Knowledge + Practice

Cisco CCNP ENARSI 300-410 (300-410) — Questions 826–900

1966 questions total · 27pages · All types, answers revealed

Take a mock exam Exam hub

Page 12 of 27

826

MCQhard

Which CoPP feature allows the control plane to process packets from a specific source IP address without rate limiting?

A.CoPP aggregate policer

B.Control Plane Protection (CPPr) exception

C.QoS pre-classify

D.Policy-map 'set' action

AnswerB

CPPr allows defining exceptions to bypass CoPP for trusted sources, such as management stations or routing peers.

Why this answer

Control Plane Protection (CPPr) extends CoPP by allowing granular control over which packets are subject to rate limiting. The CPPr exception feature specifically permits packets from a trusted source IP address to bypass all rate-limiting policies, ensuring critical traffic like routing protocol updates or management access is never dropped even under attack conditions.

Exam trap

Cisco often tests the distinction between CoPP (which applies rate limits to all matched traffic) and CPPr (which can create exceptions), leading candidates to mistakenly think aggregate policers or QoS actions can achieve the same per-source exemption.

How to eliminate wrong answers

Option A is wrong because a CoPP aggregate policer applies a single rate limit to all traffic matching the class, regardless of source IP, and does not provide per-source exceptions. Option C is wrong because QoS pre-classify is used to mark packets before encryption in VPN scenarios, not to exempt specific source IPs from rate limiting. Option D is wrong because a policy-map 'set' action modifies packet markings (e.g., DSCP or CoS) but does not create an exception to rate limiting; it only changes the QoS treatment of the packet.

Full explanation →

827

MCQhard

A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?

A.The ERSPAN session is misconfigured, causing the router to forward the original packets instead of encapsulated copies.

B.The monitoring server is stripping the GRE headers before capturing.

C.The ERSPAN session is configured with the 'ip access-group' command that filters the encapsulated traffic.

D.The router is not running the correct IOS version that supports ERSPAN.

AnswerA

Correct because the router should send GRE-encapsulated packets; if it sends raw packets, the session configuration is incorrect.

Why this answer

ERSPAN encapsulates the original packet with a GRE header. If the monitoring server receives packets without GRE encapsulation, it means the router is not encapsulating the traffic correctly, possibly because the ERSPAN session is not configured with the correct tunnel source or destination.

Full explanation →

828

MCQmedium

A router is configured with 'logging host 10.1.1.100' and 'logging trap informational'. The engineer notices that syslog messages with severity 5 (notice) are being sent, but messages with severity 6 (informational) are not. What is the most likely cause?

A.The 'logging trap' command is set to 5 (notice) rather than 6 (informational).

B.The syslog server is dropping severity 6 messages due to its own configuration.

C.The 'logging console' command is overriding the remote logging level.

D.The router's clock is not synchronized, causing timestamp issues.

AnswerA

Correct because if the trap level is 5, only messages severity 0-5 are sent; severity 6 messages are excluded.

Why this answer

The 'logging trap informational' command sets the logging severity level to 6, meaning the router should send syslog messages with severity 0 through 6. However, if only severity 5 (notice) messages are being sent, the most likely cause is that the 'logging trap' command was actually configured with level 5 (notice) instead of level 6 (informational). This is a common misconfiguration where the engineer mistakenly sets the level to 5, which excludes severity 6 messages.

Exam trap

Cisco often tests the misconception that 'logging trap informational' automatically sends all informational messages, but the trap is that the engineer might have actually configured 'logging trap 5' (notice) instead, or that the severity level is set to a lower number, which excludes higher-numbered (less severe) messages.

How to eliminate wrong answers

Option B is wrong because the question states that severity 6 messages are not being sent from the router, not that they are being dropped by the server; the server's configuration would not prevent the router from sending them. Option C is wrong because the 'logging console' command controls console output, not remote syslog logging; it does not override the 'logging trap' level. Option D is wrong because clock synchronization affects timestamps in syslog messages but does not filter or block messages based on severity.

Full explanation →

829

Multi-Selectmedium

Which TWO commands verify the application and content of an IPv4 access control list on a Cisco IOS router? (Choose TWO.)

Select 2 answers

A.show ip interface

B.show access-lists

C.show running-config | include access-list

D.show ip route

E.debug ip packet

AnswersA, B

This command shows which ACLs are applied inbound/outbound on each interface.

Why this answer

The 'show ip interface' command displays the access lists applied to an interface, including the direction (inbound/outbound) and the specific ACL name or number. The 'show access-lists' command shows the detailed content of all ACLs, including the exact permit/deny statements, sequence numbers, and hit counts, verifying both the application and the rules.

Exam trap

Cisco often tests the distinction between commands that verify ACL application (show ip interface) versus content (show access-lists), and candidates mistakenly choose 'show running-config | include access-list' thinking it shows both, but it only shows the configuration lines without interface binding or hit counts.

Full explanation →

830

Drag & Drophard

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Begin by checking the DHCP client's interface for an IP address and DHCP state. Then, verify that the relay agent is configured and reachable. Next, confirm that the DHCP server is reachable from the relay.

After that, inspect access lists or firewall rules that might block DHCP traffic. Finally, review debug output to isolate the failure point.

Full explanation →

831

MCQmedium

An engineer is troubleshooting a router that fails to write its running configuration to startup configuration using 'copy running-config startup-config'. The command returns 'Destination filename [startup-config]?' and then the prompt returns without error. 'show startup-config' shows an empty configuration. What is the most likely cause?

A.The router is configured to boot from a TFTP server using the 'boot host' command, and the TFTP server is unreachable or does not allow writes.

B.The NVRAM is full and the router cannot save the configuration.

C.The 'file prompt quiet' command is configured, suppressing prompts.

D.The router is running in ROMMON mode.

AnswerA

When 'boot host' points to a remote file, 'copy running-config startup-config' tries to write to that remote server; if it fails, the local startup-config remains empty.

Why this answer

The 'copy running-config startup-config' command prompts for the destination filename and then returns without error, but the startup configuration remains empty. This behavior occurs when the router is configured to boot from a TFTP server using the 'boot host' command, and the TFTP server is unreachable or does not allow writes. The router attempts to write the configuration to the TFTP server instead of NVRAM, and if the TFTP server is not reachable or write access is denied, the command appears to succeed but the configuration is not saved.

Exam trap

Cisco often tests the subtle behavior where a TFTP-based boot configuration causes the 'copy running-config startup-config' command to appear successful but actually fails silently, leading candidates to incorrectly suspect NVRAM issues or command syntax problems.

How to eliminate wrong answers

Option B is wrong because if NVRAM were full, the router would typically return an error message such as 'NVRAM is full' or 'Error saving configuration', not a silent return to the prompt. Option C is wrong because the 'file prompt quiet' command suppresses all user prompts, including the 'Destination filename [startup-config]?' prompt, which is still displayed in the scenario. Option D is wrong because in ROMMON mode, the router does not have a full IOS running, so the 'copy running-config startup-config' command would not be recognized or would fail with a 'command not found' error.

Full explanation →

832

MCQmedium

An engineer is troubleshooting a BGP peering issue between two routers, R1 and R2, connected via a serial link. The BGP session is established, but routes are not being exchanged. The engineer checks the BGP configuration and sees that both routers have the 'neighbor' commands correctly configured. The output of 'show ip bgp summary' shows the session is in the Established state, but the prefix counts are zero. What is the most likely cause?

A.Neither router has any network statements or redistribution commands configured to inject prefixes into BGP.

B.The BGP session is using MD5 authentication, but the passwords do not match.

C.The routers have mismatched BGP versions.

D.The update-source command is missing, causing the session to use the wrong interface.

AnswerA

Correct because BGP only advertises prefixes that are explicitly injected via network statements, redistribution, or aggregation.

Why this answer

If the BGP session is established but no prefixes are exchanged, the most common cause is that there are no networks configured under the BGP process or no redistribution. Alternatively, outbound filters could be blocking all prefixes. The stem says routes are not being exchanged, so the issue is on the advertisement side.

Full explanation →

833

MCQmedium

A network engineer runs the following command to verify IPv6 First Hop Security operation: R1# show ipv6 nd raguard policy TRUSTED Policy: TRUSTED Status: Active Device role: host Trusted ports: Fa0/1 Untrusted ports: none RA Guard: enabled RA Guard policy: allow ND inspection: enabled ND inspection policy: INSPECT What does this output indicate?

A.The policy TRUSTED allows RAs on Fa0/1 and performs ND inspection using policy INSPECT.

B.The policy TRUSTED blocks all RAs on Fa0/1 and disables ND inspection.

C.The policy TRUSTED only applies to untrusted ports and has no effect on Fa0/1.

D.The policy TRUSTED is inactive and not applied to any interface.

AnswerA

The output shows RA Guard is enabled with allow action, and ND inspection is enabled with policy INSPECT on the trusted port.

Why this answer

The output shows that policy TRUSTED is active, with Fa0/1 listed as a trusted port. Since RA Guard is enabled with an 'allow' policy, Router Advertisements (RAs) received on Fa0/1 are permitted. Additionally, ND inspection is enabled using policy INSPECT, meaning Neighbor Discovery messages are inspected on that port.

This matches option A.

Exam trap

The trap here is that candidates may misinterpret 'RA Guard: enabled' as blocking RAs, but the output explicitly shows 'RA Guard policy: allow', meaning RAs are permitted on the trusted port.

How to eliminate wrong answers

Option B is wrong because the policy does not block RAs on Fa0/1; it explicitly allows them (RA Guard policy: allow). Option C is wrong because the policy is applied to trusted ports (Fa0/1 is listed as trusted), not only to untrusted ports. Option D is wrong because the status is 'Active', indicating the policy is applied and functioning.

Full explanation →

834

MCQmedium

A network engineer runs the following command to troubleshoot SNMP trap generation: R1# show snmp mib sysDescr.0 = Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.7(3)M sysObjectID.0 = .1.3.6.1.4.1.9.1.1 sysUpTime.0 = 123456789 sysContact.0 = admin@example.com sysName.0 = R1 sysLocation.0 = Lab What does this output indicate?

A.The router's system MIB is populated with correct values, including contact and location.

B.The router's sysContact is not configured, causing SNMP traps to fail.

C.The router is not responding to SNMP queries.

D.The router uses SNMPv3 only.

AnswerA

All system MIB objects have values, indicating proper configuration.

Why this answer

The output of 'show snmp mib' displays the system MIB (RFC 1213) values currently populated on the router. The presence of sysContact, sysName, and sysLocation with valid data indicates that the SNMP agent is running and these mandatory MIB-II objects are correctly configured. This confirms the router's system MIB is properly populated, which is a prerequisite for SNMP trap generation to function correctly.

Exam trap

Cisco often tests the misconception that SNMP trap generation requires sysContact or sysLocation to be configured, but in reality, only sysName and sysObjectID are critical for trap identification, and the output here shows all values are correctly set.

How to eliminate wrong answers

Option B is wrong because the output clearly shows sysContact.0 = admin@example.com, meaning sysContact is configured; traps failing due to missing sysContact is a misconception as traps do not require sysContact to be set. Option C is wrong because the router is responding to the SNMP query (the command succeeded and returned data), proving it is reachable and processing SNMP requests. Option D is wrong because the output does not indicate any SNMP version; the 'show snmp mib' command works regardless of SNMP version (v1, v2c, or v3) and the presence of community-based strings is not shown here, so no conclusion about SNMPv3-only can be drawn.

Full explanation →

835

MCQhard

A network engineer is troubleshooting a route redistribution issue between OSPF and BGP. Router R1 runs both OSPF and BGP, and redistributes OSPF routes into BGP. The engineer notices that OSPF external routes are not appearing in the BGP table on R1. The show ip bgp command does not list these prefixes. The redistribute ospf 1 match external command is configured under BGP. What is the most likely cause?

A.The redistribute ospf 1 match external command under BGP is missing the subnets keyword.

B.OSPF has a higher administrative distance than BGP.

C.The OSPF process on R1 has a distribute-list blocking these routes.

D.BGP requires the network command to advertise routes, not redistribution.

AnswerA

Correct: Without subnets, only classful networks are redistributed, causing missing routes.

Why this answer

When redistributing OSPF into BGP, the subnets keyword is required to redistribute classless subnets. Without it, only classful networks are redistributed, which may cause many routes to be missing.

Full explanation →

836

MCQhard

R1 and R2 are iBGP peers in AS 65001. R1 has: neighbor 10.1.1.2 route-reflector-client. R2 advertises a prefix 192.168.1.0/24 with next-hop 10.1.1.2. R3, another iBGP speaker not a client of R1, receives the prefix but the next-hop is unchanged (10.1.1.2) and R3 cannot reach it because 10.1.1.2 is not directly connected. R1 has no other configuration. What is the root cause?

A.R1 is missing the next-hop-self configuration for its non-client peer R3, so the next-hop remains R2, which is not reachable by R3.

B.R2 should have sent the route with next-hop-self to R1.

C.R3 is missing a static route to 10.1.1.2.

D.The route-reflector-client command should be applied on R2 instead.

AnswerA

Route reflectors do not change next-hop for reflected routes; next-hop-self is needed on the reflector for non-clients.

Why this answer

When a route reflector reflects a route from a client to a non-client, it does not modify the next-hop attribute by default. The next-hop remains the original router (R2). If the non-client (R3) does not have a route to that next-hop, the prefix is considered unreachable.

The fix is to use next-hop-self on the route reflector for non-client peers, or ensure reachability to the next-hop. The root cause is that R1 is not configured with neighbor 10.1.1.3 next-hop-self for the non-client peer.

Full explanation →

837

MCQeasy

What is the default OSPF dead interval on a broadcast multi-access network (e.g., Ethernet) when the hello interval is 10 seconds?

A.40 seconds

B.30 seconds

C.20 seconds

D.10 seconds

AnswerA

The dead interval is 4 * hello interval (10 seconds) = 40 seconds.

Why this answer

On broadcast multi-access networks like Ethernet, OSPF defaults to a hello interval of 10 seconds. The dead interval is calculated as 4 times the hello interval, resulting in a default dead interval of 40 seconds. This ensures that a router has multiple missed hello opportunities before being declared dead, providing stability against transient network issues.

Exam trap

The trap here is that candidates often confuse the default dead interval multiplier (thinking it is 3 instead of 4) or mistakenly apply the NBMA dead interval logic to broadcast networks, leading them to select 30 or 20 seconds.

How to eliminate wrong answers

Option B (30 seconds) is wrong because it incorrectly assumes a multiplier of 3, but the OSPF standard (RFC 2328) specifies a multiplier of 4 for broadcast networks. Option C (20 seconds) is wrong because it suggests a multiplier of 2, which is used for NBMA networks (e.g., Frame Relay) where the hello interval is 30 seconds and the dead interval is 120 seconds, not for Ethernet. Option D (10 seconds) is wrong because it confuses the hello interval with the dead interval; the dead interval must be longer to allow for missed hellos.

Full explanation →

838

MCQhard

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, the router becomes unreachable via SSH, and OSPF neighbor adjacencies go down. The engineer checks the CoPP policy and sees that the class-map for SSH and OSPF traffic is configured with a police rate. Which is the most likely explanation?

A.The class-default is set to drop all traffic not matched by explicit classes

B.The police rate for OSPF traffic is too high

C.The CoPP policy is applied to the wrong interface

D.The class-map for SSH uses the wrong match criteria

AnswerA

Correct. If class-default drops traffic, OSPF and SSH packets that are not explicitly permitted will be dropped.

Why this answer

A common edge case with CoPP is that the default class (class-default) is often configured with an explicit deny or a very low rate, which can drop all traffic not matched by other classes. If the engineer does not include a 'class class-default' with an appropriate action (e.g., 'police' with a conform action of 'transmit'), all unmatched traffic, including critical control plane traffic, may be dropped. Additionally, if the police rate is too low for OSPF hello packets, adjacencies can fail.

Full explanation →

839

MCQhard

A network engineer is troubleshooting IPv6 redistribution between EIGRP and OSPFv3 on Router R1. Routes from OSPFv3 are being redistributed into EIGRP, but they are not appearing in the EIGRP topology table. Router R1 has the following relevant configuration: router eigrp Test address-family ipv6 unicast redistribute ospf 1 metric 10000 100 255 1 1500 ! Router R2 shows: show ipv6 eigrp topology output does not include any OSPF-derived routes. What is the root cause?

A.The EIGRP metric values are too high, causing the routes to be considered unreachable.

B.The OSPFv3 process ID in the redistribute command does not match the actual OSPFv3 process ID running on the router.

C.The routes from OSPFv3 are external, and EIGRP does not redistribute external OSPF routes by default.

D.The EIGRP address-family is not configured with a router ID, preventing redistribution.

AnswerB

If the process ID is wrong, the redistribution command does not match any OSPFv3 process, and no routes are redistributed.

Why this answer

The redistribute ospf 1 command references OSPFv3 process ID 1, but if the actual OSPFv3 process ID running on Router R1 is different (e.g., 100), the redistribution will silently fail—no routes are injected into EIGRP. The process ID must match exactly for redistribution to occur.

Exam trap

Cisco often tests the requirement for matching process IDs in redistribution commands, leading candidates to overlook that the redistribute statement references a specific OSPF process that must be active and correctly numbered.

How to eliminate wrong answers

Option A is wrong because the EIGRP metric values (10000 100 255 1 1500) are well within acceptable ranges; high metrics do not make routes unreachable—they only affect path selection. Option C is wrong because EIGRP can redistribute external OSPFv3 routes (type E1/E2) without any special keyword; the redistribute command includes all OSPF routes by default. Option D is wrong because EIGRP for IPv6 does not require a router ID for redistribution to function; a router ID is needed for neighbor adjacency but not for the redistribution process itself.

Full explanation →

840

MCQmedium

An engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using OSPF with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip cef vrf CUSTOMER 10.2.2.0 command on PE1 shows the next-hop as 192.168.1.2 and the output interface as GigabitEthernet0/0. The show mpls forwarding-table 192.168.1.2 detail command on PE1 shows a label with outgoing interface GigabitEthernet0/0. The show ip route 192.168.1.2 command on PE1 shows the route with a next-hop of 10.0.0.2 and output interface GigabitEthernet0/0. The show ip cef 192.168.1.2 command on PE1 shows the next-hop as 10.0.0.2 and output interface GigabitEthernet0/0. What is the most likely cause?

A.The VRF route-target import on PE2 is misconfigured.

B.The PE2 router does not have a label for the CE1 prefix in its LFIB.

C.The OSPF process on PE1 is not redistributing BGP routes into OSPF.

D.The MP-BGP session is using an incorrect update-source.

AnswerB

Correct: If PE2 cannot forward return traffic due to missing label, traffic will be dropped.

Why this answer

All forwarding components on PE1 are correct. The issue is likely on the remote side, such as PE2 not having a label for the return traffic or CE2 not having a route back. The engineer should check PE2's forwarding table for the CE1 prefix.

Full explanation →

841

Drag & Dropmedium

Drag and drop the steps to verify and validate route summarization operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Begin by checking the routing table on the summarizing router to see the summary route. Then, inspect the OSPF database to confirm the summary LSA. Next, verify that the summary is not causing suboptimal routing by checking for more specific routes.

After that, use show ip protocols to confirm summarization is enabled. Finally, test reachability to a host within the summarized range.

Full explanation →

842

MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 dhcp binding Client: FE80::A8BB:CCFF:FE01:0200 DUID: 00030001AABBCC010200 Username: unassigned IA NA: IA ID 0x00010001, T1 302400, T2 483840 Address: 2001:DB8:1::1000 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 08 2020 12:00 AM (2592000 seconds) Client: FE80::A8BB:CCFF:FE01:0300 DUID: 00030001AABBCC010300 Username: unassigned IA NA: IA ID 0x00010001, T1 302400, T2 483840 Address: 2001:DB8:1::1001 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 08 2020 12:00 AM (2592000 seconds) Based on this output, which statement is correct?

A.The DHCPv6 server has assigned duplicate addresses to the clients.

B.The DHCPv6 server is functioning correctly with two active bindings.

C.The DHCPv6 server is not using a pool; addresses are statically assigned.

D.The DHCPv6 server has a DUID conflict.

AnswerB

Both clients have unique bindings and valid lifetimes.

Why this answer

The output shows two DHCPv6 clients with unique link-local addresses and DUIDs, each assigned a distinct IPv6 address from the 2001:DB8:1::/64 prefix. The presence of valid lifetimes and T1/T2 timers indicates the DHCPv6 server is operating normally, maintaining two active bindings. Option B correctly identifies this as proper server behavior.

Exam trap

Cisco often tests the distinction between duplicate addresses and unique addresses in DHCPv6 binding output, where candidates may mistakenly think two different addresses are duplicates because they share the same prefix or IA ID.

How to eliminate wrong answers

Option A is wrong because the addresses 2001:DB8:1::1000 and 2001:DB8:1::1001 are different, not duplicates; duplicate addresses would show the same IPv6 address for both clients. Option C is wrong because the output shows dynamically assigned addresses with lifetimes and timers, which are characteristics of pool-based DHCPv6 assignment, not static configuration. Option D is wrong because each client has a unique DUID (00030001AABBCC010200 vs 00030001AABBCC010300), so there is no DUID conflict.

Full explanation →

843

MCQeasy

A network engineer runs the following command on Router R1: R1# show ipv6 access-list DENY-REMOTE IPv6 access list DENY-REMOTE deny ipv6 2001:DB8:2::/48 any sequence 10 permit ipv6 any any sequence 20 Based on this output, what is the effect of this access list when applied to an interface?

A.It permits all IPv6 traffic

B.It denies all IPv6 traffic from 2001:DB8:2::/48 and permits everything else

C.It permits only IPv6 traffic from 2001:DB8:2::/48

D.It denies all IPv6 traffic

AnswerB

Sequence 10 denies the prefix, sequence 20 permits all other traffic.

Why this answer

The access list DENY-REMOTE explicitly denies IPv6 traffic sourced from the prefix 2001:DB8:2::/48 (sequence 10) and then permits all other IPv6 traffic (sequence 20). When applied to an interface, this results in only traffic from that specific prefix being blocked, while all other IPv6 traffic is allowed. This matches option B.

Exam trap

Cisco often tests the concept that an ACL with an explicit permit any any at the end overrides the implicit deny, so candidates mistakenly think the ACL only denies or only permits based on the first line, ignoring the sequence of entries.

How to eliminate wrong answers

Option A is wrong because the access list does not permit all IPv6 traffic; it specifically denies traffic from 2001:DB8:2::/48. Option C is wrong because the access list denies, not permits, traffic from 2001:DB8:2::/48. Option D is wrong because the access list does not deny all IPv6 traffic; it only denies traffic from the specified prefix and permits everything else.

Full explanation →

844

Multi-Selecthard

Which TWO statements about the operation of DMVPN Phase 2 are true? (Choose TWO.)

Select 2 answers

A.Spoke routers can dynamically establish direct tunnels with each other.

B.The hub router must be configured with the 'ip nhrp redirect' command.

C.The hub router must use a point-to-point GRE tunnel interface.

D.All spoke-to-spoke traffic must traverse the hub router.

E.NHRP is not required for Phase 2 operation.

AnswersA, B

This is a key feature of Phase 2: spokes can build direct tunnels using NHRP redirect/shortcut.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically using NHRP redirect and shortcut routes. The spoke router learns the NBMA address of another spoke via an NHRP redirect from the hub, and then initiates a direct tunnel. Phase 2 uses the 'ip nhrp redirect' command on the hub and 'ip nhrp shortcut' on spokes.

The other statements are incorrect: Phase 2 does not require a multipoint GRE tunnel on the hub (it can be point-to-multipoint), and spoke-to-spoke traffic does not always go through the hub after the shortcut is established.

Full explanation →

845

MCQeasy

A network engineer runs the following command to verify Flexible NetFlow cache entries: R1# show flow monitor FLOW-MONITOR-1 cache format record Cache entry for flow 1: ipv4 source address: 10.0.0.1 ipv4 destination address: 192.168.1.100 ip protocol: 6 counter bytes: 1500 counter packets: 10 timestamp sys-uptime first: 123456 timestamp sys-uptime last: 123556 Cache entry for flow 2: ipv4 source address: 10.0.0.2 ipv4 destination address: 192.168.1.101 ip protocol: 17 counter bytes: 500 counter packets: 5 timestamp sys-uptime first: 123457 timestamp sys-uptime last: 123557 What does this output indicate?

A.Both flows are TCP connections.

B.The cache shows two flows with source/destination IP, protocol, byte/packet counts, and timestamps.

C.The cache does not include protocol information.

D.The flows are being exported immediately.

AnswerB

The output correctly displays all the fields defined in the flow record for both flows.

Why this answer

The output shows two active flows in the Flexible NetFlow cache. Flow 1 is a TCP (protocol 6) flow from 10.0.0.1 to 192.168.1.100 with 1500 bytes and 10 packets. Flow 2 is a UDP (protocol 17) flow from 10.0.0.2 to 192.168.1.101 with 500 bytes and 5 packets.

The timestamps show the first and last packet times.

Full explanation →

846

MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.2.2.0/24 BGP routing table entry for 10.2.2.0/24, version 5 Paths: (1 available, best #1, table default) Not advertised to any peer Refresh Epoch 1 65002 10.1.12.2 from 10.1.12.2 (10.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best rx pathid: 0, tx pathid: 0x0 Based on this output, what is a potential issue with this route?

A.The route has a low local preference of 100.

B.The route is not being advertised to any BGP peer, possibly due to outbound filtering.

C.The next hop 10.1.12.2 is unreachable.

D.The route is not installed in the routing table.

AnswerB

The output explicitly states 'Not advertised to any peer', indicating a filtering or configuration issue preventing advertisement.

Why this answer

The route is valid and best, but it is 'Not advertised to any peer'. This could be due to outbound filtering, such as a route-map, prefix-list, or the neighbor not being configured to receive the route. The route is learned from an eBGP peer but not being propagated.

Full explanation →

847

Multi-Selecthard

Which THREE symptoms indicate a misconfiguration in the MPLS L3VPN control plane between two PEs? (Choose THREE.)

Select 3 answers

A.The command 'show ip bgp vpnv4 vrf CUSTOMER_A' shows no prefixes on the remote PE.

B.The command 'show mpls forwarding-table vrf CUSTOMER_A' shows no labels for remote prefixes.

C.The MP-BGP session between PEs is in the 'Idle' or 'Active' state.

D.Ping from CE1 to CE2 fails, but ping from CE1 to the local PE succeeds.

E.The IGP adjacency between PE and P routers is down.

AnswersA, B, C

Indicates that VPNv4 routes are not being received, a control plane issue.

Why this answer

Common control plane issues include missing VPNv4 prefixes in BGP, lack of MPLS labels for VPN routes, and failure to establish the MP-BGP session. Correct routing table entries on the PE but no labels suggests a label allocation problem. Ping failure from CE to CE could be due to many issues, not specifically control plane.

IGP adjacency down affects the underlay but is not a direct VPN control plane symptom.

Full explanation →

848

MCQmedium

A network engineer runs the following command to troubleshoot an EEM issue: R1# show event manager history applet TRACK-INTERFACE Applet TRACK-INTERFACE: Time Created : Mar 1 00:00:12 2025 Time Last Triggered : Mar 1 00:15:30 2025 Time Last Executed : Mar 1 00:15:30 2025 Trigger Count : 5 Execution Count : 5 Last Event Type : syslog Last Event Detail : OSPF-5-ADJCHG Last Action Executed : show ip route Last Action Result : Success What does this output indicate?

A.The applet 'TRACK-INTERFACE' has been triggered 5 times and executed successfully each time, with the last trigger at 00:15:30.

B.The applet 'TRACK-INTERFACE' has failed to execute 5 times.

C.The applet 'TRACK-INTERFACE' has not been triggered since it was created.

D.The applet 'TRACK-INTERFACE' executed the action 'show ip route' but the output was not captured.

AnswerA

Correct. The trigger count and execution count are both 5, and the last action result is 'Success'.

Why this answer

The output shows the history for a specific EEM applet. It includes creation time, last trigger and execution times, trigger and execution counts, the last event that triggered it, the last action executed, and the result. This helps in determining if the applet is being triggered and executing successfully.

Full explanation →

849

MCQeasy

What is the default behavior of a route-map when a route does not match any match clause in any sequence?

A.The route is permitted by default.

B.The route is denied by default.

C.The route is processed by the last sequence regardless of match.

D.The route is forwarded to the next route-map if one exists.

AnswerB

Correct. If a route does not match any sequence, it is implicitly denied.

Why this answer

A route-map consists of sequences with permit or deny actions. If a route does not match any match clause in any sequence, it is implicitly denied. This is similar to an access-list: there is an implicit deny at the end of the route-map.

Full explanation →

850

MCQhard

A network engineer is troubleshooting an issue where IPv6 hosts are unable to perform Duplicate Address Detection (DAD) successfully. The switch is configured with IPv6 First Hop Security features including ND Inspection and ND Suppress. The engineer notices that Neighbor Solicitation messages for DAD are being dropped by the switch. What is the most likely cause?

A.ND Inspection is configured to drop Neighbor Solicitations with an unspecified source address (::) because it has no binding for that address.

B.RA Guard is configured to drop all multicast traffic, including Neighbor Solicitations.

C.DHCPv6 Guard is blocking the DAD messages because they are considered DHCPv6 traffic.

D.IPv6 Source Guard is dropping the DAD messages because the source address :: is not in the binding table.

AnswerA

Correct because ND Inspection typically requires a valid binding for the source address; DAD uses :: as source, which is not in the binding table, causing drops.

Why this answer

ND Inspection drops Neighbor Solicitations with an unspecified source address (::) because it requires a valid binding for the source address in its binding table. During Duplicate Address Detection (DAD), the source address is :: (RFC 4862), which has no corresponding binding, causing ND Inspection to drop the message and preventing DAD from completing.

Exam trap

Cisco often tests the distinction between ND Inspection and IPv6 Source Guard, where candidates mistakenly think Source Guard drops DAD messages, but it is actually ND Inspection that drops Neighbor Solicitations with an unspecified source address due to missing bindings.

How to eliminate wrong answers

Option B is wrong because RA Guard is designed to block Router Advertisement messages, not multicast traffic like Neighbor Solicitations; it does not affect DAD messages. Option C is wrong because DHCPv6 Guard filters DHCPv6 server messages (e.g., DHCPv6 Advertise/Reply) to prevent rogue DHCP servers, not Neighbor Solicitations used for DAD. Option D is wrong because IPv6 Source Guard checks the source address against the binding table, but DAD uses the unspecified source address (::), which is a legitimate exception; however, ND Inspection specifically drops such messages, not IPv6 Source Guard.

Full explanation →

851

MCQmedium

Consider this configuration on router R2: ``` interface GigabitEthernet0/0 ip access-group RESTRICT_ACCESS in ! ip access-list extended RESTRICT_ACCESS permit ip 10.0.0.0 0.255.255.255 any deny ip any any ``` What traffic will be permitted inbound on GigabitEthernet0/0?

A.Only traffic from source 10.0.0.0/24.

B.All traffic from the 10.0.0.0/8 network.

C.All traffic from any source.

D.Only traffic from source 10.0.0.0/16.

AnswerB

Correct. The wildcard mask 0.255.255.255 matches the 10.0.0.0/8 range.

Why this answer

The access list RESTRICT_ACCESS uses a wildcard mask of 0.255.255.255, which matches the first octet exactly and ignores the remaining three octets. This effectively permits all traffic from the 10.0.0.0/8 network (10.0.0.0 through 10.255.255.255). The explicit deny ip any any at the end blocks all other traffic, so only traffic sourced from the 10.0.0.0/8 range is permitted inbound on GigabitEthernet0/0.

Exam trap

Cisco often tests the distinction between prefix length and wildcard mask, leading candidates to misinterpret 0.255.255.255 as a /24 or /16 mask instead of the correct /8 range.

How to eliminate wrong answers

Option A is wrong because a wildcard mask of 0.255.255.255 matches the entire /8 range, not just the /24 subnet (which would require a wildcard mask of 0.0.0.255). Option C is wrong because the access list ends with a deny ip any any statement, which blocks all traffic not explicitly permitted by earlier entries. Option D is wrong because a /16 prefix would require a wildcard mask of 0.0.255.255, not 0.255.255.255; the given mask matches the full /8 range.

Full explanation →

852

MCQhard

When redistributing OSPF into EIGRP, which EIGRP metric components are used to calculate the default metric?

A.Bandwidth and delay only

B.Bandwidth, delay, reliability, load, and MTU

C.No default metric is assigned; redistribution fails unless a metric is configured.

D.The OSPF cost is converted to an EIGRP metric using a default formula.

AnswerC

EIGRP does not assign a default metric for redistributed routes; if no metric is specified, the route is not redistributed.

Why this answer

EIGRP requires all five K-values (bandwidth, delay, reliability, load, MTU) for metric calculation, but by default, only bandwidth and delay are used; the default metric for redistribution is not automatically derived and must be explicitly set.

Full explanation →

853

MCQmedium

Consider the ERSPAN configuration on a router: monitor session 1 type erspan-source source interface GigabitEthernet0/0/1 both destination erspan-id 1 ip address 192.168.1.100 origin ip address 192.168.1.1 What is the primary purpose of the 'origin ip address' command?

A.It specifies the IP address of the monitoring device.

B.It defines the source IP address used in the ERSPAN GRE encapsulation.

C.It sets the IP address of the interface being monitored.

D.It enables ERSPAN on the specified interface.

AnswerB

This is the correct function of the origin IP address.

Why this answer

The origin IP address is the source IP used in the ERSPAN encapsulated packets, allowing the destination to identify the source of the mirrored traffic.

Full explanation →

854

MCQhard

An engineer configures an IPsec site-to-site VPN between two routers using OSPF as the routing protocol. The OSPF neighbor forms, but routes are not being exchanged. The engineer verifies that the IPsec tunnel is up and that OSPF packets are being encrypted. The OSPF network type on the tunnel interface is set to broadcast. What is the most likely explanation for the missing routes?

A.The OSPF network type broadcast requires a DR/BDR election, but the tunnel is point-to-point, so the DR election fails and routes are not exchanged.

B.The IPsec crypto map is configured to encrypt only unicast traffic, and OSPF hello packets are multicast (224.0.0.5), so they are dropped before encryption.

C.The OSPF hello and dead intervals are mismatched, preventing the neighbor from forming.

D.The IPsec tunnel is using transport mode, which does not support multicast traffic.

AnswerB

If the crypto ACL only permits unicast traffic (e.g., 'permit ip host A host B'), multicast OSPF packets are not matched and are sent in clear text or dropped, depending on the configuration. This is a common edge case where the interesting traffic definition does not include multicast.

Why this answer

OSPF hello packets are sent to the multicast address 224.0.0.5, but IPsec crypto maps by default only encrypt unicast traffic. Since the crypto map does not match multicast packets, OSPF hellos are dropped before encryption, preventing OSPF neighbor adjacency from forming even though the IPsec tunnel is up and other packets are encrypted.

Exam trap

Cisco often tests the misconception that an IPsec tunnel being up guarantees all traffic is encrypted, but the trap here is that OSPF multicast packets are not matched by the default crypto ACL, causing OSPF to fail silently.

How to eliminate wrong answers

Option A is wrong because OSPF network type broadcast on a tunnel interface does not inherently fail; DR/BDR election can occur over a point-to-point tunnel if the network type is set to broadcast, but the real issue is that multicast OSPF hellos are not encrypted. Option C is wrong because the question states that the OSPF neighbor forms, which would not happen if hello/dead intervals were mismatched. Option D is wrong because IPsec transport mode does not inherently block multicast traffic; the limitation is that crypto maps only match unicast traffic, regardless of transport or tunnel mode.

Full explanation →

855

MCQhard

According to RFC 4787 (NAT Behavioral Requirements for UDP), what is the recommended default timeout for UDP NAT mappings?

A.60 seconds

B.300 seconds

C.600 seconds

D.86400 seconds

AnswerB

Correct. RFC 4787 recommends and Cisco IOS defaults to 300 seconds for UDP NAT mappings.

Why this answer

RFC 4787, Section 4.3, specifies that the recommended default timeout for UDP NAT mappings is 300 seconds (5 minutes). This value balances the need to maintain active sessions while promptly releasing stale mappings to conserve NAT table resources. Cisco IOS NAT implementations adhere to this recommendation by default for UDP translations.

Exam trap

The trap here is that candidates often confuse the UDP NAT timeout with the TCP NAT timeout (which defaults to 86400 seconds or 24 hours for established TCP sessions) or assume a shorter value like 60 seconds based on common application timeouts, rather than recalling the specific RFC 4787 recommendation.

How to eliminate wrong answers

Option A is wrong because 60 seconds is too short for typical UDP applications like DNS or VoIP, causing premature timeout and session drops. Option C is wrong because 600 seconds (10 minutes) is not the RFC-recommended default; it may be used for TCP mappings but not for UDP per RFC 4787. Option D is wrong because 86400 seconds (24 hours) is far too long for UDP mappings, leading to NAT table exhaustion and is typically associated with static NAT entries, not dynamic UDP timeouts.

Full explanation →

856

MCQhard

A network engineer is troubleshooting a multi-homed BGP setup. R1 receives the prefix 10.1.1.0/24 from two eBGP peers: R2 (AS 100) and R3 (AS 200). The engineer configures the distance bgp 20 20 20 command on R1 to make all BGP routes have the same AD. However, R1 still prefers the route from R2 over R3. What is the most likely reason?

A.The route from R2 has a lower MED than the route from R3.

B.The route from R2 has a higher local preference than the route from R3.

C.The route from R2 is the oldest BGP route.

D.The AS path for the route from R2 is shorter than that from R3.

AnswerB

Local preference is compared before AS path and MED; if R2's route has a higher local preference (e.g., 150 vs 100), it will be preferred even with equal AD.

Why this answer

The distance bgp command sets AD for eBGP, iBGP, and local routes. With AD equal, the router uses other BGP path attributes, such as local preference, AS path length, or MED. The most common tie-breaker is local preference (default 100) or the oldest route.

Full explanation →

857

Multi-Selecthard

Which TWO statements about EEM applet debugging and verification are correct? (Choose TWO.)

Select 2 answers

A.The command 'show event manager policy available' displays all configured EEM applets on the device.

B.The 'debug event manager action cli' command enables debugging output for CLI actions executed by EEM applets.

C.The 'show event manager history events' command displays a log of recent events that have triggered applets.

D.The 'show event manager policy active' command shows all applets that are currently running or have run recently.

E.The 'show event manager applet' command is not a valid IOS command.

AnswersB, C

Correct. This debug command shows the CLI commands being executed by applet actions.

Why this answer

'show event manager policy available' lists registered Tcl policies, not applets. 'debug event manager action cli' debugs CLI actions. 'show event manager history events' shows recent event occurrences. 'show event manager policy active' shows running policies. 'show event manager applet' is a valid command.

Full explanation →

858

MCQhard

A network engineer is troubleshooting a VRF-Lite setup where two routers are connected via a serial link. Each router has VRF_SALES configured. The engineer configures EIGRP in VRF_SALES. The 'show ip eigrp vrf VRF_SALES neighbors' shows no neighbors. The 'show ip eigrp vrf VRF_SALES interfaces' shows the serial interface is passive. What is the most likely cause?

A.The 'passive-interface default' command is configured under the EIGRP process for VRF_SALES.

B.The 'network' command for the serial interface's subnet is missing.

C.The 'autonomous-system' number is different on the two routers.

D.The 'metric weights' command is misconfigured.

AnswerA

This command makes all interfaces passive by default, and if the serial interface is not explicitly set to no passive, it will remain passive.

Why this answer

If an interface is marked as passive in EIGRP, it will not send or receive hello packets, preventing neighbor formation. This is a common misconfiguration.

Full explanation →

859

MCQhard

What is the default inter-packet interval (in milliseconds) for an IP SLA UDP Jitter operation?

A.10 ms

B.20 ms

C.50 ms

D.100 ms

AnswerB

Correct. The default inter-packet interval is 20 ms.

Why this answer

The default inter-packet interval for UDP Jitter is 20 milliseconds. This is the delay between sending successive packets within a single probe.

Full explanation →

860

MCQhard

What is the default OSPF reference bandwidth used in the metric calculation on Cisco IOS-XE?

A.100 Mbps

B.1000 Mbps

C.10 Mbps

D.10000 Mbps

AnswerA

Correct. The default reference bandwidth is 100 Mbps.

Why this answer

Cisco IOS-XE uses a default reference bandwidth of 100 Mbps for OSPF metric calculation (cost = reference bandwidth / interface bandwidth).

Full explanation →

861

MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After configuration, routing loops occur. Which is the most likely explanation?

A.The administrative distance of the redistributed routes is not modified, causing the redistributed route to be preferred over the original.

B.The seed metric is not configured for EIGRP redistribution.

C.The OSPF process ID is mismatched.

D.The redistribute command is missing the subnets keyword.

AnswerA

Without adjusting the administrative distance (e.g., using 'distance' command on redistributed routes), the redistributed route may have a lower AD than the original, leading to a routing loop.

Why this answer

Mutual redistribution without route tagging or filtering can cause routing loops. When a route redistributed from OSPF into EIGRP is then redistributed back into OSPF, it can be preferred over the original route if the administrative distance is lower, creating a loop. This is a classic edge case that requires careful use of route tags and distribute-lists.

Full explanation →

862

MCQmedium

A network engineer runs the following command on Router R1: R1# show snmp user User name: monitor Engine ID: 800000090300001122334455 storage-type: nonvolatile Authentication Protocol: MD5 Privacy Protocol: DES Group-name: readonly User name: admin Engine ID: 800000090300AABBCCDDEEFF storage-type: nonvolatile Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: admin Based on this output, which statement is correct?

A.The 'monitor' user uses deprecated authentication and privacy protocols.

B.The 'admin' user can only read MIB objects.

C.Both users use the same engine ID.

D.The 'monitor' user cannot authenticate because MD5 is not supported.

AnswerA

MD5 and DES are deprecated in favor of SHA and AES due to security vulnerabilities.

Why this answer

The 'monitor' user is configured with MD5 for authentication and DES for privacy. Both MD5 and DES are considered deprecated in SNMPv3 due to known security vulnerabilities; RFC 3414 defines MD5 as a weaker authentication protocol, and DES (56-bit key) is no longer recommended for encryption. The output confirms these protocols are in use, making option A correct.

Exam trap

Cisco often tests the misconception that any protocol listed in the output is automatically secure, but the trap here is that MD5 and DES are explicitly deprecated in SNMPv3, and candidates may overlook the security implications of these legacy protocols.

How to eliminate wrong answers

Option B is wrong because the 'admin' user belongs to the 'admin' group, which typically implies read-write access (the group name 'admin' suggests full access, not read-only). Option C is wrong because the two users have different engine IDs: 'monitor' uses 800000090300001122334455 and 'admin' uses 800000090300AABBCCDDEEFF. Option D is wrong because MD5 is still supported as an authentication protocol in SNMPv3, though deprecated; the 'monitor' user can authenticate successfully.

Full explanation →

863

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail GigabitEthernet0/0 IP-EIGRP interfaces for process 100 Interface Peers Xmit Queue Mean Pacing Time Multicast Pending Un/Reliable SRTT Un/Reliable Flow Timer Routes Gi0/0 1 0/0 10 0/10 50 0 Hello interval: 5 sec, Hold time: 15 sec Split horizon is enabled Summary address: 10.0.0.0/8 Next xmit serial <none> Un/reliable mcasts: 0/0 Un/reliable ucasts: 0/0 Mcast exceptions: 0 CR packets: 0 ACKs suppressed: 0 Retransmissions: 0 Retry timer: 15 Hello packets sent: 100, received: 99 Based on this output, what is the purpose of the summary address configured on this interface?

A.It filters all routes in the 10.0.0.0/8 range.

B.It advertises a summary route 10.0.0.0/8 to neighbors.

C.It redistributes connected routes.

D.It disables split horizon.

AnswerB

The summary address configuration causes R1 to advertise a summary route 10.0.0.0/8 on this interface.

Why this answer

The 'Summary address: 10.0.0.0/8' line shows that a manual summary route is configured on this interface, which will be advertised to EIGRP neighbors.

Full explanation →

864

MCQhard

A network engineer runs the following command on Router PE6: PE6# show mpls forwarding-table Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 16 Pop Label 10.0.0.1/32 0 Gi0/0 10.1.1.1 17 20 10.0.0.2/32 0 Gi0/1 10.2.2.2 18 Untagged 10.0.0.3/32 0 Gi0/2 10.3.3.3 Based on this output, what is the problem?

A.MPLS is not enabled on interface Gi0/2.

B.The router has run out of local labels.

C.Penultimate Hop Popping is misconfigured.

D.The prefix 10.0.0.3/32 is not reachable.

AnswerA

The 'Untagged' label indicates MPLS is not enabled on the outgoing interface or the next hop is not an MPLS router.

Why this answer

The MPLS forwarding table shows three entries. The third entry for prefix 10.0.0.3/32 has 'Untagged' as the outgoing label. This means the outgoing interface for that prefix does not have MPLS enabled, or the next hop does not support MPLS.

This is a problem because MPLS packets cannot be forwarded with an untagged label.

Full explanation →

865

MCQmedium

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel. The GRE tunnel is up/up, and EIGRP is forming an adjacency over it. However, traffic from the local LAN to the remote LAN is not working. The engineer pings the remote LAN IP from the local router and it succeeds. What is the most likely cause?

A.The local router does not have a route to the remote LAN subnet in its routing table.

B.The crypto map access list does not include the local LAN subnet.

C.The GRE tunnel keepalive is disabled.

D.The IPsec transform set is missing authentication.

AnswerA

Correct because the router can ping the remote LAN using its own IP, but if there is no route for the remote LAN subnet, traffic from LAN hosts will be dropped.

Why this answer

The GRE tunnel and routing protocol are working, but traffic from the LAN is failing. This indicates that the routing table on the local router does not have a route to the remote LAN subnet, or the route points to the wrong next-hop. The ping from the router succeeds because the router uses its own IP as source, which is directly connected to the tunnel.

Full explanation →

866

MCQhard

An engineer configures EIGRP named mode on a router. After a link failure, a route becomes stuck-in-active (SIA). The engineer checks the EIGRP topology and notices that the route has a feasible successor. Which is the most likely explanation?

A.The router received a query from a neighbor and must reply, but the reply is delayed because the feasible successor's route is also being queried.

B.The feasible successor is not used because the route is in passive mode, and the router must wait for the active timer to expire.

C.The named mode EIGRP does not support feasible successors, so the router must always go active.

D.The feasible successor's metric is higher than the successor's, so it is not considered as a backup.

AnswerA

Even with a feasible successor, the router must reply to queries from neighbors. If the reply is delayed (e.g., due to a unidirectional link), the local router may become SIA.

Why this answer

In EIGRP, if a route has a feasible successor, the router will immediately use it without going active. However, if the feasible successor's route is also invalidated (e.g., due to a metric change) or if the query process is triggered by a neighbor that does not have a feasible successor, the router may still go active. A common corner case is when the feasible successor is not used because the route is in a 'stuck-in-active' state due to a query from a neighbor that did not receive a reply, even though the local router has a feasible successor.

This can happen if the router receives a query from a neighbor and must reply, but the reply is delayed.

Full explanation →

867

MCQmedium

Consider the following partial configuration: ip access-list extended SECURE_ACCESS permit icmp any any echo permit icmp any any echo-reply permit tcp any host 192.168.1.1 eq 22 permit tcp any host 192.168.1.1 eq 443 deny ip any any ! interface GigabitEthernet0/0 ip access-group SECURE_ACCESS in ! interface GigabitEthernet0/1 ip access-group SECURE_ACCESS out What is a potential issue with this ACL placement?

A.The ACL may block traffic that needs to pass between the two interfaces because it is applied in both directions.

B.The ACL is missing a 'permit ip any any' statement, so all traffic is denied.

C.The ACL should be applied only inbound on both interfaces.

D.The ACL permits ICMP echo and echo-reply, which could allow ping floods.

AnswerA

Traffic from Gi0/0 to Gi0/1 is filtered inbound on Gi0/0 and outbound on Gi0/1, potentially blocking non-matching traffic.

Why this answer

The ACL SECURE_ACCESS is applied inbound on GigabitEthernet0/0 and outbound on GigabitEthernet0/1. This means traffic entering G0/0 is filtered by the ACL, and traffic exiting G0/1 is also filtered by the same ACL. Since the ACL denies all IP traffic by default (via the 'deny ip any any' at the end), any packet that must traverse from G0/0 to G0/1 will be checked twice: once inbound on G0/0 and again outbound on G0/1.

If the packet matches a permit statement on the inbound check, it may still be denied on the outbound check if the source/destination or protocol does not match the permit entries from the perspective of the outbound interface. In this configuration, the ACL permits only ICMP echo/echo-reply and TCP to 192.168.1.1 on ports 22 and 443; all other traffic is denied. Therefore, legitimate traffic between the two interfaces that does not match these specific permits will be blocked, potentially disrupting connectivity.

Exam trap

Cisco often tests the concept that applying an ACL in both directions (inbound on one interface and outbound on another) can cause unintended filtering of traffic that must pass through the router, leading candidates to overlook the fact that the ACL is evaluated twice and that the permit entries may not cover all necessary flows.

How to eliminate wrong answers

Option B is wrong because the ACL already ends with 'deny ip any any', which is an explicit deny-all; adding 'permit ip any any' would defeat the purpose of the ACL by allowing all traffic, and the issue is not about missing a permit-all but about the ACL being applied in both directions causing double filtering. Option C is wrong because applying the ACL inbound on both interfaces would still filter traffic entering each interface, but it would not solve the problem of traffic being filtered twice when crossing from one interface to the other; the issue is the dual-direction application, not the direction of application. Option D is wrong because while permitting ICMP echo and echo-reply could theoretically allow ping floods, that is not the primary issue described in the question; the question asks about a potential issue with the ACL placement, and the correct answer focuses on the blocking of traffic due to bidirectional application, not the security risk of ICMP.

Full explanation →

868

MCQhard

An enterprise uses EIGRP for IPv6 with route summarization. Router R1 has a summary route 2001:db8:1::/48 via Null0 redistributed into EIGRP. Router R2 receives this summary and has a more specific route 2001:db8:1:1::/64 learned via a different interface. R2's IPv6 uRPF is configured in strict mode on the interface facing R1. Traffic from a host behind R2 destined to 2001:db8:1:2::1 is being dropped. R2 shows 'ipv6 cef' indicates the summary route points to R1, but uRPF checks fail. What is the root cause?

A.The summary route 2001:db8:1::/48 on R1 causes R2 to have a less specific route pointing to R1, making uRPF think the source address is not reachable via the incoming interface.

B.R2's uRPF is configured in loose mode, which requires a matching route in the FIB, but the summary route is not installed.

C.EIGRP redistribution of the summary route creates a routing loop, causing uRPF to fail.

D.The host behind R2 has an incorrect source address, causing uRPF to drop all traffic.

AnswerA

uRPF strict mode requires the source address to be reachable via the same interface. The summary route points to R1, but the source is directly connected, causing a mismatch.

Why this answer

R2's strict mode uRPF checks that the source address of incoming traffic is reachable via the exact interface on which the packet arrived. When R2 receives a packet from a host behind it destined to 2001:db8:1:2::1, the source address is from the host's subnet (e.g., 2001:db8:1:2::/64). R2's FIB has a less specific summary route 2001:db8:1::/48 pointing to R1 (via the interface facing R1), but the more specific /64 route is learned via a different interface.

Strict uRPF requires a matching route in the FIB that points back out the same interface the packet arrived on; since the summary route points to R1's interface, uRPF fails, dropping the traffic.

Exam trap

Cisco often tests the distinction between strict and loose uRPF modes, and the trap here is that candidates overlook how a less specific summary route can satisfy the FIB lookup but still fail strict mode's interface check, leading them to incorrectly blame routing loops or source address issues.

How to eliminate wrong answers

Option B is wrong because loose mode uRPF only requires a matching route in the FIB, not necessarily via the same interface; the question states strict mode is configured, so loose mode is irrelevant. Option C is wrong because EIGRP redistribution of a Null0 summary route does not inherently create a routing loop; the summary route is a legitimate way to prevent loops, and the issue is uRPF, not a loop. Option D is wrong because the host behind R2 has a correct source address (presumably within the 2001:db8:1:2::/64 subnet), and the problem is uRPF failing due to the summary route, not an incorrect source address.

Full explanation →

869

MCQhard

A network engineer is troubleshooting a route redistribution issue between EIGRP and BGP. Router R1 runs both EIGRP and BGP, and redistributes EIGRP routes into BGP. The engineer notices that some EIGRP routes are not appearing in the BGP table on R1. The show ip bgp command does not list these prefixes. The redistribute eigrp command is configured under BGP. What is the most likely cause?

A.The redistribute eigrp command under BGP is missing the subnets keyword.

B.The EIGRP routes are not present in the IP routing table on R1.

C.BGP has a higher administrative distance than EIGRP.

D.The EIGRP process on R1 has a route filter blocking these routes.

AnswerB

Correct: BGP only redistributes routes that are in the routing table; if they are missing, redistribution fails.

Why this answer

When redistributing into BGP, by default only classful networks are redistributed unless the subnets keyword is used. Additionally, BGP does not redistribute routes that are not in the routing table. However, a common cause is that the EIGRP routes are not in the global routing table due to administrative distance or other reasons.

Full explanation →

870

MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on the ingress interface of a PE router in an MPLS L3VPN. The router is receiving VPN traffic from a customer edge (CE) router. The engineer notices that some legitimate traffic is being dropped by uRPF. The engineer verifies that the CE router has a route back to the source address in its routing table. What is the most likely explanation?

A.Asymmetric routing is causing the return path to use a different interface, violating the strict uRPF check.

B.The uRPF 'allow-default' option is not configured, so default routes are not considered.

C.The CE router is not advertising the source network to the PE via BGP.

D.The uRPF mode is set to 'loose' instead of 'strict', causing all traffic to be dropped.

AnswerA

Correct. uRPF strict mode requires that the return path uses the same interface; asymmetric routing causes legitimate traffic to be dropped.

Why this answer

uRPF strict mode checks that the source address of an incoming packet has a route in the routing table that points back to the same interface on which the packet was received. If there is asymmetric routing (i.e., the return path takes a different interface), uRPF strict mode will drop the packet. In an MPLS L3VPN, traffic from the CE to the PE may take one path, but return traffic from the PE to the CE may take a different path (e.g., due to load balancing or different routing policies).

This is a common edge case. The solution is to use uRPF loose mode or to ensure symmetric routing.

Full explanation →

871

MCQeasy

Which syslog severity level is used for informational messages that are not errors but may be useful for monitoring?

A.Severity 5 (Notice)

B.Severity 6 (Informational)

C.Severity 7 (Debug)

D.Severity 0 (Emergency)

AnswerB

Severity 6 is 'Informational' and is used for normal but significant conditions.

Why this answer

Severity 6 is defined as 'Informational' in RFC 5424, used for non-error messages.

Full explanation →

872

Multi-Selecthard

Which TWO statements about EEM applet actions and their behavior are correct? (Choose TWO.)

Select 2 answers

A.The 'action cli command' can execute any EXEC mode command, including 'show' commands and 'ping'.

B.The 'action syslog' command sends a syslog message with a default facility of local7 and severity of informational.

C.The 'action snmp-trap' command can send an SNMP trap without any additional configuration if the device has an SNMP community set.

D.The 'action mail' command can be used to send an email notification from an EEM applet.

E.The 'action cli command' can be used to enter global configuration mode and execute configuration commands directly.

AnswersA, B

Correct. 'action cli command' can execute any valid EXEC command.

Why this answer

'action cli command' can run any exec command. 'action syslog' sends a syslog message with facility local7 by default. 'action snmp-trap' requires an SNMP community. 'action mail' is not supported in EEM. 'action cli command' cannot run config commands directly without entering config mode.

Full explanation →

873

MCQmedium

A network engineer is troubleshooting a scenario where a router is dropping IPv6 packets that are destined for a server on a directly connected network. The engineer checks the interface and finds that uRPF is enabled in loose mode. The router has a default route pointing to an upstream router. The source address of the packets is 2001:db8:100::1, which is not in the routing table (the router has no route to that prefix). What is the most likely cause of the packet drops?

A.The uRPF loose mode check fails because there is no route to the source address in the routing table.

B.The uRPF loose mode check fails because the source address is not reachable via the same interface.

C.The router has an ACL that blocks traffic from that source.

D.The uRPF mode should be strict mode to allow the traffic.

AnswerA

Correct because loose mode requires at least one route to the source address in the FIB; if no route exists, the packet is dropped.

Why this answer

With uRPF loose mode enabled, the router checks whether a route to the source address exists in the routing table, but it does not verify that the incoming interface matches the reverse path. Since the source address 2001:db8:100::1 is not present in the routing table, the loose mode check fails and the packets are dropped. The presence of a default route does not help because uRPF requires an exact match for the source prefix, not a default route.

Exam trap

Cisco often tests the misconception that a default route satisfies uRPF loose mode, but in reality, uRPF requires a route to the specific source prefix, not a default route.

How to eliminate wrong answers

Option B is wrong because loose mode does not check that the source address is reachable via the same interface; that behavior is specific to strict mode. Option C is wrong because the question provides no evidence of an ACL, and the described behavior is consistent with uRPF dropping packets, not an ACL. Option D is wrong because strict mode would impose an additional interface check and would also fail if there is no route to the source; the issue here is the missing route, not the mode.

Full explanation →

874

MCQeasy

A network engineer runs the following command on Router R1: R1# show ip route ospf Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set 10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks O 10.1.1.0/24 [110/20] via 192.168.1.2, 00:15:30, GigabitEthernet0/0 O 10.2.2.0/24 [110/30] via 192.168.1.2, 00:15:30, GigabitEthernet0/0 Based on this output, which statement is correct?

A.The router has a default route via OSPF.

B.The router has two OSPF routes to different subnets.

C.The OSPF neighbor is down.

D.The metric for 10.2.2.0/24 is 20.

AnswerB

Two OSPF routes are listed: 10.1.1.0/24 and 10.2.2.0/24.

Why this answer

The output shows two OSPF routes via the same next hop. The administrative distance is 110 (default for OSPF), and the metrics are 20 and 30. No problems are indicated; the routes are present and valid.

Full explanation →

875

MCQeasy

A network engineer runs the following command on Router R1: R1# show ip interface GigabitEthernet0/1 GigabitEthernet0/1 is up, line protocol is up Internet address is 10.1.1.1/24 Broadcast address is 255.255.255.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is 101 Inbound access list is not set Based on this output, which statement is correct?

A.ACL 101 filters traffic entering the interface.

B.ACL 101 filters traffic leaving the interface.

C.The interface has no ACL applied.

D.ACL 101 is applied in both directions.

AnswerB

The output shows 'Outgoing access list is 101', so traffic exiting is filtered.

Why this answer

The command output shows 'Outgoing access list is 101', which indicates that ACL 101 is applied to filter traffic leaving the GigabitEthernet0/1 interface. This is confirmed by the absence of an 'Inbound access list' entry, meaning no ACL is applied to incoming traffic. Therefore, ACL 101 filters traffic leaving the interface.

Exam trap

Cisco often tests the distinction between inbound and outbound ACL application by showing only one direction in the output, leading candidates to assume no ACL is applied or that it applies to both directions.

How to eliminate wrong answers

Option A is wrong because the output shows 'Inbound access list is not set', meaning ACL 101 is not applied to incoming traffic; it is applied to outgoing traffic. Option C is wrong because the output explicitly shows 'Outgoing access list is 101', indicating an ACL is applied. Option D is wrong because the output shows ACL 101 is only applied to outgoing traffic, not inbound, so it is not applied in both directions.

Full explanation →

876

MCQmedium

A network engineer runs the following command to troubleshoot an EEM issue: R1# show event manager policy registered No. Class Type Version Time Created Name 1 applet system 1.0 Mar 1 00:00:12 2025 TRACK-INTERFACE 2 applet system 1.0 Mar 1 00:00:15 2025 BGP-RESET 3 applet user 1.0 Mar 1 00:02:30 2025 LOG-ERROR What does this output indicate?

A.Three EEM applets are registered, including two system-defined and one user-defined.

B.Three EEM applets are registered, all user-defined.

C.Three EEM applets are registered, all system-defined.

D.The output shows the EEM applets that are currently executing.

AnswerA

Correct. The output shows two applets with class 'system' (TRACK-INTERFACE and BGP-RESET) and one with class 'user' (LOG-ERROR).

Why this answer

The output shows three registered EEM applets. The 'Class' column indicates whether the applet is system-defined or user-defined. 'Type' is always 'applet' for EEM applets. 'Time Created' shows when the applet was registered. The 'Name' is the applet name.

This output confirms that the applets are registered and available for execution.

Full explanation →

877

MCQhard

A network engineer runs the following command on Router PE4: PE4# show bgp vpnv4 unicast all summary BGP router identifier 10.0.0.4, local AS number 65001 BGP table version is 25, main routing table version 25 5 network prefixes using 640 bytes of memory 5 path entries using 400 bytes of memory 3/3 BGP path/bestpath attribute entries using 360 bytes of memory 1 BGP AS-PATH entries using 24 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 1424 total bytes of memory BGP activity 15/10 prefixes, 20/15 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.0.0.5 4 65001 1020 1015 25 0 0 00:12:34 5 10.0.0.6 4 65002 500 495 25 0 0 00:06:20 0 Based on this output, what is the problem?

A.Neighbor 10.0.0.5 is not exchanging prefixes.

B.Neighbor 10.0.0.6 is not sending any prefixes.

C.Both neighbors are in the Idle state.

D.The BGP table is empty.

AnswerB

The 'State/PfxRcd' column shows 0 for 10.0.0.6, indicating no prefixes received.

Why this answer

The BGP summary shows two neighbors: 10.0.0.5 (AS 65001) with 5 prefixes received, and 10.0.0.6 (AS 65002) with 0 prefixes received. The neighbor 10.0.0.6 has been up for 6 minutes but has not sent any prefixes. This indicates a problem with prefix advertisement from that neighbor.

Full explanation →

878

Multi-Selecthard

Which THREE commands can be used to verify the MPLS label assigned to a specific prefix in a VRF on a PE router? (Choose THREE.)

Select 3 answers

A.show ip bgp vpnv4 vrf CUSTOMER 10.1.1.0/24

B.show ip route vrf CUSTOMER 10.1.1.0/24

C.show mpls forwarding-table vrf CUSTOMER 10.1.1.0/24

D.show ip cef vrf CUSTOMER 10.1.1.0/24 detail

E.show mpls ldp bindings prefix 10.1.1.0/24

AnswersA, C, D

Correct. This command displays the BGP table entry for the prefix, including the MPLS label.

Why this answer

To check the MPLS label for a VRF prefix, an engineer can use 'show ip bgp vpnv4 vrf <name> <prefix>' to see the BGP label, 'show mpls forwarding-table vrf <name> <prefix>' to see the label used in forwarding, and 'show ip cef vrf <name> <prefix> detail' to see the label in the CEF entry. 'show ip route vrf' does not show MPLS labels. 'show mpls ldp bindings' shows local and remote label bindings, but not specifically for a VRF prefix without additional filtering.

Full explanation →

879

MCQhard

A network engineer runs the following command to troubleshoot SNMP statistics: R1# show snmp statistics 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 0 Number of requested variables 0 Number of altered variables 0 Get-request PDUs 0 Get-next PDUs 0 Set-request PDUs 0 Input queue drops 0 SNMP packets output 0 Too big errors 0 No such name errors 0 Bad values errors 0 General errors 0 Get-response PDUs 0 SNMP trap PDUs What does this output indicate?

A.No SNMP traffic has been processed, which may indicate a configuration or connectivity issue.

B.SNMP is working correctly with many successful requests.

C.The router is sending many SNMP traps.

D.There are errors due to bad community names.

AnswerA

All counters at zero suggest no SNMP communication has occurred.

Why this answer

The output shows all counters at zero, including SNMP packets input and output, which means the router has not processed any SNMP traffic. This typically indicates that SNMP is either not configured, the community strings are mismatched, or there is a network connectivity issue preventing SNMP messages from reaching the router. A correctly functioning SNMP agent would show non-zero counters for received requests or sent responses.

Exam trap

Cisco often tests the misconception that zero error counters mean SNMP is working fine, when in fact zero counters for all input/output packets indicate no SNMP communication at all, not a healthy state.

How to eliminate wrong answers

Option B is wrong because the output shows zero packets input and output, not many successful requests; successful SNMP operations would increment counters like Get-request PDUs and Get-response PDUs. Option C is wrong because the output shows zero SNMP trap PDUs, indicating no traps are being sent, not many. Option D is wrong because the output shows zero Unknown community name errors, which means no requests with bad community names have been received; errors from bad community names would increment that specific counter.

Full explanation →

880

Multi-Selecthard

Which TWO configuration steps are required to enable IPsec site-to-site VPN with IKEv2 on a Cisco router? (Choose TWO.)

Select 2 answers

A.Configure an IKEv2 keyring with the pre-shared key.

B.Configure an IKEv2 proposal specifying encryption and integrity algorithms.

C.Configure a crypto isakmp policy for phase 1.

D.Configure an IKEv2 profile and bind it to the crypto map.

E.Configure the 'crypto ipsec transform-set' command.

AnswersA, B

The keyring stores the pre-shared key used for authentication in IKEv2.

Why this answer

An IKEv2 keyring stores the pre-shared key (PSK) used for authenticating the remote peer during IKEv2 SA establishment. Without a keyring, the router has no local credential to present or verify against the peer. Option B is correct because an IKEv2 proposal defines the mandatory encryption (e.g., AES-256) and integrity (e.g., SHA-256) algorithms that both peers must agree on for the IKEv2 Phase 1 (IKE SA) negotiation.

Exam trap

Cisco often tests the distinction between IKEv1 and IKEv2 commands, so the trap here is that candidates mistakenly select 'crypto isakmp policy' (IKEv1) instead of the IKEv2-specific 'crypto ikev2 proposal' and 'crypto ikev2 keyring' commands.

Full explanation →

881

MCQmedium

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

A.The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.

B.IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.

C.RA Guard is blocking Neighbor Advertisements between hosts.

D.DHCPv6 Guard is blocking DHCPv6 messages between hosts.

AnswerA

Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.

Why this answer

Private VLAN (PVLAN) on VLAN 20 isolates ports within the same VLAN, preventing direct communication between hosts on isolated ports. Even though the hosts share the same VLAN, PVLAN restricts traffic so that isolated ports can only communicate with a promiscuous port (e.g., a router uplink), not with each other. This directly explains why IPv6 hosts on VLAN 20 cannot ping each other.

Exam trap

Cisco often tests the misconception that IPv6 Source Guard or RA Guard blocks all inter-host traffic, when in fact Private VLAN is the feature specifically designed to isolate hosts within the same VLAN at Layer 2.

How to eliminate wrong answers

Option B is wrong because IPv6 Source Guard filters traffic based on the source IPv6 address and MAC address binding table, but it does not block inter-host traffic within the same VLAN if the bindings are valid; it prevents spoofing, not peer-to-peer communication. Option C is wrong because RA Guard blocks Router Advertisements from unauthorized sources, not Neighbor Advertisements (which are used for ND and DAD) between hosts. Option D is wrong because DHCPv6 Guard blocks unauthorized DHCPv6 server messages, not client-to-client communication; hosts do not exchange DHCPv6 messages directly.

Full explanation →

882

MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto ipsec sa interface: Tunnel0 Crypto map tag: VPN-MAP, local addr 10.1.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0 Based on this output, what is the problem?

A.The IPsec SA is not established; phase 1 is still pending.

B.The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.

C.The remote peer is unreachable; the SA is in a dead state.

D.The tunnel interface is down; the SA cannot be used.

AnswerB

Zero packet counts indicate no traffic has been encapsulated; check the crypto ACL and routing.

Why this answer

The IPsec SA is present but the packet counters are all zero. This indicates that the tunnel is established but no interesting traffic is being sent through it. The likely cause is that the crypto ACL does not match the actual traffic or routing is not directing traffic into the tunnel.

Full explanation →

883

MCQmedium

What is the default hello interval for the Label Distribution Protocol (LDP) on a Cisco IOS-XE router?

A.5 seconds

B.10 seconds

C.15 seconds

D.3 seconds

AnswerA

The default LDP hello interval is 5 seconds.

Why this answer

LDP hello messages are sent every 5 seconds by default on Cisco IOS-XE routers to discover and maintain adjacencies.

Full explanation →

884

MCQmedium

What is the default value of the Router Advertisement (RA) interval in IPv6 First Hop Security (FHS) when using the 'ipv6 nd ra-interval' command on an IOS-XE interface?

A.100 seconds

B.200 seconds

C.600 seconds

D.300 seconds

AnswerB

Correct. The default RA interval on Cisco IOS-XE is 200 seconds.

Why this answer

The default Router Advertisement (RA) interval in IPv6 First Hop Security (FHS) when using the 'ipv6 nd ra-interval' command on an IOS-XE interface is 200 seconds. This value is defined by RFC 4861, which specifies that the default RA interval should be between 30 and 1800 seconds, with Cisco implementing a default of 200 seconds for FHS to balance responsiveness and network overhead.

Exam trap

Cisco often tests the distinction between the default RA interval for standard IPv6 ND (600 seconds) and the default for FHS (200 seconds), trapping candidates who assume the standard value applies to FHS configurations.

How to eliminate wrong answers

Option A is wrong because 100 seconds is not the default RA interval for FHS; it is a common misconception that RA intervals are shorter, but Cisco defaults to 200 seconds for FHS. Option C is wrong because 600 seconds is the default RA interval for standard IPv6 Neighbor Discovery (without FHS), not for FHS where the interval is reduced to 200 seconds to improve security responsiveness. Option D is wrong because 300 seconds is the default RA interval for some other IPv6 implementations (e.g., Linux), but Cisco IOS-XE uses 200 seconds for FHS.

Full explanation →

885

MCQhard

R1 and R2 are IS-IS neighbors with BFD enabled. R1#show clns is-neighbors shows R2 as 'Up'. R1#show bfd neighbors shows the session as 'Down'. R2#show bfd neighbors shows the session as 'Up' with R1. R1 has 'bfd interval 50 min_rx 50 multiplier 3' on the interface. R2 has 'bfd interval 100 min_rx 100 multiplier 3'. The link is stable. What is the root cause?

A.R1 has an ACL blocking UDP port 3784 from R2.

B.IS-IS requires 'bfd all-interfaces' to work with BFD.

C.The BFD multiplier on R1 is too low.

D.The IS-IS metric must be set to 1 for BFD.

AnswerA

BFD uses UDP port 3784; if R1 blocks incoming BFD packets, the session appears down on R1 but up on R2 because R2 receives R1's packets.

Why this answer

IS-IS BFD requires that the BFD session be established between the same IP addresses used for IS-IS. If R1's BFD session is down but R2's is up, it indicates a unidirectional issue. This can be due to an MTU mismatch where R1's BFD packets are fragmented and dropped, or a firewall blocking inbound BFD packets on R1.

Here, the most likely cause is that R1 has an ACL denying UDP port 3784 from R2.

Full explanation →

886

Multi-Selecthard

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

Select 3 answers

A.PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.

B.The NAT translation table for PAT includes the inside global IP and port, and the outside global IP and port.

C.The command 'ip nat inside source list 1 interface GigabitEthernet0/0 overload' enables PAT using the interface IP.

D.The 'ip nat inside source static' command automatically enables PAT when multiple inside hosts are configured.

E.The 'ip nat pool' command is required for all PAT configurations.

AnswersA, B, C

Correct. PAT multiplexes many inside addresses to one outside address by differentiating TCP/UDP ports.

Why this answer

PAT (Port Address Translation) extends NAT by using unique source port numbers to multiplex multiple inside hosts over a single public IP address. This allows many internal devices to share one external IP, with the router tracking each session by the combination of inside global IP and port.

Exam trap

Cisco often tests the distinction between static NAT and PAT, where candidates mistakenly think 'ip nat inside source static' can automatically perform PAT, but it only creates a fixed one-to-one mapping without port multiplexing.

Full explanation →

887

MCQeasy

Which statement is true about the implicit deny any at the end of an IPv4 ACL?

A.It can be overridden by adding a permit any at the end.

B.It is invisible and applies only to TCP traffic.

C.It is always present and cannot be removed or overridden.

D.It denies all traffic not explicitly permitted and is always present.

AnswerD

The implicit deny any is a fundamental property of Cisco ACLs.

Why this answer

Every IPv4 ACL has an implicit deny any statement at the end that denies all traffic not explicitly permitted by earlier entries. This implicit rule is always present and cannot be removed, ensuring that only traffic matching a permit entry is allowed through the ACL.

Exam trap

Cisco often tests the misconception that the implicit deny any can be removed or that it only applies to specific protocols, when in fact it is a permanent, protocol-agnostic rule that denies all unmatched traffic.

How to eliminate wrong answers

Option A is wrong because the implicit deny any cannot be overridden; adding a permit any at the end explicitly permits all traffic, effectively negating the implicit deny, but the implicit rule itself remains in the ACL logic. Option B is wrong because the implicit deny any applies to all IP traffic, not just TCP; it covers UDP, ICMP, and any other IP protocol. Option C is wrong because while the implicit deny any is always present and cannot be removed, it can be overridden by a permit any statement placed before it in the ACL; the statement 'cannot be overridden' is incorrect.

Full explanation →

888

MCQeasy

What is the default hello interval for OSPFv3 on a broadcast network type in Cisco IOS-XE?

A.10 seconds

B.30 seconds

C.40 seconds

D.5 seconds

AnswerA

Default hello interval for OSPFv3 on broadcast networks is 10 seconds.

Why this answer

OSPFv3 uses the same default hello interval as OSPFv2 for broadcast and point-to-point network types, which is 10 seconds. This is defined in RFC 5340 and is the default on Cisco IOS-XE for OSPFv3 on broadcast networks.

Exam trap

Cisco often tests the default hello interval for OSPFv3 by making candidates confuse it with OSPFv2 defaults or with the dead interval; the trap here is assuming OSPFv3 uses a different default than OSPFv2 for broadcast networks, when in fact both use 10 seconds.

How to eliminate wrong answers

Option B (30 seconds) is wrong because 30 seconds is the default hello interval for OSPFv3 on non-broadcast multi-access (NBMA) networks, not broadcast. Option C (40 seconds) is wrong because 40 seconds is the default dead interval (4 times the hello interval) for broadcast networks, not the hello interval itself. Option D (5 seconds) is wrong because 5 seconds is not a default OSPFv3 hello interval; it is sometimes used in OSPFv2 for faster convergence on certain interface types but is not the default for OSPFv3 broadcast.

Full explanation →

889

MCQhard

An engineer enables uRPF (strict mode) on an interface facing the Internet. Legitimate traffic from a customer network is being dropped. The customer network uses asymmetric routing where return traffic takes a different path. Which is the most likely explanation?

A.The uRPF strict mode requires that the source IP's best path is out the same interface; asymmetric routing violates this.

B.The uRPF loose mode should be used instead, as it only requires a route to the source IP in the FIB.

C.The customer network is using private IP addresses that are not routable.

D.The uRPF allow-default option is missing, which is required for default routes.

AnswerA

Strict mode drops packets if the reverse path does not match the incoming interface, which occurs with asymmetric routing.

Why this answer

Strict uRPF checks that the source IP of incoming packets has a route in the FIB pointing back to the same interface. With asymmetric routing, the return path may use a different interface, causing the check to fail and the packet to be dropped.

Full explanation →

890

MCQhard

R1 and R2 are connected via an IPsec VPN tunnel. R1 has a static route to 10.10.10.0/24 pointing to the tunnel interface. R2 has a static route to 192.168.1.0/24 pointing to the tunnel interface. Both routers have BGP configured between loopback addresses over the tunnel. BGP peering is established, but R1 cannot ping 10.10.10.1 (R2's loopback) from its loopback. R1's show ip bgp shows the route as valid but not best. What is the root cause?

A.The static route to 10.10.10.0/24 via tunnel causes recursive routing failure because the tunnel destination is not reachable.

B.BGP next-hop-self is not configured on R2.

C.The IPsec tunnel is not encrypting BGP traffic.

D.The BGP network statement for 10.10.10.0/24 is missing on R2.

AnswerA

The static route references the tunnel interface, but the tunnel's destination IP must be reachable via another route. If not, the route is invalid, and BGP cannot use the next-hop.

Why this answer

R1's static route to 10.10.10.0/24 points to the tunnel interface, but the tunnel destination (the remote peer's public IP) is not reachable via a valid routing path. This creates a recursive routing failure: the router tries to resolve the tunnel interface's next-hop (the tunnel destination) but cannot find a route to it, causing the BGP route to be marked as valid but not best. Without a reachable tunnel destination, the IPsec VPN cannot forward traffic, so pings from R1's loopback to 10.10.10.1 fail.

Exam trap

Cisco often tests the concept of recursive routing failure in IPsec VPN scenarios, where candidates mistakenly focus on BGP configuration issues (like next-hop-self or network statements) instead of recognizing that the tunnel destination must be reachable independently of the tunnel itself.

How to eliminate wrong answers

Option B is wrong because next-hop-self on R2 would change the next-hop of BGP routes advertised to R1 to R2's own IP, but the issue here is that the BGP route is valid but not best due to recursive routing failure, not because of next-hop reachability. Option C is wrong because the IPsec tunnel not encrypting BGP traffic would not cause the BGP route to be valid but not best; it might cause a peering issue or packet drop, but the route would still be considered best if reachable. Option D is wrong because the BGP network statement for 10.10.10.0/24 on R2 is not required for R1 to learn the route via BGP; R2 can advertise the route via network or redistribution, and the problem is on R1's side with recursive routing, not on R2's advertisement.

Full explanation →

891

MCQmedium

A network engineer runs the following command to troubleshoot BFD with BGP: R1# show bgp ipv4 unicast 10.3.3.0/24 BGP routing table entry for 10.3.3.0/24, version 2 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.1.1.2 from 10.1.1.2 (2.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best rx pathid: 0, tx pathid: 0x0 BFD enabled, BFD state: UP What does this output indicate?

A.BGP is using BFD with state UP, enabling sub-second failure detection for this prefix.

B.BFD is disabled for this BGP neighbor.

C.BFD state is DOWN, so BGP uses its own timers.

D.BGP is using BFD only for IPv6 prefixes.

AnswerA

BFD is enabled and UP, allowing BGP to detect failures faster than BGP keepalive/hold timers.

Why this answer

The output shows that BFD is enabled for the BGP session and the BFD state is UP, indicating fast failure detection for the BGP neighbor.

Full explanation →

892

MCQhard

What is the default behavior of PBR when a 'set ip next-hop' is configured with an IP address that is not directly connected?

A.The router performs a recursive lookup to find the next-hop.

B.The packet is forwarded using the routing table.

C.The packet is dropped.

D.The router sends an ICMP redirect.

AnswerC

PBR requires the next-hop to be directly connected by default; otherwise, the packet is dropped.

Why this answer

By default, PBR requires the next-hop to be directly connected. If it is not directly connected, the packet is dropped unless 'set ip next-hop verify-availability' is used or the next-hop is reachable via a recursive lookup (which requires additional configuration).

Full explanation →

893

MCQmedium

A network engineer is troubleshooting an OSPFv2 route flapping issue. The router R1 is learning a route to 192.168.1.0/24 via two different paths: one through R2 and one through R3. The route is flapping between the two paths every few seconds. 'show ip ospf interface' shows that both interfaces are stable. What is the most likely cause?

A.The routers R2 and R3 have the same OSPF router ID.

B.The route is being redistributed by both R2 and R3 with different metrics.

C.The OSPF network type on the interfaces is set to broadcast, causing DR/BDR instability.

D.The link between R1 and R2 has a high error rate causing intermittent packet loss.

AnswerA

Duplicate router IDs can cause OSPF to see the same route from two different neighbors as different, leading to route flapping.

Why this answer

Route flapping can be caused by a number of issues, but if the interfaces are stable, the problem is likely due to a routing loop or a metric issue. One common cause is that the routers are using the same router ID, causing OSPF to see the same route from two different neighbors as equal-cost paths, but the route may be flapping due to a change in the metric. Another cause is that the link between R1 and R2 is flapping at Layer 1, but the stem says the interfaces are stable.

The most likely cause is that the routers have duplicate router IDs, which can cause OSPF to treat the same route as two different routes and cause instability.

Full explanation →

894

MCQhard

A network engineer runs the following command on Router R1: R1# show ip nhrp 192.168.1.0/24 via 172.16.0.2 Tunnel0 created 00:00:15, expire 00:01:45 Type: dynamic, Flags: unique NBMA address: 10.1.1.2 192.168.2.0/24 via 172.16.0.3 Tunnel0 created 00:00:10, expire 00:01:50 Type: dynamic, Flags: unique NBMA address: 10.1.1.3 Based on this output, what is the problem?

A.The NHRP holdtime is too short, causing frequent re-registrations.

B.The NHRP entries are static and will not expire.

C.The tunnel interface is down.

D.The NBMA addresses are incorrect.

AnswerA

Expire time of 2 minutes indicates a holdtime of 120 seconds, which is low.

Why this answer

The output shows NHRP cache entries for remote networks. The expire time is decreasing, indicating these are dynamic entries learned via NHRP. The problem is that the NHRP holdtime is set to 2 minutes (120 seconds), as seen from the expire time starting at 2 minutes.

This is a short holdtime that may cause frequent re-registrations.

Full explanation →

895

Multi-Selectmedium

Which TWO commands can be used to verify route summarization on a Cisco router running OSPF? (Choose TWO.)

Select 2 answers

A.show ip route summary

B.show ip ospf border-routes

C.show ip protocols

D.show ip route

E.show ip ospf database

AnswersA, B

This command provides a summary of the routing table, including the number of routes and memory usage, which helps verify summarization.

Why this answer

The 'show ip route summary' command provides a summary of the routing table including the number of routes and the memory used, while 'show ip ospf border-routes' displays the OSPF route table entries for ABRs and ASBRs, which can include summary routes. 'show ip protocols' does not directly show summarization details. 'show ip route' alone does not summarize. 'show ip ospf database' shows the LSDB, not the summarized routing table.

Full explanation →

896

Drag & Dropmedium

Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, a hostname and domain name must be set to generate the RSA key pair. Then the RSA key pair is generated with the crypto key generate rsa command. Next, local AAA authentication is enabled with aaa new-model and aaa authentication login default local.

The VTY lines are then configured to use SSH transport and the local login authentication. Finally, the SSH version is set to 2 for enhanced security.

Full explanation →

897

MCQmedium

snmp-server community public RO\nsnmp-server community private RW\nsnmp-server community secret RW What is wrong with this configuration?

A.There is no access list to restrict SNMP access.

B.The community strings must be at least 8 characters.

C.Only one read-write community is allowed.

D.The 'public' community should be read-write.

AnswerA

Without an ACL, any host can query the device using these community strings, which is a security concern.

Why this answer

The configuration lacks an access control list (ACL) to restrict which SNMP managers can use the community strings. Without an ACL, any device that can reach the router can query or modify the SNMP agent using the 'public' or 'private' strings, creating a severe security vulnerability. Cisco SNMP best practices mandate that each community string should be paired with an ACL to limit source IP addresses.

Exam trap

Cisco often tests the misconception that multiple RW communities are invalid or that community strings have a minimum length, when the real issue is the missing ACL to enforce source-based security.

How to eliminate wrong answers

Option B is wrong because SNMP community strings have no minimum length requirement in RFC 1157 or Cisco IOS; they can be as short as one character. Option C is wrong because Cisco IOS allows multiple read-write community strings; the configuration shown has two RW communities ('private' and 'secret'), which is perfectly valid. Option D is wrong because the 'public' community is correctly configured as read-only (RO) for monitoring purposes; making it read-write would violate the principle of least privilege and is not required.

Full explanation →

898

Multi-Selectmedium

Which TWO statements about route summarization in BGP are true? (Choose TWO.)

Select 2 answers

A.The 'aggregate-address' command creates a summary route in the BGP table.

B.The 'summary-only' keyword can be used with 'aggregate-address' to suppress more specific routes.

C.The 'network' command is used to create a summary route in BGP.

D.BGP summarization requires a route-map to suppress more specific routes.

E.Route summarization in BGP can only be configured on route reflectors.

AnswersA, B

This command is used to create an aggregate route in BGP, which can then be advertised to peers.

Why this answer

In BGP, the 'aggregate-address' command creates a summary route in the BGP table, and it can suppress more specific routes using the 'summary-only' keyword. The 'network' command is used to advertise a specific prefix, not to summarize. The 'aggregate-address' command does not require a route-map to suppress specifics; the 'summary-only' keyword does that.

BGP summarization can be done on any BGP speaker, not just route reflectors.

Full explanation →

899

MCQhard

Router R1 is leaking a summary route 10.0.0.0/8 from VRF-A into the global routing table, but hosts in the global table cannot reach subnet 10.1.1.0/24 within VRF-A. R1 configuration: ip vrf VRF-A, rd 100:1, route-target export 100:1, route-target import 100:1. Interface Gig0/0 in VRF-A has ip address 10.1.1.1 255.255.255.0. The leaking is done via route-map: route-map LEAK permit 10, match ip address prefix-list SUMMARY, set global. Prefix-list SUMMARY permits 10.0.0.0/8. What is the root cause?

A.The summary route 10.0.0.0/8 is being installed in the global table, but the more specific route 10.1.1.0/24 is not leaked, causing traffic to be dropped.

B.The route-map should use match ip address prefix-list SPECIFIC instead of SUMMARY.

C.The VRF must have a default route to reach the global table.

D.The prefix-list should permit 10.1.1.0/24 only.

AnswerA

Correct: The summary lacks the specific route; traffic to 10.1.1.0/24 matches the summary but may be discarded if the summary points to null or is not resolved.

Why this answer

The summary route 10.0.0.0/8 covers the more specific subnet 10.1.1.0/24, but the route-map only leaks the summary, not the specific. When the global table has the summary, traffic to 10.1.1.0/24 is forwarded based on the summary, but since the specific route is not leaked, the packet may be dropped or sent to a null interface if the summary points to a discard. The issue is that the summary route does not provide reachability to the specific subnet because the specific route is not leaked.

Full explanation →

900

MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto isakmp sa dst src state conn-id slot status 10.1.1.2 10.1.1.1 MM_ACTIVE 1 0 ACTIVE 10.1.1.3 10.1.1.1 MM_ACTIVE 2 0 ACTIVE Based on this output, which statement is correct?

A.IKE phase 1 is complete for both peers.

B.IKE phase 2 is complete for both peers.

C.The IPsec tunnels are established.

D.The peers are not responding.

AnswerA

MM_ACTIVE indicates successful IKE phase 1.

Why this answer

The show crypto isakmp sa command shows IKE phase 1 security associations. The state MM_ACTIVE indicates that IKE phase 1 is complete and active. The output shows two active SAs with the local router (10.1.1.1) and two remote peers (10.1.1.2 and 10.1.1.3).

Full explanation →

Page 12 of 27

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 Technologies VPN Technologies Infrastructure Security Infrastructure Services

See all domains with question counts →