Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1051–1125

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 14

Page 15 of 27

Page 16
1051
MCQhard

A network engineer is troubleshooting a BGP session that is not establishing. The routers are connected via a Layer 3 switch. BFD is configured for BGP. The engineer checks the BFD session and sees it is 'Down'. The BGP configuration appears correct. The interface between the routers is up/up. What is the most likely cause?

A.The BGP neighbor is not directly connected; BFD requires a directly connected interface or a static route pointing to the neighbor's IP.
B.The Layer 3 switch is not configured for BFD, causing it to drop BFD packets.
C.The BGP session is using EBGP multihop, and the TTL is set to 1.
D.The interface is configured with 'bfd interval 50 min_rx 50 multiplier 3' but the neighbor is not configured for BFD.
AnswerA

BFD sessions over multihop BGP require special configuration (bfd all-interfaces under BGP) and a route to the neighbor; if the neighbor is not directly connected, BFD will fail without proper setup.

Why this answer

BFD sessions require that the destination IP address be reachable via a directly connected interface or a static route. If the BGP neighbor is not directly connected (e.g., via a loopback), BFD may fail if the next hop is not directly connected or if there is a routing issue.

Full explanation →
1052
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip vrf CUSTOMER Name Default RD Interfaces CUSTOMER 65001:100 Gi0/0.100 Gi0/1.100 Based on this output, which statement is correct?

A.The VRF CUSTOMER is configured with two subinterfaces.
B.The VRF CUSTOMER has no route distinguisher configured.
C.The VRF CUSTOMER is not active because no routes are shown.
D.The VRF CUSTOMER is using OSPF as the routing protocol.
AnswerA

The output lists two interfaces under the VRF.

Why this answer

The output of 'show ip vrf CUSTOMER' displays the VRF name, its default route distinguisher (RD) of 65001:100, and the interfaces assigned to it. The interfaces listed are Gi0/0.100 and Gi0/1.100, which are both subinterfaces (indicated by the .100 suffix). Therefore, the VRF CUSTOMER is correctly configured with two subinterfaces.

Exam trap

Cisco often tests the distinction between VRF configuration output and routing information; the trap here is that candidates may assume a VRF is inactive or misconfigured because no routes are shown, when in fact 'show ip vrf' only displays the VRF name, RD, and interface assignments.

How to eliminate wrong answers

Option B is wrong because the output clearly shows a default RD of 65001:100, so a route distinguisher is configured. Option C is wrong because the VRF is active; the absence of routes in this output is normal, as 'show ip vrf' only displays VRF configuration and interface assignments, not routing information. Option D is wrong because the output does not indicate any routing protocol; VRF configuration is independent of the routing protocol used (OSPF, EIGRP, BGP, etc.) and no protocol is shown here.

Full explanation →
1053
MCQhard

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are not being established dynamically. The hub router has NHRP redirect enabled, and spokes have NHRP shortcut enabled. The engineer notices that when a spoke sends traffic to another spoke, the hub forwards the traffic but does not send an NHRP redirect. The hub's NHRP configuration includes the command 'ip nhrp redirect'. What is the most likely cause?

A.The spoke does not have 'ip nhrp shortcut' enabled.
B.The hub router does not have a route to the spoke's LAN subnet.
C.The tunnel interface on the hub has 'no ip nhrp redirect' configured.
D.The spoke's NHRP registration does not include the LAN subnet.
AnswerB

Correct because the hub must have a route to the spoke's subnet to generate an NHRP redirect; without it, the hub forwards traffic without sending a redirect.

Why this answer

In DMVPN phase 3, the hub must have 'ip nhrp redirect' enabled on the tunnel interface, and the spoke must have 'ip nhrp shortcut' enabled. Additionally, the hub must have a route to the spoke's subnet; otherwise, the hub will not send an NHRP redirect. The issue is that the hub does not have a route to the spoke's subnet.

Full explanation →
1054
MCQeasy

Which statement accurately describes the behavior of the ip nat inside source static command when configuring static NAT for a single inside host?

A.It dynamically allocates the global address from a pool and removes the entry after an idle timeout.
B.It creates a permanent mapping that remains in the NAT table until the configuration is removed.
C.It requires the use of an access list to define which traffic is translated.
D.It translates only TCP and UDP traffic by default.
AnswerB

Correct. Static NAT entries are permanent and do not age out.

Why this answer

The `ip nat inside source static` command creates a permanent one-to-one mapping between an inside local IP address and an inside global IP address. This static entry remains in the NAT table indefinitely until the administrator explicitly removes it with the `no ip nat inside source static` command, making option B correct.

Exam trap

Cisco often tests the misconception that static NAT requires an access list or that it behaves like dynamic NAT with timeouts, leading candidates to incorrectly choose options A or C.

How to eliminate wrong answers

Option A is wrong because static NAT does not dynamically allocate addresses from a pool or use timeouts; dynamic NAT and PAT use pools and idle timeouts. Option C is wrong because static NAT does not require an access list; the mapping is defined directly by the command, whereas dynamic NAT uses an access list to identify traffic to be translated. Option D is wrong because static NAT translates all IP traffic, including ICMP and other protocols, not just TCP and UDP; PAT (overload) is what typically limits translation to TCP/UDP by default.

Full explanation →
1055
MCQmedium

What is the default ERSPAN encapsulation type on Cisco IOS-XE devices?

A.ERSPAN Type I
B.ERSPAN Type II
C.ERSPAN Type III
D.ERSPAN Type IV
AnswerB

Type II is the default, with a 4-byte GRE header and 4-byte ERSPAN header, including a sequence number.

Why this answer

ERSPAN defaults to Type II encapsulation, which uses a 4-byte GRE header with a 4-byte ERSPAN header (8 bytes total). Type III is optional and requires explicit configuration.

Full explanation →
1056
MCQmedium

A network engineer is troubleshooting an IPsec site-to-site VPN that stopped working after a recent configuration change. The engineer runs 'show crypto isakmp sa' and sees an active IKE SA, but 'show crypto ipsec sa' shows no IPsec SAs. What is the most likely cause?

A.The IPsec transform set on one router does not match the transform set on the other.
B.The pre-shared key is incorrect on one of the routers.
C.The tunnel interface is down.
D.The IKE proposal is mismatched.
AnswerA

Correct because during phase 2, the routers negotiate the transform set; if they do not match, the IPsec SA cannot be established.

Why this answer

An active IKE SA indicates that IKE phase 1 completed successfully, but no IPsec SAs means phase 2 failed. The most common cause is a mismatch in the IPsec transform set or the crypto map access list between the two routers.

Full explanation →
1057
MCQmedium

Examine the following partial IPv6 DHCP guard configuration: ipv6 dhcp guard policy DHCP_GUARD device-role server match server access-list SERVER_ACL interface GigabitEthernet0/2 ipv6 dhcp guard policy DHCP_GUARD Which statement is true about this configuration?

A.The interface will allow DHCP server messages only from sources matching SERVER_ACL.
B.The interface will block all DHCP server messages.
C.The interface will allow all DHCP client messages.
D.The interface will drop all DHCP messages.
AnswerA

The 'match server' clause restricts which servers are trusted, and the policy is applied to the interface.

Why this answer

The configuration applies the DHCP_GUARD policy to GigabitEthernet0/2 with the device-role set to server and a match server access-list SERVER_ACL. This means the interface is configured to trust DHCP server messages, but only those that match the source addresses permitted by SERVER_ACL. Any DHCP server messages from sources not matching the ACL will be dropped, while client messages are unaffected because the policy only filters server-side traffic.

Exam trap

Cisco often tests the misconception that setting device-role server blocks all server messages, but the match server ACL allows specific trusted servers, so the interface permits only those matching the ACL.

How to eliminate wrong answers

Option B is wrong because the configuration does not block all DHCP server messages; it allows those matching SERVER_ACL. Option C is wrong because the policy does not explicitly allow all DHCP client messages; client messages are permitted by default since the device-role is server, but the focus is on filtering server messages, not client messages. Option D is wrong because the configuration does not drop all DHCP messages; it only filters server messages based on the ACL, and client messages are allowed.

Full explanation →
1058
MCQhard

A BGP-speaking router R1 is redistributing BGP routes into EIGRP. R1 has configuration: router bgp 100 redistribute eigrp 100. Router R2, an EIGRP neighbor, shows: 'show ip route eigrp' includes some BGP routes but with high metrics. Traffic to those destinations is suboptimal. What is the root cause?

A.R1 has no default-metric configured for EIGRP, so redistributed BGP routes use the default metric of infinity, causing them to be unreachable.
B.R1 has a route-map that sets the metric to 100000 1000 255 1 1500, which is too high, causing suboptimal path selection.
C.BGP routes have a lower administrative distance than EIGRP, so they are not installed.
D.R2 has a route filter that increases the metric for BGP-originated routes.
AnswerB

High metric values make the route less preferred, leading to suboptimal routing.

Why this answer

The route-map explicitly sets a high composite metric (100000 1000 255 1 1500) for redistributed BGP routes into EIGRP. This high metric causes R2 to prefer other paths (if available) or to consider the route less optimal, leading to suboptimal traffic forwarding. The configuration snippet indicates that a route-map is applied during redistribution, which overrides any default-metric and directly inflates the metric.

Exam trap

Cisco often tests the distinction between missing default-metric (causing unreachable routes) versus a configured but excessively high metric (causing suboptimal routing), leading candidates to incorrectly assume the routes are missing rather than present with inflated metrics.

How to eliminate wrong answers

Option A is wrong because if no default-metric were configured, EIGRP would assign a default metric of infinity (effectively unreachable), but the question states the routes are present with high metrics, not missing. Option C is wrong because administrative distance does not affect metric values; BGP routes (eBGP AD 20, iBGP AD 200) can still be installed if they are the best path, and the issue is about metric, not route preference. Option D is wrong because R2 does not have a route filter that increases metrics; the metric manipulation occurs on the redistributing router R1 via the route-map, not on the receiving EIGRP neighbor.

Full explanation →
1060
MCQmedium

What is the default size of the logging buffer in Cisco IOS-XE when 'logging buffered' is enabled without specifying a size?

A.1024 bytes
B.4096 bytes
C.8192 bytes
D.16384 bytes
AnswerB

The default buffer size is 4096 bytes.

Why this answer

The default logging buffer size is 4096 bytes (4 KB) on most Cisco IOS-XE platforms.

Full explanation →
1061
Multi-Selectmedium

Which TWO statements about syslog message severity levels are true? (Choose TWO.)

Select 2 answers
A.Severity level 0 (emergencies) is the most critical and indicates system instability.
B.Severity level 5 (warnings) is less severe than level 4 (notifications).
C.Severity level 7 (debugging) includes all messages from lower severity levels.
D.Severity level 6 (informational) is used for system error messages.
E.Severity level 3 (errors) is more critical than level 2 (critical).
AnswersA, C

Level 0 is the highest severity, used for system-wide emergencies.

Why this answer

Syslog severity levels range from 0 (emergencies) to 7 (debugging). Level 0 is the most critical, and level 7 is the least critical. Level 5 is 'notifications', not 'warnings'; warnings are level 4.

Level 6 is 'informational'. Level 3 is 'errors'.

Full explanation →
1062
MCQhard

CoPP is rate-limiting legitimate routing traffic. Router R1 has: class-map match-any ROUTING, match protocol bgp, match protocol ospf, policy-map COPP, class ROUTING, police 10000 conform-action transmit exceed-action drop. BGP sessions flap. What is the root cause?

A.The class-map should match only BGP, not OSPF.
B.The police rate is too low, causing drops of BGP packets.
C.CoPP should be applied to the control plane, not the data plane.
D.BGP sessions flap due to MTU mismatch, not CoPP.
AnswerB

10 kbps is insufficient for BGP keepalives and updates, leading to flaps.

Why this answer

B is correct because the police rate of 10,000 bps (10 kbps) is too low for BGP traffic. BGP uses TCP port 179 and can generate bursts of packets during keepalive and update exchanges; if the policer drops BGP packets, the TCP session times out and flaps. The class-map correctly matches both BGP and OSPF, but the rate limit is insufficient for the combined control-plane traffic.

Exam trap

Cisco often tests the misconception that CoPP class-map matching must be exclusive, when in fact the root cause is an overly restrictive police rate that drops essential control-plane packets like BGP keepalives.

How to eliminate wrong answers

Option A is wrong because the class-map uses match-any logic, so matching both BGP and OSPF is valid; the issue is not the match criteria but the police rate. Option C is wrong because CoPP is specifically designed to be applied to the control plane via 'service-policy input CoPP' under 'control-plane' configuration; applying it to the data plane would not protect the control plane. Option D is wrong because MTU mismatch would cause packet fragmentation or loss at Layer 3, but the question explicitly states CoPP is rate-limiting traffic, and BGP flapping due to dropped keepalives is a classic symptom of policer drops, not MTU issues.

Full explanation →
1063
MCQmedium

Consider the following BGP configuration with BFD: router bgp 65000 neighbor 10.1.1.2 remote-as 65001 neighbor 10.1.1.2 fall-over bfd ! interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.252 bfd interval 200 min_rx 200 multiplier 4 ! What is the effect of the 'neighbor fall-over bfd' command?

A.BGP will use BFD to detect link failures, but the BGP hold timer still applies.
B.BGP will ignore the BFD session and continue using its own keepalive/hold mechanism.
C.BGP will use BFD for fast failure detection; if BFD goes down, BGP will reset the session immediately.
D.The 'fall-over bfd' command is only needed if BFD timers are less than 100 ms.
AnswerC

Correct. BGP registers with BFD and upon BFD session failure, BGP tears down the neighbor without waiting for the hold timer.

Why this answer

The 'neighbor fall-over bfd' command enables BGP to use BFD for fast failure detection. When BFD detects a failure, BGP will immediately tear down the peering session without waiting for the hold timer.

Full explanation →
1064
MCQmedium

A router running EIGRP has a CoPP policy that includes a class-map matching EIGRP packets with a police rate of 2000 bps. The network engineer notices that EIGRP neighbor adjacencies are flapping. The EIGRP network has 100 routes. The engineer checks the CoPP statistics and sees that the EIGRP class has dropped 500 packets in the last hour. What is the most likely root cause?

A.The EIGRP hello interval is set too low, causing excessive hello packets that exceed the police rate.
B.The CoPP police rate of 2000 bps is insufficient for EIGRP hello and update traffic, causing packet drops.
C.The EIGRP authentication is causing larger packets that exceed the police rate.
D.The CoPP class-map is matching EIGRP packets incorrectly, causing them to be dropped by a default class.
AnswerB

EIGRP packets, though small, can be dropped if the police rate is too low, leading to adjacency flapping.

Why this answer

The CoPP police rate of 2000 bps is too low for EIGRP traffic. EIGRP hello packets are sent every 5 seconds (default) and are typically around 60-80 bytes each, plus periodic updates and queries. With 100 routes, the initial exchange and any topology changes generate significant update traffic.

Dropping 500 packets in an hour confirms the rate is insufficient, causing hello loss and neighbor flapping.

Exam trap

Cisco often tests the misconception that CoPP drops are always due to misconfiguration or authentication overhead, when in fact the police rate is simply too low for the protocol's normal operation, especially with a moderate number of routes.

How to eliminate wrong answers

Option A is wrong because lowering the hello interval would increase hello frequency, making the problem worse, not better; the default hello interval is already 5 seconds and is not the root cause of drops. Option C is wrong because EIGRP authentication adds only a small amount of data (e.g., MD5 adds 16-20 bytes per packet), which is negligible compared to the 2000 bps rate; it would not cause 500 drops per hour. Option D is wrong because the class-map is explicitly matching EIGRP packets (likely using 'match protocol eigrp' or ACL), and CoPP statistics show drops specifically in the EIGRP class, not the default class, so misclassification is not occurring.

Full explanation →
1065
MCQmedium

Interface GigabitEthernet0/1 is configured as shown: interface GigabitEthernet0/1 ipv6 address 2001:db8:1::1/64 ipv6 nd raguard ipv6 nd prefix default no-autoconfig What is the effect of this configuration?

A.The interface drops all incoming Router Advertisements from other routers.
B.The interface sends RAs with the autonomous flag set to allow SLAAC.
C.The interface only allows RAs from a specific authorized router.
D.The interface drops all Neighbor Solicitations.
AnswerA

The 'ipv6 nd raguard' command blocks RAs received on this interface, enforcing first-hop security.

Why this answer

The `ipv6 nd raguard` command enables Router Advertisement (RA) guard on the interface, which drops all incoming RAs from other routers to prevent rogue RA attacks. The `ipv6 nd prefix default no-autoconfig` command suppresses the autonomous flag in sent RAs, but the RA guard is the active security feature that blocks incoming RAs, making option A correct.

Exam trap

Cisco often tests the distinction between commands that affect outgoing RAs (like `ipv6 nd prefix default no-autoconfig`) versus those that filter incoming RAs (like `ipv6 nd raguard`), leading candidates to confuse the direction of the traffic being controlled.

How to eliminate wrong answers

Option B is wrong because `ipv6 nd prefix default no-autoconfig` clears the autonomous flag in sent RAs, preventing SLAAC, not setting it. Option C is wrong because RA guard drops all incoming RAs indiscriminately; it does not filter based on a specific authorized router—that would require a more advanced feature like RA guard with a device-tracking policy or IPv6 SAVI. Option D is wrong because RA guard specifically targets Router Advertisements, not Neighbor Solicitations; Neighbor Solicitations are handled by other IPv6 first-hop security features like ND inspection or DAI for IPv6.

Full explanation →
1066
Multi-Selecthard

Which THREE symptoms indicate that NAT is misconfigured or failing on a Cisco router? (Choose THREE.)

Select 3 answers
A.Inside hosts can ping the outside interface IP but cannot reach hosts beyond it.
B.Traffic flows in one direction only (e.g., inside-to-outside works, but return traffic fails).
C.The show ip nat translations output shows many translations with the same inside global address but different ports, and new connections fail.
D.The router's CPU utilization is high due to BGP process.
E.The show ip route command shows a default route pointing to the ISP next hop.
AnswersA, B, C

This often indicates that NAT is not translating the source address for packets going out, or the return traffic is not being untranslated.

Why this answer

If inside hosts can ping the outside interface IP but cannot reach hosts beyond it, this indicates that NAT is translating the source address correctly for outbound traffic, but the router is not performing NAT for destinations beyond the outside interface. This typically happens when the NAT configuration lacks an access list that matches the inside-to-outside traffic or when the ip nat inside/outside interface commands are misapplied, causing the router to forward packets without translation for destinations beyond the directly connected network.

Exam trap

Cisco often tests the distinction between connectivity to the outside interface (which does not require NAT) and connectivity beyond it (which requires proper NAT translation), leading candidates to mistakenly think that successful pings to the outside interface imply full NAT functionality.

Full explanation →
1067
MCQhard

An engineer configures an IPv6 manual tunnel between two routers. The tunnel is up and both routers can ping each other's tunnel IPv6 addresses. However, when the engineer tries to redistribute a connected IPv6 route from the tunnel into OSPFv3, the route is not advertised. The OSPFv3 process includes the tunnel interface. What is the most likely cause?

A.The tunnel interface does not have an IPv6 address configured; manual tunnels require an IPv6 address on the tunnel interface for the connected route to exist.
B.OSPFv3 does not support redistribution of connected routes from tunnel interfaces.
C.The 'redistribute connected' command must include the 'metric-type' keyword to be effective.
D.The tunnel interface is in a different OSPFv3 process than the one where redistribution is configured.
AnswerA

Without an IPv6 address on the tunnel interface, there is no connected route to redistribute. The tunnel may still pass traffic using the tunnel source/destination, but no IPv6 subnet is directly connected.

Why this answer

For a manual IPv6 tunnel, the tunnel interface must have an IPv6 address configured. Without an IPv6 address on the tunnel interface, there is no connected IPv6 route for that interface, so the 'redistribute connected' command under OSPFv3 has no route to advertise. The tunnel being up and pingable between tunnel IPv6 addresses indicates the tunnel itself is operational, but the absence of an IPv6 address on the tunnel interface means no connected route exists to redistribute.

Exam trap

Cisco often tests the misconception that a tunnel being up and pingable implies a connected IPv6 route exists, but in manual tunnels, the tunnel interface must have its own IPv6 address for a connected route to be present and redistributable.

How to eliminate wrong answers

Option B is wrong because OSPFv3 fully supports redistribution of connected routes from tunnel interfaces, provided the tunnel interface has an IPv6 address and is included in the OSPFv3 process. Option C is wrong because the 'metric-type' keyword is optional; its absence does not prevent redistribution from occurring—it only affects the metric type (E1 vs E2) of the redistributed routes. Option D is wrong because the tunnel interface is explicitly stated to be part of the OSPFv3 process where redistribution is configured, so a process mismatch is not the issue.

Full explanation →
1068
MCQeasy

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down R1# show event manager history events Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down Based on this output, which statement is correct?

A.The EIGRP neighbor down event has occurred once.
B.The EIGRP neighbor is currently down.
C.The EEM policy is disabled.
D.The EIGRP neighbor is flapping.
AnswerA

The event history shows a single entry for EIGRP_Neighbor_Down.

Why this answer

The output shows one registered EEM applet policy and one triggered event. The correct answer is that the EIGRP neighbor down event has occurred once.

Full explanation →
1069
Multi-Selecthard

Which THREE symptoms indicate a potential MPLS label switching issue on a Cisco router? (Choose THREE.)

Select 3 answers
A.The output of 'show mpls forwarding-table' shows 'no label' for a specific prefix.
B.The output of 'show mpls ldp neighbor' shows 'state: OPERATIONAL' for all neighbors.
C.The output of 'debug mpls ldp errors' shows 'Label bindings not received from peer'.
D.The output of 'show mpls forwarding-table' shows 'Pop tag' for a prefix on a router that is not the egress LSR.
E.The output of 'show mpls interfaces' shows 'IP' only for an interface configured for MPLS.
AnswersA, C, D

This indicates that the router has not received a label binding for that prefix from its LDP neighbor, causing packets to be forwarded without MPLS.

Why this answer

MPLS issues often manifest as incorrect label operations. 'show mpls forwarding-table' showing 'no label' for a route indicates a missing label binding. 'show mpls ldp neighbor' showing 'state: OPERATIONAL' is normal, not a symptom. 'debug mpls ldp errors' showing 'Label bindings not received' indicates a problem. 'show mpls forwarding-table' showing 'Pop tag' for a non-egress router suggests a misconfiguration. 'show mpls interfaces' showing 'IP' only (not MPLS) indicates MPLS is not enabled on the interface.

Full explanation →
1070
MCQmedium

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue: R1# debug mpls ldp transport Output: *Mar 1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 *Mar 1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is accepted *Mar 1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is established *Mar 1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is up What does this output indicate?

A.LDP session is being established between 10.0.0.1 and 10.0.0.2
B.LDP session is being torn down between 10.0.0.1 and 10.0.0.2
C.LDP is using UDP for transport
D.LDP label bindings are being exchanged
AnswerA

The output shows the TCP connection for LDP is accepted, established, and up, indicating a successful LDP session setup.

Why this answer

The debug output shows LDP transport connections between two routers. The messages indicate that a TCP connection from 10.0.0.2 (LDP port 646) to 10.0.0.1 (ephemeral port 1025) was accepted, established, and is now up. This confirms LDP adjacency is forming at the transport layer.

Full explanation →
1071
MCQhard

A large enterprise network is experiencing intermittent reachability from a specific subnet (10.1.1.0/24) to a critical server (192.168.10.10). Router R1 has PBR configured to forward traffic from 10.1.1.0/24 to next-hop 10.2.2.2, but traffic is also being load-balanced via the routing table to 10.3.3.3. Router R2 shows: 'show ip route 192.168.10.10' returns a route via 10.4.4.4, but 'show ip policy' on R1 shows the route-map is applied. What is the root cause?

A.The route-map is missing the 'set ip next-hop verify-availability' command, causing PBR to forward traffic to an unreachable next-hop.
B.The ACL in the route-map is incorrectly matching traffic from 10.1.1.0/24, causing PBR to be applied to the wrong traffic.
C.The routing table on R1 has a higher administrative distance for the route to 192.168.10.10 via 10.3.3.3, causing PBR to be ignored.
D.The next-hop 10.2.2.2 is reachable but the path is congested, causing intermittent packet drops.
AnswerA

Without 'verify-availability', PBR does not check if the next-hop is reachable. Adding this command ensures PBR only uses the next-hop if it is reachable, falling back to the routing table otherwise.

Why this answer

PBR uses a route-map to match traffic and set next-hop. If the route-map does not have a 'set ip next-hop verify-availability' command, PBR will forward traffic to the next-hop even if it is not reachable. In this scenario, the next-hop 10.2.2.2 is not reachable, but PBR still forwards traffic to it, causing intermittent reachability.

The routing table load-balancing to 10.3.3.3 works, but PBR overrides it for matched traffic.

Full explanation →
1072
MCQhard

A network engineer configures PBR on a router to route traffic from subnet 10.1.1.0/24 via next-hop 192.168.1.2. The route-map uses match ip address and set ip next-hop commands. However, traffic sourced from 10.1.1.5 still follows the routing table instead of the PBR policy. What is the most likely cause?

A.The route-map is applied to the wrong interface (outbound instead of inbound).
B.The router is generating the traffic locally (e.g., ping from the router), and PBR does not apply to local packets without 'ip local policy route-map'.
C.The ACL in the route-map is missing a permit statement for subnet 10.1.1.0/24.
D.The next-hop 192.168.1.2 is not reachable via any directly connected interface.
AnswerB

Local packets require 'ip local policy route-map' to be influenced by PBR.

Why this answer

PBR processes only transit traffic; locally generated packets (e.g., from the router itself) are not affected by PBR unless the 'ip local policy route-map' command is used. The engineer must apply PBR globally for local packets.

Full explanation →
1073
Drag & Dropmedium

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order ensures that the OSPF DR/BDR election is properly influenced. First, verify the current DR/BDR roles using show ip ospf interface. Next, set the OSPF priority on the desired router to a higher value than the current DR.

Then, clear the OSPF process on all routers to force a new election. After that, verify the new DR/BDR roles have been elected as expected. Finally, confirm that adjacencies are formed with the new DR/BDR.

Full explanation →
1074
Multi-Selecthard

An engineer must prevent a VRF on a PE router from learning routes from a specific remote site in an MPLS L3VPN. Which TWO configuration changes on the local PE can achieve this? (Choose TWO.)

Select 2 answers
A.Remove the import RT that corresponds to the remote site's export RT from the VRF configuration.
B.Remove the export RT from the VRF configuration.
C.Apply a route map with a 'match ip address' prefix-list to the VRF's import direction to deny the remote site's prefixes.
D.Change the Route Distinguisher (RD) of the VRF to a different value.
E.Configure 'neighbor <remote-PE> default-originate' under the VRF address-family.
AnswersA, C

Correct. Without a matching import RT, the PE will not install the remote site's VPNv4 routes into the VRF.

Why this answer

To block routes from a specific remote site, the engineer can either remove the import RT that matches the remote site's export RT, or configure a route map with a 'match ip address' clause to deny specific prefixes and apply it to the import direction. Removing the export RT from the local VRF would affect how the local site's routes are advertised, not what is received. Changing the RD does not affect route acceptance.

The 'neighbor ... default-originate' command is unrelated to filtering VPNv4 routes.

Full explanation →
1075
MCQmedium

A network engineer runs the following command on Router R2: R2# show logging | include %SYS-5-CONFIG_I *Mar 1 00:10:15.123: %SYS-5-CONFIG_I: Configured from console by console *Mar 1 00:12:45.678: %SYS-5-CONFIG_I: Configured from console by console *Mar 1 00:15:30.001: %SYS-5-CONFIG_I: Configured from console by console *Mar 1 00:20:00.999: %SYS-5-CONFIG_I: Configured from console by console Based on this output, what is the most likely problem?

A.The router has a memory leak causing frequent reloads.
B.The router is being reconfigured repeatedly from the console, which could indicate unauthorized access or a script issue.
C.The logging buffer is full and messages are being overwritten.
D.The syslog server is not reachable, so messages are only logged locally.
AnswerB

Multiple %SYS-5-CONFIG_I messages from the console suggest repeated configuration changes, which is abnormal and could be a security issue or a misconfigured automation script.

Why this answer

The output shows multiple configuration changes being made from the console in a short period of time. This could indicate unauthorized access or a misconfiguration that is causing repeated configuration changes. However, the most likely problem is that the logging level is set too low, and these messages are being generated due to a loop or automated script.

But the key clue is that the messages are from the console, suggesting someone is making changes repeatedly. The correct answer is that the router is being reconfigured frequently, possibly due to a configuration loop or an attacker.

Full explanation →
1076
Multi-Selectmedium

Which TWO statements about OSPFv3 (OSPF for IPv6) are true when comparing it to OSPFv2? (Choose TWO.)

Select 2 answers
A.OSPFv3 uses link-local IPv6 addresses for neighbor discovery.
B.OSPFv3 uses the same LSA types as OSPFv2.
C.OSPFv3 supports authentication using MD5 or SHA within the OSPF packet.
D.OSPFv3 uses the 'network' command to enable OSPF on interfaces.
E.OSPFv3 operates on a per-link basis rather than per-IP-subnet.
AnswersA, E

OSPFv3 routers form adjacencies using their link-local IPv6 addresses.

Why this answer

OSPFv3 runs on a per-link basis (not per-subnet) and uses link-local addresses for neighbor discovery. OSPFv3 still uses areas and LSAs, and authentication is handled by IPsec, not OSPF itself. OSPFv3 does not use the 'network' command; it uses 'ipv6 ospf' under the interface.

Full explanation →
1077
MCQmedium

What is the default CoPP classification for ARP packets on a Cisco IOS-XE device?

A.Normal
B.Critical
C.Management
D.Best-effort
AnswerB

ARP is classified as critical to ensure that address resolution is not starved by CoPP.

Why this answer

B is correct because on Cisco IOS-XE devices, ARP packets are classified under the 'Critical' control plane class by default. This ensures that ARP processing receives high priority to maintain Layer 2 connectivity and avoid adjacency timeouts, which could lead to network instability.

Exam trap

Cisco often tests the misconception that ARP is treated as 'Normal' because it is a Layer 2 protocol, but the default CoPP classification explicitly places it in 'Critical' to prevent adjacency loss and ensure network stability.

How to eliminate wrong answers

Option A is wrong because 'Normal' is the default CoPP class for most control plane traffic (e.g., OSPF hellos, BGP keepalives), but ARP is explicitly assigned to 'Critical' for higher priority. Option C is wrong because 'Management' is reserved for traffic like SSH, SNMP, or NTP that is directly destined to the device for administrative access, not for Layer 2 resolution protocols. Option D is wrong because 'Best-effort' is used for low-priority or non-essential traffic (e.g., ICMP echo replies) and would be inappropriate for ARP, which is critical for basic network operation.

Full explanation →
1078
MCQmedium

A network engineer is troubleshooting a DHCPv4 issue where a router configured as a DHCP server is not assigning addresses to clients on a subnet that is reachable via a different router (relay). The relay router (R2) has 'ip helper-address 10.1.1.1' on its client-facing interface, and the DHCP server is at 10.1.1.1 (R1). The engineer sees that R2 is sending DHCP DISCOVER messages with giaddr set to the client-facing interface IP, but R1 is not responding. R1 has a DHCP pool for the client subnet. The engineer pings 10.1.1.1 from R2 successfully. What is the most likely cause?

A.The DHCP server does not have a route to the client subnet (the giaddr subnet).
B.The relay agent R2 is missing the 'ip dhcp relay information option' command.
C.The DHCP pool on R1 is missing the 'default-router' command.
D.The 'ip helper-address' on R2 should point to the server's loopback address, not the interface IP.
AnswerA

Correct because the server sends the OFFER to the giaddr IP, which is on a different subnet; without a route back, the OFFER is lost.

Why this answer

The DHCP server may not have a route back to the client subnet (the giaddr subnet). Even though the server's interface IP is reachable, the server needs to send the OFFER to the giaddr (which is the relay agent's interface IP). If the server does not have a route to that subnet, the OFFER will be dropped.

The ping from R2 to R1 succeeds because R1's interface is directly connected, but the return traffic from R1 to the giaddr (which is on a different subnet) may fail if R1 does not have a route.

Full explanation →
1079
MCQhard

Which of the following is a limitation of NAT as defined in RFC 2663?

A.NAT cannot translate UDP traffic.
B.NAT is incompatible with TCP traffic.
C.NAT breaks end-to-end IP connectivity and can interfere with application-layer protocols.
D.NAT requires all traffic to be encrypted.
AnswerC

Correct. This is a well-known limitation of NAT as per RFC 2663.

Why this answer

RFC 2663 defines NAT as a mechanism that modifies IP addresses and/or ports in packet headers, which inherently breaks the end-to-end IP connectivity model. This modification can interfere with application-layer protocols that embed IP addresses or port numbers in their payload, such as FTP, SIP, or DNS, because NAT does not automatically translate these embedded addresses.

Exam trap

Cisco often tests the misconception that NAT is transparent to all traffic, when in fact it breaks end-to-end connectivity and requires ALGs for protocols that embed addressing information in the payload.

How to eliminate wrong answers

Option A is wrong because NAT can translate UDP traffic; it is commonly used for DNS and VoIP traffic. Option B is wrong because NAT is fully compatible with TCP traffic; it is widely used for web browsing and email. Option D is wrong because NAT does not require traffic to be encrypted; it operates on plaintext IP headers and can work with both encrypted and unencrypted traffic.

Full explanation →
1080
MCQhard

What is the default maximum number of route-map entries that can be processed in a single PBR policy on Cisco IOS-XE?

A.255
B.65535
C.1000
D.Unlimited
AnswerB

The default maximum number of route-map entries for PBR is 65535.

Why this answer

The default maximum number of route-map entries in a PBR policy is 65535, but the practical limit is often lower due to memory and performance constraints.

Full explanation →
1081
Multi-Selecthard

Which TWO statements about route summarization in EIGRP are true? (Choose TWO.)

Select 2 answers
A.EIGRP automatic summarization is enabled by default for classful networks.
B.Manual summarization can be configured using the 'ip summary-address eigrp' command under interface configuration.
C.EIGRP supports automatic summarization for all types of networks, including discontiguous subnets.
D.Route summarization in EIGRP requires the use of a route-map to define the summary prefix.
E.Manual summarization can only be applied to serial interfaces.
AnswersA, B

By default, EIGRP summarizes routes at classful boundaries when automatic summarization is enabled.

Why this answer

EIGRP supports manual summarization on any interface using the 'ip summary-address eigrp' command, and automatic summarization is enabled by default for classful networks. EIGRP does not support automatic summarization at the classful boundary for all networks; it is only for major network boundaries. Summarization in EIGRP does not require a route-map, and it can be configured on any interface, not just serial interfaces.

Full explanation →
1082
MCQhard

A DMVPN Phase 3 network with MPLS LDP configured on the tunnel interfaces experiences label distribution failures. R1 (hub) and R2 (spoke) have LDP neighborships established, but R2 is not receiving labels for prefixes behind R3 (another spoke). What is the root cause?

A.LDP is not enabled on the tunnel interface of R3, so R2 cannot receive labels for prefixes behind R3.
B.R2 has a higher LDP router ID, causing it to become the LDP session initiator.
C.NHRP is not resolving R3's tunnel IP to its physical IP, preventing LDP hello packets from reaching R3.
D.The MPLS label range on R2 is exhausted, preventing new label bindings.
AnswerA

Correct. LDP must be enabled on all tunnel interfaces for label distribution. If R3 does not have 'mpls ip' on its tunnel interface, it will not distribute labels.

Why this answer

In DMVPN Phase 3, the tunnel interface is a multipoint interface. LDP uses the primary IP address of the interface for neighbor discovery. If the tunnel interface is configured with 'ip mtu' or 'ip tcp adjust-mss' that differs between routers, or if the LDP hello packets are not reaching the other routers due to NHRP resolution issues, label distribution may fail.

The most common cause is that LDP is not enabled on the tunnel interface or the label space is not correctly configured for DMVPN.

Full explanation →
1083
MCQeasy

Which SNMPv2c PDU type is used by the manager to request a large amount of data efficiently, such as an entire routing table?

A.GetRequest
B.GetNextRequest
C.GetBulkRequest
D.SetRequest
AnswerC

GetBulkRequest allows retrieval of multiple variable bindings in one request, ideal for large tables.

Why this answer

C is correct because SNMPv2c introduced the GetBulkRequest PDU specifically to allow a manager to retrieve large amounts of data, such as an entire routing table, in a single request. Unlike GetNextRequest, which requires repeated requests to walk through a MIB subtree, GetBulkRequest uses a non-repeaters and max-repetitions mechanism to fetch multiple variable bindings in one operation, significantly reducing network overhead and latency.

Exam trap

Cisco often tests the misconception that GetNextRequest is the most efficient way to retrieve large tables, but the trap here is that GetBulkRequest was specifically designed for bulk retrieval and is the correct answer when efficiency is explicitly mentioned.

How to eliminate wrong answers

Option A is wrong because GetRequest retrieves only the value of a single specific OID instance and cannot efficiently fetch multiple rows or a large table. Option B is wrong because GetNextRequest retrieves the next OID in lexicographic order, requiring multiple sequential requests to traverse an entire table, which is inefficient for large data sets like a routing table. Option D is wrong because SetRequest is used to modify the value of a managed object, not to retrieve data.

Full explanation →
1084
MCQmedium

Given this configuration: ip nat pool GLOBAL 203.0.113.1 203.0.113.10 prefix-length 28 ip nat inside source list 10 pool GLOBAL overload access-list 10 permit 10.0.0.0 0.255.255.255 What is the effect?

A.All inside hosts are translated to the first pool address only.
B.Each inside host gets a unique pool address without port translation.
C.Inside hosts matching ACL 10 are translated to addresses in the pool using PAT.
D.The prefix-length 28 is invalid; a netmask must be used instead.
AnswerC

This correctly describes the configuration: dynamic NAT with overload.

Why this answer

The configuration uses `ip nat inside source list 10 pool GLOBAL overload`, which combines a NAT pool with the `overload` keyword to enable Port Address Translation (PAT). ACL 10 permits all 10.0.0.0/8 addresses, so inside hosts matching this ACL are translated to the pool addresses (203.0.113.1–203.0.113.10) with port multiplexing, allowing many hosts to share the same public IP. This is the standard Cisco PAT behavior, making option C correct.

Exam trap

The trap here is that candidates often confuse `overload` with static NAT or assume `prefix-length` is invalid, but Cisco explicitly tests the understanding that `overload` enables PAT and that `prefix-length` is a valid syntax for defining the subnet mask in NAT pools.

How to eliminate wrong answers

Option A is wrong because the `overload` keyword enables PAT, which allows multiple inside hosts to share any pool address, not just the first one; without `overload`, only the first address would be used for dynamic translation. Option B is wrong because the `overload` keyword explicitly enables port translation, preventing each host from getting a unique pool address; without `overload`, a one-to-one mapping would occur, but here PAT is active. Option D is wrong because `prefix-length 28` is a valid alternative to a netmask in Cisco NAT pool configuration; it specifies the subnet mask as a prefix length (e.g., /28 = 255.255.255.240), and the command is syntactically correct.

Full explanation →
1085
MCQmedium

A network engineer runs the following command to troubleshoot IPv6 source guard: R1# debug ipv6 source-guard *Mar 1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, IPv6 packet from 2001:db8::5, src MAC 0011.2233.4455, dst 2001:db8::1 *Mar 1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, Binding lookup: 2001:db8::5 not found in binding table *Mar 1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, Packet dropped: source 2001:db8::5 not allowed What does this output indicate?

A.IPv6 source guard is dropping packets from sources not in the binding table, preventing spoofing.
B.IPv6 source guard is allowing the packet because the source MAC matches.
C.IPv6 source guard is not configured; the debug output is from default IPv6 forwarding.
D.IPv6 source guard is learning the binding from the packet and will allow future packets.
AnswerA

The packet is dropped because the source address is not found in the binding table.

Why this answer

The debug output shows that IPv6 source guard is actively dropping a packet from source address 2001:db8::5 because that address is not found in the binding table. This is the core function of IPv6 source guard: it filters traffic based on the source IPv6 address and MAC address, using the binding table (populated by DHCPv6 snooping or ND snooping) to prevent spoofing attacks. The packet is dropped because the source address is not allowed, confirming that option A is correct.

Exam trap

Cisco often tests the misconception that IPv6 source guard can dynamically learn bindings from any traffic, when in fact it requires a pre-built binding table from DHCPv6 snooping or ND snooping to function correctly.

How to eliminate wrong answers

Option B is wrong because IPv6 source guard does not allow a packet solely based on a matching source MAC; it requires the source IPv6 address to be present in the binding table, and the debug explicitly states the binding lookup failed, leading to a drop. Option C is wrong because the debug output clearly shows IPv6 source guard is configured and actively processing packets (it performs a binding lookup and drops the packet), not that it is unconfigured or using default forwarding. Option D is wrong because IPv6 source guard does not dynamically learn bindings from arbitrary packets; it relies on a pre-populated binding table from DHCPv6 snooping or IPv6 neighbor discovery snooping, and the debug shows no learning action—only a lookup failure and drop.

Full explanation →
1086
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on the DMVPN hub's physical interface facing the WAN. Unexpectedly, spokes are unable to communicate with each other via the hub, even though direct spoke-to-spoke tunnels are working. Which is the most likely explanation?

A.uRPF strict mode on the physical interface drops packets from spokes because the reverse path to the spoke's tunnel IP is via the DMVPN tunnel interface, not the physical interface.
B.uRPF strict mode on the physical interface drops packets because the source IP of the spoke is not in the routing table at all.
C.uRPF strict mode is incompatible with DMVPN because the tunnel interface uses GRE encapsulation, which modifies the source IP.
D.The 'allow-default' option is not configured, which is required for uRPF to work with DMVPN.
AnswerA

The hub routes traffic to spoke tunnel IPs through the tunnel interface, so the reverse path check fails on the physical interface, causing drops.

Why this answer

uRPF strict mode checks that the source IP address of incoming packets has a route back to the source via the same interface. In a DMVPN network, when a spoke sends traffic to another spoke via the hub, the source IP is the spoke's tunnel IP. The hub's routing table may have a route to that spoke's tunnel IP via the DMVPN tunnel interface, not the physical WAN interface.

Therefore, uRPF strict mode on the physical interface drops the packet because the reverse path is not through the same interface. The fix is to use uRPF loose mode or allow-default option, or apply uRPF on the tunnel interface.

Full explanation →
1087
Multi-Selecthard

Which TWO actions will prevent a CoPP policy from inadvertently dropping legitimate routing protocol packets during a traffic spike? (Choose TWO.)

Select 2 answers
A.Create a class-map that matches routing protocol packets (e.g., OSPF, EIGRP, BGP) and assign a police rate with conform-action transmit and exceed-action drop.
B.Create a class-map that matches routing protocol packets and assign a police rate with conform-action transmit and violate-action transmit.
C.Place routing protocol traffic into a class with a 'drop' action to prevent it from overwhelming the control plane.
D.Use the 'police' command with a high committed information rate (CIR) and burst size, and apply 'conform-action transmit' and 'exceed-action set-dscp cs6'.
E.Apply the CoPP policy only to the 'control-plane host' subinterface, which processes all routing protocol packets.
AnswersB, D

Correct. Using transmit for both conform and violate actions ensures routing protocol packets are never dropped, even during spikes.

Why this answer

Using 'conform-action transmit' and 'violate-action transmit' ensures that routing protocol packets are never dropped, even if they exceed the configured police rate. This prevents CoPP from inadvertently dropping critical control plane traffic during a traffic spike, as the violate-action overrides the default drop behavior. The other correct option, D, uses a high CIR and burst size with 'exceed-action set-dscp cs6' to mark but not drop routing protocol packets, preserving them while still applying QoS treatment.

Exam trap

Cisco often tests the misconception that any policing action (like exceed-action drop) is acceptable for routing protocol traffic, but the trap is that candidates forget that routing protocol packets must never be dropped, so only actions that guarantee transmission (like violate-action transmit or marking without drop) are correct.

Full explanation →
1088
MCQhard

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global udp 192.0.2.10:1234 10.0.0.10:1234 203.0.113.5:53 203.0.113.5:53 tcp 192.0.2.10:5678 10.0.0.10:5678 198.51.100.20:80 198.51.100.20:80 --- 192.0.2.11 10.0.0.11 --- --- R1# show ip nat statistics Total active translations: 3 (0 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 100 Misses: 0 CEF Translated packets: 100, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 3 map-id 1 overload [Id] ip nat inside source list ACL1 pool POOL1 overload refcount 3 Based on this output, what is the problem?

A.The third translation is not using PAT, indicating a possible ACL or route-map misconfiguration.
B.The pool is exhausted because 192.0.2.10 is used twice.
C.The outside interface is misconfigured as inside.
D.The NAT translations are all static.
AnswerA

The overload configuration should create PAT entries with protocol/port. The third entry without protocol suggests the traffic from 10.0.0.11 is not being matched by the same ACL or is using a different pool.

Why this answer

The third translation lacks a protocol and port number, meaning it is a simple dynamic NAT entry without Port Address Translation (PAT). Since the pool is configured with the `overload` keyword, all translations should use PAT to share the pool addresses. The presence of a non-PAT translation indicates that the ACL or route-map used to match traffic for NAT is misconfigured, causing some traffic to be translated without port multiplexing.

Exam trap

Cisco often tests the distinction between simple NAT and PAT by showing a translation entry without ports, leading candidates to incorrectly assume the pool is exhausted or that static NAT is in use, when the real issue is a misconfigured ACL or route-map that allows non-PAT traffic.

How to eliminate wrong answers

Option B is wrong because the pool is not exhausted; 192.0.2.10 is used twice, but with different ports (1234 and 5678), which is normal for PAT overload. Option C is wrong because the output shows the outside interface is GigabitEthernet0/1 and the inside interface is GigabitEthernet0/0, which is correctly configured. Option D is wrong because the statistics clearly state '0 static, 3 dynamic' translations, and the third translation is dynamic, not static.

Full explanation →
1089
MCQmedium

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 in AS 65001 is configured to redistribute connected routes into BGP. The route 10.10.10.0/24 is learned via BGP on R2 (AS 65002), but R2's iBGP neighbor R3 (AS 65002) does not receive this route. R2 and R3 have a full iBGP mesh, and the BGP session is established. The output of 'show ip bgp' on R2 shows the route with the 'r' flag (RIB-failure). What is the most likely cause?

A.The route is marked as RIB-failure because a route with a lower administrative distance already exists in the routing table for the same prefix.
B.The route is marked as RIB-failure because the next-hop is unreachable.
C.The route is marked as RIB-failure because BGP synchronization is enabled and the IGP does not have the route.
D.The route is marked as RIB-failure because the prefix is being filtered by an outbound route map.
AnswerA

Correct because RIB-failure occurs when another routing source (e.g., OSPF, EIGRP, static) has a better route, preventing BGP from installing its route.

Why this answer

RIB-failure indicates that BGP learned a route but it was not installed in the routing table because a better route (e.g., from an IGP or static) already exists. This prevents the route from being advertised to iBGP peers.

Full explanation →
1090
MCQhard

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up, but the engineer notices that the 'show crypto ipsec sa' output shows that the number of packets encrypted is much higher than the number of packets decrypted on the remote side. What is the most likely cause?

A.The remote router has a misconfigured route that sends return traffic out the wrong interface.
B.The IPsec SA lifetime is set too low, causing frequent rekeying.
C.The crypto map on the local router is applied to the wrong interface.
D.The access list in the crypto map on the remote router is too permissive, encrypting extra traffic.
AnswerA

Correct because if the remote router does not have a route to the local LAN that points to the tunnel interface, the return traffic will be sent out the physical interface without encryption, and the local router will not see corresponding decrypted packets.

Why this answer

A significant mismatch between encrypted and decrypted packet counts suggests that some packets are being lost or dropped after encryption. The most common cause is a routing issue where the return traffic from the remote side is not taking the VPN tunnel, so the remote router does not decrypt those packets.

Full explanation →
1091
MCQmedium

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-IN Class-map: CoPP-DEFAULT (match-any) 5000 packets, 300000 bytes 5 minute offered rate 4000 bps, drop rate 2000 bps Match: any police: cir 32000 bps, bc 6000 bytes, be 6000 bytes conformed 3000 packets, 180000 bytes; actions: transmit exceeded 1000 packets, 60000 bytes; actions: drop violated 1000 packets, 60000 bytes; actions: drop Based on this output, what is the most likely impact on the router?

A.All control plane traffic is being transmitted without issues.
B.Some control plane traffic is being dropped, which could cause routing protocol instability.
C.The police rate is set to 64000 bps.
D.Only ICMP traffic is being dropped.
AnswerB

Dropped packets in the class-default can affect critical control plane traffic.

Why this answer

The output shows that the CoPP policy is policing control plane traffic with a CIR of 32000 bps. The 'exceeded' and 'violated' counters indicate that 2000 packets (120000 bytes) have been dropped, with a drop rate of 2000 bps. This means some control plane traffic is being dropped, which can cause routing protocol instability (e.g., BGP, OSPF keepalives being dropped).

Exam trap

Cisco often tests the misinterpretation of the 'police' counters: candidates may see 'conformed' packets and assume no drops, missing the 'exceeded' and 'violated' counters that clearly indicate dropped traffic.

How to eliminate wrong answers

Option A is wrong because the output clearly shows dropped packets (exceeded and violated counters), so not all control plane traffic is being transmitted without issues. Option C is wrong because the police rate is explicitly set to 32000 bps (cir 32000 bps), not 64000 bps. Option D is wrong because the class-map CoPP-DEFAULT matches 'any' traffic, not just ICMP; the drops could affect any control plane protocol, including routing protocols like BGP or OSPF.

Full explanation →
1092
MCQmedium

snmp-server ifindex persist What is the effect of this configuration?

A.Interface indices are preserved after a device reload.
B.Interface statistics are cleared on reload.
C.SNMP traps are sent for interface state changes.
D.The ifIndex is based on the interface name.
AnswerA

The 'snmp-server ifindex persist' command ensures that ifIndex values remain consistent across reboots.

Why this answer

The `snmp-server ifindex persist` command configures the router to save interface index (ifIndex) values in non-volatile memory (the private configuration or NVRAM) so that after a reload, each interface retains its original ifIndex. This is critical for SNMP management systems that rely on stable ifIndex values to correlate interface statistics across reboots, as the default behavior is to assign ifIndex values dynamically based on the order interfaces are discovered, which can change after a reload.

Exam trap

Cisco often tests the misconception that `snmp-server ifindex persist` affects SNMP trap generation or interface statistics, when in reality it only ensures the ifIndex values remain constant across reloads.

How to eliminate wrong answers

Option B is wrong because the command does not affect interface statistics clearing; statistics are cleared by `clear counters` or reload, but ifIndex persistence does not prevent or cause that. Option C is wrong because SNMP traps for interface state changes are controlled by `snmp-server enable traps` and interface-specific trap configuration, not by ifIndex persistence. Option D is wrong because ifIndex is always based on the interface name or internal ordering, but persistence does not change the mapping logic; it only preserves the existing mapping across reboots.

Full explanation →
1093
MCQeasy

Which IP SLA operation type uses ICMP Echo Request/Reply packets to measure round-trip time?

A.UDP Jitter
B.ICMP Echo
C.TCP Connect
D.HTTP
AnswerB

Correct. ICMP Echo is the IP SLA operation that uses ICMP Echo Request/Reply.

Why this answer

The IP SLA ICMP Echo operation (type 1) uses ICMP Echo Request and Echo Reply messages to measure network latency and availability.

Full explanation →
1094
MCQhard

An engineer configures BFD for EIGRP and also applies an offset-list to increase the metric of a route. The BFD session is up, but the route with the offset-list is not being installed in the routing table. The engineer verifies that the offset-list is correctly configured. What is the most likely explanation?

A.The offset-list increased the feasible distance beyond the advertised distance, making the route no longer feasible.
B.The offset-list is applied to the wrong interface, so it does not affect the route.
C.The BFD session is flapping, causing EIGRP to remove the route.
D.The offset-list is using a metric that exceeds the maximum hop count for EIGRP.
AnswerA

Correct. Offset-lists increase the FD, and if the FD exceeds the AD, the route becomes infeasible and is removed from the topology table.

Why this answer

EIGRP offset-lists can increase the metric of a route, but they affect the feasible distance (FD), not the advertised distance (AD). If the offset-list increases the FD such that the route is no longer feasible (i.e., the FD exceeds the AD of the successor), the route may be removed from the topology table. BFD does not interact with offset-lists.

Full explanation →
1095
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla summary IPSLAs Latest Operation Summary Codes: * active, ^ inactive, ~ pending ID Type Destination Stats Return Code Last 1 icmp-echo 192.168.1.1 RTT=50ms OK 1s ago 2 icmp-echo 192.168.1.2 RTT=2000ms Over threshold 2s ago 3 icmp-echo 192.168.1.3 RTT=100ms OK 3s ago Based on this output, which statement is correct?

A.IP SLA operation 2 has failed because the destination is unreachable.
B.IP SLA operation 2 is experiencing high latency, exceeding the configured threshold.
C.IP SLA operation 1 is not active because it shows 'OK'.
D.IP SLA operation 3 has a pending status.
AnswerB

The return code 'Over threshold' directly indicates that the RTT exceeded the threshold, implying high latency.

Why this answer

The 'Return Code' column shows 'Over threshold' for ID 2, meaning the RTT exceeded the configured threshold. The other operations are OK. This output does not indicate failure or timeout unless the return code says so.

Full explanation →
1096
MCQhard

A network engineer runs the following command on switch SW4: SW4# show monitor session 6 Session 6 --------- Type : Local Session Source Ports : Both : Gi0/8, Gi0/9 Destination Ports : Gi0/10 Encapsulation : Native Ingress : Enabled Based on this output, which statement is correct?

A.The SPAN session is configured correctly and will forward traffic received on Gi0/10 into the network.
B.The SPAN session is misconfigured because source ports cannot be monitored in both directions.
C.The SPAN session is using RSPAN because the destination port has ingress enabled.
D.The SPAN session is disabled because the destination port has ingress enabled.
AnswerA

Ingress enabled on the destination port allows traffic received on that port to be forwarded, which is atypical and can cause issues.

Why this answer

This is a local SPAN session with source ports Gi0/8 and Gi0/9, and destination port Gi0/10. The destination port has ingress enabled, which means traffic received on Gi0/10 will be processed and forwarded by the switch. This is unusual because SPAN destination ports typically have ingress disabled to prevent loops and forwarding of mirrored traffic.

This configuration can cause network issues.

Full explanation →
1097
MCQhard

A network engineer runs the following command on Router R1: R1# show ip route ospf Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set 172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks O 172.16.0.0/24 [110/100] via 172.16.0.2, 00:00:15, Tunnel0 O 172.16.0.0/24 [110/100] via 172.16.0.3, 00:00:10, Tunnel0 Based on this output, what is the problem?

A.OSPF is learning the same subnet from multiple spokes, indicating a misconfiguration.
B.The OSPF cost is 100, which is high.
C.The routes are learned via EIGRP.
D.The tunnel interface is down.
AnswerA

Duplicate routes for the same network via different next hops is problematic.

Why this answer

The output shows OSPF routes for the same network 172.16.0.0/24 via two different next hops (172.16.0.2 and 172.16.0.3). This indicates that OSPF is seeing the same subnet from multiple spokes, which is incorrect because the tunnel network should be unique per spoke. This suggests a misconfiguration where the tunnel IP addresses are overlapping or OSPF is not properly filtering.

Full explanation →
1098
MCQeasy

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

A.The 'logging on' command is not configured.
B.The logging buffer is full and needs to be cleared.
C.The router has run out of memory to generate syslog messages.
D.The 'logging host' command is missing, so no destination is configured.
AnswerA

Correct because 'logging on' globally enables syslog; without it, no messages are produced.

Why this answer

The 'show logging' output clearly states that syslog logging is disabled. The most common cause is that the global 'logging on' command is missing from the configuration. Without this command, no syslog messages are generated or sent to any destination.

Full explanation →
1099
MCQmedium

What is the default logging severity level for messages sent to the console in Cisco IOS-XE?

A.Level 0 (emergencies)
B.Level 7 (debugging)
C.Level 5 (notifications)
D.Level 4 (warnings)
AnswerB

The default console logging severity is level 7, meaning all messages from emergencies through debugging are displayed.

Why this answer

By default, Cisco IOS-XE logs messages with severity level 7 (debugging) and higher to the console.

Full explanation →
1100
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 eigrp neighbors IPv6-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 FE80::A8BB:CCFF:FE00:2 Tunnel0 13 00:23:45 10 200 0 12 1 FE80::A8BB:CCFF:FE00:3 Tunnel1 12 00:22:10 15 200 0 15 Based on this output, which statement is correct?

A.EIGRP is not configured for IPv6.
B.The neighbors are using global unicast addresses.
C.EIGRP for IPv6 adjacencies are established over the tunnels.
D.The tunnels are using GRE encapsulation.
AnswerC

Neighbors are present with uptime and hold time.

Why this answer

The output shows two IPv6 EIGRP neighbors with link-local addresses (FE80::/10) on interfaces Tunnel0 and Tunnel1, and the adjacency is established and exchanging routes (Seq Num increasing). This confirms that EIGRP for IPv6 adjacencies are formed over these tunnel interfaces, making option C correct.

Exam trap

Cisco often tests the misconception that EIGRP for IPv6 uses global unicast addresses for neighbor adjacencies, but the output clearly shows link-local addresses, and candidates may incorrectly assume the tunnels must be GRE without evidence from the command output.

How to eliminate wrong answers

Option A is wrong because the command 'show ipv6 eigrp neighbors' successfully displays neighbor entries, which proves EIGRP for IPv6 is configured and operational on the process 100. Option B is wrong because the neighbor addresses shown are link-local addresses (FE80::/10), not global unicast addresses; EIGRP for IPv6 always uses link-local addresses for neighbor adjacencies. Option D is wrong because the output does not provide any information about the encapsulation type (GRE, IPsec, or other); the tunnels could be using any IPv6 tunneling technique, and GRE is not confirmed by this output.

Full explanation →
1101
MCQmedium

Refer to the following partial configuration: logging console informational logging monitor debugging logging trap errors logging buffered 4096 Which statement is true about the logging levels?

A.The console receives messages of severity 0 through 6.
B.The monitor receives messages of severity 0 through 6.
C.The syslog server receives messages of severity 0 through 7.
D.The buffer stores messages of severity 0 through 6.
AnswerA

Console level 'informational' includes severities 0-6 (emergency through informational).

Why this answer

Logging levels: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), debugging (7). The trap level 'errors' means only messages severity 0-3 are sent to syslog servers. Console 'informational' means 0-6.

Monitor 'debugging' means 0-7. Buffer defaults to debugging if not specified, but here it is set to 4096 bytes without a level, so it defaults to debugging.

Full explanation →
1102
MCQmedium

Router R4 has the following configuration: ``` interface GigabitEthernet0/5 ip address 10.4.4.4 255.255.255.0 ip policy route-map PBR-DEFAULT ! route-map PBR-DEFAULT permit 10 set ip default next-hop 192.168.3.1 ``` What is the effect of this configuration?

A.All packets received on G0/5 are forwarded to 192.168.3.1 if they do not have a route in the routing table.
B.All packets received on G0/5 are forwarded to 192.168.3.1 regardless of the routing table.
C.The route-map is missing a match statement, so it does nothing.
D.The configuration is invalid because 'set ip default next-hop' requires an ACL.
AnswerA

Default next-hop applies only when the routing table has no route for the destination.

Why this answer

The 'set ip default next-hop' command is used for packets that do not match any explicit route in the routing table. It does not affect packets that have a matching route.

Full explanation →
1103
MCQmedium

A network engineer runs the following command on router R4: R4# show monitor session 9 Session 9 --------- Type : ERSPAN Source Session Status : Admin Disabled Source Ports : Both : Gi0/2 Destination IP : 192.168.2.20 Origin IP : 10.0.0.3 ERSPAN ID : 200 Based on this output, which statement is correct?

A.The ERSPAN session is configured but not currently active because it is administratively disabled.
B.The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.
C.The ERSPAN session is using RSPAN because the status is disabled.
D.The ERSPAN session is misconfigured because the origin IP is missing.
AnswerA

The status 'Admin Disabled' indicates the session is not active.

Why this answer

This is an ERSPAN source session that is administratively disabled. The configuration is present but not active. To enable it, the engineer must use the 'no shutdown' command under the session configuration.

Full explanation →
1104
MCQmedium

What is the default timer value for the EEM environment variable 'timer watchdog'?

A.30 seconds
B.60 seconds
C.120 seconds
D.180 seconds
AnswerB

The default watchdog timer is 60 seconds, configurable via 'event timer watchdog'.

Why this answer

The default watchdog timer is 60 seconds; it monitors the EEM policy execution and resets if exceeded.

Full explanation →
1105
MCQmedium

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# debug crypto isakmp *Mar 1 00:01:23.456: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (N) NEW SA *Mar 1 00:01:23.457: ISAKMP: Created a peer struct for 192.168.1.2, peer port 500 *Mar 1 00:01:23.457: ISAKMP: New peer created peer = 0x12345678 peer_handle = 0x80000001 *Mar 1 00:01:23.457: ISAKMP: Locking peer struct 0x12345678, refcount 1 for crypto_isakmp_process_block *Mar 1 00:01:23.457: ISAKMP (0:0): SA request profile is (default) *Mar 1 00:01:23.457: ISAKMP: local port 500, remote port 500 *Mar 1 00:01:23.458: ISAKMP (0:0): found peer pre-shared-key matching 192.168.1.2 *Mar 1 00:01:23.458: ISAKMP (0:0): constructed NAT-T vendor ID *Mar 1 00:01:23.458: ISAKMP (0:0): sending packet to 192.168.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 1 00:01:23.458: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (I) MM_NO_STATE *Mar 1 00:01:23.459: ISAKMP (0:0): processing SA payload. message ID = 0 *Mar 1 00:01:23.459: ISAKMP (0:0): Checking ISAKMP transform 1 against priority 1 policy *Mar 1 00:01:23.459: ISAKMP: encryption DES-CBC *Mar 1 00:01:23.459: ISAKMP: hash SHA *Mar 1 00:01:23.459: ISAKMP: default group 2 *Mar 1 00:01:23.459: ISAKMP: auth pre-share *Mar 1 00:01:23.459: ISAKMP (0:0): atts are not acceptable. Next transforms are not acceptable *Mar 1 00:01:23.460: ISAKMP (0:0): no offers accepted! What does this output indicate?

A.The ISAKMP SA is established successfully using pre-shared key authentication.
B.The ISAKMP transform set proposal is rejected due to a mismatch in encryption, hash, or DH group between peers.
C.The router is receiving the packet from an incorrect source IP address.
D.The router is unable to find a pre-shared key for the peer.
AnswerB

The output clearly states 'atts are not acceptable' and 'no offers accepted', which means the proposed transform does not match the local policy.

Why this answer

The debug output shows that the router received an ISAKMP proposal from the peer (192.168.1.2) and checked it against its own configured policy. The line 'atts are not acceptable' followed by 'no offers accepted' indicates that the transform set attributes (encryption DES-CBC, hash SHA, DH group 2) did not match any of the router's ISAKMP policies. This is a classic proposal mismatch, preventing the ISAKMP SA from being established.

Exam trap

Cisco often tests the distinction between a pre-shared key mismatch (which would show 'no pre-shared key found') and a transform set mismatch (which shows 'atts are not acceptable'), leading candidates to incorrectly blame the PSK when the actual issue is the encryption/hash/DH group.

How to eliminate wrong answers

Option A is wrong because the debug clearly shows 'no offers accepted', meaning the ISAKMP SA was not established; successful establishment would show 'ISAKMP (0:0): SA has been created' or similar. Option C is wrong because the router correctly identifies the source IP as 192.168.1.2 and processes the packet; there is no indication of an incorrect source IP. Option D is wrong because the debug explicitly states 'found peer pre-shared-key matching 192.168.1.2', so the pre-shared key is present and matched.

Full explanation →
1106
MCQhard

R1 and R2 are EIGRP neighbors with BFD enabled. R1#show ip eigrp neighbors shows R2 in state 'Init' for BFD. R1#show bfd neighbors shows the session as 'Up'. R2#show bfd neighbors shows the session as 'Up'. R1 has 'eigrp stub' configured. R2 does not. What is the root cause?

A.The EIGRP stub configuration on R1 prevents full adjacency, but BFD is unaffected.
B.BFD requires 'eigrp stub' to be removed.
C.The BFD interval on R1 is too low for EIGRP.
D.EIGRP must be configured with 'no eigrp stub' for BFD to work.
AnswerA

EIGRP stub does not affect BFD; the BFD session is up, but EIGRP adjacency is in Init due to stub behavior.

Why this answer

EIGRP stub routers can form BFD sessions but the EIGRP adjacency may remain in Init state if the stub router is not configured correctly. However, BFD session is up, so the issue is with EIGRP itself. The stub router may be blocking queries, but that does not affect BFD.

The real issue is that R1 has 'eigrp stub' but is missing the 'receive-only' keyword, causing it to not advertise routes, but BFD is fine. The BFD session is up, so the problem is EIGRP, not BFD.

Full explanation →
1107
MCQhard

Two OSPF domains are redistributed into each other on router R1. R1 has: router ospf 1 redistribute ospf 2 subnets router ospf 2 redistribute ospf 1 subnets Router R2 (in OSPF 1) shows: R2# show ip route ospf O E2 10.1.1.0/24 [110/20] via 10.2.1.1, 00:00:05, Serial0/0/0 O E2 10.2.1.0/24 [110/20] via 10.2.1.1, 00:00:05, Serial0/0/0 R2# traceroute 10.1.1.1 source 10.2.1.2 Type escape sequence to abort. Tracing the route to 10.1.1.1 1 10.2.1.1 4 msec 4 msec 4 msec 2 10.1.1.1 8 msec 8 msec 8 msec R2# traceroute 10.2.1.1 source 10.1.1.2 Type escape sequence to abort. Tracing the route to 10.2.1.1 1 10.1.1.1 4 msec 4 msec 4 msec 2 10.2.1.1 8 msec 8 msec 8 msec Traffic between the two domains is taking suboptimal paths. What is the root cause?

A.The redistribution is mutual without any route filtering, causing routing loops.
B.The 'subnets' keyword is missing from one of the redistribute commands.
C.OSPF administrative distance is set incorrectly, preferring external routes.
D.R1 has a routing table entry for 10.1.1.0/24 pointing to R2.
AnswerA

Routes from OSPF 1 are redistributed into OSPF 2 and then back into OSPF 1, creating a loop.

Why this answer

Mutual redistribution without route filtering creates a routing loop. Routes from OSPF 1 are redistributed into OSPF 2, and then back into OSPF 1, causing suboptimal paths. The traceroute shows traffic going through R1 twice.

The fix is to use route tagging and filtering to prevent re-redistribution.

Full explanation →
1108
MCQmedium

A network engineer runs the following command on Router R1: R1# show flow exporter EXPORTER-1 Flow Exporter EXPORTER-1: Description: Exports to collector Export protocol: NetFlow Version 9 Transport Configuration: Destination IP address: 192.168.1.100 Source IP address: 10.0.0.1 Transport Protocol: UDP Destination Port: 2055 Source Port: 0 Collector Configuration: VRFs: Default Options Configuration: Sampler: Not configured Export Statistics: Number of Flows exported: 0 Number of Packets exported: 0 Number of Source IP address unreachable: 0 Number of Packets dropped: 0 Based on this output, what is the most likely reason that no flows are being exported?

A.The destination port is incorrect; NetFlow version 9 requires port 9996.
B.The flow exporter is not referenced in any flow monitor applied to an interface.
C.The source IP address is not reachable from the destination.
D.The sampler is not configured, causing all packets to be dropped.
AnswerB

The exporter statistics show no flows exported, but no errors, meaning the exporter is idle. This typically occurs when no flow monitor using this exporter is applied to an interface.

Why this answer

The output shows 0 flows exported, but no errors. This often indicates that the flow monitor is not applied to an interface or the exporter is not referenced in a flow monitor. The exporter itself is configured correctly with a valid destination.

Full explanation →
1109
MCQmedium

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla statistics 10 detail Round Trip Time (RTT) for Index 10 Latest RTT: 12 ms Latest RTT (milliseconds): 12 Latest RTT (microseconds): 12000 Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Last operation return code: OK Number of successes: 100 Number of failures: 0 Operation time to live: Forever Last operation response time: 12 ms Latest operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Latest operation return code: OK Over thresholds occurred: FALSE Threshold (milliseconds): 5000 RTT Values: RTTAvg: 12 RTTMin: 10 RTTMax: 15 RTTNum: 100 RTTStdDev: 1 What does this output indicate?

A.The IP SLA operation has high jitter because the RTT standard deviation is 1 ms.
B.The IP SLA operation is experiencing packet loss because the number of failures is 0.
C.The IP SLA operation shows stable performance with low jitter and no threshold violations.
D.The IP SLA operation has exceeded the threshold because the RTTMax is 15 ms.
AnswerC

The low standard deviation and 'Over thresholds occurred: FALSE' confirm stability.

Why this answer

This detailed output shows RTT statistics including average, minimum, maximum, and standard deviation. The low standard deviation (1 ms) and no thresholds exceeded indicate stable performance.

Full explanation →
1110
MCQhard

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down R1# show bgp neighbors 192.168.1.2 BGP neighbor is 192.168.1.2, remote AS 65002, external link BGP version 4, remote router ID 10.0.0.2 BGP state = Idle Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds Neighbor sessions: 1 active, is not multisession capable Based on this output, what is the most likely conclusion?

A.The BGP neighbor is up and running.
B.The BGP neighbor is down, and the EEM policy may have been triggered.
C.The EEM policy is not registered.
D.The BGP session is established.
AnswerB

The Idle state indicates the session is down, which would likely trigger the BGP_Neighbor_Down event.

Why this answer

The EEM policy BGP_Neighbor_Down is registered, and the BGP neighbor is in Idle state, indicating the session is down. The correct answer is that the BGP neighbor is down, and the EEM policy may have been triggered.

Full explanation →
1111
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer confirms that the route for the customer subnet exists in the routing table and points to the correct interface. What is the most likely explanation?

A.Asymmetric routing is in use, and the return route for the source IP points to a different interface.
B.The 'allow-default' option is not enabled, so default routes are not considered.
C.The 'ip verify unicast source reachable-via any' command was used instead of 'rx'
D.The customer subnet is a summary route, and the more specific route is missing.
AnswerA

Strict uRPF requires that the best route to the source IP address points back to the same interface on which the packet was received. If asymmetric routing is present, the return path may be via a different interface, causing strict uRPF to drop the packet.

Why this answer

Strict uRPF checks that the source IP address of an incoming packet has a route in the routing table that points back to the same interface. If the customer network uses asymmetric routing (i.e., traffic comes in one interface but the return route points out a different interface), strict uRPF will drop the traffic. The edge case is that even if the route exists, if it does not point to the incoming interface, the packet is dropped.

Full explanation →
1112
MCQeasy

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp traffic IP-EIGRP Traffic Statistics for process 100 Hellos sent/received: 500/495 Updates sent/received: 10/8 Queries sent/received: 2/1 Replies sent/received: 1/2 Acks sent/received: 8/10 Input queue high water mark: 2, Input queue depth: 0 Total packets sent: 521, received: 516 What does this output indicate?

A.The network is experiencing a high number of queries, indicating instability.
B.The EIGRP process is functioning normally with no signs of congestion or issues.
C.There is a problem with packet loss because more hellos were sent than received.
D.The router is not receiving acknowledgments for its updates.
AnswerB

The traffic statistics are balanced and the input queue is empty, indicating normal operation.

Why this answer

The output shows a balanced exchange of EIGRP packets with no retransmissions, a low input queue depth of 0, and a high water mark of only 2. These metrics indicate the EIGRP process is stable, with no congestion, packet loss, or neighbor issues. The slight difference between hellos sent (500) and received (495) is normal due to timing or asymmetric paths and does not indicate a problem.

Exam trap

Cisco often tests the misconception that any asymmetry in hello packet counts indicates packet loss, when in fact EIGRP hellos are sent unreliably and a slight mismatch is normal due to timing differences or interface delays.

How to eliminate wrong answers

Option A is wrong because the query count (2 sent, 1 received) is very low, not high; a high number of queries would indicate route recomputation or instability, but these numbers show a stable topology. Option C is wrong because a small difference in hellos sent vs received is normal in EIGRP due to hello interval timing variations or asymmetric links, and does not indicate packet loss. Option D is wrong because the Ack counts (8 sent, 10 received) are balanced and consistent with the update and query/reply exchanges, showing that acknowledgments are being received properly.

Full explanation →
1113
Multi-Selectmedium

Which THREE symptoms indicate that IPv6 First Hop Security features are misconfigured or not functioning correctly? (Choose THREE.)

Select 3 answers
A.IPv6 hosts on a segment are unable to obtain a global unicast address via SLAAC, even though a legitimate router is present.
B.A newly connected switch causes existing hosts to lose IPv6 connectivity to the default gateway.
C.Hosts on a VLAN receive Router Advertisements but do not update their default gateway.
D.IPv6 pings between two hosts on the same VLAN succeed, but pings to the router fail.
E.The switch logs show frequent 'IPv6 address collision' messages.
AnswersA, B, C

This could be due to RA Guard blocking the router's Router Advertisements, preventing SLAAC.

Why this answer

SLAAC relies on Router Advertisements (RAs) to provide the prefix and other configuration information. If IPv6 First Hop Security features such as RA Guard or RA snooping are misconfigured, they may block or drop legitimate RAs, preventing hosts from generating a global unicast address via SLAAC even though a valid router is present.

Exam trap

Cisco often tests the distinction between First Hop Security failures (which block control-plane messages like RAs and DHCPv6) and other IPv6 issues like routing problems or DAD collisions, so candidates must recognize that symptoms like inter-host ping success but router ping failure point to routing, not First Hop Security.

Full explanation →
1114
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail Gi0/0 EIGRP-IPv4 Interfaces for AS(100) Interface: GigabitEthernet0/0 Peers: 1 Xmit Queue Un/Reliable: 0/0 Mean SRTT: 12 Pacing Time Un/Reliable: 0/10 Multicast Flow Timer: 50 Pending Routes: 0 Hello interval: 5 Hold time: 15 Split horizon: Enabled Next multicast: 0.0.0.0 Next broadcast: 0.0.0.0 Based on this output, what is the problem?

A.Split horizon is enabled, which is a normal and expected configuration.
B.Split horizon is disabled, which could cause routing loops.
C.The hold time of 15 seconds is too short and may cause instability.
D.The interface has no peers, indicating a problem.
AnswerA

Split horizon is enabled by default on EIGRP interfaces and helps prevent routing loops.

Why this answer

Split horizon is a default and expected behavior in EIGRP for most interface types, including GigabitEthernet. The output shows 'Split horizon: Enabled', which is normal and prevents routing loops by ensuring that routing information learned on an interface is not advertised back out of that same interface. There is no problem indicated by this setting.

Exam trap

The trap here is that candidates may mistakenly think split horizon is a problem or misconfiguration, when in fact it is a standard loop-prevention mechanism, and Cisco often tests this by showing a normal default value and asking if it indicates an issue.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Split horizon: Enabled', not disabled, so the premise of the option is factually incorrect. Option C is wrong because a hold time of 15 seconds with a hello interval of 5 seconds is the default for EIGRP on high-speed interfaces (hello=5, hold=15) and is not too short; it provides adequate time to detect neighbor failures without causing instability. Option D is wrong because the output shows 'Peers: 1', indicating that the interface does have an EIGRP neighbor, so there is no peer problem.

Full explanation →
1115
Multi-Selectmedium

Which THREE symptoms indicate a potential issue with NHRP registration in a DMVPN network? (Choose THREE.)

Select 3 answers
A.The spoke router does not receive an NHRP Registration Reply from the hub.
B.The hub router's NHRP cache does not contain an entry for the spoke.
C.The spoke router's tunnel interface shows 'UP/UP' but NHRP registration status is 'NOT REGISTERED'.
D.The spoke router's tunnel interface shows 'UP/DOWN'.
E.The spoke router's routing table shows routes learned from the hub.
AnswersA, B, C

This indicates that the registration request failed, possibly due to authentication mismatch or reachability issues.

Why this answer

Common symptoms of NHRP registration problems include the spoke not receiving a registration reply from the hub, the spoke not appearing in the hub's NHRP cache, and the spoke's tunnel interface showing a status of 'UP/UP' but the NHRP registration being 'NOT REGISTERED'. The other options are not direct symptoms of NHRP registration issues.

Full explanation →
1116
Drag & Dropmedium

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Validation begins with checking the uRPF configuration on the interface, then verifying the interface status, inspecting uRPF statistics, testing connectivity with ping, and finally confirming the routing table for expected routes.

Full explanation →
1117
MCQmedium

A network engineer runs the following command on Router PE7: PE7# show bgp vpnv4 unicast vrf CUSTOMER_E labels Network Next Hop In Label/Out Label 10.10.10.0/24 10.0.0.8 18/22 10.20.20.0/24 10.0.0.9 19/23 Based on this output, which statement is correct?

A.The router is correctly assigning labels for VPNv4 routes.
B.The router is not receiving labels from its BGP peers.
C.The VRF CUSTOMER_E has no routes.
D.The label allocation is failing.
AnswerA

Both entries have valid incoming and outgoing labels.

Why this answer

The show bgp vpnv4 unicast vrf labels command displays the label bindings for VPNv4 routes in a VRF. Each entry shows the incoming label (assigned locally) and outgoing label (assigned by the next hop). The output shows correct label assignments for two prefixes.

Full explanation →
1118
MCQmedium

A network engineer is troubleshooting OSPFv2 route redistribution. R1 is an ASBR redistributing static routes into OSPF. R2, an internal router, receives the redistributed routes but they appear as O E2 routes. However, R1 also has a directly connected network 10.1.1.0/24 that is not being advertised as an OSPF route. 'show ip ospf database external' on R2 shows the redistributed static routes but not the connected network. What is the most likely cause?

A.The connected network is not included in the redistribution because the engineer used 'redistribute static' without the 'subnets' keyword.
B.The connected network is not being advertised because it is not part of the OSPF process; the engineer must configure 'network 10.1.1.0 0.0.0.255 area 0' under router ospf.
C.The ASBR is missing the 'redistribute connected' command under the OSPF process.
D.The connected network is a loopback interface, and OSPF does not advertise loopback networks by default.
AnswerC

Without 'redistribute connected', the directly connected network is not advertised into OSPF, even if the interface is enabled for OSPF (which it may not be).

Why this answer

By default, OSPF does not redistribute connected routes unless explicitly configured. The ASBR must use the 'redistribute connected' command under the OSPF process to advertise directly connected networks. The static routes are being redistributed because they are matched by the 'redistribute static' command, but the connected network is not part of the static route set unless it is also a static route.

The engineer likely forgot to add 'redistribute connected' or use the 'subnets' keyword.

Full explanation →
1119
Multi-Selecthard

Which THREE symptoms indicate that a route-map applied to a redistribution configuration is not working as intended? (Choose THREE.)

Select 3 answers
A.Routes that should be filtered are still present in the routing table of the receiving router.
B.Routes that are redistributed have an incorrect metric or metric type.
C.After modifying the route-map, the redistributed routes do not change until the route-map is reapplied or the routing process is cleared.
D.Routes have the correct next-hop but an incorrect administrative distance.
E.Routes appear in the routing table with the correct attributes as defined in the route-map.
AnswersA, B, C

This indicates the route-map is not denying the intended routes.

Why this answer

Common symptoms of misconfigured route-maps include missing routes in the routing table, routes with wrong metrics, and no change after modifying the route-map (due to route-map caching or not reapplying). Routes with correct next hops but wrong administrative distance usually indicate a different issue. Routes appearing in the routing table with correct attributes suggest the route-map is working.

Full explanation →
1120
MCQmedium

Examine the following partial configuration on a PE router: interface GigabitEthernet0/1 ip vrf forwarding CUSTOMER-A ip address 10.1.1.1 255.255.255.252 ! router bgp 65000 neighbor 192.168.1.1 remote-as 65000 neighbor 192.168.1.1 update-source Loopback0 ! address-family ipv4 vrf CUSTOMER-A neighbor 10.1.1.2 remote-as 65001 neighbor 10.1.1.2 activate exit-address-family What is the effect of this configuration?

A.The eBGP session between PE and CE will be established successfully.
B.The BGP session will fail because the neighbor must be configured under the global BGP process.
C.The BGP session will fail because the neighbor remote-as must match the AS of the PE router.
D.The BGP session will fail because the update-source is not specified for the VRF neighbor.
AnswerA

The VRF is defined, the interface is in the VRF, and the BGP neighbor is correctly configured under the VRF address-family. The neighbor IP is on the same subnet, so the eBGP session should come up.

Why this answer

The configuration correctly assigns the interface to a VRF, then in BGP the neighbor under the VRF address-family is activated. However, the neighbor is directly connected on a /30 link, so a remote-as of 65001 is valid for an eBGP session. The configuration is correct and will establish an eBGP session with the CE router.

Full explanation →
1121
MCQmedium

Which statement correctly describes the behavior of the 'default-information originate' command in OSPF?

A.It always injects a default route into OSPF regardless of the routing table.
B.It injects a default route as a Type 3 LSA.
C.It injects a default route as a Type 5 LSA only if a default route exists in the routing table.
D.It injects a default route as a Type 7 LSA in all OSPF areas.
AnswerC

By default, OSPF requires an existing default route to originate a Type 5 LSA for 0.0.0.0/0.

Why this answer

The 'default-information originate' command in OSPF generates a default route (0.0.0.0/0) as a Type 5 LSA, but only if a default route exists in the routing table, unless the 'always' keyword is used.

Full explanation →
1122
Multi-Selecthard

Which TWO statements about the behavior of IPv4 ACLs with the 'established' keyword are true? (Choose TWO.)

Select 1 answer
A.The 'established' keyword matches TCP packets that have the ACK or RST bit set.
B.The 'established' keyword can be applied to extended ACLs for UDP traffic to permit return packets.
C.The 'established' keyword checks the state of the session in the router's state table.
D.The 'established' keyword can be used in both standard and extended ACLs.
E.The 'established' keyword will match a TCP SYN packet sent from a client to initiate a connection.
AnswersA

Correct. The 'established' keyword matches TCP packets that have the ACK or RST bit set, allowing return traffic for established sessions.

Why this answer

Only option A is true. The 'established' keyword matches TCP packets with the ACK or RST bit set. It is a stateless TCP flag check, cannot be used with UDP, and is not supported in standard ACLs.

Exam trap

Cisco often tests the misconception that the 'established' keyword performs stateful inspection or works with UDP, when in reality it is a simple stateless TCP flag check limited to extended ACLs.

Full explanation →
1123
MCQmedium

In a CoPP policy, what is the effect of the 'violate-action' parameter in the police command?

A.It specifies the action for packets that exceed the conform rate but are within the excess burst.
B.It specifies the action for packets that exceed both the conform rate and the excess burst.
C.It specifies the action for packets that are below the conform rate.
D.It is only used in two-rate policers and is ignored in single-rate policers.
AnswerB

Correct. The violate-action applies to packets that exceed the excess burst (i.e., violate the token bucket).

Why this answer

In a Control Plane Policing (CoPP) policy, the 'violate-action' parameter in the police command specifies the action taken for packets that exceed both the conform rate and the excess burst (i.e., packets that are beyond the peak rate). This is part of a three-color policer (conform, exceed, violate), where violate-action handles the most severe traffic violations, such as dropping or remarking packets that exceed the excess burst.

Exam trap

Cisco often tests the distinction between 'exceed-action' and 'violate-action' in three-color policers, and the trap here is that candidates confuse the exceed-action (for packets within excess burst) with the violate-action (for packets beyond the excess burst), especially in single-rate policers where both are configurable.

How to eliminate wrong answers

Option A is wrong because it describes the 'exceed-action' parameter, not the 'violate-action'; the exceed-action handles packets that exceed the conform rate but are within the excess burst. Option C is wrong because it describes the 'conform-action' parameter, which applies to packets below the conform rate. Option D is wrong because the 'violate-action' parameter is used in both single-rate and two-rate policers; in single-rate policers, it is valid and not ignored, as the three-color marker (e.g., RFC 2697) defines conform, exceed, and violate actions.

Full explanation →
1124
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla statistics 2 Round Trip Time (RTT) for Index 2 Latest RTT: No connection Latest RTT (milliseconds): No connection Latest RTT (microseconds): No connection Number of successes: 0 Number of failures: 100 Operation time to live: Forever Output: No connection Based on this output, which statement is correct?

A.The IP SLA operation is working correctly but the RTT is too high to measure.
B.The target device is not responding to ICMP echo requests, or there is a routing problem.
C.The IP SLA operation has been manually disabled.
D.The IP SLA responder is misconfigured on the source router.
AnswerB

'No connection' indicates that the probe failed to reach the target, likely due to unreachability or lack of response.

Why this answer

The output shows 'No connection' for RTT and 'Output: No connection'. This indicates that the IP SLA operation cannot reach the target. The 100 failures confirm this.

This is a clear sign of a connectivity issue.

Full explanation →
1125
MCQhard

Management traffic is being dropped. Router R1 has: access-list 100 deny ip any any log, applied to VTY lines. Remote access via SSH fails, but console works. What is the root cause?

A.The ACL should permit SSH before the deny statement.
B.The VTY lines require transport input ssh, but the ACL is irrelevant.
C.The ACL is applied to the wrong interface.
D.The log keyword causes performance issues, not drops.
AnswerA

Without a permit statement for SSH, the deny blocks all traffic.

Why this answer

The ACL `access-list 100 deny ip any any log` applied to VTY lines denies all IP traffic, including SSH, before any permit statement can match. Since SSH traffic is denied, remote access fails. The correct fix is to add a `permit tcp any any eq 22` statement before the deny to allow SSH management traffic.

Exam trap

The trap here is that candidates often think the ACL is applied to an interface (Option C) or that the `log` keyword causes the problem, when in fact the issue is the order of ACL entries—specifically, the missing permit for SSH before the global deny.

How to eliminate wrong answers

Option B is wrong because the VTY lines do require `transport input ssh` for SSH access, but the ACL is directly relevant—it is the cause of the drops, and without a permit for SSH, even with correct transport settings, traffic is denied. Option C is wrong because the ACL is correctly applied to VTY lines (using `access-class`), not to an interface; applying it to an interface would affect transit traffic, not management traffic. Option D is wrong because the `log` keyword does not cause drops; it only generates log messages for matched packets, and the drops are due to the `deny` action itself.

Full explanation →
Page 14

Page 15 of 27

Page 16

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →