Knowledge + Practice

Cisco CCNP ENARSI 300-410 (300-410) — Questions 901–975

1966 questions total · 27pages · All types, answers revealed

Take a mock exam Exam hub

Page 13 of 27

901

MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface facing the Internet. Legitimate traffic from a customer network is being dropped. The traffic has a source IP that belongs to the customer's prefix, which is reachable via a different interface on the router. Which is the most likely explanation?

A.The 'ip verify unicast source reachable-via any' command was used instead of 'rx'.

B.The router has a default route pointing out the same interface, causing uRPF to pass all traffic.

C.The customer traffic is arriving on an interface where the return path to the source is via a different interface, violating strict uRPF.

D.The 'ip urpf allow-default' command is missing, causing default routes to be ignored.

AnswerC

Strict uRPF requires symmetric routing; asymmetric routing causes drops.

Why this answer

Strict uRPF checks that the source IP of incoming packets has a route back out the same interface. If the best path to the source IP is via a different interface (asymmetric routing), the packet is dropped. This is a classic edge case with strict uRPF in asymmetric routing scenarios.

Full explanation →

902

MCQmedium

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# show route-map PBR-MAP route-map PBR-MAP, permit, sequence 10 Match clauses: ip address (access-lists): 101 Set clauses: ip next-hop 10.1.1.2 ip next-hop verify-availability Policy routing matches: 100 packets, 12000 bytes What does this output indicate?

A.PBR is successfully forwarding traffic matching ACL 101 to next-hop 10.1.1.2.

B.The next-hop 10.1.1.2 is unreachable.

C.The route-map is not applied to any interface.

D.The ACL 101 is blocking all traffic.

AnswerA

The packet counter increments, showing successful policy routing.

Why this answer

The output shows that 100 packets have matched the route-map and have been policy-routed. This indicates PBR is functioning correctly.

Full explanation →

903

MCQhard

A network engineer configures an EEM applet to monitor IPsec tunnel failures using the event syslog pattern 'IPSEC-3-IPSEC'. The applet is designed to clear the IPsec security associations. The IPsec tunnel fails due to a transform-set mismatch, but the EEM applet does not trigger. Which is the most likely explanation?

A.Transform-set mismatch generates an IPSEC syslog with severity 4, not severity 3.

B.The EEM applet must use 'event isakmp' to capture IPsec events.

C.The IPsec tunnel failure is not logged because the router drops the packet silently.

D.The transform-set mismatch causes a routing loop that suppresses syslog generation.

AnswerA

Correct. The syslog for transform-set mismatch is severity 4, so the pattern 'IPSEC-3-IPSEC' does not match.

Why this answer

When an IPsec tunnel fails due to a transform-set mismatch, the IKE phase 2 negotiation fails, and the syslog message generated is typically 'IPSEC-4-IPSEC' (severity 4) or 'ISAKMP-4-ISAKMP' (severity 4) depending on the IOS version. The pattern 'IPSEC-3-IPSEC' is for severity 3 errors, which are used for more critical events like SA lifetime expiration or hardware failures. The transform-set mismatch is a negotiation failure, not a critical error, so the syslog severity is lower (4), and the EEM applet does not match.

Full explanation →

904

Multi-Selecthard

Which THREE symptoms indicate that an IPv4 access control list may be misconfigured or not applied correctly? (Choose THREE.)

Select 3 answers

A.Traffic that should be permitted is being blocked.

B.The interface is flapping up and down.

C.High CPU utilization on the router due to ACL processing.

D.ACL hit counts are not incrementing for expected traffic.

E.Routing protocol neighbors are dropping.

AnswersA, C, D

This indicates the ACL may have an incorrect deny statement or order.

Why this answer

A primary symptom of a misconfigured or incorrectly applied ACL is that it blocks traffic that should be permitted. This typically occurs when the ACL's sequence of permit and deny statements does not match the intended policy, or when the ACL is applied in the wrong direction (inbound vs. outbound) on an interface. The router processes ACL entries sequentially, so a deny statement placed before a permit statement for the same traffic will cause legitimate packets to be dropped.

Exam trap

Cisco often tests the distinction between direct symptoms of ACL misconfiguration (blocking permitted traffic, no hit counts, high CPU) and indirect or unrelated issues (interface flapping, neighbor drops) that candidates might incorrectly associate with ACLs due to a superficial understanding of ACL behavior.

Full explanation →

905

Multi-Selectmedium

Which TWO configuration steps are required to enable MPLS L3VPN on a new PE router? (Choose TWO.)

Select 2 answers

A.Configure VRF with route distinguisher and route target.

B.Associate the VRF with the customer-facing interface using 'ip vrf forwarding <name>'.

C.Enable OSPF on all core-facing interfaces.

D.Enable CEF globally.

E.Configure an MPLS TE tunnel between PEs.

AnswersA, B

VRF definition with RD/RT is essential for VPN route separation.

Why this answer

To enable MPLS L3VPN, you must configure VRF definitions with RD and RT, and then associate the VRF with customer-facing interfaces. Enabling LDP on the core-facing interfaces is also required for label distribution. Configuring OSPF on the core is an underlay step, not specific to VPN.

Enabling CEF is a prerequisite for MPLS but is often already enabled. Configuring MP-BGP on the PE is necessary but the question asks for steps on the PE; MP-BGP configuration is a separate step but not listed as an option here; the two correct options are the most direct VRF and interface steps.

Full explanation →

906

MCQhard

A network engineer runs the following command on Router R1: R1# show ip nhrp nhs NHS: 172.16.0.1 Tunnel0 status: registered NHS: 172.16.0.2 Tunnel0 status: not registered Based on this output, what is the problem?

A.Router R1 is not registered with the second NHS, indicating a registration failure.

B.Both NHS are registered successfully.

C.The tunnel interface is down.

D.The NHS addresses are swapped.

AnswerA

Status 'not registered' for second NHS indicates a problem.

Why this answer

The show ip nhrp nhs command displays the NHRP server (NHS) registrations. The output shows that R1 is registered with NHS 172.16.0.1 but not registered with NHS 172.16.0.2. This indicates a problem with the registration to the second NHS, possibly due to authentication mismatch, reachability issues, or configuration error.

Full explanation →

907

MCQhard

A network engineer is troubleshooting MPLS TE where a tunnel is configured with explicit path but the tunnel remains down. The show mpls traffic-eng tunnels command shows 'Path computation failed' and the show mpls traffic-eng topology command shows that the explicit path includes a router that is not in the TED. What is the most likely cause?

A.The router in the explicit path does not have MPLS TE enabled.

B.The explicit path is configured with a loose next-hop.

C.The tunnel destination is not reachable via the IGP.

D.The mpls traffic-eng tunnels command is missing on the headend.

AnswerA

Correct because for a router to appear in the TED, MPLS TE must be enabled globally and on its interfaces; otherwise, the headend cannot include it in the path.

Why this answer

The explicit path includes a router that is not in the TED, meaning the headend cannot find that router in the traffic engineering database. This is because MPLS TE is not enabled on that router or its interfaces, so its link attributes are not advertised.

Full explanation →

908

MCQeasy

A network engineer runs the following command on Router R1: R1# show snmp mib MIB: IF-MIB MIB: SNMPv2-MIB MIB: IP-MIB MIB: CISCO-CONFIG-MAN-MIB MIB: ENTITY-MIB Based on this output, which statement is correct?

A.The router supports monitoring of configuration changes via SNMP.

B.The router does not support the IF-MIB.

C.The router only supports Cisco proprietary MIBs.

D.The ENTITY-MIB is used for entity authentication.

AnswerA

CISCO-CONFIG-MAN-MIB provides objects to monitor configuration changes.

Why this answer

The output of 'show snmp mib' lists the MIBs that the router supports. The presence of CISCO-CONFIG-MAN-MIB indicates that the router supports the Cisco Configuration Management MIB, which allows SNMP to monitor and manage configuration changes, such as when a configuration is saved or modified. Therefore, option A is correct.

Exam trap

Cisco often tests the misconception that 'show snmp mib' lists only Cisco proprietary MIBs, but the output includes standard MIBs like IF-MIB and SNMPv2-MIB, so candidates must recognize that both standard and proprietary MIBs can be supported.

How to eliminate wrong answers

Option B is wrong because the output explicitly lists IF-MIB, so the router does support it. Option C is wrong because the output includes standard MIBs like IF-MIB, SNMPv2-MIB, and IP-MIB, not only Cisco proprietary MIBs. Option D is wrong because ENTITY-MIB is used for managing physical and logical entities (e.g., chassis, modules) and has nothing to do with entity authentication; authentication is handled by SNMPv3 security models or community strings.

Full explanation →

909

MCQhard

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- --- 192.0.2.12 10.0.0.12 --- --- --- 192.0.2.13 10.0.0.13 --- --- --- 192.0.2.14 10.0.0.14 --- --- --- 192.0.2.15 10.0.0.15 --- --- --- 192.0.2.16 10.0.0.16 --- --- --- 192.0.2.17 10.0.0.17 --- --- --- 192.0.2.18 10.0.0.18 --- --- --- 192.0.2.19 10.0.0.19 --- --- --- 192.0.2.20 10.0.0.20 --- --- R1# show ip nat statistics Total active translations: 11 (0 static, 11 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 200 Misses: 0 CEF Translated packets: 200, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 11 map-id 1 [Id] ip nat inside source list ACL1 pool POOL1 refcount 11 Based on this output, what is the problem?

A.The NAT pool is exhausted; no addresses are available for new translations.

B.PAT is not configured, causing address exhaustion.

C.The inside and outside interfaces are misconfigured.

D.Static NAT is conflicting with dynamic NAT.

AnswerA

All 11 pool addresses are in use, and the pool has no more addresses. New translations will fail.

Why this answer

The output shows 11 active dynamic NAT translations using all 11 addresses from pool POOL1 (192.0.2.10–192.0.2.20, which is a /28 subnet with 14 usable addresses, but the pool is defined from .10 to .20, giving exactly 11 addresses). With no Port Address Translation (PAT) configured, each inside host requires a unique global IP, so once all 11 addresses are in use, no new translations can be created, causing the pool to be exhausted.

Exam trap

Cisco often tests the distinction between dynamic NAT (one-to-one address mapping) and PAT (many-to-one with port multiplexing), and the trap here is that candidates may assume PAT is always used with a pool, but the output shows no 'extended' translations (PAT entries) and the pool is fully allocated, indicating basic NAT exhaustion.

How to eliminate wrong answers

Option B is wrong because PAT is not the issue; the problem is that dynamic NAT without PAT exhausts the pool, and PAT would actually solve the exhaustion by allowing many inside hosts to share a single global IP using port numbers. Option C is wrong because the interfaces are correctly configured: GigabitEthernet0/0 is the inside interface and GigabitEthernet0/1 is the outside interface, as shown in the statistics. Option D is wrong because there are 0 static translations, so no static NAT is configured to conflict with the dynamic mappings.

Full explanation →

910

MCQmedium

Which of the following statements about BFD echo mode is true?

A.Echo mode increases the load on the remote router because it must process echo packets.

B.Echo mode is disabled by default and must be explicitly enabled.

C.Echo mode uses the same timer values as the BFD control packets.

D.Echo mode allows the local router to detect failures without requiring the remote router to send BFD control packets.

AnswerD

Correct. In echo mode, the local router sends echo packets that are looped back; if they stop returning, a failure is detected, reducing the need for control packets from the remote.

Why this answer

BFD echo mode is an optional mode where the local router sends echo packets to the remote router, which loops them back. This reduces the processing load on the remote router because it does not need to generate BFD control packets. Echo mode is enabled by default on Cisco IOS-XE.

Full explanation →

911

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf virtual-links Virtual Link OSPF_VL0 to router 10.1.1.3 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface GigabitEthernet0/0, Cost of using 10 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:08 Adjacency State FULL Based on this output, what can be concluded?

A.The virtual link is using area 0 as the transit area.

B.The virtual link is functioning correctly and the adjacency is full.

C.Router R1 is not receiving hello packets on the virtual link.

D.The virtual link has a cost of 1.

AnswerB

The state is FULL and the link is up, indicating proper operation.

Why this answer

The virtual link to router 10.1.1.3 is up and in FULL state. It is running as a demand circuit, which suppresses hello packets when the link is stable. The transit area is area 1.

Full explanation →

912

MCQhard

An engineer configures IPsec site-to-site VPN with a route map that defines interesting traffic using an extended access list. The VPN tunnel is established, but traffic from the local LAN to the remote LAN is not encrypted. The engineer verifies that the access list matches the traffic correctly. Which is the most likely explanation?

A.The route map must be applied to the crypto map using the 'match ip address' command, but route maps are not supported for crypto maps.

B.The crypto map is applied to the wrong interface; it should be applied to the LAN interface.

C.The IPsec transform set is missing the ESP protocol.

D.The route map uses a prefix-list instead of an access list.

AnswerA

Crypto maps only support access lists for interesting traffic; route maps are not valid.

Why this answer

In IPsec, the crypto map applies to the interface, and the access list defines interesting traffic. However, if the route map is applied to the crypto map, it is not used for interesting traffic; route maps are not supported for defining interesting traffic in crypto maps. The correct method is to use an access list directly in the crypto map.

The edge case is that the engineer mistakenly used a route map instead of an access list.

Full explanation →

913

MCQhard

A DMVPN network uses EIGRP as the routing protocol. After redistributing a static route into EIGRP on the hub, spoke-to-spoke tunnels fail to form. Hub configuration: router eigrp 100 redistribute static metric 10000 100 255 1 1500 ! ip route 10.0.0.0 255.0.0.0 Null0 Spoke1# show dmvpn Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, NHRP Peers:2, # Ent Peer NBMA Addr Peer Tunnel Addr State UpDn Tm Attrb 1 192.168.1.1 10.1.1.1 UP 00:01:00 D 2 192.168.1.2 10.1.1.2 UP 00:00:30 D What is the root cause?

A.The static Null0 route is redistributed, causing spokes to send traffic to the hub instead of directly to other spokes.

B.The EIGRP metric is too low, causing the route to be preferred over NHRP.

C.The DMVPN tunnel is misconfigured with mismatched authentication.

D.The redistribute static command is missing the route-map to set the next-hop.

AnswerA

The Null0 route blackholes traffic, preventing spoke-to-spoke communication.

Why this answer

The static route to Null0 for 10.0.0.0/8 is redistributed into EIGRP, causing all spokes to learn a summary route pointing to Null0 on the hub. This blackholes traffic destined to other spokes, preventing dynamic spoke-to-spoke tunnel establishment. The fix is to use a more specific static route or filter the Null0 route from redistribution.

Full explanation →

914

MCQhard

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, OSPF neighbors go down. The CoPP policy has a class that matches OSPF traffic with a rate-limit of 100 pps. Which is the most likely explanation?

A.The OSPF traffic is being dropped because the rate-limit is too low for the hello interval.

B.The CoPP policy is applied to the wrong interface.

C.The OSPF traffic is matched by the default class and dropped.

D.The CoPP policy uses 'police' instead of 'rate-limit'.

AnswerA

Correct. Low pps rate can drop OSPF hellos, causing neighbor loss.

Why this answer

OSPF uses Hello packets to establish and maintain neighbor adjacencies, typically sent every 10 seconds on broadcast networks. If the CoPP rate-limit of 100 pps is too low to accommodate the burst of OSPF Hello packets (e.g., during neighbor initialization or network convergence), the policer will drop excess packets, causing the OSPF dead timer to expire and neighbors to go down. This is the most direct cause because the policy explicitly matches OSPF traffic and applies a strict rate limit that can starve the control plane of necessary protocol messages.

Exam trap

Cisco often tests the misconception that CoPP is applied per-interface or that the default class is the culprit, but the real trap is understanding that control plane protocols like OSPF require consistent, low-latency delivery of Hello packets, and any rate limit—even one that seems high—can cause neighbor loss if it doesn't account for burst behavior.

How to eliminate wrong answers

Option B is wrong because CoPP is applied globally to the control plane, not to a specific interface; applying it to an interface would be a different feature (e.g., interface-based policing). Option C is wrong because the question states there is a class that matches OSPF traffic, so OSPF packets are explicitly classified and not falling into the default class. Option D is wrong because both 'police' and 'rate-limit' commands can be used in CoPP policies to enforce a rate; the issue is the rate value being too low, not the specific policing method.

Full explanation →

915

MCQmedium

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 3000(3) Gi0/0 Session state is UP and not using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 3000(0) Rx Count: 100, Tx Count: 100 Based on this output, what is the BFD session's negotiated transmit interval?

A.The negotiated transmit interval is 1000 ms.

B.The negotiated transmit interval is 500 ms.

C.The negotiated transmit interval is 3000 ms.

D.The negotiated transmit interval is 100 ms.

AnswerA

It is the maximum of local MinTxInt and received MinRxInt, both 1000000 microseconds = 1000 ms.

Why this answer

The negotiated transmit interval is the maximum of the local MinTxInt and the received MinRxInt. Local MinTxInt is 1000000 microseconds, received MinRxInt is 1000000 microseconds. The maximum is 1000000 microseconds, which is 1000 ms.

The BFD session will transmit control packets every 1000 ms.

Full explanation →

916

Multi-Selecteasy

Which TWO commands are used to configure an IP SLA ICMP echo operation on a Cisco IOS device? (Choose TWO.)

Select 2 answers

A.ip sla 1

B.icmp-echo 192.168.1.1 source-ip 10.0.0.1

C.ip sla schedule 1 life forever start-time now

D.track 1 ip sla 1 reachability

E.ip sla monitor 1

AnswersA, B

This command enters IP SLA configuration mode for operation number 1.

Why this answer

To configure an IP SLA ICMP echo operation, you start with 'ip sla <operation-number>' to enter IP SLA configuration mode, then use 'icmp-echo <destination> [source-ip <src>]' to define the probe. The 'frequency' command sets how often the probe is sent. The 'ip sla schedule' is used to start the operation, not to configure it.

The 'track' command is used separately to monitor the operation. The 'ip sla monitor' is legacy.

Full explanation →

917

MCQmedium

Examine the following configuration on R3: !--- R3 configuration access-list 10 permit 192.168.0.0 0.0.255.255 access-list 10 deny any ! route-map OSPF-REDIST permit 10 match ip address 10 set metric-type type-1 ! router ospf 1 redistribute eigrp 100 subnets route-map OSPF-REDIST ! What is the effect of this configuration?

A.All EIGRP routes are redistributed into OSPF as type-1 external routes.

B.Only EIGRP routes in the 192.168.0.0/16 range are redistributed into OSPF as type-1 external routes.

C.EIGRP routes in 192.168.0.0/16 are redistributed as type-2 by default; the set metric-type is ignored.

D.The configuration is invalid because the route-map uses an ACL that ends with deny any; a prefix-list must be used instead.

AnswerB

Correct. The ACL permits 192.168.0.0/16; the route-map sets metric-type type-1 for matching routes.

Why this answer

The ACL 10 permits only routes with source IP in the 192.168.0.0/16 range. The route-map OSPF-REDIST matches this ACL and sets the metric type to type-1. Only EIGRP routes that match the ACL (i.e., have a network starting with 192.168.x.x) are redistributed into OSPF as type-1 external routes.

Routes not matching the ACL are denied because the route-map has only one permit sequence and the ACL ends with deny any.

Full explanation →

918

MCQeasy

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-IN Class-map: CoPP-OSPF (match-all) 1000 packets, 60000 bytes 5 minute offered rate 2000 bps, drop rate 0000 bps Match: access-group 140 police: cir 64000 bps, bc 12000 bytes, be 12000 bytes conformed 1000 packets, 60000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, which statement is correct?

A.OSPF packets are being dropped due to exceeding the police rate.

B.OSPF traffic is being transmitted without any drops.

C.The police rate is set to 32000 bps.

D.The class-default is matching OSPF traffic.

AnswerB

All packets are conforming and being transmitted.

Why this answer

The output shows that under the CoPP-OSPF class, 1000 packets have been conformed and transmitted, with zero exceeded or violated packets. This means all OSPF traffic matched by access-group 140 has been within the police rate of 64000 bps, so no packets have been dropped. Therefore, OSPF traffic is being transmitted without any drops.

Exam trap

Cisco often tests the interpretation of the 'conformed', 'exceeded', and 'violated' counters in police output, where candidates mistakenly assume that any policing configuration implies drops are occurring, even when the counters show zero drops.

How to eliminate wrong answers

Option A is wrong because the output shows 0 exceeded and 0 violated packets, indicating no OSPF packets have been dropped due to policing. Option C is wrong because the police rate is explicitly shown as cir 64000 bps, not 32000 bps. Option D is wrong because the class-map is CoPP-OSPF (match-all), not class-default; class-default would only match traffic not classified by other class maps.

Full explanation →

919

MCQmedium

Given this configuration on Router R5: route-map OSPF-to-EIGRP permit 10 match ip address prefix-list EIGRP-ONLY set metric 10000 100 255 1 1500 ! router eigrp 100 redistribute ospf 1 route-map OSPF-to-EIGRP What is the purpose of the route-map in this configuration?

A.The route-map sets the metric for all redistributed OSPF routes, but does not filter any routes.

B.The route-map filters OSPF routes based on the prefix-list and sets the metric for matching routes.

C.The route-map is applied to inbound EIGRP updates, not to redistribution.

D.The route-map will deny all routes because there is no 'permit' statement for the prefix-list.

AnswerB

The match ip address prefix-list filters, and the set metric assigns the metric.

Why this answer

The route-map is used to filter which OSPF routes are redistributed into EIGRP (via the prefix-list) and to set the metric for those routes. Only routes matching the prefix-list will be redistributed.

Full explanation →

920

MCQeasy

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- R1# show ip nat statistics Total active translations: 1 (1 static, 0 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 5 Misses: 0 CEF Translated packets: 5, CEF Punted packets: 0 Expired translations: 0 Based on this output, which statement is correct?

A.Static NAT is configured for host 10.0.0.10 to 192.0.2.10.

B.Dynamic NAT is configured with overload.

C.The NAT pool is exhausted.

D.PAT is translating multiple hosts to the same global address.

AnswerA

The translation shows a static mapping (no protocol, and statistics confirm static).

Why this answer

The output shows a single static NAT translation from inside local address 10.0.0.10 to inside global address 192.0.2.10. The 'show ip nat statistics' confirms '1 static' translation with no dynamic entries, and the NAT table lacks a port number, indicating a one-to-one static mapping rather than PAT. Therefore, static NAT is correctly configured for host 10.0.0.10 to 192.0.2.10.

Exam trap

Cisco often tests the distinction between static NAT and dynamic NAT with overload (PAT) by showing a translation table without port numbers—candidates mistakenly assume PAT is in use because they see a global address, but the absence of protocol/port fields and the '1 static' count in statistics clearly indicate static NAT.

How to eliminate wrong answers

Option B is wrong because dynamic NAT with overload (PAT) would show multiple translations with port numbers in the 'Pro' column (e.g., TCP/UDP) and '0 dynamic' in the statistics, which is not the case. Option C is wrong because the NAT pool is not exhausted; there is exactly one static translation active, and no dynamic translations are attempted or failing—misses are 0. Option D is wrong because PAT translates multiple inside hosts to a single global address using unique port numbers, but the output shows only one translation with no protocol or port, and the statistics indicate a static translation, not PAT.

Full explanation →

921

MCQmedium

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show ip route 192.168.2.0 Routing entry for 192.168.2.0/24 Known via "eigrp 100", distance 90, metric 2684416, type internal Redistributing via eigrp 100 Last update from 10.0.0.2 on Tunnel0, 00:00:23 ago Routing Descriptor Blocks: * 10.0.0.2, from 10.0.0.2, via Tunnel0 Route metric is 2684416, traffic share count is 1 Total delay is 20000 microseconds, minimum bandwidth is 100000 Kbit Reliability 255/255, minimum MTU 1500 bytes Loading 1/255, Hops 1 What does this output indicate?

A.The route to the remote LAN is not present, indicating a routing issue.

B.The IPsec tunnel is up and EIGRP is exchanging routes over the tunnel.

C.The route is using a static route, not a dynamic routing protocol.

D.The tunnel interface is down, causing the route to be unreachable.

AnswerB

The route is learned via EIGRP on Tunnel0, meaning the tunnel is operational and routing is working.

Why this answer

The output shows a route to 192.168.2.0/24 learned via EIGRP (distance 90) with the next hop 10.0.0.2 reachable through Tunnel0. The last update was 23 seconds ago, confirming the tunnel is up and EIGRP is actively exchanging routing information over the IPsec tunnel. This indicates the IPsec Site-to-Site VPN is functioning and dynamic routing is working correctly.

Exam trap

Cisco often tests the misconception that a route learned via a tunnel interface implies the tunnel is down or that dynamic routing is not functioning, but the presence of a recent update and valid next hop confirms the tunnel is operational.

How to eliminate wrong answers

Option A is wrong because the route is present in the routing table, as shown by the 'Routing entry for 192.168.2.0/24' line, so there is no missing route. Option C is wrong because the route is learned via EIGRP (dynamic routing protocol), not a static route, as indicated by 'Known via "eigrp 100"'. Option D is wrong because the tunnel interface is up and operational; the route is reachable via Tunnel0 with a recent update, and the next hop is valid.

Full explanation →

922

MCQhard

An engineer configures uRPF (Unicast Reverse Path Forwarding) in strict mode on a router interface facing the Internet. After configuration, legitimate traffic from customers is being dropped. The engineer verifies that the routing table has a route back to the source IP address. Which is the most likely explanation?

A.Asymmetric routing causes the return path to use a different interface

B.The uRPF allow-default option is not configured

C.The source IP address is not in the routing table

D.uRPF strict mode requires CEF to be disabled

AnswerA

Correct. Strict uRPF drops packets if the best return route does not exit the same interface.

Why this answer

Strict uRPF checks that the source IP address of incoming packets has a route back through the same interface. If asymmetric routing is present (i.e., traffic comes in one interface but the return route points out a different interface), strict uRPF will drop the packets. This is a common edge case because engineers often assume that having a route to the source is sufficient, but strict mode requires the reverse path to be via the same interface.

Full explanation →

923

MCQhard

An engineer configures NAT overload (PAT) on a router to translate internal addresses to a single public IP. Users can browse the web, but some applications that use non-standard ports fail. Which is the most likely explanation?

A.The application uses protocols that do not have port numbers, such as GRE, and PAT cannot handle them.

B.The NAT pool is exhausted.

C.The inside interface is not configured correctly.

D.The outside interface has a different MTU.

AnswerA

Correct. PAT requires port numbers; non-TCP/UDP protocols fail.

Why this answer

PAT (Port Address Translation) relies on TCP/UDP port numbers to multiplex multiple internal addresses to a single public IP. Protocols like GRE (Generic Routing Encapsulation) and IPsec ESP/AH do not use port numbers, so PAT cannot differentiate between multiple sessions using these protocols. This causes the translation to fail for such applications, even though standard web traffic (HTTP/HTTPS) works fine.

Exam trap

Cisco often tests the misconception that PAT works for all IP traffic, when in fact it only supports TCP, UDP, and ICMP (with limitations) because it requires port numbers for multiplexing.

How to eliminate wrong answers

Option B is wrong because a NAT pool exhaustion would affect all traffic, not just non-standard port applications, and the scenario specifies a single public IP (PAT), so pool exhaustion is not relevant. Option C is wrong because if the inside interface were misconfigured, no traffic (including web browsing) would be translated or routed correctly. Option D is wrong because an MTU mismatch on the outside interface would cause fragmentation or packet loss issues for all traffic, not specifically for applications using non-standard ports.

Full explanation →

924

MCQeasy

When redistributing routes into OSPF, which OSPF metric value is assigned by default if none is specified?

A.1

B.10

C.20

D.100

AnswerC

The default OSPF metric for redistributed routes is 20, as per Cisco IOS default behavior.

Why this answer

Cisco IOS assigns a default metric of 20 to redistributed routes into OSPF, except for BGP routes which default to 1.

Full explanation →

925

MCQhard

A large enterprise network is experiencing intermittent loss of connectivity to a subnet 10.10.10.0/24 from remote sites. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.252 ip ospf 1 area 0 interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.252 ip ospf 1 area 1 router ospf 1 area 1 range 10.10.0.0 255.255.248.0 Router R2 shows: show ip route 10.10.10.0 Routing entry for 10.10.8.0/21 Known via "ospf 1", distance 110, metric 20, type inter-area Last update from 10.1.1.2 on GigabitEthernet0/0, 00:05:32 ago What is the root cause?

A.The summary route 10.10.8.0/21 does not include 10.10.10.0/24; adjust the area range to 10.10.0.0/20.

B.The metric of 20 indicates a redistribution issue; check redistributed routes.

C.The OSPF network type on GigabitEthernet0/0 is causing adjacency issues; change to point-to-point.

D.The area 1 range command is misconfigured with the wrong area; it should be area 0.

AnswerA

The range 10.10.8.0/21 covers 10.10.8.0 to 10.10.15.255, missing 10.10.10.0/24. A /20 range would include it.

Why this answer

The area range configured on R1 is 10.10.0.0/21 (255.255.248.0), which only covers networks 10.10.0.0 through 10.10.7.255. The subnet 10.10.10.0/24 falls outside this range. As a result, when R1 summarizes routes from area 1 into area 0, it does not generate a summary that includes 10.10.10.0/24.

The summary route 10.10.8.0/21 seen on R2 is coming from a different source or is a default summary; it does not correspond to the misconfigured range. The correct fix is to change the area range to 10.10.0.0/20 (255.255.240.0) to encompass the subnet.

Full explanation →

926

MCQhard

An engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers have MP-BGP peering and the VRF is configured with route-target import 100:100. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2 (the PE2 loopback), but the show ip route vrf CUSTOMER command does not have this route. The show mpls forwarding-table on PE1 does not show a label for 192.168.1.2. What is the most likely cause?

A.The VRF route-target import is missing on PE2.

B.LDP is not enabled on the core-facing interfaces of PE1 or the P routers.

C.The MP-BGP session is not using the loopback interface.

D.The VRF on PE1 has the wrong route-target export.

AnswerB

Correct: Without LDP, there is no label for the BGP next-hop, preventing route installation.

Why this answer

The VPNv4 route is received but not installed in the VRF routing table because the recursive lookup fails: the next-hop (PE2 loopback) is not reachable via LDP. Without an LDP label for the BGP next-hop, the route cannot be installed.

Full explanation →

927

Multi-Selecthard

Which THREE statements about the NetFlow flow cache and export timing are correct? (Choose THREE.)

Select 3 answers

A.A flow is exported when it has been idle for the inactive timeout period, which defaults to 15 seconds.

B.The default active flow timeout is 30 minutes, after which a long-lived flow is exported even if it is still active.

C.Flows are only exported when the flow cache becomes 100% full.

D.The 'ip flow-cache timeout active' command can be used to change the active timeout value.

E.The maximum number of flow cache entries is fixed at 64,000 and cannot be changed.

AnswersA, B, D

Correct. The inactive timeout triggers export when no packets match the flow for the configured period; default is 15 seconds.

Why this answer

The NetFlow flow cache stores active flows. Flows are exported when they become inactive (no new packets for a timeout period) or when they are long-lived (active timeout). The default active timeout is 30 minutes, and the default inactive timeout is 15 seconds.

When the cache is full, the router may force-export the oldest flows to make room. The cache size is configurable but has a hardware-dependent maximum. Flow export does not wait for the cache to be full before exporting.

Full explanation →

928

Drag & Drophard

Drag and drop the steps to troubleshoot Route Maps and Route Filtering adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Start by verifying BGP neighbor state with show ip bgp summary. Next, examine the route-map configuration for syntax errors using show route-map. Then, check if the route-map is applied correctly to the neighbor with show running-config.

After that, use debug ip bgp updates to see if prefixes are being filtered. Finally, adjust the route-map sequence or match criteria to resolve the issue.

Full explanation →

929

MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# debug ip routing IP: route table change: 10.0.0.0/16 via 10.1.1.2, Serial0/0/0, distance 90, metric 128576 IP: route table change: 10.0.1.0/24 via 10.1.1.2, Serial0/0/0, distance 90, metric 128576 IP: route table change: 10.0.2.0/24 via 10.1.1.2, Serial0/0/0, distance 90, metric 128576 What does this output indicate?

A.Both the summary route 10.0.0.0/16 and more specific /24 routes are being installed, which could indicate that summarization is not properly filtering the specific routes.

B.Only the summary route is being installed, and the /24 routes are being ignored.

C.The summary route is being replaced by the more specific routes.

D.The routes are being learned via different routing protocols.

AnswerA

The presence of both summary and specific routes suggests that the summary is not suppressing the specifics.

Why this answer

The debug output shows that multiple routes (a /16 and two /24s) are being installed into the routing table via the same next hop. This indicates that both the summary route and more specific routes are present, which may be a sign of inconsistent summarization or a leak of more specific routes.

Full explanation →

930

Multi-Selecteasy

Which TWO configuration steps are required to implement Policy-Based Routing (PBR) on a Cisco router? (Choose TWO.)

Select 2 answers

A.Create a route-map with match and set commands.

B.Apply the route-map to an interface using the 'ip policy route-map' command.

C.Configure an access-list to match the traffic.

D.Enable CEF globally.

E.Use the 'ip local policy route-map' command.

AnswersA, B

The route-map defines the policy: what traffic to match and what action to take.

Why this answer

To implement PBR, you must create a route-map with match and set commands, then apply it to an interface using 'ip policy route-map'. Configuring an ACL is optional if match criteria use other methods. Enabling CEF is not required for PBR.

The 'ip route' command is for static routing, not PBR. 'ip local policy route-map' is only for locally generated packets, not a general requirement.

Full explanation →

931

MCQeasy

Which EEM action type is used to modify the configuration of the device?

A.action syslog

B.action cli

C.action snmp-trap

D.action mail

AnswerB

The 'action cli' command executes IOS commands, enabling configuration modifications.

Why this answer

The 'action cli' command allows executing Cisco IOS commands, including configuration changes.

Full explanation →

932

Multi-Selecthard

Which THREE statements about BFD multihop sessions are true? (Choose THREE.)

Select 3 answers

A.Multihop BFD is used when the neighbors are not directly connected.

B.Multihop BFD uses UDP destination port 4784.

C.Multihop BFD requires configuration of the source and destination IP addresses.

D.Multihop BFD requires both routers to be in the same subnet.

E.Multihop BFD can only be used with BGP.

AnswersA, B, C

Multihop BFD supports sessions between routers separated by multiple Layer 3 hops.

Why this answer

BFD multihop sessions are used when the two routers are not directly connected, requiring multiple hops. They use a different destination UDP port (4784) compared to single-hop sessions (3784). Additionally, multihop sessions require explicit configuration of the BFD source and destination IP addresses.

The other statements are false because multihop sessions do not require the same subnet, and they can operate over any routed path.

Full explanation →

933

MCQmedium

A network engineer runs the following command to verify MPLS forwarding: R1# show mpls forwarding-table 192.168.1.0 255.255.255.0 detail Output: Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 101 201 192.168.1.0/24 0 Gi0/0 10.0.0.2 MAC/Encaps: 14/18, MTU: 1500, Label Stack {201} No output feature configured What does this output indicate?

A.Packets with label 101 will be swapped to label 201 and forwarded to 10.0.0.2

B.Packets with label 101 will be popped and forwarded as IP packets

C.The prefix 192.168.1.0/24 is directly connected

D.The label stack has two labels

AnswerA

The forwarding table shows label swap operation: incoming label 101 swapped to outgoing label 201.

Why this answer

The output shows the MPLS forwarding table entry for prefix 192.168.1.0/24. The local label is 101, outgoing label is 201, next hop is 10.0.0.2 via GigabitEthernet0/0. The label stack contains only label 201.

Full explanation →

934

MCQmedium

In a standard IPv4 ACL, what is the default wildcard mask if none is explicitly configured?

A.0.0.0.0 (host match)

B.255.255.255.255 (any match)

C.The mask is mandatory; configuration is rejected without it.

D.The mask is derived from the source address class.

AnswerA

When no wildcard mask is given, the router assumes a host match.

Why this answer

In a standard IPv4 ACL, if no wildcard mask is explicitly configured, the default wildcard mask is 0.0.0.0, which means the ACL matches only the exact source IP address (a host match). This is because the access-list command treats the source address as a host address when no mask is provided, effectively applying a host wildcard mask.

Exam trap

Cisco often tests the misconception that a missing wildcard mask defaults to 'any' (255.255.255.255) or that the mask is mandatory, when in fact the default is a host match (0.0.0.0).

How to eliminate wrong answers

Option B is wrong because 255.255.255.255 (any match) is not the default; it would match all source addresses, which is not the behavior when no mask is given. Option C is wrong because the mask is not mandatory; Cisco IOS accepts the command without a wildcard mask and defaults to 0.0.0.0. Option D is wrong because the mask is not derived from the source address class; ACLs do not use classful behavior, and the default is always 0.0.0.0 regardless of the address class.

Full explanation →

935

MCQmedium

An engineer is troubleshooting a route redistribution issue between OSPF and EIGRP. R1 runs both protocols and redistributes OSPF into EIGRP. The engineer notices that OSPF routes redistributed into EIGRP have an AD of 170, but some routes from OSPF are not being redistributed. What is the most likely cause?

A.The OSPF routes have a higher metric than the EIGRP routes.

B.The OSPF routes are not in the routing table because they are overridden by a static route with AD 1.

C.The redistribute ospf 1 metric 10000 command is missing.

D.The OSPF routes are external type 2, which are not redistributed by default.

AnswerB

If a static route with AD 1 exists for the same prefix, the OSPF route will not be installed, and redistribution will not include it.

Why this answer

Redistribution into EIGRP requires matching routes; by default, only routes in the routing table are redistributed. If OSPF routes are not in the routing table because they are overridden by another protocol with lower AD, they will not be redistributed.

Full explanation →

936

MCQeasy

Which OSPF packet type is used to send link-state advertisements (LSAs) and is acknowledged by the receiver?

A.Hello (type 1)

B.Database Description (type 2)

C.Link State Request (type 3)

D.Link State Update (type 4)

AnswerD

Correct. Link State Update packets carry LSAs and are acknowledged by the receiver.

Why this answer

OSPF packet type 4 is the Link State Update packet, used to flood LSAs. It is acknowledged by the receiver via a Link State Acknowledgment packet (type 5).

Full explanation →

937

MCQhard

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are established, but traffic between spokes is not using the direct tunnel. What is the most likely explanation?

A.The spoke routers have a default route via the hub, so they send traffic to the hub instead of initiating NHRP resolution for a direct tunnel.

B.The hub has 'no ip nhrp redirect' configured, which disables spoke-to-spoke tunnel setup.

C.The spokes have 'ip nhrp shortcut' enabled, which forces all traffic through the hub.

D.The tunnel mode is set to 'tunnel mode gre multipoint' on the spokes, which is incorrect.

AnswerA

Phase 2 requires that spokes have a specific route to the remote subnet to trigger NHRP; a default route prevents this.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels require that the spoke routers have a route to the destination network via the tunnel interface with a next hop that triggers NHRP resolution. If the spoke has a default route pointing to the hub, it will not attempt to resolve the spoke-to-spoke tunnel.

Full explanation →

938

MCQhard

A router configured as a DHCPv6 relay agent is not forwarding DHCPv6 requests from clients to the server. The relay interface has 'ipv6 dhcp relay destination' configured. Clients are on a different VLAN. Which is the most likely explanation?

A.The relay destination is configured on the client-facing interface; it should be on the server-facing interface.

B.The DHCPv6 server is not reachable via the relay agent's routing table.

C.The relay agent must have 'ipv6 dhcp server' configured to act as a server.

D.The clients are using DHCPv4, not DHCPv6.

AnswerA

Correct: The 'ipv6 dhcp relay destination' command must be applied to the interface that receives client requests (client-facing), not the server-facing interface.

Why this answer

The 'ipv6 dhcp relay destination' command must be configured on the interface facing the DHCPv6 clients, not the server-facing interface. This command instructs the router to intercept DHCPv6 messages arriving on that interface and forward them as relay-forward messages to the specified DHCPv6 server. Placing it on the server-facing interface would cause the router to attempt relaying on the wrong interface, so client requests on the client-facing VLAN are never intercepted or forwarded.

Exam trap

Cisco often tests the misconception that the relay destination should be placed on the interface facing the DHCP server, when in fact it must be on the interface facing the DHCP clients to intercept their messages.

How to eliminate wrong answers

Option B is wrong because if the DHCPv6 server were unreachable, the relay agent would still attempt to forward requests and generate an error or log message, but the question states the relay is not forwarding requests at all, indicating a configuration issue rather than a reachability problem. Option C is wrong because 'ipv6 dhcp server' is used to enable the router to act as a DHCPv6 server itself, not as a relay agent; a relay agent does not require a server configuration. Option D is wrong because the question explicitly states the clients are sending DHCPv6 requests, and the relay agent is configured for DHCPv6, so DHCPv4 is irrelevant.

Full explanation →

939

MCQeasy

A network engineer runs the following command on Router R6: R6# show ip route 10.0.0.0 Routing entry for 10.0.0.0/8 Known via "eigrp 100", distance 90, metric 28160 Redistributing via eigrp 100 Last update from 192.168.1.1 on GigabitEthernet0/0, 00:00:10 ago Routing Descriptor Blocks: * 192.168.1.1, from 192.168.1.1, 00:00:10 ago, via GigabitEthernet0/0 Route metric is 28160, traffic share count is 1 Additionally, an OSPF route for the same prefix is learned with distance 110. Which route will be installed in the routing table?

A.The OSPF route will be installed because it has a lower metric.

B.The EIGRP route will be installed because it has a lower administrative distance.

C.Both routes will be installed for load balancing.

D.Neither route will be installed due to a conflict.

AnswerB

EIGRP's distance of 90 is lower than OSPF's 110, so the EIGRP route is preferred.

Why this answer

EIGRP internal routes have a default administrative distance of 90, which is lower than OSPF's default distance of 110. Therefore, the EIGRP route will be preferred and installed in the routing table.

Full explanation →

940

MCQeasy

A network engineer runs the following command on Router R1: R1# show snmp engineID Local SNMP engineID: 800000090300001122334455 Local SNMP engineBoots: 5 Based on this output, which statement is correct?

A.The SNMP engine has rebooted 5 times.

B.The engine ID is 800000090300001122334455, which is the default for all Cisco devices.

C.The engineBoots value is used for SNMPv2c community authentication.

D.The engine ID must be the same on all devices in the network.

AnswerA

The engineBoots value of 5 indicates the engine has been restarted 5 times.

Why this answer

The 'Local SNMP engineBoots: 5' value indicates the number of times the SNMP engine has been initialized or rebooted since the engineID was last configured. This counter increments each time the SNMP agent restarts, typically due to a device reload or SNMP process restart, and is used for SNMPv3 message timeliness and authentication.

Exam trap

Cisco often tests the misconception that engineBoots is related to SNMPv2c or community strings, when in fact it is exclusively an SNMPv3 mechanism for replay protection and timeliness.

How to eliminate wrong answers

Option B is wrong because the engineID '800000090300001122334455' is not the default for all Cisco devices; the default engineID is derived from the device's MAC address or a configured string, and this specific value appears to be a manually configured or example ID. Option C is wrong because engineBoots is used in SNMPv3 for message timeliness and authentication, not for SNMPv2c community authentication, which relies on community strings and does not use engineBoots. Option D is wrong because the engineID must be unique per SNMP engine (device) to ensure proper SNMPv3 security and message identification; it should not be the same across all devices in the network.

Full explanation →

941

MCQmedium

A network engineer runs the following command to troubleshoot a SPAN issue: R1# show monitor session 1 detail Session 1 --------- Type : Local Session Source Ports : Both : Gi0/0 Destination Ports : Gi0/1 Encapsulation : Native Ingress : Disabled What does this output indicate?

A.The session is correctly configured to send traffic from Gi0/0 to Gi0/1.

B.The session is misconfigured because the destination port should have ingress enabled.

C.The session is misconfigured because the source port must be a VLAN.

D.The session is misconfigured because encapsulation must be set to 'replicate'.

AnswerA

The output confirms a local SPAN session with source port Gi0/0 and destination port Gi0/1.

Why this answer

The output shows a local SPAN session with source port Gi0/0 (both directions) and destination port Gi0/1. The destination port is configured with native encapsulation and no ingress traffic is allowed.

Full explanation →

942

MCQmedium

A network engineer runs the following command on Router R1: R1# show mpls ldp neighbor Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.52868 State: Oper; Msgs sent/rcvd: 123/120; Downstream Up time: 02:15:30 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 192.168.1.2 Addresses bound to peer LDP Ident: 10.0.0.2 192.168.1.2 Based on this output, which statement is correct?

A.The LDP session is down because the state is 'Oper'.

B.The LDP session is established and operational.

C.The LDP neighbor is using upstream label distribution.

D.The LDP session is using TCP port 179.

AnswerB

'State: Oper' indicates the session is operational.

Why this answer

The output shows a single LDP neighbor with state 'Oper' (operational), indicating the LDP session is up. The 'Downstream' mode is default. The peer LDP Ident is 10.0.0.2:0, and the local LDP Ident is 10.0.0.1:0.

The addresses bound include the peer's router-id and the interface IP. No problems are indicated.

Full explanation →

943

MCQhard

R1 and R2 have an IPsec VPN tunnel between their physical interfaces. They are running OSPF over the tunnel interface. R1's show ip ospf neighbor shows R2 as FULL, but R1's show ip route ospf does not include any routes from R2. R2's show ip route ospf shows routes from R1. What is the root cause?

A.The OSPF cost on R1's tunnel interface is set to 65535, preventing route installation.

B.OSPF network type mismatch: R1 uses broadcast, R2 uses point-to-point.

C.R1 has a distribute-list in filtering OSPF routes.

D.The IPsec tunnel is only encrypting unicast traffic, not OSPF multicast.

AnswerA

OSPF does not install routes with cost 65535 or higher (max metric). R1 receives LSAs but ignores them due to high cost.

Why this answer

When the OSPF cost on R1's tunnel interface is set to 65535, OSPF considers the route unreachable because the maximum OSPF cost for route installation is 65534 (per RFC 2328). Routes with cost 65535 are not installed in the routing table, even though the neighbor state is FULL. This explains why R1 sees R2 as FULL but has no OSPF routes, while R2 (with a normal cost) installs routes from R1.

Exam trap

Cisco often tests the nuance that OSPF neighbor state FULL does not guarantee route installation; the trap here is that candidates assume a FULL adjacency means routes are automatically exchanged and installed, ignoring the OSPF cost limit of 65535.

How to eliminate wrong answers

Option B is wrong because an OSPF network type mismatch (broadcast vs. point-to-point) would prevent the neighbor relationship from reaching FULL, or cause adjacency issues, but here the neighbor is FULL, so this cannot be the root cause. Option C is wrong because a distribute-list filtering OSPF routes would affect inbound or outbound route advertisement, but R2 still receives routes from R1, indicating filtering is not symmetric or not present; moreover, a distribute-list would not cause a FULL neighbor state with zero routes on one side only. Option D is wrong because IPsec tunnels encrypt all IP traffic traversing the tunnel, including OSPF multicast packets (224.0.0.5/224.0.0.6), as the tunnel interface encapsulates the entire IP packet; if OSPF multicast were blocked, the neighbor relationship would not form at all, let alone reach FULL.

Full explanation →

944

MCQhard

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Users report that some websites load slowly or partially. Router R1 shows: show ip nat statistics: Total active translations: 65535 (0 static, 65535 dynamic; 65535 extended). The NAT pool is exhausted. What is the root cause?

A.Reduce the NAT timeout values using ip nat translation timeout and ip nat translation tcp-timeout.

B.Increase the access-list 100 to include more internal hosts.

C.Change the NAT to use a pool of public IPs instead of overload.

D.Clear the NAT table with clear ip nat translation * periodically.

AnswerA

Shorter timeouts free up entries faster, preventing exhaustion.

Why this answer

The NAT pool is exhausted with 65535 active translations, which is the maximum number of PAT entries (port numbers) available for a single public IP. This causes new or existing sessions to fail or load partially. Reducing NAT timeout values (e.g., ip nat translation timeout and ip nat translation tcp-timeout) frees port mappings faster, alleviating the exhaustion without requiring additional public IPs.

Exam trap

Cisco often tests the misconception that adding more public IPs or clearing the NAT table is the primary fix, when in reality the root cause is port exhaustion due to long default timeouts, and the proper solution is to adjust timer values to reclaim ports faster.

How to eliminate wrong answers

Option B is wrong because increasing the access-list to include more hosts does not solve the port exhaustion; it would only allow more hosts to attempt NAT, worsening the problem. Option C is wrong because changing to a pool of public IPs (dynamic NAT without overload) would require multiple public IPs and does not directly address the port exhaustion issue; PAT overload is already in use and the fix is to manage port release timers. Option D is wrong because clearing the NAT table periodically is a manual, disruptive workaround that drops active sessions and does not address the root cause of slow timer-based port reclamation.

Full explanation →

945

MCQhard

Which loop prevention mechanism is used by default when redistributing between two OSPF processes?

A.Split horizon

B.Route tagging with default tag 0

C.Poison reverse

D.Hold-down timers

AnswerB

Route tagging allows an OSPF process to identify and filter routes it originated, preventing loops; the default tag is 0.

Why this answer

When redistributing between OSPF processes, Cisco IOS uses route tagging (tag field in the OSPF external LSA) to prevent loops, but the default tag value is 0 unless explicitly set.

Full explanation →

946

Multi-Selectmedium

Which THREE symptoms indicate a problem with SNMP trap delivery from a Cisco router? (Choose THREE.)

Select 3 answers

A.The NMS does not receive traps, but other SNMP operations (gets) work.

B.The 'show snmp' command shows increasing 'SNMP queue overflow' counters.

C.Syslog messages show '%SNMP-3-AUTHFAIL' for the trap receiver.

D.The router CPU utilization is consistently above 90%.

E.The NMS can ping the router successfully.

AnswersA, B, C

Indicates a specific issue with trap generation or delivery, not general SNMP connectivity.

Why this answer

SNMP traps are sent as unsolicited UDP packets from the router to the NMS, while SNMP get operations use a separate request-response mechanism. If gets succeed but traps fail, the issue is typically with trap configuration (e.g., wrong target IP, community string mismatch, or UDP port 162 blocked) rather than general SNMP or network connectivity.

Exam trap

Cisco often tests the distinction between SNMP trap delivery issues and general SNMP or network problems, leading candidates to mistakenly select high CPU or ping success as relevant symptoms when they are not specific to trap delivery.

Full explanation →

947

MCQhard

A network engineer runs the following command to verify OSPF SPF calculations: R1# show ip ospf statistics OSPF Router with ID (1.1.1.1) (Process ID 1) Area 0: SPF algorithm executed 12 times SPF calculation time (in msec): Total: 12, Average: 1.0 Minimum: 0, Maximum: 2 Last SPF due to: LSA change Number of LSA changes: 5 Number of LSA deletions: 2 Number of LSA additions: 3 Number of LSA updates: 0 Area 1: SPF algorithm executed 3 times SPF calculation time (in msec): Total: 3, Average: 1.0 Minimum: 0, Maximum: 1 Last SPF due to: LSA change Number of LSA changes: 2 Number of LSA deletions: 0 Number of LSA additions: 2 Number of LSA updates: 0 What does this output indicate?

A.The router has not performed any SPF calculations.

B.Area 0 has experienced more network changes than Area 1, as indicated by higher SPF runs and LSA changes.

C.The SPF calculation time is too high, indicating a performance issue.

D.The last SPF was triggered by a timer expiry.

AnswerB

Area 0 has 12 SPF runs and 5 LSA changes, while Area 1 has 3 SPF runs and 2 LSA changes.

Why this answer

The output shows OSPF SPF statistics for multiple areas, including number of SPF runs and LSA changes.

Full explanation →

948

MCQmedium

Which EIGRP packet type is used to confirm receipt of an update during reliable transport in a VRF-Lite configuration?

A.Hello

B.Update

C.ACK

D.Query

AnswerC

ACK packets are used to acknowledge receipt of reliable EIGRP packets.

Why this answer

EIGRP uses ACK packets, which are hello packets with no data, to acknowledge reliable packets (updates, queries, replies).

Full explanation →

949

Multi-Selectmedium

Which TWO symptoms indicate that syslog messages are not being sent to the remote syslog server? (Choose TWO.)

Select 2 answers

A.The 'show logging' command shows messages in the local buffer.

B.The syslog server receives messages from other devices but not from this router.

C.The 'show log' command returns no output.

D.The 'show logging' output does not list the syslog server IP address under 'Logging to'.

E.Debug output appears on the console but not on the syslog server.

AnswersB, D

This indicates a specific issue with this router's syslog configuration or connectivity.

Why this answer

If syslog messages are not reaching the server, the 'show logging' output will not show the server address as active, and the server will not receive any messages. The 'show logging' command may still show messages in the local buffer. The 'show log' command does not exist.

Debug output on the router does not confirm remote delivery.

Full explanation →

950

MCQhard

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp topology all-links IP-EIGRP Topology Table for AS 100 Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - Reply status, s - sia Status P 10.1.1.0/24, 1 successors, FD is 131072 via 10.1.2.2 (131072/130816), GigabitEthernet0/0 via 10.1.3.3 (131328/131072), GigabitEthernet0/1 P 10.2.2.0/24, 1 successors, FD is 131072 via 10.1.2.2 (131072/130816), GigabitEthernet0/0 A 10.3.3.0/24, 0 successors, FD is Infinity via 10.1.2.2 (4294967295/4294967295), GigabitEthernet0/0 via 10.1.3.3 (4294967295/4294967295), GigabitEthernet0/1 What does this output indicate?

A.The route 10.3.3.0/24 is stuck-in-active because replies have not been received from all neighbors.

B.The route 10.3.3.0/24 is passive and has two feasible successors.

C.The route 10.3.3.0/24 is learned via both neighbors with equal metrics.

D.The route 10.3.3.0/24 is installed in the routing table via both neighbors.

AnswerA

The Active state with FD Infinity and no successors indicates EIGRP is waiting for replies, which can lead to a stuck-in-active condition if not resolved.

Why this answer

The 'A' code for route 10.3.3.0/24 indicates it is in the Active state, meaning the router has sent Queries for this route and is waiting for Replies from all neighbors. The FD (Feasible Distance) is 'Infinity' (4294967295), and both successors are 0, confirming the route is not usable. The 's' (sia Status) code is not shown, but the Active state with no successors and infinite metrics directly points to a stuck-in-active (SIA) condition where replies have not been received from all neighbors, causing the route to remain active.

Exam trap

Cisco often tests the distinction between the 'A' (Active) and 'P' (Passive) codes in the 'show ip eigrp topology all-links' output, and candidates mistakenly assume that seeing two next hops means the route is installed or has feasible successors, ignoring the Active state and Infinity metrics.

How to eliminate wrong answers

Option B is wrong because the route is coded 'A' (Active), not 'P' (Passive), and it has 0 successors, not feasible successors; a passive route would have successors and a finite FD. Option C is wrong because the metrics via both neighbors are 4294967295 (Infinity), not equal; equal metrics would be finite and identical, and the route would be passive. Option D is wrong because the route has 0 successors and FD is Infinity, so it is not installed in the routing table; only routes with a finite FD and at least one successor are installed.

Full explanation →

951

MCQmedium

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# debug ip routing And sees the following output: *Mar 1 00:12:34.567: RT: add 192.168.10.0/24 via 10.1.1.2, ospf metric [110/20] *Mar 1 00:12:34.568: RT: add 192.168.10.0/24 via 10.2.2.2, eigrp metric [90/156160] *Mar 1 00:12:34.569: RT: better route for 192.168.10.0/24 via 10.1.1.2, ospf metric [110/20] *Mar 1 00:12:34.570: RT: add 192.168.10.0/24 to rib via 10.1.1.2, ospf metric [110/20] What does this output indicate?

A.OSPF route is preferred over EIGRP because OSPF has a lower metric.

B.EIGRP route is preferred because it has a lower administrative distance.

C.OSPF route is being installed in the routing table because the EIGRP route may have been withdrawn or not learned.

D.Both routes are installed in the routing table for load balancing.

AnswerC

The debug shows OSPF route being added to RIB. The EIGRP route is considered but not installed, likely because it was withdrawn or not valid. The router compares and selects the OSPF route.

Why this answer

The debug ip routing output shows the routing table process comparing routes from different sources. OSPF has administrative distance 110 and EIGRP has 90, so EIGRP is preferred by default. However, the output shows OSPF being chosen, indicating that the EIGRP route might have been removed or the OSPF route is being redistributed with a lower distance or the EIGRP route is not installed due to other reasons.

Full explanation →

952

MCQhard

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# show ip eigrp topology 192.168.10.0/24 And sees the following output: IP-EIGRP (AS 100): Topology entry for 192.168.10.0/24 State: Passive, Originating, 1 successors, FD is 128256 Routing Descriptor Blocks: 0.0.0.0 (Null0), from 0.0.0.0, Send flag 0x0 Composite metric is (128256/0), Route is Internal Vector metric: Minimum bandwidth is 100000 Kbit Total delay is 5000 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 0 What does this output indicate?

A.The route 192.168.10.0/24 is learned from an EIGRP neighbor.

B.The route is a summary route configured on this router.

C.The route is redistributed into EIGRP from another protocol, such as OSPF or BGP.

D.The route is a connected interface that is advertised in EIGRP.

AnswerC

The route is in Passive state, originating, with next hop 0.0.0.0, indicating it is locally injected into EIGRP, typically via redistribution.

Why this answer

The show ip eigrp topology command shows a route that is in Passive state and marked as Originating, with the next hop as 0.0.0.0 (Null0). This indicates that the route is a summary route or a redistributed route that is being originated by this router. The metric 128256 and hop count 0 suggest it is a directly connected or redistributed route.

Full explanation →

953

MCQhard

An engineer configures an EIGRP named mode with an offset-list applied to the delay metric on a serial interface. The offset-list increases the delay by 1000 microseconds. However, the feasible distance (FD) updates correctly, but the advertised distance (AD) does not change. What is the most likely explanation?

A.The offset-list only modifies the FD on the local router, not the AD received from the neighbor.

B.The offset-list is applied to the wrong interface; it should be applied to the neighbor's interface.

C.The named mode EIGRP does not support offset-lists; only classic mode does.

D.The offset-list is configured with the wrong direction; it should be inbound.

AnswerA

Offset-list adjusts the delay locally for the FD, but the AD is the neighbor's reported metric and is not altered by the local offset-list.

Why this answer

The offset-list in EIGRP modifies the composite metric (feasible distance) on the local router by adding delay to the interface where it is applied. However, the advertised distance (AD) is the metric that the neighbor reports for a route; it is received in EIGRP update packets and is not altered by the local router's offset-list. Therefore, only the FD changes, while the AD remains unchanged because it is a value learned from the neighbor.

Exam trap

Cisco often tests the distinction between advertised distance and feasible distance, and the trap here is that candidates assume an offset-list applied to an interface will affect both the local metric and the metric reported to neighbors, when in fact it only affects the local FD calculation.

How to eliminate wrong answers

Option B is wrong because the offset-list is applied to the local router's interface to influence the local metric calculation; applying it to the neighbor's interface would not change the AD received from that neighbor. Option C is wrong because named mode EIGRP fully supports offset-lists; they are configured under the address-family section using the 'offset-list' command. Option D is wrong because the offset-list direction (inbound or outbound) controls which routes are affected, not whether the AD or FD is modified; even with inbound direction, the offset-list still only modifies the local FD, not the AD received from the neighbor.

Full explanation →

954

MCQeasy

A network engineer runs the following command to troubleshoot an Administrative Distance issue: R1# show ip route 10.0.0.0 255.0.0.0 Routing entry for 10.0.0.0/8 Known via "static", distance 1, metric 0 Redistributing via eigrp 100 Last update from 10.1.1.2 on GigabitEthernet0/0, 00:00:05 ago Routing Descriptor Blocks: * 10.1.1.2, from 10.1.1.2, 00:00:05 ago, via GigabitEthernet0/0 Route metric is 0, traffic share count is 1 What does this output indicate?

A.The route is a static route with administrative distance 1, which is the default for static routes pointing to an interface.

B.The route is an EIGRP route with administrative distance 90.

C.The route is being redistributed from EIGRP into static.

D.The route has an administrative distance of 170 because it is external.

AnswerA

The static route’s administrative distance of 1 matches the default value for a static route configured with an exit interface rather than a next-hop IP address, because Cisco IOS assigns distance 1 to interface-based static routes and distance 0 to directly connected routes. This output satisfies the constraint that the route is “known via static” with distance 1, confirming the engineer is troubleshooting an AD mismatch.

Why this answer

The output shows a static route with administrative distance 1, which is the default for static routes. This route is being redistributed into EIGRP.

Full explanation →

955

MCQeasy

A network engineer runs the following command to verify Flexible NetFlow record configuration: R1# show flow record FLOW-RECORD-1 flow record FLOW-RECORD-1 match ipv4 source address match ipv4 destination address match ip protocol collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last What does this output indicate?

A.The record collects only packet counts, not byte counts.

B.The record matches on source and destination IP addresses and protocol, and collects byte/packet counters and timestamps.

C.The record does not include any timestamp information.

D.The record matches on TCP flags.

AnswerB

The output clearly shows match statements for ipv4 source address, destination address, and protocol, and collect statements for bytes, packets, and timestamps.

Why this answer

The output shows the definition of a Flexible NetFlow record. It matches on source IP, destination IP, and protocol, and collects byte and packet counters along with timestamps for the first and last packet of the flow.

Full explanation →

956

MCQmedium

Router R4 has the following DHCPv6 configuration: ipv6 dhcp pool DHCP6_POOL2 address prefix 2001:db8:2::/64 dns-server 2001:db8::1 ! interface GigabitEthernet0/1 ipv6 address 2001:db8:2::1/64 ipv6 dhcp server DHCP6_POOL2 ipv6 nd managed-config-flag no shutdown What is the effect of this configuration?

A.Hosts will use DHCPv6 to obtain both their IPv6 address and other configuration parameters like DNS.

B.Hosts will use SLAAC for addressing and DHCPv6 for DNS only.

C.The DHCPv6 pool is missing a domain-name, so it will not provide any configuration.

D.The ipv6 nd managed-config-flag command is incompatible with the DHCPv6 server and will cause an error.

AnswerA

The managed-config-flag indicates stateful DHCPv6, and the pool provides an address prefix, so hosts get addresses and other info from DHCPv6.

Why this answer

The configuration uses the `ipv6 nd managed-config-flag` command, which sets the Managed Address Configuration flag (M flag) in Router Advertisement (RA) messages. When the M flag is set to 1, hosts are instructed to use DHCPv6 (stateful DHCPv6) to obtain their IPv6 addresses, not SLAAC. Additionally, the DHCPv6 pool provides DNS server information, so hosts will use DHCPv6 for both addressing and other configuration parameters like DNS.

This matches option A.

Exam trap

Cisco often tests the distinction between the M flag (managed-config-flag) and the O flag (other-config-flag), where candidates mistakenly think the M flag only affects DNS or that SLAAC is still used for addressing when the M flag is set.

How to eliminate wrong answers

Option B is wrong because the `ipv6 nd managed-config-flag` sets the M flag to 1, which tells hosts to use DHCPv6 for addressing, not SLAAC; SLAAC is used when the M flag is 0 and the O flag (Other Configuration flag) may be set for DHCPv6-only DNS. Option C is wrong because a DHCPv6 pool does not require a domain-name to function; it can provide an address prefix and DNS server without a domain name, and the configuration will still work. Option D is wrong because the `ipv6 nd managed-config-flag` command is fully compatible with the DHCPv6 server configuration; it is designed to work together to signal hosts to use stateful DHCPv6.

Full explanation →

957

MCQhard

An EIGRP network with routers R1, R2, and R3 is experiencing frequent Stuck-in-Active (SIA) events for the prefix 172.16.1.0/24. R1 is the successor, R2 is the feasible successor. R3 is a query originator. 'show ip eigrp topology 172.16.1.0/24' on R1 shows the route in active state. 'show ip eigrp interfaces' on R2 shows the link to R3 is up but with high packet loss. What is the root cause?

A.High packet loss on the link between R2 and R3 causes EIGRP queries or replies to be dropped, leading to SIA.

B.R3 has a route summarization that causes the query to be sent to the Null0 interface.

C.The EIGRP active timer is set too low on R1, causing premature SIA.

D.R2 has a distribute-list that filters the prefix, preventing the reply from being sent.

AnswerA

EIGRP relies on reliable transport; packet loss can cause queries to remain unanswered, triggering SIA after the active timer expires.

Why this answer

The high packet loss on the link between R2 and R3 causes EIGRP queries or replies to be dropped. When R3 originates a query for the prefix 172.16.1.0/24, R1 (the successor) transitions the route to active state and sends queries to all neighbors, including R2. R2, as the feasible successor, must reply, but if the link to R3 has high packet loss, the query from R2 to R3 or the reply from R3 back to R2 may be lost, preventing R2 from sending its reply to R1 within the active timer, leading to a Stuck-in-Active (SIA) event.

Exam trap

Cisco often tests the misconception that SIA is always caused by a slow or congested link directly between the query originator and the successor, but here the trap is that the packet loss is on the link between R2 and R3, which indirectly prevents R2 from replying to R1, causing SIA.

How to eliminate wrong answers

Option B is wrong because route summarization sending traffic to Null0 would cause a black hole for the prefix, but it does not directly cause EIGRP queries or replies to be dropped; SIA events are caused by missing replies, not by summarization. Option C is wrong because the EIGRP active timer is a global or per-interface timer that controls how long a router waits for replies before declaring SIA; while setting it too low could cause premature SIA, the scenario explicitly states high packet loss on the R2-R3 link, which is the direct cause of dropped packets, not a timer misconfiguration. Option D is wrong because a distribute-list on R2 that filters the prefix would prevent R2 from installing or advertising the route, but it would not prevent R2 from sending an EIGRP reply; in fact, if R2 has no route, it would send a reply with an unreachable condition, which does not cause SIA.

Full explanation →

958

MCQhard

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# debug ip policy Policy routing debugging is on R1# *Mar 1 00:05:23.123: IP: s=192.168.1.10 (FastEthernet0/0), d=10.1.1.100, len 100, policy match *Mar 1 00:05:23.123: IP: s=192.168.1.10 (FastEthernet0/0), d=10.1.1.100, len 100, policy rejected What does this output indicate?

A.The packet matched the route-map but was not forwarded due to a failed next-hop check.

B.The packet was successfully policy-routed to the next-hop.

C.The route-map does not have a match clause for this packet.

D.The packet was dropped due to an ACL deny.

AnswerA

'policy rejected' indicates the packet matched but the set action could not be applied, often due to next-hop unreachability.

Why this answer

The debug output shows a packet from 192.168.1.10 to 10.1.1.100 that matches the policy but is then rejected. This typically occurs when the set clause specifies a next-hop that is unreachable or when verify-availability fails.

Full explanation →

959

MCQmedium

A network engineer runs the following command to verify IPv6 uRPF drops: R1# show ipv6 traffic | include verify 0 verify source drops, 0 verify source suppressed drops What does this output indicate?

A.No IPv6 packets have been dropped by uRPF checks.

B.uRPF is not configured on any interface.

C.uRPF is dropping all packets.

D.The router is not processing IPv6 traffic.

AnswerA

Correct. Zero drops indicate that all packets passed uRPF verification.

Why this answer

The output shows '0 verify source drops' and '0 verify source suppressed drops', which are the counters for IPv6 unicast Reverse Path Forwarding (uRPF) drops. Since both counters are zero, no IPv6 packets have been dropped by uRPF checks. This does not necessarily mean uRPF is not configured; it simply indicates that no packets have failed the uRPF verification process.

Exam trap

Cisco often tests the misconception that zero counters mean the feature is not configured, when in fact the feature may be configured and simply not dropping any packets.

How to eliminate wrong answers

Option B is wrong because the counters being zero do not prove that uRPF is not configured; uRPF could be configured and passing all traffic, or it could be configured with 'allow-default' or 'allow-none' options that suppress drops. Option C is wrong because zero drops indicate no packets are being dropped, not that all packets are dropped. Option D is wrong because the router is clearly processing IPv6 traffic (the command itself shows IPv6 traffic statistics), and zero drops do not imply a lack of IPv6 traffic processing.

Full explanation →

960

MCQhard

A network engineer is troubleshooting PBR on a Cisco router where traffic from source 10.1.2.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-TEST' is configured with 'match ip address 101' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for most traffic, but traffic from a specific host (10.1.2.100) is not being policy-routed. The engineer checks the ACL 101 and confirms it includes 10.1.2.0/24. What is the most likely cause?

A.The router is using CEF switching, and PBR is not applied to CEF-switched traffic without the 'ip route-cache policy' command.

B.The host 10.1.2.100 is sending traffic with a different source IP than expected.

C.The 'set ip next-hop' command requires the next-hop to be directly connected, and 192.168.1.2 is not reachable.

D.The route map is missing a 'sequence 10' statement; PBR requires explicit sequence numbers.

AnswerA

Correct because by default, PBR only affects process-switched packets; CEF-switched packets ignore PBR unless 'ip route-cache policy' is enabled.

Why this answer

If PBR is working for most traffic but not for a specific host, it could be due to the route map being applied to a subinterface while the host traffic arrives on a different subinterface, or the host traffic is being fast-switched and bypassing PBR. However, a common cause is that the host's traffic is being processed by CEF and the 'ip policy route-map' command does not affect CEF-switched packets unless 'ip route-cache policy' is enabled. In modern IOS, PBR by default only applies to process-switched packets unless 'ip route-cache policy' is configured.

Full explanation →

961

MCQmedium

Which statement correctly describes the behavior of the 'logging synchronous' command on a Cisco IOS device?

A.It disables all syslog messages on the console line.

B.It causes syslog messages to be displayed only after a carriage return.

C.It changes the severity level of messages sent to the console.

D.It enables logging to a synchronous serial interface.

AnswerB

Syslog messages are held until the user presses Enter, preventing interruption.

Why this answer

The 'logging synchronous' command prevents syslog messages from interrupting console command output by buffering them until the user finishes typing.

Full explanation →

962

MCQhard

An enterprise uses IP SLA to track a route to a remote site via two ISPs. Router R1 has: ip sla 3 icmp-echo 8.8.8.8 source-ip 10.0.0.1 frequency 10 ip sla schedule 3 life forever start-time now track 3 ip sla 3 reachability ip route 10.10.10.0 255.255.255.0 10.0.0.2 track 3 ip route 10.10.10.0 255.255.255.0 10.0.1.2 10 When the primary ISP fails, the backup route is used, but traffic to 10.10.10.0/24 is intermittently lost. Show output on R1: show ip route 10.10.10.0 Routing entry for 10.10.10.0/24 Known via "static", distance 1, metric 0 Last update from 10.0.0.2 on GigabitEthernet0/0 * 10.0.1.2, via GigabitEthernet0/1 What is the root cause?

A.The IP SLA probe to 8.8.8.8 is successful via the backup path, so the track remains up, but the primary next-hop 10.0.0.2 is down, causing traffic to be sent to a dead next-hop.

B.The backup route has a higher administrative distance, so it is not installed until the primary route is removed, but the track is not removing the primary route.

C.The IP SLA frequency is too low, causing a delay in track state change.

D.The track should be configured with 'ip sla 3 state' instead of 'reachability' to monitor the next-hop.

AnswerA

The track monitors reachability to 8.8.8.8, not the next-hop. If the backup path can reach 8.8.8.8, the track stays up, and the primary route remains installed even though the next-hop is unreachable.

Why this answer

The tracked route is still present in the routing table even though the track is down. This happens because the track is only removed if the track state is 'down', but the show output shows the route is still there. The likely cause is that the track is not properly associated with the route, or the route has a higher administrative distance that is not being overridden.

However, the correct answer is that the track 3 is configured with 'reachability' but the IP SLA probe may be successful due to a different path, so the track remains up, but the primary next-hop is actually unreachable, causing packet loss.

Full explanation →

963

MCQmedium

Examine this OSPF configuration on router R5: router ospf 1 network 10.0.0.0 0.255.255.255 area 0 passive-interface default no passive-interface GigabitEthernet0/0 What is the effect of the passive-interface default command?

A.All interfaces except GigabitEthernet0/0 will be passive; GigabitEthernet0/0 will send and receive OSPF hellos.

B.All interfaces are passive, including GigabitEthernet0/0, because the no passive-interface command is ignored.

C.Only interfaces with network statements will be affected; other interfaces remain active.

D.The configuration is invalid because passive-interface default cannot be used with OSPF.

AnswerA

Correct. The default passive is overridden for GigabitEthernet0/0.

Why this answer

The passive-interface default command sets all interfaces as passive by default, meaning they will not send OSPF hello packets or form adjacencies. The no passive-interface command then overrides this for the specified interface, allowing it to form adjacencies.

Full explanation →

964

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 180 10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (50 matches) 20 permit tcp 192.168.2.0 0.0.0.255 any eq 443 (30 matches) 30 deny ip any any (5 matches) Based on this output, what is the problem?

A.Traffic from 192.168.1.0/24 to port 80 is permitted.

B.Traffic from 192.168.2.0/24 to port 443 is denied.

C.All traffic from 192.168.1.0/24 is permitted.

D.The ACL is correctly configured to allow only specific web traffic.

AnswerA

Line 10 permits that traffic with 50 matches.

Why this answer

The ACL explicitly permits TCP traffic from the 192.168.1.0/24 network to any destination on port 80, as shown by the first entry with 50 matches. The output confirms that this traffic is being allowed, so there is no problem with that specific rule.

Exam trap

Cisco often tests the ability to interpret ACL match counters and recognize that a working ACL with expected matches does not indicate a problem, leading candidates to incorrectly assume a misconfiguration when none exists.

How to eliminate wrong answers

Option B is wrong because the ACL permits TCP traffic from 192.168.2.0/24 to any destination on port 443, as shown by the second entry with 30 matches, so it is not denied. Option C is wrong because the ACL does not permit all traffic from 192.168.1.0/24; it only permits TCP traffic to port 80, and any other traffic from that subnet would be denied by the implicit deny all at the end of the ACL (or the explicit deny ip any any entry). Option D is wrong because the ACL is not correctly configured to allow only specific web traffic; it permits HTTP (port 80) and HTTPS (port 443) but also includes an explicit deny ip any any, which is redundant and does not cause a problem, but the question asks for the problem, and there is no problem with the configuration as shown—the ACL is functioning as designed.

Full explanation →

965

MCQhard

A network engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using eBGP with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip cef vrf CUSTOMER 10.2.2.0 command on PE1 shows the next-hop as 192.168.1.2 and the output interface as GigabitEthernet0/0. The show mpls forwarding-table 192.168.1.2 detail command on PE1 shows a label but the outgoing interface is 'aggregate'. What is the most likely cause?

A.The PE2 loopback address is accidentally configured on PE1.

B.LDP is not enabled on the core-facing interfaces.

C.The VRF route-target import is misconfigured.

D.The MP-BGP session is using the wrong update-source.

AnswerA

Correct: If PE1 has the same loopback IP, it will treat itself as the egress for that prefix, causing 'aggregate' in the LFIB.

Why this answer

The label for the BGP next-hop is pointing to 'aggregate', which means the router is the egress LSR for that prefix. This occurs when the PE2 loopback is also configured on PE1, causing the router to think it is the destination. The traffic is then dropped or looped because the router tries to process the packet locally instead of forwarding it.

Full explanation →

966

MCQmedium

A network engineer runs the following command on Router R1: R1# show mpls ldp neighbor Peer LDP Ident: 192.168.1.2:0, Local LDP Ident: 192.168.0.1:0 TCP connection: 192.168.1.2.646 - 192.168.0.1.49876 State: Oper; Msgs sent/rcvd: 100/105; Downstream on demand Up time: 00:10:30 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 192.168.1.2 Addresses bound to peer LDP Ident: 192.168.1.2 10.1.1.2 Based on this output, what is the state of the LDP session?

A.The LDP session is down due to a TCP connection issue.

B.The LDP session is operational and exchanging label information.

C.The LDP session is in the process of being established.

D.The LDP session is using downstream on demand mode, which is a problem.

AnswerB

State Oper indicates the session is up and running.

Why this answer

The output shows 'State: Oper', which means the LDP session is operational. The 'Downstream on demand' label distribution mode is a valid mode (RFC 5036) and does not indicate a problem. The session is exchanging label information, as evidenced by the 'Oper' state and the presence of peer addresses.

Exam trap

Cisco often tests the misconception that 'Downstream on demand' is a problem or that any mention of 'downstream' implies a failure, when in fact it is a standard operational mode for LDP.

How to eliminate wrong answers

Option A is wrong because the TCP connection is established (TCP connection: 192.168.1.2.646 - 192.168.0.1.49876) and the state is 'Oper', not down. Option C is wrong because the state is 'Oper', not 'Initialized' or 'OpenRec', which would indicate an ongoing establishment process. Option D is wrong because 'Downstream on demand' is a valid label distribution mode per RFC 5036; it is not inherently a problem and is commonly used in MPLS LDP configurations.

Full explanation →

967

MCQmedium

Which loop prevention mechanism is inherent to 6to4 tunneling?

A.Split horizon

B.Reverse path forwarding (RPF) check

C.Embedded IPv4 address validation

D.TTL decrement

AnswerC

6to4 validates that the source IPv6 address's embedded IPv4 matches the tunnel source to prevent spoofing and loops.

Why this answer

6to4 tunneling uses an embedded IPv4 address in the IPv6 prefix (2002::/16) to automatically derive the tunnel destination. This inherent validation prevents routing loops by ensuring that a 6to4 router only accepts packets whose source IPv4 address matches the embedded address in the IPv6 source prefix, rejecting mismatched or spoofed traffic that could cause loops.

Exam trap

Cisco often tests the distinction between generic loop prevention mechanisms (like TTL or split horizon) and the specific, inherent validation unique to 6to4 tunneling, leading candidates to overlook the embedded IPv4 address check.

How to eliminate wrong answers

Option A is wrong because split horizon is a mechanism used in distance-vector routing protocols (e.g., RIP, EIGRP) to prevent routing loops by not advertising routes back out the interface they were learned on; it is not inherent to 6to4 tunneling. Option B is wrong because reverse path forwarding (RPF) check is used in multicast routing and unicast reverse path forwarding (uRPF) for anti-spoofing, but it is not a built-in loop prevention mechanism specific to 6to4 tunnels. Option D is wrong because TTL decrement is a standard IP mechanism to prevent packets from looping indefinitely by limiting their hop count, but it is not unique or inherent to 6to4 tunneling; it applies to all IP packets.

Full explanation →

968

MCQhard

A network engineer runs the following command to troubleshoot a VRF-Lite CoPP issue: R1# show policy-map control-plane input class CoPP-ACL vrf CUSTOMER_I Output: Class-map: CoPP-ACL (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop What does this output indicate?

A.The CoPP policy is dropping all packets that match access-group 100.

B.The CoPP policy is rate-limiting traffic to 8000 bps, but no traffic has matched the class yet.

C.The CoPP policy has matched many packets and is dropping them due to exceeding the rate.

D.The CoPP policy is not applied to the control plane for this VRF.

AnswerB

Correct. The police rate is 8000 bps, but all counters are zero, so no matching traffic has been seen.

Why this answer

The 'show policy-map control-plane input class vrf' command displays CoPP policy statistics for a specific VRF. The output shows class CoPP-ACL matching access-group 100, with a police rate of 8000 bps. All counters are zero, indicating no traffic has matched this class.

This could mean the ACL is not matching any packets, or no traffic is being sent to the control plane for this VRF.

Full explanation →

969

MCQeasy

A network engineer runs the following command to troubleshoot an Administrative Distance issue: R1# show ip route 172.16.0.0 255.255.0.0 Routing entry for 172.16.0.0/16 Known via "ospf 1", distance 110, metric 20, type intra area Last update from 10.1.1.2 on GigabitEthernet0/0, 00:00:05 ago Routing Descriptor Blocks: * 10.1.1.2, from 2.2.2.2, 00:00:05 ago, via GigabitEthernet0/0 Route metric is 20, traffic share count is 1 What does this output indicate?

A.The route is an OSPF intra-area route with administrative distance 110, which is the default for OSPF.

B.The route is an OSPF external route with administrative distance 110.

C.The route has an administrative distance of 20 because it is an OSPF route.

D.The route is preferred over an EIGRP route with AD 90.

AnswerA

OSPF routes have a default AD of 110.

Why this answer

The output shows an OSPF intra-area route with administrative distance 110, which is the default for OSPF. The metric is 20, and the route is learned from neighbor 2.2.2.2.

Full explanation →

970

MCQeasy

In a standard IPv4 ACL, what is the range of valid numbers for the access-list number?

A.1-99 and 1300-1999

B.100-199 and 2000-2699

C.1-99 only

D.1-199

AnswerA

Correct. These are the standard ACL number ranges.

Why this answer

Standard IPv4 ACLs use access-list numbers 1-99 and 1300-1999 to filter traffic based solely on source IP address. The expanded range 1300-1999 was introduced to provide additional standard ACL identifiers beyond the original 1-99, allowing more granular control without overlapping with extended ACL ranges.

Exam trap

Cisco often tests the expanded standard ACL range (1300-1999) to catch candidates who only memorize the original 1-99 range, assuming standard ACLs are limited to that smaller set.

How to eliminate wrong answers

Option B is wrong because 100-199 and 2000-2699 are the valid ranges for extended IPv4 ACLs, not standard ACLs. Option C is wrong because it omits the expanded standard ACL range 1300-1999, which is also valid per Cisco IOS. Option D is wrong because 100-199 is reserved for extended ACLs, and standard ACLs do not include numbers 100-199.

Full explanation →

971

MCQmedium

A network engineer runs the following command on Router R1: R1# show logging Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, small buffer) Console logging: level debugging, 37 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level informational, 5 messages logged, xml disabled, filtering disabled Logging Exception size (4096 bytes) Count and timestamp logging messages: disabled Persistent logging: disabled No active filter modules. Trap logging: level informational, 0 message lines logged Logging to 192.168.1.100 (udp port 514, audit disabled, link up), 0 message lines logged, xml disabled, filtering disabled Logging Source Interface: Loopback0 Log Buffer (4096 bytes): *Mar 1 00:01:23.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up *Mar 1 00:02:34.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up Based on this output, which statement is correct?

A.The syslog server at 192.168.1.100 is receiving messages because the link is up.

B.Buffer logging is set to debugging level, so all debug messages are stored in the buffer.

C.Console logging is set to debugging level, meaning all debug messages will appear on the console.

D.The logging buffer size is 4096 bytes, which is sufficient to store all messages without overwriting.

AnswerC

The output explicitly shows 'Console logging: level debugging', so all messages at debugging level and below will be displayed on the console.

Why this answer

The output shows that buffer logging is set to level informational, but the buffer only contains 4096 bytes and has logged only 5 messages. The trap logging (syslog server) is set to informational but has logged 0 messages, and the server 192.168.1.100 is reachable (link up). The key issue is that the syslog server is not receiving messages despite being configured correctly, likely due to the source interface being Loopback0 which may not have a route to the server or the server is not processing the messages.

However, the question asks for a correct statement based on the output. The correct answer is that console logging is set to debugging, which is the most detailed level, and this is confirmed by the output showing 'level debugging' for console logging.

Full explanation →

972

Multi-Selectmedium

Which TWO configuration steps are required to successfully redistribute OSPF routes into EIGRP on a Cisco router? (Choose TWO.)

Select 2 answers

A.Enter EIGRP router configuration mode using the 'router eigrp <as-number>' command.

B.Configure a route-map under OSPF to match OSPF routes for redistribution.

C.Use the 'redistribute eigrp <as-number>' command under OSPF router configuration mode.

D.Set a seed metric for EIGRP using the 'default-metric' command or specify metric in the redistribute command.

E.Issue the 'default-information originate' command under OSPF to advertise redistributed routes.

AnswersA, D

Correct: You must be in EIGRP configuration mode to issue the redistribute command.

Why this answer

To redistribute OSPF into EIGRP, you must enter EIGRP configuration mode and use the redistribute command. Additionally, you must set a seed metric for EIGRP because EIGRP does not have a default metric for redistributed routes. Option A is correct because you need to enter EIGRP router configuration.

Option D is correct because you must set a metric (e.g., bandwidth, delay) for the redistributed routes. Option B is incorrect because you do not need to explicitly match routes in OSPF; you can redistribute all OSPF routes. Option C is incorrect because the redistribute command is under EIGRP, not OSPF.

Option E is incorrect because the default-information originate command is for OSPF to inject a default route, not for redistribution.

Full explanation →

973

MCQhard

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP class-map: MANAGEMENT (match-all) 100 packets, 5000 bytes 5 minute offered rate 0 bps police: 8000 bps, 1500 limit, 1500 extended limit conformed 95 packets, 4750 bytes; action: transmit exceeded 5 packets, 250 bytes; action: drop conformed 0 bps, exceed 0 bps class-map: ROUTING (match-all) 200 packets, 10000 bytes 5 minute offered rate 0 bps police: 16000 bps, 3000 limit, 3000 extended limit conformed 200 packets, 10000 bytes; action: transmit exceeded 0 packets, 0 bytes; action: drop conformed 0 bps, exceed 0 bps Based on this output, what is happening to traffic matching the MANAGEMENT class?

A.All management traffic is being transmitted without any drops.

B.Some management traffic is being dropped because it exceeds the configured police rate.

C.The management traffic is being rate-limited but no packets are dropped.

D.The police rate is too high, causing all traffic to be dropped.

AnswerB

The exceeded counter shows 5 packets dropped.

Why this answer

The output shows that the MANAGEMENT class has a police rate of 8000 bps. Out of 100 packets, 5 packets were exceeded and dropped because they exceeded this configured rate. This confirms that some management traffic is being dropped due to policing, making option B correct.

Exam trap

Cisco often tests the distinction between 'policing' (which drops excess traffic) and 'shaping' (which buffers excess traffic), and candidates may mistakenly think that a policer only rate-limits without dropping packets.

How to eliminate wrong answers

Option A is wrong because the output clearly shows 5 packets were dropped (exceeded action: drop), so not all management traffic is transmitted. Option C is wrong because packets are indeed dropped (5 exceeded packets), not just rate-limited without drops. Option D is wrong because the police rate is not too high; only 5 packets were dropped, not all traffic, and the conformed count shows most traffic is transmitted.

Full explanation →

974

MCQmedium

Which of the following is true regarding the default behavior of NAT in Cisco IOS when handling ICMP traffic?

A.ICMP traffic is not translated by NAT unless explicitly configured.

B.ICMP NAT entries use the same timeout as TCP entries by default.

C.ICMP NAT entries timeout after 60 seconds by default.

D.ICMP NAT entries are permanent and do not time out.

AnswerC

Correct. The default timeout for ICMP NAT entries is 60 seconds in Cisco IOS.

Why this answer

C is correct because Cisco IOS NAT uses a default timeout of 60 seconds for ICMP NAT entries. When an ICMP packet is translated, the router creates a NAT translation entry, and if no subsequent traffic matches that entry within 60 seconds, the entry is removed. This behavior is independent of TCP or UDP timeouts and is specific to ICMP.

Exam trap

Cisco often tests the misconception that ICMP NAT entries are permanent or use the same timeout as TCP, when in fact they have a distinct and much shorter default timeout of 60 seconds.

How to eliminate wrong answers

Option A is wrong because ICMP traffic is translated by NAT by default; no explicit configuration is required for ICMP to be subject to NAT. Option B is wrong because ICMP NAT entries do not use the same timeout as TCP entries; TCP entries default to 86400 seconds (24 hours) while ICMP defaults to 60 seconds. Option D is wrong because ICMP NAT entries are not permanent; they time out after 60 seconds of inactivity by default, though the timeout can be adjusted with the 'ip nat translation icmp-timeout' command.

Full explanation →

975

MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/BDR 00:00:35 FE80::2 GigabitEthernet0/0 10.1.1.3 1 FULL/DR 00:00:32 FE80::3 GigabitEthernet0/1 Based on this output, which statement is correct regarding OSPFv3?

A.Router R1 is the DR on the segment connected to GigabitEthernet0/0.

B.Router R1 has a full adjacency with both neighbors in OSPFv3.

C.The OSPFv3 process is using IPv4 addresses as router IDs.

D.Router R1 is not receiving hello packets from 10.1.1.3.

AnswerB

Both neighbors show FULL state, indicating complete adjacency in OSPFv3.

Why this answer

The output shows OSPFv3 neighbors. The neighbor 10.1.1.2 is in state FULL/BDR, meaning it is the Backup Designated Router. The neighbor 10.1.1.3 is in state FULL/DR, meaning it is the Designated Router.

The addresses are link-local IPv6 addresses.

Full explanation →

Page 13 of 27

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 Technologies VPN Technologies Infrastructure Security Infrastructure Services

See all domains with question counts →