, R2 sees R1 as the next-hop for 192.168.1.0, so it does not attempt to build a direct tunnel to R3. NHRP requires the next-hop to be the remote spoke's tunnel IP.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels require that the next-hop in the routing table not be changed to the hub. The route-map SET-NEXT-HOP on R1 is setting the next-hop to the hub's tunnel IP (10.0.0.1) for routes matching SPOKE-NET. This causes spokes to see the hub as the next-hop for other spoke networks, preventing NHRP from triggering a spoke-to-spoke tunnel.

The correct behavior is to not set the next-hop (or set it to itself) so that spokes use the original next-hop (the other spoke's tunnel IP) and NHRP can resolve it.

Full explanation →
732
MCQmedium

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

A.The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct pattern is 'LINK-5-CHANGED'.
B.The EEM applet is not registered with the SNMP agent.
C.The SNMP trap action requires an SNMP community string to be specified in the applet.
D.The SNMP trap destination is not configured globally.
AnswerD

Correct because the EEM applet's SNMP trap action sends traps to the configured SNMP trap receivers; if none are configured, the trap is not sent.

Why this answer

The EEM applet is triggered by a syslog message, but the syslog message may not be generated for that specific interface, or the SNMP trap action may require additional configuration such as an SNMP community or target host.

Full explanation →
733
MCQeasy

A network engineer runs the following command to troubleshoot IPsec with route-maps: R1# show crypto ipsec transform-set Transform set combined: { esp-aes 256 esp-sha-hmac } will negotiate = { Transport, } Transform set ESP-AES: { esp-aes 256 esp-sha-hmac } will negotiate = { Tunnel, } What does this output indicate?

A.There are two transform sets configured, one using transport mode and one using tunnel mode.
B.The transform set 'combined' is not valid.
C.IPsec is not configured because no transform set is active.
D.The transform set 'ESP-AES' is used for route-map filtering.
AnswerA

The output shows two transform sets with different modes: transport and tunnel.

Why this answer

The output shows two IPsec transform sets: 'combined' and 'ESP-AES'. The 'combined' set uses transport mode, while 'ESP-AES' uses tunnel mode. This indicates that different transform sets are configured for different purposes.

Full explanation →
734
MCQhard

MPLS LDP neighbors are not forming between two directly connected routers. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.252 mpls ip Router R2 shows: show mpls ldp neighbor No LDP neighbors show mpls ldp discovery Local LDP Identifier: 10.1.1.1:0 Discovery Sources: Interfaces: GigabitEthernet0/0 (ldp): xmit/recv LDP: no Hello adjacencies What is the root cause?

A.An ACL or CoPP is blocking LDP UDP port 646 or TCP session.
B.The mpls ip command is missing on R2's interface.
C.The LDP router ID is not reachable; check loopback interfaces.
D.The label distribution method is different; use 'label distribution cdp' instead.
AnswerA

LDP uses UDP 646 for hellos and TCP 646 for session; if blocked, no adjacency forms.

Why this answer

LDP hello packets are being sent and received (xmit/recv), but no adjacency forms. This could be due to ACL blocking UDP 646, or CoPP rate-limiting LDP packets. The correct fix is to check ACLs and CoPP policies that may drop LDP hello or session packets.

Full explanation →
735
MCQhard

What is the default DHCPv4 client lease time on a Cisco IOS-XE router configured as a DHCP client?

A.3600 seconds (1 hour)
B.43200 seconds (12 hours)
C.86400 seconds (1 day)
D.1800 seconds (30 minutes)
AnswerC

Cisco IOS-XE DHCP client requests a lease time of 86400 seconds by default.

Why this answer

When a Cisco IOS-XE router is configured as a DHCPv4 client (e.g., using the 'ip address dhcp' command on an interface), the default lease time requested by the client is 86400 seconds (1 day). This value is defined in the Cisco DHCP client implementation and is the default lease time sent in the DHCPDISCOVER message, though the actual lease assigned depends on the DHCP server's configuration.

Exam trap

Cisco often tests the default DHCP client lease time on IOS-XE routers, and the trap here is that candidates confuse the default lease time requested by the client (86400 seconds) with common DHCP server default lease times (like 3600 or 43200 seconds) or with the default lease time for a Cisco IOS-XE DHCP server (which is also 86400 seconds, but for a different role).

How to eliminate wrong answers

Option A (3600 seconds) is wrong because 1 hour is a common default lease time for many home routers or small-office DHCP servers, but not the default requested by a Cisco IOS-XE DHCP client. Option B (43200 seconds) is wrong because 12 hours is a typical lease time used in some enterprise DHCP server configurations, but it is not the Cisco IOS-XE client default. Option D (1800 seconds) is wrong because 30 minutes is a very short lease time often used for high-density wireless or guest networks, but it is not the default requested by a Cisco IOS-XE DHCP client.

Full explanation →
736
MCQmedium

A network engineer is troubleshooting an MPLS L2VPN (VPWS) where the pseudowire between two PE routers is down. The show mpls l2transport vc command displays state 'down' and the VC ID is correct on both ends. The engineer checks the MPLS LDP session and sees it is up, but the targeted LDP session for the pseudowire is not established. What is the most likely cause?

A.The mpls ldp neighbor command is missing on one or both PEs.
B.The VC ID does not match on both ends.
C.The IGP is not converging, causing reachability issues.
D.The mpls label protocol ldp command is missing globally.
AnswerA

Correct because targeted LDP sessions require explicit configuration using the mpls ldp neighbor command to initiate the session for pseudowire signaling.

Why this answer

For a pseudowire to be established, a targeted LDP session is required between the two PE routers. If the targeted LDP session is not established, the pseudowire cannot exchange labels. The most common cause is that the mpls ldp neighbor command is missing or misconfigured on one or both PEs.

Full explanation →
737
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 access-list PERMIT-ONLY IPv6 access list PERMIT-ONLY permit ipv6 2001:DB8:3::/48 any sequence 10 Based on this output, what is the effect of this access list when applied to an interface?

A.It permits all IPv6 traffic
B.It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else
C.It denies all IPv6 traffic from 2001:DB8:3::/48
D.It permits all IPv6 traffic except from 2001:DB8:3::/48
AnswerB

The permit statement allows the prefix, and the implicit deny denies all other traffic.

Why this answer

An IPv6 access list, like its IPv4 counterpart, has an implicit deny all at the end. The single permit entry for source 2001:DB8:3::/48 allows only traffic from that prefix; all other IPv6 traffic is denied by the implicit deny ipv6 any any rule.

Exam trap

Cisco often tests the implicit deny any any behavior in IPv6 ACLs, tricking candidates into thinking that a single permit entry allows all traffic or that the ACL only filters the specified prefix without affecting other traffic.

How to eliminate wrong answers

Option A is wrong because the access list does not permit all IPv6 traffic; it only permits traffic from 2001:DB8:3::/48, and the implicit deny blocks everything else. Option C is wrong because the permit action explicitly allows traffic from 2001:DB8:3::/48, not denies it. Option D is wrong because the access list permits only the specified prefix, not all traffic except that prefix; the implicit deny blocks all other traffic, including traffic from 2001:DB8:3::/48 is permitted, not denied.

Full explanation →
738
MCQeasy

Which SNMPv3 message type is used by an SNMP agent to send unsolicited notifications to a manager?

A.GetRequest
B.Response
C.Trap or Inform
D.GetBulkRequest
AnswerC

Traps and informs are unsolicited notifications from agent to manager; informs require acknowledgment.

Why this answer

SNMPv3 agents use Trap or Inform messages to send unsolicited notifications to a manager without waiting for a polling request. Traps are unreliable (UDP, no acknowledgment), while Informs are reliable (require acknowledgment). This matches the definition of unsolicited notification in RFC 3416.

Exam trap

Cisco often tests the distinction between Traps and Informs as both being unsolicited notifications, but the trap here is that candidates forget that Informs are also unsolicited (agent-initiated) and are a valid SNMPv3 message type for notifications, not just Traps.

How to eliminate wrong answers

Option A is wrong because GetRequest is a manager-to-agent message used to poll for specific OID values, not an unsolicited agent-initiated notification. Option B is wrong because Response is a message sent by an agent in reply to a manager's request (e.g., GetRequest, SetRequest), not an unsolicited push. Option D is wrong because GetBulkRequest is a manager-to-agent message for retrieving large tables efficiently, not an unsolicited notification from the agent.

Full explanation →
739
Multi-Selectmedium

Which THREE commands can be used to troubleshoot DHCPv6 client address assignment issues on a Cisco IOS router acting as a DHCPv6 client? (Choose THREE.)

Select 3 answers
A.show ipv6 dhcp interface
B.debug ipv6 dhcp detail
C.show ipv6 interface
D.show ip dhcp binding
E.show ipv6 dhcp pool
AnswersA, B, C

Displays DHCPv6 client state, server address, and lease information.

Why this answer

'show ipv6 dhcp interface' displays the DHCPv6 client state, including the assigned IPv6 address, prefix, and server information for a specific interface. This command directly shows whether the client has successfully obtained an address via DHCPv6.

Exam trap

Cisco often tests the distinction between DHCPv4 and DHCPv6 commands, expecting candidates to know that 'show ip dhcp binding' is IPv4-only and 'show ipv6 dhcp pool' is server-side, not client-side.

Full explanation →
740
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip policy Interface Route-map GigabitEthernet0/0 PBR-DEFAULT R1# show route-map PBR-DEFAULT route-map PBR-DEFAULT, permit, sequence 10 Match clauses: ip address (access-lists): 150 Set clauses: ip next-hop 10.0.0.2 Policy routing matches: 0 packets, 0 bytes route-map PBR-DEFAULT, deny, sequence 20 Match clauses: Set clauses: Policy routing matches: 0 packets, 0 bytes R1# show access-lists 150 Extended IP access list 150 10 permit ip 192.168.1.0 0.0.0.255 any R1# show ip route 10.0.0.2 Routing entry for 10.0.0.2/32 Known via "ospf 1", distance 110, metric 20 Last update from 10.1.1.2 on GigabitEthernet0/1 Based on this output, what is the most likely problem?

A.The deny sequence 20 is blocking all traffic from being policy-routed.
B.No traffic matching ACL 150 is arriving on GigabitEthernet0/0.
C.The next-hop 10.0.0.2 is unreachable.
D.The route map is missing a permit statement.
AnswerB

Zero matches on both sequences indicate no packets are being evaluated by the route map.

Why this answer

The route map has a deny sequence 20 with no match clause, which means it matches all packets. Since route maps are processed in order, if sequence 10 does not match (zero matches), sequence 20 will match all remaining packets and deny them (i.e., not apply PBR), causing them to be routed normally. However, the counters show zero for both sequences, indicating no traffic is being processed at all, likely because no traffic matching ACL 150 arrives on the interface.

Full explanation →
741
MCQeasy

In IPsec site-to-site VPN, what is the default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers?

A.3600 seconds (1 hour)
B.86400 seconds (24 hours)
C.28800 seconds (8 hours)
D.1800 seconds (30 minutes)
AnswerB

This is the Cisco default for ISAKMP lifetime.

Why this answer

The default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers is 86400 seconds (24 hours). This is defined in the Cisco IOS default configuration for the `crypto isakmp policy` and is the recommended value to balance security and performance by reducing the frequency of re-authentication and Diffie-Hellman key exchanges.

Exam trap

Cisco often tests the distinction between IKE phase 1 and IPsec phase 2 default lifetimes, so the trap here is confusing the 86400-second (24-hour) default for ISAKMP with the 3600-second (1-hour) default for IPsec SAs.

How to eliminate wrong answers

Option A is wrong because 3600 seconds (1 hour) is the default lifetime for IPsec (IKE phase 2) security associations, not for ISAKMP phase 1. Option C is wrong because 28800 seconds (8 hours) is a common user-configured value but is not the Cisco IOS default for ISAKMP. Option D is wrong because 1800 seconds (30 minutes) is too short for phase 1 and is typically used for aggressive rekeying scenarios, not the default.

Full explanation →
742
Multi-Selecthard

Which TWO statements about IPv6 First Hop Security (FHS) RA Guard are true? (Choose TWO.)

Select 2 answers
A.The default RA Guard policy action is to block Router Advertisements from unauthorized ports.
B.RA Guard validates the source MAC address of Router Advertisements against the IPv6 source address.
C.The default RA Guard policy action is to log Router Advertisements from unauthorized ports.
D.RA Guard can be applied on a per-interface or per-VLAN basis using a policy map.
E.RA Guard is typically enabled on trunk ports to protect against rogue RAs from other VLANs.
AnswersA, D

Correct. The default action for an RA Guard policy is 'block', which drops unauthorized RAs.

Why this answer

The default action of an IPv6 RA Guard policy is to block Router Advertisements (RAs) received on ports that are not explicitly authorized. This prevents rogue devices from sending malicious RAs that could redirect traffic or launch man-in-the-middle attacks. The RA Guard feature enforces this by dropping unauthorized RAs at the switch level.

Exam trap

Cisco often tests the distinction between the default action (block) and optional actions (log), and the specific validation of source MAC against link-local IPv6 address rather than any IPv6 address, leading candidates to confuse the validation scope.

Full explanation →
743
MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# show ip bgp vpnv4 vrf CUSTOMER-A 10.10.10.0/24 BGP routing table entry for 10.10.10.0/24, version 2 Paths: (1 available, best #1, table CUSTOMER-A) Not advertised to any peer Refresh Epoch 1 Local 10.1.1.2 from 10.1.1.2 (10.1.1.2) Origin IGP, metric 0, localpref 100, valid, internal, best Extended Community: RT:100:100 mpls labels in/out nolabel/101 What does this output indicate?

A.The route 10.10.10.0/24 is installed in VRF CUSTOMER-A with an MPLS label of 101 for forwarding.
B.The route 10.10.10.0/24 is not installed because it is not advertised to any peer.
C.The route 10.10.10.0/24 is learned from an external BGP peer.
D.The route 10.10.10.0/24 has no MPLS label and will be forwarded using IP lookup.
AnswerA

The output shows the route is best and has an MPLS label of 101 for outbound forwarding.

Why this answer

The output shows that the route 10.10.10.0/24 is installed in VRF CUSTOMER-A (table CUSTOMER-A) with an MPLS label of 101 for outgoing forwarding, as indicated by 'mpls labels in/out nolabel/101'. The route is valid, internal, and best, meaning it is used for forwarding despite not being advertised to any peer. This confirms that the MPLS label is applied for forwarding within the VRF context.

Exam trap

Cisco often tests the misconception that 'not advertised to any peer' means the route is not installed or usable, but in MPLS VPN contexts, a route can be installed and used for forwarding even if it is not advertised to BGP peers.

How to eliminate wrong answers

Option B is wrong because the route is marked as 'best' and installed in the VRF table, so it is used for forwarding even though it is not advertised to any peer; non-advertisement does not prevent installation. Option C is wrong because the path is labeled 'Local' and 'internal', and the neighbor 10.1.1.2 is an iBGP peer (same AS), not an external BGP peer. Option D is wrong because the output explicitly shows an MPLS label of 101 for outgoing packets, so forwarding will use label switching, not IP lookup.

Full explanation →
744
MCQmedium

What is the default value for the 'active flow timeout' in a Flexible NetFlow monitor on Cisco IOS-XE?

A.15 minutes
B.30 minutes
C.60 minutes
D.5 minutes
AnswerB

Correct. The default active flow timeout is 30 minutes.

Why this answer

The default active flow timeout is 30 minutes, after which long-lived flows are exported regardless of activity.

Full explanation →
745
MCQhard

Two routers R1 and R2 are connected via Ethernet link, but OSPF adjacency is not forming. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.252 ip ospf network point-to-multipoint ip ospf 1 area 0 Router R2 shows: show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:35 10.1.1.2 GigabitEthernet0/0 But R2's configuration: interface GigabitEthernet0/0 ip address 10.1.1.2 255.255.255.252 ip ospf network broadcast ip ospf 1 area 0 What is the root cause?

A.Network type mismatch; change both to point-to-point or broadcast.
B.The subnet mask is /30, which is not supported with point-to-multipoint.
C.The OSPF area is mismatched; both are area 0.
D.The IP addresses are on different subnets; both are 10.1.1.0/30.
AnswerA

Point-to-multipoint and broadcast have different hello and DR election behaviors, causing adjacency failure.

Why this answer

OSPF network type mismatch: R1 is configured as point-to-multipoint, which does not elect DR/BDR and uses multicast 224.0.0.5 for all neighbors. R2 is broadcast, expecting DR/BDR election and using 224.0.0.6 for DR/BDR communication. This mismatch prevents proper adjacency formation, though R2 sees R1 as FULL due to unidirectional hello.

The correct fix is to match network types.

Full explanation →
746
MCQmedium

A network engineer is troubleshooting a manual IPv6-in-IPv4 tunnel between two Cisco routers. The tunnel is up, and both routers can ping each other's tunnel IPv6 addresses. However, traffic from a host behind Router A to a host behind Router B fails. The engineer notices that Router A has a route to the remote IPv6 prefix via the tunnel, but Router B does not have a route to the local IPv6 prefix. What is the most likely cause?

A.Router B is missing a static route pointing the local IPv6 prefix to the tunnel interface.
B.The tunnel mode is set to 'ipv6ip 6to4' instead of 'ipv6ip'.
C.The tunnel source on Router B is misconfigured with the wrong IPv4 address.
D.The IPv6 access-list on Router B is blocking incoming traffic from the local prefix.
AnswerA

Correct because without a return route, Router B cannot forward packets destined to the local prefix, breaking bidirectional communication.

Why this answer

The tunnel is up and both routers can ping each other's tunnel IPv6 addresses, confirming that the tunnel itself is operational. However, traffic from a host behind Router A to a host behind Router B fails because Router B lacks a route back to the local IPv6 prefix (the network behind Router A). For bidirectional communication, both routers must have a route to the remote IPv6 prefix pointing to the tunnel interface.

Since Router B is missing this static route, it cannot forward return traffic into the tunnel, causing the failure.

Exam trap

Cisco often tests the distinction between tunnel reachability (Layer 3 connectivity between tunnel endpoints) and prefix reachability (routing of actual user networks), leading candidates to overlook the missing static route on the return path.

How to eliminate wrong answers

Option B is wrong because 'ipv6ip 6to4' is a 6to4 tunnel mode that uses an automatic addressing scheme (2002::/16) and requires a different configuration; the question describes a manual IPv6-in-IPv4 tunnel, which uses 'tunnel mode ipv6ip' (or 'tunnel mode ipv6ip [ipv4]'). Option C is wrong because if the tunnel source on Router B were misconfigured with the wrong IPv4 address, the tunnel would not be up and the routers could not ping each other's tunnel IPv6 addresses. Option D is wrong because the problem states that Router B does not have a route to the local IPv6 prefix; an IPv6 access-list blocking traffic would cause a different symptom (e.g., packets dropped at the interface) but the routing table would still contain the route.

Full explanation →
747
MCQmedium

A network engineer runs the following command on Router R1: R1# show flow monitor FLOW-MONITOR-1 cache format table Cache type: Normal Cache size: 1000 Current entries: 0 High Watermark: 0 Flows added: 0 Flows aged: 0 - Active timeout (1800 secs) 0 - Inactive timeout (15 secs) 0 - Event aged 0 - Watermark aged 0 - Emergency aged 0 Based on this output, what is the most likely problem?

A.The cache size is too small at 1000 entries.
B.The flow monitor is not applied to any interface.
C.The active timeout is too long at 1800 seconds.
D.The cache type is Normal, which requires a sampler.
AnswerB

With 0 flows added and 0 current entries, the monitor is not receiving traffic. This is typical when it is not attached to an interface.

Why this answer

The cache shows 0 current entries and 0 flows added, indicating no traffic is being captured. This often means the flow monitor is not applied to any interface.

Full explanation →
748
MCQmedium

A network engineer is troubleshooting a router that is not responding to ICMP echo requests from a management station at 10.10.10.1. The router has an ACL applied to the VTY lines that permits only 10.10.10.0/24. The engineer can telnet to the router from the management station. What is the most likely cause?

A.The VTY ACL also applies to ICMP traffic.
B.An inbound ACL on the interface denies ICMP from 10.10.10.1.
C.The router has 'no ip icmp echo' configured globally.
D.The management station is not in the routing table of the router.
AnswerB

Since Telnet works, the VTY ACL is not the issue; an interface ACL blocking ICMP is the likely cause.

Why this answer

The management station can telnet to the router, which proves that the VTY ACL permits 10.10.10.0/24 and that reachability exists. Since ICMP is processed by the interface input path before any VTY ACL, the failure of ICMP echo requests points to an inbound ACL on the interface that explicitly denies ICMP from 10.10.10.1. This is the most likely cause because telnet (TCP/23) succeeds while ICMP fails, isolating the issue to interface-level filtering.

Exam trap

Cisco often tests the misconception that VTY ACLs control all management traffic, including ICMP, when in fact VTY ACLs only filter Telnet/SSH sessions, while ICMP is filtered by interface ACLs.

How to eliminate wrong answers

Option A is wrong because VTY ACLs apply only to inbound Telnet/SSH sessions (TCP/23, TCP/22) and do not affect ICMP traffic, which is handled at the interface level. Option C is wrong because there is no global command 'no ip icmp echo' in Cisco IOS; the correct command to disable ICMP echo responses is 'no ip icmp echo-reply' or 'no ip unreachables', but even then, the router would still respond to echo requests unless explicitly blocked, and this scenario is less common than an ACL. Option D is wrong because the management station is reachable (telnet succeeds), which confirms the router has a route back to 10.10.10.1; otherwise, the TCP handshake would fail.

Full explanation →
749
MCQeasy

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 3000(3) Gi0/0 Session state is UP and not using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 3000(0) Rx Count: 100, Tx Count: 100 Based on this output, what is the BFD session's remote discriminator?

A.The remote discriminator is 3.
B.The remote discriminator is 1.
C.The remote discriminator is 10.1.1.2.
D.The remote discriminator is 10.1.1.1.
AnswerA

The RD (Remote Discriminator) is 3 as shown in the output.

Why this answer

The remote discriminator is the RD value shown in the output. In this case, it is 3.

Full explanation →
750
MCQhard

An engineer configures a BGP route reflector with two clients. One client advertises a prefix to the route reflector. The route reflector reflects the prefix to the other client, but the second client does not install it in its routing table. The second client has a lower administrative distance for the same prefix from another protocol. Which is the most likely explanation?

A.The second client has a route from another protocol (e.g., OSPF) with a lower administrative distance for the same prefix, so BGP route is not installed.
B.The route reflector does not set the next-hop-self, so the next-hop is unreachable from the second client.
C.The route reflector is not configured as a client on the second router.
D.The BGP synchronization rule is enabled and the prefix is not in the IGP.
AnswerA

Administrative distance is used to select the best route when multiple protocols provide the same prefix; a lower AD wins.

Why this answer

A router installs only the best route for a given prefix based on administrative distance (AD) when multiple routing protocols provide routes. BGP has a default AD of 20 for eBGP and 200 for iBGP, while OSPF has an AD of 110. Since OSPF has a lower AD, the OSPF route is preferred and installed in the routing table, causing the BGP-learned prefix to be ignored even though it was successfully reflected.

Exam trap

Cisco often tests the concept that route reflection only affects BGP propagation, not the route installation decision, which is governed by administrative distance or other route selection criteria like prefix length.

How to eliminate wrong answers

Option B is wrong because the next-hop-self issue would cause the BGP route to be received but not usable due to an unreachable next-hop, not because of a lower AD from another protocol; the question states the route is not installed, not that it is missing from the BGP table. Option C is wrong because the route reflector is already configured with two clients, and the prefix is reflected to the second client; if the second router were not a client, the route reflector would not reflect the prefix to it at all, contradicting the scenario. Option D is wrong because BGP synchronization is disabled by default in modern Cisco IOS (since IOS 12.2(8)T) and is rarely used; even if enabled, it would prevent the BGP route from being advertised, not from being installed in the routing table after receipt.

Full explanation →
Page 9

Page 10 of 27

Page 11

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →