Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 976–1050

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 13

Page 14 of 27

Page 15
976
Multi-Selecthard

Which TWO statements about Flexible NetFlow flow monitors and flow exporters are true? (Choose TWO.)

Select 2 answers
A.A flow monitor can reference only one flow record, but multiple flow monitors can reference the same flow record.
B.A flow exporter can be referenced by only one flow monitor to avoid export conflicts.
C.The default export format for Flexible NetFlow is NetFlow version 5.
D.The flow monitor is applied to an interface using the 'ip flow-export' command.
E.A flow exporter can be referenced by multiple flow monitors simultaneously.
AnswersA, E

Correct. Each flow monitor is configured with a single flow record, but that record can be reused in multiple monitors.

Why this answer

Flexible NetFlow separates flow monitoring into three components: flow record (defines what to collect), flow monitor (applies the record and associates an exporter), and flow exporter (defines export parameters). A flow monitor can reference only one flow record, but multiple flow monitors can reference the same flow record. A flow exporter can be shared by multiple flow monitors.

The default export format is NetFlow version 9, not v5. The flow monitor is applied to an interface using the 'ip flow monitor' command, not 'ip flow-export'.

Full explanation →
977
Multi-Selecthard

An engineer is troubleshooting an issue where an SNMPv2c NMS cannot poll interface counters on a Cisco router. Which THREE commands can be used to verify the SNMP configuration and connectivity? (Choose THREE.)

Select 3 answers
A.show snmp
B.show snmp mib ifmib ifindex
C.show ip snmp
D.show snmp community
E.debug snmp packet
AnswersA, B, D

This command displays SNMP configuration, including community strings, trap receivers, and packet statistics.

Why this answer

The 'show snmp' command displays the overall SNMP agent status, including enabled traps, system contact, and location. This verifies that SNMP is configured and operational on the router, which is essential for an NMS to poll interface counters.

Exam trap

Cisco often tests the distinction between verification commands (show) and troubleshooting commands (debug), and candidates may incorrectly select 'debug snmp packet' as a verification tool, forgetting that debug commands are resource-intensive and used only after initial verification fails.

Full explanation →
978
MCQhard

A network engineer configures Control Plane Policing (CoPP) on a DMVPN hub router to protect the control plane. The policy includes a class-map matching NHRP traffic and a police rate of 1000 pps. Unexpectedly, after applying the policy, NHRP registrations from spokes fail intermittently, and debug shows packets being dropped by CoPP. Which is the most likely explanation?

A.The CoPP policy's class-default has a lower police rate or is set to drop, and NHRP traffic is not explicitly matched in a higher class, causing it to fall into class-default and be dropped.
B.The police rate of 1000 pps is too high for the hub's CPU, causing the router to drop packets due to CPU overload.
C.The CoPP policy is applied to the wrong interface; it should be applied to the tunnel interface, not the physical interface.
D.The NHRP packets are being classified as 'critical' traffic, and the CoPP policy has a lower priority for critical traffic.
AnswerA

If NHRP traffic is not classified in a specific class, it matches class-default, which may have a restrictive policy, leading to drops.

Why this answer

CoPP rate-limits control plane traffic. If the police rate is set in packets per second (pps), but the actual NHRP registration traffic is bursty (e.g., multiple spokes registering simultaneously), the policer may drop packets. The corner case is that the default CoPP class-default may also match NHRP traffic if not explicitly classified, and the class-default may have a lower rate or be set to drop.

Additionally, CoPP uses a token bucket; if the rate is too low or the burst size is insufficient, packets are dropped. The engineer should ensure that NHRP traffic is matched in a dedicated class with appropriate rate and burst.

Full explanation →
979
MCQmedium

Examine the following configuration on a PE router: ip vrf CUSTOMER-E rd 400:1 route-target export 400:1 route-target import 400:2 ! interface GigabitEthernet0/5 ip vrf forwarding CUSTOMER-E ip address 10.4.4.1 255.255.255.252 ! router bgp 65000 neighbor 10.0.0.1 remote-as 65000 neighbor 10.0.0.1 update-source Loopback0 ! address-family vpnv4 neighbor 10.0.0.1 activate neighbor 10.0.0.1 send-community extended exit-address-family ! address-family ipv4 vrf CUSTOMER-E neighbor 10.4.4.2 remote-as 65003 neighbor 10.4.4.2 activate neighbor 10.4.4.2 route-map SET-COMMUNITY in exit-address-family ! route-map SET-COMMUNITY permit 10 set community 100:100 What is the effect of the route-map on the incoming routes from the CE?

A.The route-map will set the standard community 100:100 on the routes received from the CE, but the RT is still determined by the route-target export command.
B.The route-map will override the route-target export and set the RT to 100:100.
C.The route-map will cause the BGP session to reset because the community format is incorrect.
D.The route-map will have no effect because the community is not sent to the CE.
AnswerA

The route-map modifies the standard community, which is a different attribute. The RT is set by the VRF configuration and is not affected by this route-map.

Why this answer

The route-map is applied inbound on the eBGP session from the CE. It sets a standard community on the routes. However, for MPLS L3VPN, the extended community (route-target) is what matters for VRF import/export.

The standard community set here does not affect the RT. The route-map will modify the standard community attribute, but the RT is still set by the route-target export command. The route-map does not interfere with the VPNv4 process.

Full explanation →
980
MCQhard

An engineer configures ERSPAN on a Cisco router to monitor traffic from a tunnel interface. The mirrored traffic shows the tunnel's inner IP headers, but the outer encapsulation is missing. What is the most likely cause?

A.ERSPAN on a tunnel interface captures the inner IP packet, not the encapsulated GRE/IPsec packet.
B.The ERSPAN session is configured with 'erspan-type' that strips the outer header.
C.The collector is not configured to decode GRE headers.
D.The tunnel interface is in a VRF, causing the outer header to be removed.
AnswerA

The tunnel interface processes the inner packet; the outer encapsulation is added later on the physical interface.

Why this answer

When monitoring a tunnel interface with ERSPAN, the router captures the traffic at the point where it enters the tunnel (before encapsulation) or exits (after decapsulation). To capture the encapsulated packets, the source must be the physical egress interface, not the tunnel interface. By default, ERSPAN on a tunnel interface shows the inner packet.

Full explanation →
981
MCQmedium

What is the default SNMP trap queue length on Cisco IOS?

A.10
B.100
C.Unlimited
D.5
AnswerA

The default queue length is 10.

Why this answer

The default SNMP trap queue length on Cisco IOS is 10. This value defines the maximum number of SNMP traps that can be queued in the trap buffer before they are sent to the configured SNMP trap receivers. If the queue is full and a new trap is generated, the oldest trap is dropped to make room for the new one.

Exam trap

Cisco often tests the default SNMP trap queue length as a specific numeric value, and the trap here is that candidates confuse it with other default SNMP parameters (like the default SNMP community string or default SNMP version) or assume a larger value like 100 is the default due to common practice in production networks.

How to eliminate wrong answers

Option B (100) is wrong because the default SNMP trap queue length is 10, not 100; 100 is a common value used in some other network devices or configurations but not the Cisco IOS default. Option C (Unlimited) is wrong because the trap queue has a finite default size of 10; an unlimited queue would risk memory exhaustion and is not the default behavior. Option D (5) is wrong because while 5 might seem plausible as a small queue, the actual default is 10, and this value can be modified with the 'snmp-server queue-length' command.

Full explanation →
982
Multi-Selecthard

Which THREE commands are used to troubleshoot a SPAN session on a Cisco Catalyst switch? (Choose THREE.)

Select 3 answers
A.show monitor session 1
B.show monitor
C.debug monitor
D.show running-config | include monitor
E.show ip interface brief
AnswersA, B, C

Displays the operational status and configuration of a specific SPAN session.

Why this answer

'show monitor session 1' provides details of the session. 'show monitor' lists all sessions. 'debug monitor' enables debugging for SPAN operations. 'show running-config | include monitor' shows the configuration but is not a direct troubleshooting command for operational issues. 'show ip interface brief' shows IP status, not SPAN.

Full explanation →
983
MCQmedium

Consider the following configuration: ipv6 access-list FILTER permit ipv6 2001:db8:3::/48 any deny ipv6 any any interface GigabitEthernet0/5 ipv6 traffic-filter FILTER in ipv6 verify unicast source reachable-via rx A packet arrives on GigabitEthernet0/5 with source 2001:db8:3::100 and destination 2001:db8:4::1. The route for 2001:db8:3::/48 points out interface GigabitEthernet0/6. What happens?

A.The packet is permitted because the ACL matches and uRPF is not applied.
B.The packet is dropped by uRPF because strict mode requires the source to be reachable via the receiving interface.
C.The packet is dropped by the ACL because the deny statement blocks all traffic.
D.The packet is permitted because uRPF only checks destination addresses.
AnswerB

Strict uRPF (rx) fails because the return route uses a different interface.

Why this answer

The packet is dropped by uRPF (unicast Reverse Path Forwarding) in strict mode because the `ipv6 verify unicast source reachable-via rx` command checks that the source address 2001:db8:3::100 is reachable via the receiving interface (GigabitEthernet0/5). The route for the source prefix 2001:db8:3::48 points out GigabitEthernet0/6, not the receiving interface, so uRPF fails and drops the packet before the ACL is evaluated.

Exam trap

Cisco often tests the order of operations: uRPF is checked before ACLs, so candidates mistakenly think the ACL permit will allow the packet, but uRPF drops it first.

How to eliminate wrong answers

Option A is wrong because uRPF is applied (the `ipv6 verify unicast source reachable-via rx` command is present) and it will drop the packet before the ACL is checked; the ACL is not the only filter in play. Option C is wrong because the ACL's permit statement matches the source prefix 2001:db8:3::/48, so the packet would be permitted by the ACL; the deny statement only applies to traffic not matching the permit. Option D is wrong because uRPF checks the source address, not the destination address; it verifies that the source is reachable via the receiving interface.

Full explanation →
984
MCQeasy

In OSPF, what is the default hello interval on a point-to-point network type?

A.10 seconds
B.30 seconds
C.5 seconds
D.40 seconds
AnswerA

Correct. Point-to-point and broadcast networks use a 10-second hello interval.

Why this answer

OSPF default hello interval is 10 seconds for broadcast and point-to-point networks, and 30 seconds for NBMA networks. This is defined in RFC 2328.

Full explanation →
985
MCQhard

An MPLS network is experiencing label distribution failures. Router R1 (LSR) has the following configuration: mpls ldp neighbor 10.0.0.2 password cisco. Router R2 shows: 'show mpls ldp neighbor' lists R1 as 'Oper Down' with reason 'TCP MD5 authentication failure'. R1's 'show mpls ldp neighbor' shows R2 as 'Oper Down' with the same reason. Both routers have the same password configured. What is the root cause?

A.The LDP neighbor IP address configured on R1 does not match R2's LDP transport address, causing MD5 authentication to fail.
B.The password is not configured globally under 'mpls ldp password' on both routers.
C.The MPLS LDP session is using a different port number, causing authentication to be ignored.
D.The interface between R1 and R2 has 'mpls ip' disabled.
AnswerA

The 'mpls ldp neighbor' command expects the neighbor's LDP transport address (usually the router ID). If R1 uses 10.0.0.2 but R2's transport address is different (e.g., 10.0.0.3), the TCP connection uses a different IP, and MD5 authentication fails because the password is associated with the wrong IP.

Why this answer

LDP uses TCP for session establishment, and MD5 authentication is configured via the 'mpls ldp neighbor' command. However, the password must match on both ends, and the command must specify the correct neighbor IP. If the IP address specified is incorrect (e.g., using a loopback IP instead of the transport address), the authentication will fail.

Additionally, the 'mpls ldp password' command under the interface or global configuration may be required. In this scenario, the root cause is likely that the neighbor IP in the command does not match the actual LDP transport address (e.g., R1 uses 10.0.0.2 but R2's LDP transport address is 10.0.0.3).

Full explanation →
986
MCQmedium

Consider this IP SLA configuration on router R6: ip sla 60 udp-echo 203.0.113.1 2000 source-ip 198.51.100.1 frequency 20 ip sla schedule 60 life forever start-time now What is the purpose of this configuration?

A.It tests UDP connectivity by sending a UDP packet and expecting a response.
B.It tests ICMP echo instead of UDP.
C.It measures jitter and packet loss.
D.It will only work if the destination is a Cisco router.
AnswerA

UDP echo operation sends a UDP datagram and waits for a reply to measure round-trip time.

Why this answer

The configuration sends UDP packets to destination 203.0.113.1 on port 2000, sourced from 198.51.100.1, every 20 seconds. It tests UDP connectivity and response time.

Full explanation →
987
MCQmedium

A network engineer is troubleshooting a DMVPN phase 2 network where the hub router is not forming an NHRP adjacency with a spoke. The spoke router is configured with 'ip nhrp nhs 10.0.0.1' and 'ip nhrp map 10.0.0.1 192.168.1.1'. The hub's tunnel interface IP is 10.0.0.1, and the physical interface IP is 192.168.1.1. The engineer pings the hub's tunnel IP from the spoke and it succeeds. However, 'show ip nhrp' on the spoke shows no NHRP entries. What is the most likely cause?

A.The hub router has 'ip nhrp authentication DMVPN' configured, but the spoke does not.
B.The spoke's tunnel interface is in a different VRF than the hub's.
C.The hub's tunnel interface has 'no ip nhrp server-only' configured.
D.The spoke's NHRP map is incorrect; it should map the hub's tunnel IP to the hub's tunnel IP.
AnswerA

Correct because NHRP authentication must match between hub and spoke for registration to succeed.

Why this answer

NHRP registration requires the spoke to send a Registration Request to the hub. If the hub does not respond, the spoke will not have NHRP entries. A common cause is that the hub's NHRP authentication is configured with a password, but the spoke's NHRP authentication is missing or mismatched.

Full explanation →
988
MCQhard

A network engineer runs the following command on Router R1: R1# show event manager history events Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Flap 3 00:01:32 UTC Mar 1 syslog EIGRP_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Flap Based on this output, what is the most likely problem?

A.The EEM policies are not configured correctly.
B.The router is experiencing network instability causing repeated neighbor state changes.
C.The EEM applet policies are disabled.
D.The syslog server is not reachable.
AnswerB

The repeated events within seconds indicate flapping, likely due to link issues or routing problems.

Why this answer

The 'show event manager history events' command shows the last triggered events. The output shows repeated syslog events for EIGRP neighbor down and OSPF neighbor flap within a short timeframe, indicating a flapping condition. The correct answer is that the router is experiencing network instability causing repeated neighbor state changes.

Full explanation →
989
MCQhard

A network engineer is troubleshooting a DHCPv4 relay scenario where clients on subnet 10.1.1.0/24 are unable to obtain IP addresses from a DHCP server at 192.168.1.10. The router interface Gi0/0 (10.1.1.1/24) has 'ip helper-address 192.168.1.10' configured. The engineer captures packets and sees DHCP DISCOVER messages sourced from 10.1.1.1 being sent to 192.168.1.10, but no replies are seen. The server is reachable via ping from the router. What is the most likely cause?

A.The DHCP server does not have a route to 10.1.1.0/24.
B.The DHCP server is not configured with a scope for subnet 10.1.1.0/24.
C.The 'ip helper-address' command should be configured on the server-facing interface, not the client-facing interface.
D.The router needs the 'ip dhcp relay information option' command.
AnswerB

Correct because if the server has no scope for the client subnet, it will ignore the DISCOVER message and not send any reply, even though the relayed packet reaches the server.

Why this answer

The DHCP server may not have a route back to the client subnet (10.1.1.0/24) or the server's default gateway does not have a route. The relay agent sets the gateway IP address (giaddr) to the interface IP (10.1.1.1), and the server sends the OFFER back to that giaddr. If the server cannot reach 10.1.1.1, the reply is lost.

However, the engineer confirms the server is reachable via ping, so the issue is likely that the server is not configured with a scope for the 10.1.1.0/24 subnet, causing it to drop the DISCOVER.

Full explanation →
990
MCQeasy

A network engineer configures SNMPv2c on router R3 with 'snmp-server community cisco RO' and 'snmp-server community cisco RW'. The NMS can poll read-only data but fails when trying to write a configuration value. The NMS uses the RW community string. What is the most likely cause?

A.The community string 'cisco' is used for both RO and RW; the router applies the first matching community, which is RO.
B.The NMS is sending the community string in uppercase, but the router expects lowercase.
C.The router needs the 'snmp-server enable traps' command to allow write operations.
D.The NMS must use SNMPv3 for write operations; SNMPv2c does not support writes.
AnswerA

Correct because identical community strings cause the router to use the RO access, preventing writes.

Why this answer

When two SNMPv2c community strings are identical (both 'cisco'), the router applies the first matching entry in its configuration. Since 'snmp-server community cisco RO' is configured before 'snmp-server community cisco RW', the router treats all requests using 'cisco' as read-only, regardless of the intended access level. This prevents write operations even when the NMS correctly sends the RW community string.

Exam trap

Cisco often tests the subtlety that identical community strings with different access levels cause the first-configured entry to take precedence, leading candidates to overlook the order of configuration lines.

How to eliminate wrong answers

Option B is wrong because SNMPv2c community strings are case-sensitive, but the NMS is already using the correct case ('cisco'); the issue is not case mismatch. Option C is wrong because the 'snmp-server enable traps' command is for sending SNMP traps, not for enabling write operations; write access is controlled solely by the RW community string. Option D is wrong because SNMPv2c fully supports write operations (SET requests) when a valid RW community is configured; SNMPv3 is not required for writes.

Full explanation →
991
MCQmedium

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

A.deny ipv6 any 2001:db8:1::/48
B.deny ipv6 2001:db8:1::/48 any
C.deny ipv6 any host 2001:db8:1::1
D.deny ipv6 2001:db8:1::/48 2001:db8:1::/48
AnswerA

This correctly denies all IPv6 traffic from any source to the specified destination prefix.

Why this answer

The IPv6 access-list entry 'deny ipv6 any 2001:db8:1::/48' uses the correct syntax: the source is 'any' (all traffic), and the destination is the prefix 2001:db8:1::/48, which matches all addresses within that /48 range. This entry denies traffic from any source to the entire destination prefix, as required by the question.

Exam trap

Cisco often tests the order of source and destination in ACL entries, where candidates mistakenly reverse them (as in Option B) or use a host keyword instead of a prefix (as in Option C), thinking it matches a range.

How to eliminate wrong answers

Option B is wrong because it reverses the source and destination: 'deny ipv6 2001:db8:1::/48 any' denies traffic from the prefix 2001:db8:1::/48 to any destination, which is the opposite of the requirement. Option C is wrong because it uses 'host 2001:db8:1::1', which matches only a single host address, not the entire /48 prefix. Option D is wrong because it specifies the same prefix for both source and destination, denying traffic from 2001:db8:1::/48 to itself, which does not deny traffic from any source to the destination prefix.

Full explanation →
993
MCQmedium

In BGP, what is the effect of using a route-map with a set community command but without the additive keyword?

A.The specified community is added to the existing communities.
B.The existing communities are overwritten by the specified community.
C.The community attribute is not modified; the set command is ignored.
D.The route is denied if it already has communities.
AnswerB

Correct. Without additive, set community replaces the community attribute.

Why this answer

When set community is used without the additive keyword, it replaces any existing community attributes on the route with the specified community. With the additive keyword, the specified community is added to the existing communities.

Full explanation →
994
MCQhard

A network engineer runs the following command on Router R1: R1# show ip sla configuration 1 IP SLAs Infrastructure Engine-II Entry number: 1 Owner: Tag: Type of operation to perform: icmp-echo Target address: 192.168.1.1 Source address: 0.0.0.0 Source interface: none Type Of Service parameter: 0 Verify data: No Operation timeout (milliseconds): 5000 Request size (ARR data block): 28 Threshold (milliseconds): 100 Frequency (seconds): 10 Life (seconds): Forever Ageout (seconds): 0 Based on this output, what is the primary problem with this IP SLA configuration?

A.The threshold value is too low, causing frequent threshold violations.
B.The source address is set to 0.0.0.0, which may cause the probe to fail if the router does not have a valid route.
C.The frequency is set to 10 seconds, which is too fast for accurate measurements.
D.The operation timeout is too high, causing delays in failure detection.
AnswerB

A source address of 0.0.0.0 means the router uses the IP of the egress interface, but if that interface is down or has no IP, the probe may fail. This is a common misconfiguration.

Why this answer

The source address is 0.0.0.0 and no source interface is configured. This means the router will use the outgoing interface's IP address, which might not be routable or expected. However, the key clue is that the threshold is set to 100 ms, but the operation timeout is 5000 ms.

If the RTT exceeds 100 ms, the operation will report 'Over threshold' but not necessarily fail. The question focuses on configuration issues; the source address being 0.0.0.0 is a common misconfiguration that can cause problems if the router cannot reach the target.

Full explanation →
995
MCQhard

R1 and R2 are eBGP peers. R1 advertises a summary route 10.0.0.0/8 via aggregate-address 10.0.0.0 255.0.0.0 summary-only. R2 receives the summary but also expects to receive more specific routes (e.g., 10.1.0.0/16) for traffic engineering. R2's BGP table shows only the summary, and the more specific routes are missing. R1's configuration includes: router bgp 65001, network 10.1.0.0 mask 255.255.0.0, and aggregate-address 10.0.0.0 255.0.0.0 summary-only. What is the root cause?

A.The summary-only keyword suppresses all more specific routes, including the network 10.1.0.0/16, from being advertised to R2.
B.The network 10.1.0.0/16 is not in the routing table of R1, so it cannot be advertised.
C.R2 must have a route-map to accept the more specific route.
D.The aggregate-address should be configured with the as-set keyword to include more specifics.
AnswerA

summary-only causes all more specific routes to be suppressed, even if they are explicitly configured with network statements.

Why this answer

The aggregate-address with summary-only suppresses all more specific routes from being advertised to neighbors. Even though the network 10.1.0.0/16 is injected into BGP, the summary-only keyword causes it to be suppressed from advertisements. To allow the more specific route to be advertised alongside the summary, the summary-only keyword should be removed, or the more specific route should be explicitly permitted via a route-map.

The root cause is that summary-only suppresses the more specific routes.

Full explanation →
996
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla statistics IPSLAs Latest Operation Statistics IPSLA operation id: 1 Type of operation: icmp-echo Latest RTT: 20 milliseconds Latest operation start time: 12:00:00 UTC Mon Mar 1 2021 Latest operation return code: OK Number of successes: 100 Number of failures: 0 Based on this output, which statement is correct?

A.The IP SLA probe is successfully reaching the target with no failures.
B.The IP SLA probe has failed 100 times.
C.The IP SLA probe is using UDP jitter.
D.The IP SLA probe is not configured because the operation ID is 1.
AnswerA

The return code is OK, and there are 100 successes with 0 failures.

Why this answer

The output shows 100 successes and 0 failures for the ICMP echo operation, with a latest return code of OK, confirming that the IP SLA probe is successfully reaching the target without any failures. The 'Number of successes: 100' and 'Number of failures: 0' directly indicate a 100% success rate for the probe.

Exam trap

Cisco often tests the ability to interpret the 'Number of successes' and 'Number of failures' fields correctly, where candidates may mistakenly associate the count with failures instead of successes, or confuse the operation type (ICMP echo vs. UDP jitter) based on the operation ID alone.

How to eliminate wrong answers

Option B is wrong because the output shows 100 successes, not 100 failures; the 'Number of failures: 0' explicitly contradicts this claim. Option C is wrong because the 'Type of operation: icmp-echo' clearly indicates ICMP echo, not UDP jitter, which would require a different operation type (e.g., 'udp-jitter'). Option D is wrong because operation ID 1 is present and has statistics, meaning the IP SLA probe is configured and active; an unconfigured operation would not display any statistics.

Full explanation →
997
MCQeasy

Which default administrative distance is assigned to a directly connected interface route?

A.0
B.1
C.5
D.110
AnswerA

A directly connected route has an AD of 0, meaning it is always preferred over any learned route.

Why this answer

Directly connected routes have a default administrative distance of 0, indicating the highest preference.

Full explanation →
998
MCQhard

In a DMVPN Phase 2 network with EIGRP, R1 (hub) and R2 (spoke) are configured. R2's tunnel interface has an ACL applied inbound that denies ICMP. R2 can ping R1's tunnel IP, but R1 cannot ping R2's tunnel IP. What is the root cause?

A.R2's tunnel interface has an inbound ACL that denies ICMP, blocking R1's ping requests.
B.R1's tunnel interface has an outbound ACL that denies ICMP.
C.NHRP is not resolving R2's tunnel IP to its physical IP on R1.
D.EIGRP is not advertising R2's tunnel IP to R1.
AnswerA

Correct. Inbound ACLs filter traffic entering the interface. ICMP echo requests from R1 are denied, so R1 cannot ping R2.

Why this answer

The ACL on R2's tunnel interface inbound denies ICMP. When R1 sends an ICMP echo request to R2, it is denied by the ACL. However, R2 can ping R1 because the ACL does not affect outbound traffic.

The issue is that the ACL is applied inbound, blocking incoming ICMP packets.

Full explanation →
999
MCQmedium

A network engineer runs the following command to troubleshoot Control Plane Policing (CoPP): R1# show policy-map control-plane input class class-default Class-map: class-default (match-any) 140091 packets, 12345678 bytes 5 minute offered rate 1000 bps, drop rate 0 bps Match: any police: cir 8000 bps, bc 1500 bytes conformed 140091 packets, 12345678 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop What does this output indicate?

A.CoPP is dropping all traffic to the control plane.
B.CoPP is rate-limiting traffic to 8000 bps and not dropping any packets.
C.CoPP is not configured; the class-default shows no action.
D.CoPP is dropping packets due to exceeding the rate.
AnswerB

The police cir is 8000 bps, and all packets conform, so they are transmitted.

Why this answer

The output shows that the class-default policy-map for control-plane input has a police statement with a CIR of 8000 bps. The counters indicate 140,091 packets conformed and transmitted, with zero packets exceeded or violated. Since the drop rate is 0 bps and no packets have been dropped, CoPP is rate-limiting traffic to 8000 bps without any drops occurring.

Exam trap

Cisco often tests the misconception that a police statement with a CIR automatically means packets are being dropped, but the actual drop counters must be checked to confirm drops are occurring.

How to eliminate wrong answers

Option A is wrong because the output shows zero dropped packets (exceeded and violated counters are 0), so CoPP is not dropping all traffic. Option C is wrong because the class-default clearly shows a police action with a CIR of 8000 bps and transmit/drop actions, indicating CoPP is configured. Option D is wrong because the exceeded and violated packet counts are 0, meaning no packets have exceeded the configured rate and no drops have occurred.

Full explanation →
1000
MCQhard

A network engineer configures SPAN on a switch to monitor traffic from VLAN 20 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source vlan 20 rx monitor session 1 destination interface Gi0/1. The analyzer sees no traffic. The switch runs OSPF and has a route to 0.0.0.0/0 via a neighbor. The Gi0/1 interface is configured as a trunk port with native VLAN 1. The analyzer is connected to a hub that also connects to another device. The other device sends traffic that causes the switch to learn MAC addresses on Gi0/1. What is the root cause?

A.The destination interface Gi0/1 is a trunk port, which is not supported for SPAN destinations; it must be an access port.
B.The source VLAN 20 is not allowed on the trunk port Gi0/1.
C.The analyzer is connected via a hub, causing a loop that disables the port.
D.The monitor session is missing the 'no shutdown' command.
AnswerA

SPAN destination ports must be access ports; trunk ports are not allowed as SPAN destinations.

Why this answer

SPAN destination ports should not be used for normal traffic; they are dedicated to monitoring. If the destination port is configured as a trunk, it may participate in spanning tree and learn MAC addresses. However, the key issue is that SPAN does not work if the destination port is a trunk port that is also used for other traffic.

The switch may be forwarding traffic from other VLANs to the analyzer, but the mirrored traffic from VLAN 20 may be dropped because the destination port is not in the correct VLAN. Specifically, the destination port should be an access port in the same VLAN as the source, or if it is a trunk, the mirrored traffic is sent as untagged or tagged depending on the configuration. The analyzer may not receive traffic if the native VLAN mismatch occurs.

The correct root cause is that the destination port is a trunk with native VLAN 1, but the mirrored traffic from VLAN 20 is tagged with VLAN 20, and the analyzer may not understand the tag. However, the more subtle issue is that the switch may not allow the destination port to be a trunk for SPAN; it must be an access port. The correct answer is that SPAN destination ports cannot be trunk ports.

Full explanation →
1001
Drag & Dropmedium

Drag and drop the steps to verify and validate route redistribution operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Verification of redistribution starts with checking the routing table for redistributed routes, then examining the specific protocol database, followed by verifying the redistribution configuration, then checking for administrative distance issues, and finally using traceroute to validate the path. This order confirms routes are present, correctly sourced, and reachable.

Full explanation →
1002
Drag & Dropmedium

Drag and drop the steps to configure an ERSPAN session for remote traffic capture into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, you must define the source interface and traffic direction. Next, specify the ERSPAN ID and destination IP address. Then, configure the ERSPAN origin IP address on the source switch.

After that, enable the ERSPAN session globally. Finally, verify the session is active.

Full explanation →
1003
Multi-Selecthard

Which TWO statements about MPLS label stack operations in a Layer 3 VPN (L3VPN) are true? (Choose TWO.)

Select 2 answers
A.A P router (core router) performs label swapping only on the top label in the label stack.
B.The ingress PE router imposes two labels: an outer LDP label and an inner VPN label.
C.The P router pops the inner VPN label before forwarding the packet to the egress PE.
D.The egress PE router swaps the VPN label with a new label before forwarding to the CE.
E.The P router uses the inner VPN label to make forwarding decisions.
AnswersA, B

Correct. The P router swaps the outer IGP label; it does not process the inner VPN label.

Why this answer

In MPLS L3VPN, the P router (core router) performs label swapping based on the top label (IGP label). The PE router (ingress) imposes two labels: the outer IGP label for transport and the inner VPN label for identifying the egress VRF. The P router does not look at the inner VPN label.

Option A is correct: the P router swaps only the top label. Option B is correct: the ingress PE imposes two labels. Option C is false: the P router does not pop the VPN label; it swaps the transport label.

Option D is false: the egress PE pops the VPN label, not the P router. Option E is false: the P router does not look at the VPN label; it only swaps the outer label.

Full explanation →
1004
MCQhard

A network engineer configures EEM to monitor CPU usage on R1. R1 has: event manager applet CPU-MONITOR event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 80 poll-interval 5 action 1.0 cli command "enable" action 2.0 cli command "show processes cpu sorted" action 3.0 syslog msg "High CPU usage detected". After a few hours, the engineer notices that the applet triggers repeatedly, but the show command output is truncated. Router R2 shows: no issues. What is the root cause?

A.The EEM applet runs too frequently (every 5 seconds), consuming CPU and causing output truncation.
B.The SNMP OID is for 5-second CPU, not 1-minute average, causing false positives.
C.The 'show processes cpu sorted' command requires a terminal length setting.
D.The applet should use 'event manager applet CPU-MONITOR trigger' to start.
AnswerA

Frequent execution of the show command increases CPU load, worsening the condition.

Why this answer

The EEM applet triggers every 5 seconds when CPU exceeds 80%, and each execution runs the show command, which itself consumes CPU. This can create a feedback loop where the applet increases CPU usage, causing more triggers. Additionally, the show command output may be truncated if the applet runs too frequently or the buffer is insufficient.

The correct fix is to increase the poll interval or add a throttle.

Full explanation →
1005
MCQhard

A network engineer runs the following command to verify OSPF database on a DMVPN hub: R1# show ip ospf database router 2.2.2.2 OSPF Router with ID (1.1.1.1) (Process ID 1) Router Link States (Area 0) LS age: 100 Options: (No TOS-capability, DC) LS Type: Router Links Link State ID: 2.2.2.2 Advertising Router: 2.2.2.2 LS Seq Number: 80000001 Checksum: 0x1234 Length: 48 Number of Links: 1 Link connected to: a Transit Network (Link ID) Designated Router address: 10.0.0.1 (Link Data) Router Interface address: 10.0.0.2 Number of MTID metrics: 0 TOS 0 Metrics: 10 What does this output indicate?

A.The router 2.2.2.2 is advertising a stub network via Tunnel0.
B.The router 2.2.2.2 is connected to the DR at 10.0.0.1 over the DMVPN tunnel with cost 10.
C.The router 2.2.2.2 is the DR for the DMVPN network.
D.The OSPF database is empty; no LSAs have been received.
AnswerB

Correct: The LSA shows a transit link to DR 10.0.0.1 with metric 10.

Why this answer

The output shows the router LSA from 2.2.2.2, advertising a link to a transit network (the DMVPN tunnel) with metric 10, indicating the spoke is connected to the hub's DR.

Full explanation →
1006
MCQhard

What is the default dead interval multiplier for OSPFv3?

A.3
B.4
C.5
D.2
AnswerB

The default dead interval multiplier is 4, resulting in a dead interval of 40 seconds on broadcast networks.

Why this answer

In OSPFv3, the default dead interval multiplier is 4, meaning the router dead interval is calculated as 4 times the hello interval. This is defined in RFC 5340 and is consistent with OSPFv2 behavior, ensuring that a neighbor is declared down after missing four consecutive hello packets.

Exam trap

Cisco often tests the default dead interval multiplier for OSPFv3 by making candidates confuse it with the OSPFv2 default multiplier (which is also 4) or with the EIGRP default multiplier of 3, leading to selection of option A.

How to eliminate wrong answers

Option A is wrong because 3 is the default dead interval multiplier for EIGRP, not OSPFv3. Option C is wrong because 5 is not a standard default multiplier for any common OSPF implementation; it might be confused with the default hello interval of 10 seconds. Option D is wrong because 2 is the multiplier used in some proprietary or older routing protocols, but OSPFv3 uses a multiplier of 4 to provide sufficient time for hello packet loss before declaring a neighbor down.

Full explanation →
1007
Multi-Selectmedium

Which TWO commands can be used to verify the administrative distance of a route in a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show ip route
B.show ip protocols
C.show ip interface brief
D.show running-config | include distance
E.show ip ospf interface
AnswersA, B

This command shows the routing table, where each entry includes the administrative distance (e.g., [110/20]).

Why this answer

The show ip route command displays the routing table including the administrative distance for each route. The show ip protocols command displays routing protocol parameters including the default and any configured administrative distances. The other options either do not show administrative distance or are incorrect commands.

Full explanation →
1008
MCQhard

An engineer configures IP SLA with an ICMP echo operation and tracks it with a static route. The IP SLA operation is configured with a source interface of Loopback0. The engineer notices that when the remote host becomes unreachable, the static route is removed, but when the remote host becomes reachable again, the static route is not reinstalled immediately. The show ip sla statistics shows the operation is 'Active' and 'Success'. Which is the most likely explanation?

A.The static route has a higher administrative distance than the default route, so it is not installed.
B.The track object has a 'delay up' configured, causing a delay before the route is reinstalled.
C.The IP SLA operation uses a source interface that is not reachable from the remote host, causing asymmetric routing.
D.The IP SLA operation has a frequency that is too high, causing the router to ignore the results.
AnswerB

The `track object delay up` command introduces a timer that postpones the transition of the tracked object from 'Down' to 'Up' state, even after the IP SLA operation reports 'Success' and 'Active'. This directly explains why the static route, which depends on the track object being 'Up', is not reinstalled immediately when the remote host becomes reachable again. The constraint satisfied is the observed delay between the host's recovery and the route's reinstallation.

Why this answer

When an IP SLA operation uses a source interface, the operation may fail if that interface is down, but more importantly, the track object may have a delay configured for up transitions. Additionally, the static route may have a higher administrative distance that prevents it from being reinstalled if another route to the same prefix exists. However, the most common edge case is that the track object has a 'delay up' configured, which delays the route installation after the operation recovers.

Full explanation →
1009
MCQmedium

Which MPLS label is used for the Router Alert function, and what is its purpose?

A.Label 1; used to alert the router to examine the packet in the control plane.
B.Label 0; used to alert the router to examine the packet.
C.Label 2; used to alert the router to examine the packet.
D.Label 3; used to alert the router to examine the packet.
AnswerA

Label 1 is the Router Alert label per RFC 3032.

Why this answer

Label 1 is the Router Alert label, used to indicate that the packet should be examined by the router's control plane, typically for OAM or RSVP-TE messages.

Full explanation →
1010
MCQmedium

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue: R1# debug ip bgp updates Output: BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, path 65002 BGP(0): 10.0.0.2 rcvd 10.1.1.0/24 BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, path 65002 65003 BGP(0): 10.0.0.2 rcvd 10.2.2.0/24 What does this output indicate?

A.The router is receiving BGP updates for prefixes 10.1.1.0/24 and 10.2.2.0/24 from neighbor 10.0.0.2.
B.The router is sending BGP updates to neighbor 10.0.0.2.
C.The router is experiencing a BGP route flap.
D.The router is filtering BGP updates due to a prefix list.
AnswerA

The debug shows received updates with prefixes and AS paths.

Why this answer

The output shows BGP updates being received from neighbor 10.0.0.2, including prefixes and AS path information. This indicates successful BGP peering and route exchange.

Full explanation →
1011
MCQhard

What is the default value of the 'limit' parameter in the 'ipv6 nd prefix' command for the number of prefixes advertised in RA messages?

A.8
B.16
C.32
D.64
AnswerB

Correct. The default limit is 16 prefixes.

Why this answer

The default value of the 'limit' parameter in the 'ipv6 nd prefix' command is 16, as defined by Cisco IOS. This parameter controls the maximum number of IPv6 prefixes that can be advertised in Router Advertisement (RA) messages. When the number of prefixes exceeds this limit, the router will not include additional prefixes in the RA, ensuring the message stays within reasonable size constraints.

Exam trap

Cisco often tests the default value of the 'limit' parameter to catch candidates who confuse it with other common IPv6 defaults, such as the 64-bit prefix length or the 32-byte option size, leading them to pick 8, 32, or 64 instead of the correct 16.

How to eliminate wrong answers

Option A (8) is wrong because it is not the default limit; Cisco uses 16 as the default, and 8 might be confused with the default for other parameters like the number of entries in certain tables. Option C (32) is wrong because it is double the actual default; this could be a common guess based on powers of two but is incorrect for this specific command. Option D (64) is wrong because it is four times the actual default; this value might be associated with other IPv6 parameters, such as the prefix length or the number of bits in an IPv6 address, but not the RA prefix limit.

Full explanation →
1012
MCQmedium

A network engineer runs the following command to troubleshoot an EEM issue: R1# show event manager history events Event History: Event Type : syslog Time : Mar 1 00:05:23 Pattern : OSPF-5-ADJCHG Trigger count : 1 Event Type : timer Time : Mar 1 00:06:00 Timer Type : absolute Timer Name : MY-TIMER Trigger count : 1 What does this output indicate?

A.Two events have triggered EEM applets: a syslog event matching 'OSPF-5-ADJCHG' and an absolute timer named 'MY-TIMER'.
B.Two EEM applets are currently registered: one for syslog and one for timer.
C.The OSPF-5-ADJCHG syslog event triggered an applet that executed a timer.
D.The timer event is a countdown timer that triggered after 5 minutes and 23 seconds.
AnswerA

Correct. The output shows two events: one syslog event with pattern OSPF-5-ADJCHG triggered once, and one absolute timer named MY-TIMER triggered once.

Why this answer

The output shows the event history for EEM. It lists events that have triggered EEM applets. Each entry shows the event type (syslog, timer, etc.), the time it occurred, specific details (pattern for syslog, timer type and name for timer), and the number of times that event triggered an applet.

This helps in troubleshooting which events are being matched.

Full explanation →
1013
MCQhard

A network engineer runs the following command to verify MPLS LDP label bindings for a specific prefix: R1# show mpls ldp bindings 10.0.0.0 255.0.0.0 Output: lib entry: 10.0.0.0/8, rev 10 local binding: label: imp-null remote binding: lsr: 10.0.0.2:0, label: imp-null remote binding: lsr: 10.0.0.3:0, label: 302 What does this output indicate?

A.R1 will pop the label for 10.0.0.0/8 before forwarding to the next hop
B.R1 will swap the label for 10.0.0.0/8
C.All neighbors are using implicit null for this prefix
D.The prefix 10.0.0.0/8 is not in the routing table
AnswerA

Implicit null (imp-null) means the router will pop the label (PHP - Penultimate Hop Popping).

Why this answer

The output shows label bindings for prefix 10.0.0.0/8. R1 has assigned implicit null label (label 3) locally, meaning it will pop the label before forwarding. Neighbor 10.0.0.2 also uses implicit null, while 10.0.0.3 uses label 302.

Full explanation →
1014
MCQeasy

What is the default administrative distance for OSPFv3 internal routes?

A.90
B.110
C.115
D.120
AnswerB

OSPFv3 internal routes have a default AD of 110.

Why this answer

OSPFv3, like OSPFv2, uses a default administrative distance of 110 for all internal routes (intra-area and inter-area). This value is hard-coded in Cisco IOS and is not configurable per-route type; it distinguishes OSPF routes from other routing protocols. Option B is correct because 110 is the standard AD for OSPF (both versions) internal routes.

Exam trap

Cisco often tests the misconception that OSPFv3 might have a different administrative distance than OSPFv2, or that the AD changes for IPv6 protocols, but in reality, the default AD values are identical for both IPv4 and IPv6 versions of the same protocol.

How to eliminate wrong answers

Option A is wrong because 90 is the default administrative distance for EIGRP (both IPv4 and IPv6), not OSPFv3. Option C is wrong because 115 is not a default AD for any common routing protocol; it is sometimes used for IS-IS level-2 routes in certain implementations but not for OSPFv3. Option D is wrong because 120 is the default administrative distance for RIP (both RIPv2 and RIPng), not OSPFv3.

Full explanation →
1015
MCQmedium

Consider the following DHCPv6 configuration on router R2: ipv6 dhcp pool DHCP6_POOL dns-server 2001:db8::1 domain-name example.com ! interface GigabitEthernet0/0 ipv6 address 2001:db8:1::1/64 ipv6 dhcp server DHCP6_POOL ipv6 nd other-config-flag no shutdown What is the effect of this configuration?

A.Hosts on this subnet will use SLAAC to obtain their IPv6 address and then use DHCPv6 to get DNS and domain information.
B.Hosts will obtain both their IPv6 address and DNS information from the DHCPv6 pool.
C.The DHCPv6 pool is missing the address prefix, so it will not provide any configuration to clients.
D.The ipv6 nd other-config-flag command is ignored because the DHCPv6 server is configured on the interface.
AnswerA

The other-config-flag indicates that hosts should use SLAAC for addressing and DHCPv6 for additional parameters, which is stateless DHCPv6.

Why this answer

The configuration uses the `ipv6 nd other-config-flag` command, which sets the 'Other Configuration' flag (O-flag) in Router Advertisement (RA) messages. This tells hosts to use Stateless Address Autoconfiguration (SLAAC) for their IPv6 address (based on the prefix in the RA) and then use DHCPv6 (stateless DHCPv6) only to obtain additional parameters like DNS server and domain name, as defined in the DHCPv6 pool.

Exam trap

Cisco often tests the distinction between the M-flag (stateful DHCPv6) and O-flag (stateless DHCPv6), and the trap here is that candidates confuse the `other-config-flag` with the `managed-config-flag`, leading them to incorrectly think DHCPv6 provides addresses when it only provides other parameters.

How to eliminate wrong answers

Option B is wrong because it describes stateful DHCPv6, where both the IPv6 address and other parameters are obtained from the DHCPv6 server; however, the `ipv6 nd other-config-flag` (O-flag) explicitly instructs hosts to use SLAAC for addressing, not DHCPv6 for addresses. Option C is wrong because a DHCPv6 pool does not require an `address prefix` for stateless DHCPv6; the pool only needs to provide options like DNS and domain name, and the prefix for SLAAC is advertised via Router Advertisements. Option D is wrong because the `ipv6 nd other-config-flag` command is not ignored; it is fully functional and works in conjunction with the DHCPv6 server configuration to signal stateless DHCPv6 to clients.

Full explanation →
1016
MCQhard

A network engineer configures Flexible NetFlow to export traffic statistics for a VRF named CUSTOMER_A. The configuration includes 'flow exporter EXPORTER' with destination 10.10.10.10:2055 and 'vrf CUSTOMER_A' under the exporter. The flow monitor is applied to the VRF interface. However, 'show flow monitor name MONITOR cache' shows no entries for VRF traffic. What is the most likely cause?

A.The exporter is missing the 'source' interface command.
B.The flow monitor is applied to the global routing table interface instead of the VRF interface.
C.The VRF is not configured with 'ip flow-export' commands.
D.The flow record does not match any VRF-specific fields.
AnswerB

The monitor must be applied under the VRF interface (e.g., interface GigabitEthernet0/1.100 with encapsulation dot1q and VRF forwarding CUSTOMER_A). Applying it to the physical interface without VRF will not capture VRF traffic.

Why this answer

For VRF-aware NetFlow, the flow monitor must be applied using the 'ip flow monitor MONITOR input' command under the VRF interface, and the exporter must reference the VRF. A common mistake is forgetting to apply the monitor to the interface in the VRF context.

Full explanation →
1017
MCQmedium

In OSPF, what is the default administrative distance for intra-area routes on a Cisco IOS-XE router?

A.90
B.110
C.115
D.120
AnswerB

Correct. OSPF uses a default administrative distance of 110 for all route types.

Why this answer

Cisco IOS-XE assigns an administrative distance of 110 to all OSPF routes, including intra-area, inter-area, and external routes, unless modified.

Full explanation →
1018
MCQmedium

A network engineer runs the following command on Router P1: P1# show mpls ldp neighbor Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.48632 State: Oper, Msgs sent/rcvd: 120/118, Downstream Up time: 00:12:34 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.1.1.2 Addresses bound to peer LDP Ident: 10.0.0.2 192.168.1.1 Based on this output, which statement is correct?

A.The LDP session is down.
B.The LDP session is up and functioning correctly.
C.The router is not receiving label bindings from the neighbor.
D.The LDP router ID is misconfigured.
AnswerB

All indicators show a normal, operational LDP session.

Why this answer

The show mpls ldp neighbor output shows a single LDP neighbor with IP 10.0.0.2. The state is 'Oper' (operational), and the neighbor has been up for 12 minutes. The output indicates a healthy LDP session.

Full explanation →
1019
MCQmedium

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue: R1# show ip access-lists 130 Extended IP access list 130 10 deny ip host 10.1.1.1 host 10.2.2.2 20 permit ip any any Then the engineer runs: R1# debug ip packet 130 IP packet debugging is on for access list 130 *Mar 1 00:20:10.123: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto ICMP, access list 130: matched line 10 deny ip host 10.1.1.1 host 10.2.2.2 What does this output indicate?

A.ICMP traffic from 10.1.1.1 to 10.2.2.2 is being denied by ACL 130.
B.ICMP traffic from 10.1.1.1 to 10.2.2.2 is being permitted by ACL 130.
C.ACL 130 is applied outbound on GigabitEthernet0/0.
D.ACL 130 is not matching any packets.
AnswerA

The debug shows the match on the deny line.

Why this answer

The debug output explicitly shows that the packet with source 10.1.1.1 and destination 10.2.2.2 matched line 10 of ACL 130, which is a deny statement. Since the ACL is evaluated sequentially and the first match is a deny, the ICMP traffic is denied. The debug message confirms the match, so option A is correct.

Exam trap

Cisco often tests the misconception that a debug message showing a packet matched an ACL line implies the packet was permitted, when in fact the action (deny or permit) is determined by the matched line's action.

How to eliminate wrong answers

Option B is wrong because the debug output shows the packet matched line 10 (deny), not line 20 (permit), so the traffic is denied, not permitted. Option C is wrong because the debug output does not indicate the direction (inbound or outbound) of the ACL application; the interface shown (GigabitEthernet0/0) is the source interface of the packet, not where the ACL is applied. Option D is wrong because the debug output explicitly states 'matched line 10', proving that ACL 130 is matching packets.

Full explanation →
1020
MCQeasy

A network engineer runs the following command to troubleshoot EIGRP over DMVPN: R1# debug eigrp packets EIGRP: Received HELLO on Tunnel0 nbr 10.0.0.2 EIGRP: New peer 10.0.0.2 What does this output indicate?

A.EIGRP neighbor adjacency with 10.0.0.2 is established over Tunnel0.
B.EIGRP is not enabled on Tunnel0.
C.The EIGRP neighbor is in a stuck-in-active state.
D.EIGRP authentication is failing between the routers.
AnswerA

Correct: Receiving a hello and creating a new peer indicates adjacency formation.

Why this answer

The debug output shows that R1 has received an EIGRP hello from 10.0.0.2 on Tunnel0 and has formed a new neighbor adjacency.

Full explanation →
1021
MCQeasy

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# show ip local policy Interface Route-map local PBR-LOCAL What does this output indicate?

A.Local PBR is enabled for packets originated by the router.
B.PBR is applied to all incoming interfaces.
C.The route-map PBR-LOCAL is not configured.
D.PBR is applied to all outgoing interfaces.
AnswerA

'ip local policy route-map PBR-LOCAL' applies to locally generated traffic.

Why this answer

The output shows that local PBR is configured using route-map PBR-LOCAL. This applies PBR to locally generated packets on the router.

Full explanation →
1022
MCQhard

An engineer configures an IPsec site-to-site VPN between two routers running EIGRP. The EIGRP neighbor forms, but routes are not being exchanged. The engineer notices that the EIGRP neighbor is stuck in active state for certain routes. What is the most likely explanation?

A.The EIGRP hello packets are being encrypted but the reply is not, causing asymmetric routing.
B.The IPsec ACL is permitting EIGRP packets (protocol 88) only in one direction, so queries are sent but replies are dropped by the remote router's crypto map.
C.The EIGRP K-values are mismatched between the two routers.
D.The IPsec tunnel is using aggressive mode, which does not support multicast traffic.
AnswerB

If the crypto ACL on one router permits only certain traffic (e.g., TCP/179 for BGP) but not EIGRP, EIGRP packets may be dropped. If the other router's ACL permits EIGRP, the neighbor forms partially, but queries may not be replied to, causing SIA.

Why this answer

When EIGRP neighbors form but routes are not exchanged and the neighbor is stuck in active (SIA) state, it indicates that EIGRP queries are being sent but replies are not received. In an IPsec VPN, if the crypto ACL permits EIGRP (protocol 88) only in one direction, queries from one router are encrypted and sent, but the remote router's crypto map does not match the reply packets, so they are dropped. This prevents the EIGRP query/reply process from completing, causing routes to remain in active state and not be exchanged.

Exam trap

Cisco often tests the misconception that EIGRP neighbor formation implies full route exchange, but the trap here is that a one-way crypto ACL permits neighbor formation (since hellos are multicast and may be permitted) but blocks query/reply unicast traffic, causing SIA routes.

How to eliminate wrong answers

Option A is wrong because EIGRP hello packets are multicast (224.0.0.10) and are encrypted by IPsec; asymmetric routing would cause a different issue (e.g., packet loss), not specifically SIA routes. Option C is wrong because K-value mismatch prevents neighbor formation entirely, not just route exchange; the neighbor forms here, so K-values must match. Option D is wrong because aggressive mode is an IKE phase 1 mode that does not affect multicast traffic; IPsec tunnels can transport multicast regardless of IKE mode, and EIGRP uses multicast for hellos, which would still work.

Full explanation →
1023
MCQhard

A network engineer configures an EEM applet to monitor redistribution events using the event syslog pattern 'IP-4-ROUTING'. The applet is intended to log when a route is redistributed from OSPF into EIGRP. The redistribution is configured without a seed metric for EIGRP, and the route is not redistributed. The EEM applet does not trigger. Which is the most likely explanation?

A.Redistribution into EIGRP without a seed metric fails silently, and no syslog message is generated.
B.The EEM applet must use 'event routing' to capture redistribution events.
C.The syslog pattern 'IP-4-ROUTING' is incorrect; it should be 'IP-5-ROUTING'.
D.The redistribution is blocked by route tagging, preventing the syslog.
AnswerA

Correct. EIGRP requires a seed metric; without it, the route is not redistributed and no syslog is generated.

Why this answer

When redistributing routes into EIGRP without a seed metric, the redistribution fails silently—no syslog message is generated. The EIGRP process drops the redistributed route because the default metric is not set. The 'IP-4-ROUTING' syslog message is only generated when a routing table change occurs due to redistribution, but since the route is not installed, no syslog is produced.

The EEM applet will not trigger because there is no matching syslog event.

Full explanation →
1024
MCQhard

In MPLS L3VPN, which OSPF network type is used by default on a Frame Relay point-to-point subinterface when OSPF is enabled?

A.Broadcast
B.Non-broadcast
C.Point-to-point
D.Point-to-multipoint
AnswerC

Correct. Point-to-point subinterfaces default to point-to-point network type.

Why this answer

On a point-to-point subinterface over Frame Relay, the default OSPF network type is point-to-point, which does not require DR/BDR election.

Full explanation →
1025
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.1.2 1 FULL/DR 00:00:35 192.168.1.2 Gi0/0 192.168.2.2 1 2WAY/DROTHER 00:00:38 192.168.2.2 Gi0/1 10.10.10.2 1 FULL/BDR 00:00:32 10.10.10.2 Gi0/2 Based on this output, what is a potential issue?

A.Neighbor 192.168.2.2 is stuck in 2WAY state, indicating a problem.
B.The DR election is incomplete on Gi0/0.
C.All OSPF neighbors are in appropriate states for their roles.
D.Neighbor 10.10.10.2 should be in FULL/DR state.
AnswerC

Each neighbor is in the correct state based on its role (DR, BDR, DROTHER).

Why this answer

The output shows normal OSPF neighbor states for a multi-access network. The DR (192.168.1.2) is in FULL/DR state, the BDR (10.10.10.2) is in FULL/BDR state, and the DROTHER (192.168.2.2) is in 2WAY/DROTHER state, which is expected for a non-DR/non-BDR router on a broadcast multi-access segment. The 2WAY state is a valid and stable state for DROTHER neighbors, indicating that they have exchanged Hello packets and are aware of each other but do not form full adjacency with each other.

Exam trap

Cisco often tests the misconception that the 2WAY state is always a problem, but in reality it is a normal and expected state for DROTHER neighbors on broadcast multi-access networks, and candidates must recognize that only the DR and BDR should be in FULL state with all neighbors.

How to eliminate wrong answers

Option A is wrong because the 2WAY state is not a problem for a DROTHER neighbor; it is the normal state between two non-DR/non-BDR routers on a broadcast network, as they only form full adjacency with the DR and BDR. Option B is wrong because the DR election is complete on Gi0/0, as evidenced by the presence of a neighbor in FULL/DR state (192.168.1.2) and a BDR on Gi0/2; the DR election process is stable. Option D is wrong because the neighbor 10.10.10.2 is correctly in FULL/BDR state, which is the expected state for a Backup Designated Router; it does not need to be in FULL/DR state unless it wins the DR election.

Full explanation →
1026
MCQhard

In OSPFv3, which authentication method is supported by default?

A.MD5 authentication
B.Simple password authentication
C.IPsec authentication
D.No authentication is supported
AnswerC

Correct. OSPFv3 relies on IPsec for authentication and integrity.

Why this answer

OSPFv3 uses IPsec for authentication and encryption, as defined in RFC 4552. It does not support the simple password or MD5 authentication used in OSPFv2.

Full explanation →
1027
MCQmedium

Given the following configuration on Router R2: router eigrp 200 redistribute ospf 1 metric 10000 100 255 1 1500 default-metric 10000 100 255 1 1500 What is the effect of having both the 'metric' keyword in the redistribute command and the 'default-metric' command?

A.The 'metric' keyword is ignored; the default-metric is used for all redistributed routes.
B.Both metrics are applied, causing a conflict and potential routing issues.
C.The 'metric' keyword overrides the default-metric for routes redistributed from OSPF into EIGRP.
D.The default-metric command is not needed and can be removed without any effect.
AnswerC

The explicit metric in the redistribute command takes precedence over the default-metric.

Why this answer

The 'metric' keyword in the redistribute command overrides the default-metric for that specific redistribution. The default-metric applies to all other redistribution without an explicit metric.

Full explanation →
1028
MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show ip nhrp detail 10.0.0.0/16 via 10.1.1.2, Tunnel0 created 00:01:00, expire 01:59:00 Type: summary, Flags: used NBMA address: 192.168.1.2 Registration: never What does this output indicate?

A.The summary route 10.0.0.0/16 is learned via NHRP and is active, with the next hop being 192.168.1.2 over Tunnel0.
B.The summary route is not being used because the 'used' flag is not set.
C.The summary route is learned via EIGRP, not NHRP.
D.The summary route is a static route configured on the router.
AnswerA

The 'summary' type and 'used' flag confirm this is an active NHRP summary route.

Why this answer

This output shows an NHRP cache entry for the summary route 10.0.0.0/16. The type is 'summary', indicating that this is a summary route learned via NHRP. The 'used' flag and NBMA address show that the route is active and pointing to a specific tunnel destination.

Full explanation →
1029
MCQmedium

Which statement about PBR and the 'set interface' command is correct?

A.The 'set interface' command can only be used with point-to-point interfaces.
B.If the specified interface is down, the router uses the routing table.
C.The 'set interface' command requires a next-hop IP address to be specified.
D.The 'set interface' command forces the packet out the specified interface, and if the interface is down, the packet is dropped.
AnswerD

This is correct; PBR with 'set interface' does not fall back to the routing table if the interface is down.

Why this answer

The 'set interface' command forces the packet out a specific interface, overriding the routing table. If the interface is down, the packet is dropped unless a fallback is configured.

Full explanation →
1030
MCQmedium

Examine this configuration: interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 ip nat outside ! ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable Which statement is true?

A.All traffic from 10.0.0.10 is translated to 198.51.100.10.
B.Incoming traffic to 198.51.100.10:8080 is forwarded to 10.0.0.10:80.
C.The 'extendable' keyword is invalid for static NAT.
D.This translation will not work unless 'ip nat inside source list' is also configured.
AnswerB

Static NAT/PAT maps the outside address/port to the inside address/port bidirectionally.

Why this answer

The configuration uses a static NAT with TCP port translation (also known as NAT with port forwarding). The command `ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable` creates a one-to-one mapping between the inside local address/port (10.0.0.10:80) and the inside global address/port (198.51.100.10:8080). This means any incoming packet destined to 198.51.100.10 on TCP port 8080 will have its destination translated to 10.0.0.10 port 80, and the response traffic is reverse-translated.

Option B correctly describes this behavior.

Exam trap

Cisco often tests the misconception that static NAT translates all traffic from an inside host, when in fact a static NAT with port specification only translates traffic matching that specific protocol and port, leaving other traffic untranslated.

How to eliminate wrong answers

Option A is wrong because the static NAT entry is specific to TCP port 80 on the inside host; it does not translate all traffic from 10.0.0.10 — only traffic matching source IP 10.0.0.10 and source TCP port 80 is translated to 198.51.100.10:8080. Option C is wrong because the 'extendable' keyword is valid for static NAT; it allows multiple static NAT entries to share the same global address (e.g., different ports) without conflict, which is essential for PAT-style static translations. Option D is wrong because 'ip nat inside source list' is used for dynamic NAT or PAT with an ACL, but this is a static NAT configuration that does not require an ACL — the translation is explicitly defined by the static command.

Full explanation →
1031
MCQeasy

What is the default timeout for NAT translation entries in Cisco IOS?

A.60 seconds
B.300 seconds
C.86400 seconds (24 hours)
D.Never expires
AnswerC

The default timeout for NAT entries is 24 hours.

Why this answer

C is correct because the default timeout for NAT translation entries in Cisco IOS is 86400 seconds (24 hours). This default applies to dynamic NAT translations that are not protocol-specific, such as those for TCP or UDP, and ensures that translations remain active for a full day before being aged out, balancing resource usage with session persistence.

Exam trap

Cisco often tests the distinction between general NAT translation timeout and protocol-specific timeouts (like DNS timeout of 300 seconds), leading candidates to mistakenly choose 300 seconds as the default for all NAT entries.

How to eliminate wrong answers

Option A is wrong because 60 seconds is the default timeout for NAT translations only when the ip nat translation timeout command is explicitly configured to that value, not the default; the default is 86400 seconds. Option B is wrong because 300 seconds is the default timeout for DNS timeout in NAT (ip nat translation dns-timeout), not for general NAT translation entries. Option D is wrong because NAT translation entries do expire by default; they are not permanent, as Cisco IOS uses timeouts to free resources, though the never-expire behavior can be achieved with the ip nat translation never-expire command, but it is not the default.

Full explanation →
1032
MCQhard

BGP is used between two ISPs. Router R1 has: neighbor 10.0.0.2 route-map SET-MED in, route-map SET-MED permit 10, set metric 50. Router R2 shows: show ip bgp 172.16.0.0 includes MED 50 but the path is not preferred. What is the root cause?

A.The MED value is too low to influence path selection.
B.The route-map should be applied outbound, not inbound.
C.MED is only compared when paths are from the same neighboring AS.
D.The neighbor has a higher local preference overriding MED.
AnswerC

BGP default behavior ignores MED from different ASes.

Why this answer

BGP's MED (Multi-Exit Discriminator) attribute is only compared between paths that originate from the same neighboring AS. In this scenario, even though R2 receives a route with MED 50 from R1, the path is not preferred because the competing path likely comes from a different neighboring AS, making the MED comparison invalid. MED is a non-transitive attribute that influences inbound traffic only when comparing multiple exit points from the same AS.

Exam trap

Cisco often tests the nuance that MED is only compared between paths from the same neighboring AS, leading candidates to mistakenly think MED always influences path selection or that the value itself is the issue.

How to eliminate wrong answers

Option A is wrong because a MED value of 50 is not inherently too low; MED is a metric where lower values are preferred, so a low MED would actually make the path more preferred, not less. Option B is wrong because applying the route-map inbound on R1 correctly sets the MED on routes received from R2; applying it outbound would affect routes sent to R2, which is not the intended behavior for influencing R2's path selection. Option D is wrong because while local preference does override MED in BGP path selection order, the question states the MED is 50 but the path is not preferred, and there is no evidence that local preference is configured or higher; the most direct root cause is the AS path comparison rule for MED.

Full explanation →
1033
Drag & Dropmedium

Drag and drop the steps to configure and verify Policy-Based Routing (PBR) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, define the route map with a sequence number. Next, match the interesting traffic using an ACL or prefix list. Then, set the next-hop or interface.

Apply the route map under the interface in the inbound direction. Finally, verify with 'show route-map' or 'show ip policy'.

Full explanation →
1034
Multi-Selectmedium

Which TWO commands would a network engineer use to verify NAT translations and their statistics on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show ip nat translations
B.show ip nat statistics
C.show ip nat verbose
D.show running-config | include nat
E.debug ip nat
AnswersA, B

This command lists all current NAT/PAT translations, including inside local, inside global, outside local, and outside global addresses.

Why this answer

The 'show ip nat translations' command displays the current active NAT/PAT translation entries in the translation table, including inside local, inside global, outside local, and outside global addresses. The 'show ip nat statistics' command provides aggregate counters such as total translations, hits, misses, expired translations, and the number of dynamic mappings. Together, these two commands give a complete view of both the active translations and their performance statistics, which is essential for verifying NAT operations.

Exam trap

Cisco often tests the distinction between verification commands (show) and troubleshooting commands (debug), and candidates mistakenly select 'debug ip nat' because they think it provides statistics, when in fact it is a real-time debugging tool that can impact router performance.

Full explanation →
1035
MCQhard

An engineer configures PBR on a router to route traffic from subnet 10.1.1.0/24 to next-hop 192.168.1.2. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. However, the engineer notices that PBR is not working for multicast traffic from that subnet. What is the most likely explanation?

A.PBR is not supported for multicast traffic; multicast uses its own forwarding mechanisms.
B.The ACL in the route-map is blocking multicast addresses.
C.The next-hop 192.168.1.2 is not a multicast-capable router.
D.The route-map is missing a 'set ip next-hop verify-availability' command.
AnswerA

Multicast traffic is handled by multicast routing, not PBR, unless explicitly configured.

Why this answer

PBR does not process multicast traffic by default. Multicast packets are forwarded using multicast routing protocols (e.g., PIM) and are not subject to PBR. To apply PBR to multicast, special configuration (e.g., 'ip multicast policy route-map') is required.

Full explanation →
1036
MCQhard

A network engineer configures RSPAN on a switch to monitor traffic from VLAN 10 to a remote switch via VLAN 100 as the RSPAN VLAN. The source switch has: monitor session 1 source vlan 10 rx monitor session 1 destination remote vlan 100. The remote switch has: monitor session 2 source remote vlan 100 monitor session 2 destination interface Gi0/1. The remote switch's Gi0/1 is connected to a network analyzer. The analyzer sees no traffic. The RSPAN VLAN 100 is configured on all intermediate switches with the 'remote-span' command. However, the intermediate switches run MST and VLAN 100 is mapped to a different MST instance than the native VLAN. What is the root cause?

A.The RSPAN VLAN is not allowed on the trunk ports between switches.
B.MST maps VLAN 100 to a different instance, causing the port to be in a blocking state for that instance, thus dropping RSPAN traffic.
C.The 'remote-span' command is missing on the source and destination switches.
D.The RSPAN VLAN must be the native VLAN on all trunks.
AnswerB

MST can block VLANs in different instances, preventing RSPAN traffic from traversing.

Why this answer

RSPAN relies on flooding the mirrored traffic across the RSPAN VLAN. In MST, if the RSPAN VLAN is mapped to a different MST instance than the native VLAN, the spanning-tree topology may block the RSPAN VLAN on some ports. Specifically, if the RSPAN VLAN is in a different MST instance, the port may be in a blocking state for that instance, preventing the mirrored traffic from reaching the destination.

The 'remote-span' command does not override MST behavior. The fix is to map the RSPAN VLAN to the same MST instance as the native VLAN or use a single spanning-tree region.

Full explanation →
1037
Multi-Selecthard

Which THREE commands can be used to verify the status of a DMVPN Phase 2 spoke-to-spoke tunnel? (Choose THREE.)

Select 3 answers
A.show dmvpn
B.show ip nhrp
C.show crypto isakmp sa
D.show ip route
E.show crypto ipsec sa
AnswersA, B, C

Correct. This command displays DMVPN tunnel status, including the state of spoke-to-spoke tunnels.

Why this answer

To verify a spoke-to-spoke tunnel, 'show dmvpn' displays the tunnel status including peers and up/down state. 'show ip nhrp' shows NHRP cache entries, including the /32 host route for the remote spoke. 'show crypto isakmp sa' shows the IKE phase 1 SA, which must be active for the IPsec tunnel. 'show ip route' shows the routing table but does not specifically show tunnel status. 'show crypto ipsec sa' shows IPsec phase 2 SAs, but the question asks for commands that verify the tunnel, and 'show crypto isakmp sa' is more fundamental for the initial establishment. However, both are valid; we choose three that are most direct. 'show ip route' is not specific enough, and 'show crypto ipsec sa' is also valid but we need exactly three. The correct set is 'show dmvpn', 'show ip nhrp', and 'show crypto isakmp sa'.

Full explanation →
1038
MCQhard

R1 and R2 are BGP peers with BFD enabled. R1#show bgp neighbors 10.1.1.2 shows BGP state 'Active' and BFD session 'Down'. R2#show bfd neighbors shows the session as 'Up' with R1. R1 has 'neighbor 10.1.1.2 fall-over bfd' configured. R2 has 'neighbor 10.1.1.1 fall-over bfd' configured. The link between them is stable. What is the root cause?

A.R1 is missing 'bfd interval' configuration on the interface facing R2.
B.BGP requires 'neighbor 10.1.1.2 ebgp-multihop' for BFD to work.
C.R2 has a higher BFD multiplier causing session failure.
D.The BGP update-source is not set to the interface IP.
AnswerA

Without BFD interval configuration on the interface, R1 cannot establish a BFD session, causing BGP fall-over to keep BGP in Active state.

Why this answer

BFD for BGP fall-over requires that the BFD session be established before BGP can form. If the BFD session is up on R2 but down on R1, it indicates a unidirectional issue. This can happen if R1 has an ACL blocking BFD control packets from R2, or if R1's BFD configuration is missing.

Here, R1 likely lacks 'bfd interval' configuration on the interface, causing BFD to not initiate.

Full explanation →
1039
MCQeasy

A network engineer runs the following command on Router R1: R1# show ipv6 dhcp interface GigabitEthernet0/1 GigabitEthernet0/1 is in server mode Using pool: POOL6 Preference value: 0 Hint from client: ignored Rapid-Commit: disabled Based on this output, which statement is correct?

A.The interface is configured as a DHCPv6 client.
B.The interface is configured as a DHCPv6 server using pool POOL6.
C.The interface is using rapid-commit for faster address assignment.
D.The interface is in DHCPv6 relay mode.
AnswerB

Server mode with pool specified.

Why this answer

The command output explicitly states 'GigabitEthernet0/1 is in server mode' and 'Using pool: POOL6', which confirms that the interface is acting as a DHCPv6 server. The DHCPv6 server assigns IPv6 addresses and other configuration parameters from the specified pool to requesting clients.

Exam trap

Cisco often tests the ability to read the exact output of 'show ipv6 dhcp interface' and distinguish between server, client, and relay modes, where candidates may misinterpret 'server mode' as client mode or overlook the 'Rapid-Commit: disabled' line.

How to eliminate wrong answers

Option A is wrong because the output shows 'server mode', not client mode; a DHCPv6 client would show 'client mode' or 'in client mode'. Option C is wrong because the output shows 'Rapid-Commit: disabled', meaning rapid-commit is not enabled, so the interface is not using it for faster address assignment. Option D is wrong because the output does not indicate relay mode; a DHCPv6 relay interface would show 'relay mode' or similar, not 'server mode'.

Full explanation →
1040
MCQmedium

Consider the following configuration: ipv6 access-list BLOCK-ICMP deny icmp any any echo-request deny icmp any any echo-reply permit ipv6 any any interface GigabitEthernet0/2 ipv6 traffic-filter BLOCK-ICMP in Which statement is true?

A.The ACL blocks ICMP echo-request and echo-reply, but permits all other IPv6 traffic inbound.
B.The ACL blocks all ICMPv6 traffic because the deny statements are too broad.
C.The ACL must be applied outbound to filter echo-request.
D.The ACL is missing the 'log' keyword to be effective.
AnswerA

The deny statements match the specified ICMP types; the final permit allows everything else.

Why this answer

The IPv6 ACL explicitly denies ICMPv6 echo-request and echo-reply messages (types 128 and 129) while the final permit ipv6 any any statement allows all other IPv6 traffic. The ipv6 traffic-filter command applied inbound on GigabitEthernet0/2 filters traffic as it enters the interface, so only the specified ICMP types are blocked, and all other IPv6 traffic is permitted.

Exam trap

Cisco often tests the misconception that an ACL applied inbound cannot block echo-reply because it is a response, but in IPv6, echo-reply is a separate ICMP type that can be filtered inbound on the interface where it arrives.

How to eliminate wrong answers

Option B is wrong because the ACL does not block all ICMPv6 traffic; it only denies two specific ICMPv6 message types (echo-request and echo-reply), and the permit ipv6 any any statement allows all other ICMPv6 types and all other IPv6 traffic. Option C is wrong because the ACL can filter echo-request and echo-reply when applied inbound; ICMP echo-request is typically sent from a source to a destination, so applying the ACL inbound on the destination interface will block the incoming echo-request, and echo-reply is also blocked inbound on the source interface if needed. Option D is wrong because the 'log' keyword is optional and not required for the ACL to be effective; the ACL will deny or permit traffic based on the configured entries without logging.

Full explanation →
1041
MCQhard

A redistribution setup between OSPF and EIGRP is causing a routing loop for subnet 10.1.1.0/24. Router R1 runs OSPF and EIGRP with redistribution. R1's configuration: router ospf 1 redistribute eigrp 100 subnets ! router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 ! interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip summary-address eigrp 100 10.1.0.0 255.255.255.0 ! Router R2 (EIGRP neighbor) shows: R2# show ip route 10.1.1.0 Routing entry for 10.1.0.0/24, supernet Known via "eigrp 100", distance 90, metric 30720, type internal Last update from 10.1.1.1 on GigabitEthernet0/0, 00:00:05 ago What is the root cause?

A.The summary route 10.1.0.0/24 is less specific and can cause routing loops when combined with redistribution because R2 may send traffic for 10.1.1.0/24 back to R1.
B.The redistribution metric is too high, causing EIGRP to prefer the OSPF route via another path.
C.OSPF does not support subnets keyword, so the route is not redistributed correctly.
D.EIGRP is not enabled on the interface, so the summary is not advertised.
AnswerA

The summary creates a less specific route that can be redistributed, leading to a loop.

Why this answer

The summary route 10.1.0.0/24 is being advertised via EIGRP, but it is a less specific prefix than the actual /24. When R1 redistributes OSPF into EIGRP, the summary may cause R2 to prefer the summary over a more specific route, and if R2 sends traffic back to R1 for 10.1.1.0/24, R1 might forward it to R2 again if the OSPF route is not present, creating a loop. The summary should match the exact subnet or be more specific to avoid loops.

Full explanation →
1042
MCQhard

An engineer is troubleshooting a missing BGP route on R3. R3 has an eBGP session with R4 (AS 65004) and an iBGP session with R1 (AS 65003). R4 advertises a prefix 192.168.1.0/24 to R3, and R3's BGP table shows the route with next-hop 10.1.4.4. However, R3 does not install this route in its routing table. The output of 'show ip bgp 192.168.1.0/24' on R3 shows the route as valid but not best. What is the most likely cause?

A.The route is not installed because the next-hop 10.1.4.4 is not reachable via any routing table entry.
B.The route is not installed because BGP synchronization is enabled and the IGP does not have the route.
C.The route is not installed because the prefix length is too long for the routing table.
D.The route is not installed because R3 has a higher administrative distance for eBGP routes.
AnswerA

Correct because BGP requires the next-hop to be reachable; otherwise, the route is not considered best.

Why this answer

For an eBGP route to be installed, the next-hop must be reachable via an IGP or static route. If the next-hop is not reachable, BGP marks the route as valid but not best.

Full explanation →
1043
Multi-Selecthard

An engineer is troubleshooting a route redistribution issue between EIGRP and OSPF. Which TWO actions will prevent routing loops in a mutual redistribution scenario? (Choose TWO.)

Select 2 answers
A.Configure a higher administrative distance for routes learned via redistribution (e.g., distance 200 for OSPF external routes) to prefer the original protocol's routes.
B.Use the 'default-metric' command to set a consistent seed metric for redistributed routes, ensuring all routes have the same metric.
C.Apply route tags to redistributed routes and use distribute lists or route maps to prevent re-redistribution of tagged routes back into the original protocol.
D.Enable 'auto-summary' on both routing protocols to summarize routes at classful boundaries, reducing the number of routes and loop potential.
E.Configure 'passive-interface' on all interfaces where redistribution is performed to prevent routing updates from being sent.
AnswersA, C

Correct. By increasing the administrative distance for redistributed routes, you ensure that the original protocol's routes (with lower AD) are preferred, reducing the chance of a loop where a redistributed route is preferred over the original.

Why this answer

To prevent routing loops during mutual redistribution, you must ensure that routes redistributed from one protocol are not re-injected back into the source protocol. Common methods include setting administrative distance values (e.g., using 'distance' command) or using route tagging with distribute lists or route maps to filter. Simply increasing the metric for redistributed routes does not prevent loops, and disabling auto-summary is unrelated to loop prevention.

Full explanation →
1044
MCQhard

Which authentication method is used by default in IKEv1 main mode for IPsec site-to-site VPN on Cisco IOS?

A.RSA signatures
B.Pre-shared keys
C.Elliptic Curve Digital Signature Algorithm (ECDSA)
D.No default; authentication must be explicitly configured
AnswerB

PSK is the default authentication method for IKEv1.

Why this answer

In Cisco IOS, IKEv1 main mode for IPsec site-to-site VPN defaults to pre-shared keys (PSK) as the authentication method. This is because PSK is the simplest to configure and does not require a public key infrastructure (PKI), making it the default choice when no other authentication method is explicitly specified. The configuration commands like 'crypto isakmp key' directly implement PSK authentication.

Exam trap

Cisco often tests the misconception that IKEv1 has no default authentication method, leading candidates to choose 'No default; authentication must be explicitly configured' when in fact pre-shared keys are the default.

How to eliminate wrong answers

Option A is wrong because RSA signatures require digital certificates and a PKI, which is not the default; they must be explicitly configured with commands like 'crypto isakmp identity' and certificate enrollment. Option C is wrong because ECDSA is not supported as an authentication method in IKEv1 on Cisco IOS; it is only available in IKEv2 with the 'authentication ecdsa-sig' command. Option D is wrong because there is a default authentication method (pre-shared keys) in IKEv1 main mode; authentication does not need to be explicitly configured unless a different method is desired.

Full explanation →
1045
MCQmedium

A network engineer is troubleshooting a BGP session that is flapping. The routers are connected via a direct Ethernet cable. BFD is configured for the BGP session. The engineer checks the BFD session and sees it is 'Up'. However, the BGP session goes down every 30 seconds. The BGP configuration includes 'neighbor 10.0.0.2 fall-over bfd'. What is the most likely cause?

A.The BGP hold timer is set to 30 seconds on one router and 90 seconds on the other.
B.The BFD session is using echo mode, which is not supported for BGP fall-over.
C.The interface is configured with 'bfd interval 50 min_rx 50 multiplier 3' but the neighbor is configured with 'bfd interval 100 min_rx 100 multiplier 3'.
D.The BGP session is using EBGP multihop, and the TTL is set to 2.
AnswerA

A mismatch in BGP hold timer can cause the session to reset when the hold timer expires; the BFD session being up does not affect BGP's own keepalive mechanism.

Why this answer

The BGP fall-over bfd command causes BGP to monitor the BFD session. If the BFD session is up but BGP is flapping, the issue is likely a BGP configuration problem, such as a mismatch in hold timer or update-source.

Full explanation →
1046
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a customer network. The customer has a default route pointing to the router. After enabling uRPF, the router drops traffic from the customer that has a source IP address that is not in the routing table as a directly connected or static route. What is the most likely explanation?

A.Strict mode uRPF requires a specific route for the source IP; a default route is not sufficient.
B.The customer's default route causes asymmetric routing, which breaks strict mode.
C.The uRPF mode should be loose mode to allow the default route.
D.The router has an ACL that is blocking the traffic before uRPF checks.
AnswerA

Strict mode checks for a matching route with the same incoming interface; a default route does not provide a specific interface match.

Why this answer

Strict mode uRPF verifies that the source IP address of an incoming packet matches a specific route in the routing table, and that the interface used to reach that source IP is the same as the incoming interface. A default route (0.0.0.0/0) is a catch-all entry and does not provide a specific, directly connected or static route for the customer's source IP. Therefore, the router drops the traffic because it cannot find an exact match for the source IP in the routing table, which is a fundamental requirement of strict mode.

Exam trap

Cisco often tests the misconception that a default route satisfies strict mode uRPF requirements, but the trap is that strict mode demands a specific route (not a default) for the source IP, and the incoming interface must match the route's outgoing interface.

How to eliminate wrong answers

Option B is wrong because asymmetric routing is not the core issue; strict mode uRPF drops packets even with symmetric routing if the source IP lacks a specific route. Option C is wrong because loose mode uRPF only checks that a route exists for the source IP in the routing table (including a default route), but it does not require the incoming interface to match; however, the question describes strict mode behavior, not a need to switch modes. Option D is wrong because the problem is explicitly caused by uRPF strict mode, not by an ACL; ACLs are processed after uRPF checks, so they would not be the reason for the drops described.

Full explanation →
1047
MCQhard

A network engineer configures iBGP between DMVPN hub and spokes using the hub as a route reflector. On the hub, the BGP configuration includes 'neighbor <spoke-ip> next-hop-self'. Unexpectedly, spokes receive routes from other spokes with the next-hop set to the hub's tunnel IP, but the spokes cannot reach that next-hop because it is not in their routing table. Which is the most likely explanation?

A.The hub's 'next-hop-self' command is configured under the BGP neighbor statement for the spoke, but the route reflector behavior overrides it, causing the hub to not modify the next-hop for routes reflected between spokes.
B.The spokes are not configured as route-reflector clients, so the hub does not reflect routes between them, and the next-hop remains unchanged.
C.The iBGP session between hub and spokes is using loopback interfaces, and the next-hop is set to the loopback IP, which is not reachable via the tunnel.
D.The 'next-hop-self' command is only applicable for eBGP sessions, not iBGP, so it has no effect on the reflected routes.
AnswerA

In a route reflector setup, 'next-hop-self' must be configured under the address-family for the neighbor; otherwise, the reflector does not change the next-hop for reflected routes.

Why this answer

In a DMVPN Phase 2 or 3 network, the hub typically sets the next-hop to itself using 'next-hop-self' for routes advertised to spokes. However, if the hub is a route reflector, it does not change the next-hop for routes received from one spoke and advertised to another spoke, unless 'next-hop-self' is explicitly configured. The corner case is that 'next-hop-self' must be applied under the address-family or neighbor configuration, and if it is misapplied or missing for the route-reflector client sessions, the spoke-to-spoke routes retain the original next-hop (the other spoke's tunnel IP), which may not be reachable if NHRP redirect or shortcuts are not enabled.

Full explanation →
1048
MCQmedium

Given this configuration on router R1: crypto isakmp policy 10 encryption aes 256 authentication pre-share group 14 lifetime 86400 ! crypto isakmp key cisco123 address 192.168.1.2 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 192.168.1.2 set transform-set TSET match address 101 ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ! access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 What will happen when traffic from 10.1.1.0/24 to 10.2.2.0/24 is generated?

A.The traffic will be dropped because the ACL denies it.
B.The traffic will be forwarded normally without encryption.
C.The router will attempt to establish an IPsec tunnel but fail because the crypto map is missing.
D.The router will create a dynamic crypto map entry automatically.
AnswerB

Since the crypto map is not applied, the router treats the traffic as normal and forwards it based on routing.

Why this answer

The crypto map is not applied to any interface. Without the `crypto map CMAP` command under GigabitEthernet0/1, the router has no IPsec policy to enforce on that interface. Traffic matching access-list 101 will simply be forwarded normally as clear-text IP packets, since no encryption is triggered.

Exam trap

The trap here is that candidates often assume a crypto map is automatically applied to the interface it references (e.g., via the peer IP), but Cisco explicitly tests that the `crypto map` command under the interface is required for IPsec to function.

How to eliminate wrong answers

Option A is wrong because access-list 101 is a permit ACL used to identify interesting traffic for IPsec, not a deny ACL; it does not drop traffic. Option C is wrong because the crypto map is fully configured (with peer, transform-set, and match address), but it is not missing—it is simply not applied to any interface, so no tunnel establishment is attempted. Option D is wrong because dynamic crypto maps are used for responder-only scenarios (e.g., when the peer IP is unknown) and are not automatically created; a static crypto map must be explicitly applied to an interface.

Full explanation →
1049
MCQmedium

A network engineer is troubleshooting an EIGRP issue where a router is not installing a route in the routing table, even though the route is present in the EIGRP topology table. The route is a feasible successor, but it is not being used. What is the most likely reason for this?

A.The feasible successor has a higher metric than the current successor.
B.The route is a summary route that is being suppressed.
C.The route is being filtered by a distribute-list in.
D.The EIGRP variance command is set to 1, preventing unequal-cost load balancing.
AnswerA

Correct because EIGRP installs only the route with the lowest metric (successor) into the routing table; feasible successors are kept as backup routes.

Why this answer

In EIGRP, a feasible successor is a backup route that meets the feasibility condition (reported distance < feasible distance). However, the router will only install the route with the best metric (the successor) into the routing table. If the feasible successor has a higher metric than the current successor, it will remain in the topology table as a backup but will not be used unless the successor fails.

This matches option A.

Exam trap

Cisco often tests the distinction between a route being present in the topology table versus being installed in the routing table, tricking candidates into thinking that any feasible successor should be used immediately, when in fact only the successor (lowest metric) is installed by default.

How to eliminate wrong answers

Option B is wrong because a suppressed summary route would not appear in the EIGRP topology table as a feasible successor; it would be missing or marked as a summary, not as a candidate for installation. Option C is wrong because a distribute-list in would filter the route from the routing table entirely, but the route would also be absent from the topology table or marked as filtered, not present as a feasible successor. Option D is wrong because the variance command set to 1 (default) only prevents unequal-cost load balancing; it does not prevent a feasible successor from being used as a backup or from being installed if it has the best metric—variance 1 simply means only equal-cost paths are used for load balancing, but the feasible successor with a higher metric would still not be installed because it is not the best path.

Full explanation →
1050
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 snooping binding IPv6 Address MAC Address VLAN Interface State 2001:DB8:1::100 aaaa.bbbb.cccc 10 Gi0/0/0 ACTIVE 2001:DB8:1::101 aaaa.bbbb.cccd 10 Gi0/0/0 ACTIVE 2001:DB8:1::102 aaaa.bbbb.ccce 10 Gi0/0/1 ACTIVE 2001:DB8:1::103 aaaa.bbbb.cccf 10 Gi0/0/1 ACTIVE Based on this output, which statement is correct?

A.All entries are in the ACTIVE state, meaning they are valid bindings.
B.The binding for 2001:DB8:1::103 is invalid.
C.The table shows only IPv6 addresses from SLAAC.
D.There are no entries for VLAN 10.
AnswerA

ACTIVE state indicates the binding is valid and being used.

Why this answer

The ACTIVE state in IPv6 snooping binding indicates that the binding has been validated and is currently in use, meaning the IPv6 address, MAC address, VLAN, and interface combination is legitimate. Option A is correct because all four entries show ACTIVE, confirming they are valid bindings that have passed the First Hop Security (FHS) validation process, such as Duplicate Address Detection (DAD) or neighbor solicitation verification.

Exam trap

Cisco often tests the misconception that all ACTIVE entries are automatically valid without understanding that ACTIVE simply means the binding passed initial validation, but it does not guarantee the device is not malicious if the binding was spoofed before FHS was enabled.

How to eliminate wrong answers

Option B is wrong because the binding for 2001:DB8:1::103 is listed as ACTIVE, which means it is valid; there is no indication of invalidity in the output. Option C is wrong because the output does not specify the address configuration method (SLAAC, DHCPv6, or static); IPv6 snooping binding entries can come from any source, and the table only shows addresses, not how they were assigned. Option D is wrong because all entries explicitly show VLAN 10 in the VLAN column, so there are indeed entries for VLAN 10.

Full explanation →
Page 13

Page 14 of 27

Page 15

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →