Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1126–1200

2011 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 15

Page 16 of 27

Page 17
1126
MCQmedium

Refer to the following partial configuration: logging console informational logging monitor debugging logging trap errors logging buffered 4096 Which statement is true about the logging levels?

A.The console receives messages of severity 0 through 6.
B.The monitor receives messages of severity 0 through 6.
C.The syslog server receives messages of severity 0 through 7.
D.The buffer stores messages of severity 0 through 6.
AnswerA

Console level 'informational' includes severities 0-6 (emergency through informational).

Why this answer

Logging levels: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), debugging (7). The trap level 'errors' means only messages severity 0-3 are sent to syslog servers. Console 'informational' means 0-6.

Monitor 'debugging' means 0-7. Buffer defaults to debugging if not specified, but here it is set to 4096 bytes without a level, so it defaults to debugging.

Full explanation →
1127
MCQhard

An engineer is troubleshooting an EIGRP issue where a router is not forming an adjacency with a neighbor over a Frame Relay point-to-point subinterface. The physical interface is up/up, and the subinterface is configured with an IP address. The engineer checks the EIGRP configuration and sees that the network statement includes the subnet of the subinterface. What is the most likely cause of the adjacency failure?

A.The subinterface is not configured with the 'frame-relay interface-dlci' command.
B.The subinterface is configured as multipoint instead of point-to-point.
C.The EIGRP hello timer is set to 0 on the subinterface.
D.The IP address on the subinterface is not in the same subnet as the neighbor.
AnswerB

Correct because multipoint subinterfaces require additional configuration (like 'frame-relay map' for multicast) to support EIGRP, while point-to-point subinterfaces work with multicast by default.

Why this answer

On a Frame Relay point-to-point subinterface, EIGRP expects the interface to be treated as a point-to-point link, which automatically disables split horizon and uses unicast hellos. If the subinterface is accidentally configured as multipoint, EIGRP treats it as a multi-access network, requiring a different neighbor discovery mechanism and often causing adjacency failures because the router does not receive hellos from the neighbor over the single DLCI. The correct answer is B because a multipoint configuration on a point-to-point subinterface breaks the expected EIGRP behavior.

Exam trap

Cisco often tests the distinction between point-to-point and multipoint subinterfaces in Frame Relay, where candidates mistakenly think the DLCI mapping or IP subnet mismatch is the primary issue, overlooking that the subinterface type itself dictates EIGRP's behavior regarding split horizon and neighbor discovery.

How to eliminate wrong answers

Option A is wrong because the 'frame-relay interface-dlci' command is required to associate a DLCI with a point-to-point subinterface; without it, the subinterface would not be able to send or receive frames, but the question states the physical interface is up/up and the subinterface has an IP address, implying the DLCI mapping is present. Option C is wrong because setting the EIGRP hello timer to 0 would disable hellos entirely, preventing adjacency formation, but this is not a common misconfiguration and the question does not indicate any timer modifications. Option D is wrong because the question explicitly states the network statement includes the subnet of the subinterface, and if the IP address were not in the same subnet as the neighbor, the adjacency would fail due to mismatched subnets, but this is not the most likely cause given the Frame Relay context and the fact that the engineer already verified the network statement.

Full explanation →
1128
MCQmedium

Router R4 has the following configuration: ``` interface GigabitEthernet0/5 ip address 10.4.4.4 255.255.255.0 ip policy route-map PBR-DEFAULT ! route-map PBR-DEFAULT permit 10 set ip default next-hop 192.168.3.1 ``` What is the effect of this configuration?

A.All packets received on G0/5 are forwarded to 192.168.3.1 if they do not have a route in the routing table.
B.All packets received on G0/5 are forwarded to 192.168.3.1 regardless of the routing table.
C.The route-map is missing a match statement, so it does nothing.
D.The configuration is invalid because 'set ip default next-hop' requires an ACL.
AnswerA

Default next-hop applies only when the routing table has no route for the destination.

Why this answer

The 'set ip default next-hop' command is used for packets that do not match any explicit route in the routing table. It does not affect packets that have a matching route.

Full explanation →
1129
MCQmedium

A network engineer runs the following command on router R4: R4# show monitor session 9 Session 9 --------- Type : ERSPAN Source Session Status : Admin Disabled Source Ports : Both : Gi0/2 Destination IP : 192.168.2.20 Origin IP : 10.0.0.3 ERSPAN ID : 200 Based on this output, which statement is correct?

A.The ERSPAN session is configured but not currently active because it is administratively disabled.
B.The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.
C.The ERSPAN session is using RSPAN because the status is disabled.
D.The ERSPAN session is misconfigured because the origin IP is missing.
AnswerA

The status 'Admin Disabled' indicates the session is not active.

Why this answer

This is an ERSPAN source session that is administratively disabled. The configuration is present but not active. To enable it, the engineer must use the 'no shutdown' command under the session configuration.

Full explanation →
1130
MCQmedium

What is the default timer value for the EEM environment variable 'timer watchdog'?

A.30 seconds
B.60 seconds
C.120 seconds
D.180 seconds
AnswerB

The default watchdog timer is 60 seconds, configurable via 'event timer watchdog'.

Why this answer

The default watchdog timer is 60 seconds; it monitors the EEM policy execution and resets if exceeded.

Full explanation →
1131
MCQmedium

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# debug crypto isakmp *Mar 1 00:01:23.456: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (N) NEW SA *Mar 1 00:01:23.457: ISAKMP: Created a peer struct for 192.168.1.2, peer port 500 *Mar 1 00:01:23.457: ISAKMP: New peer created peer = 0x12345678 peer_handle = 0x80000001 *Mar 1 00:01:23.457: ISAKMP: Locking peer struct 0x12345678, refcount 1 for crypto_isakmp_process_block *Mar 1 00:01:23.457: ISAKMP (0:0): SA request profile is (default) *Mar 1 00:01:23.457: ISAKMP: local port 500, remote port 500 *Mar 1 00:01:23.458: ISAKMP (0:0): found peer pre-shared-key matching 192.168.1.2 *Mar 1 00:01:23.458: ISAKMP (0:0): constructed NAT-T vendor ID *Mar 1 00:01:23.458: ISAKMP (0:0): sending packet to 192.168.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 1 00:01:23.458: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (I) MM_NO_STATE *Mar 1 00:01:23.459: ISAKMP (0:0): processing SA payload. message ID = 0 *Mar 1 00:01:23.459: ISAKMP (0:0): Checking ISAKMP transform 1 against priority 1 policy *Mar 1 00:01:23.459: ISAKMP: encryption DES-CBC *Mar 1 00:01:23.459: ISAKMP: hash SHA *Mar 1 00:01:23.459: ISAKMP: default group 2 *Mar 1 00:01:23.459: ISAKMP: auth pre-share *Mar 1 00:01:23.459: ISAKMP (0:0): atts are not acceptable. Next transforms are not acceptable *Mar 1 00:01:23.460: ISAKMP (0:0): no offers accepted! What does this output indicate?

A.The ISAKMP SA is established successfully using pre-shared key authentication.
B.The ISAKMP transform set proposal is rejected due to a mismatch in encryption, hash, or DH group between peers.
C.The router is receiving the packet from an incorrect source IP address.
D.The router is unable to find a pre-shared key for the peer.
AnswerB

The output clearly states 'atts are not acceptable' and 'no offers accepted', which means the proposed transform does not match the local policy.

Why this answer

The debug output shows that the router received an ISAKMP proposal from the peer (192.168.1.2) and checked it against its own configured policy. The line 'atts are not acceptable' followed by 'no offers accepted' indicates that the transform set attributes (encryption DES-CBC, hash SHA, DH group 2) did not match any of the router's ISAKMP policies. This is a classic proposal mismatch, preventing the ISAKMP SA from being established.

Exam trap

Cisco often tests the distinction between a pre-shared key mismatch (which would show 'no pre-shared key found') and a transform set mismatch (which shows 'atts are not acceptable'), leading candidates to incorrectly blame the PSK when the actual issue is the encryption/hash/DH group.

How to eliminate wrong answers

Option A is wrong because the debug clearly shows 'no offers accepted', meaning the ISAKMP SA was not established; successful establishment would show 'ISAKMP (0:0): SA has been created' or similar. Option C is wrong because the router correctly identifies the source IP as 192.168.1.2 and processes the packet; there is no indication of an incorrect source IP. Option D is wrong because the debug explicitly states 'found peer pre-shared-key matching 192.168.1.2', so the pre-shared key is present and matched.

Full explanation →
1132
MCQhard

R1 and R2 are EIGRP neighbors with BFD enabled. R1#show ip eigrp neighbors shows R2 in state 'Init' for BFD. R1#show bfd neighbors shows the session as 'Up'. R2#show bfd neighbors shows the session as 'Up'. R1 has 'eigrp stub' configured. R2 does not. What is the root cause?

A.The EIGRP stub configuration on R1 prevents full adjacency, but BFD is unaffected.
B.BFD requires 'eigrp stub' to be removed.
C.The BFD interval on R1 is too low for EIGRP.
D.EIGRP must be configured with 'no eigrp stub' for BFD to work.
AnswerA

EIGRP stub does not affect BFD; the BFD session is up, but EIGRP adjacency is in Init due to stub behavior.

Why this answer

EIGRP stub routers can form BFD sessions but the EIGRP adjacency may remain in Init state if the stub router is not configured correctly. However, BFD session is up, so the issue is with EIGRP itself. The stub router may be blocking queries, but that does not affect BFD.

The real issue is that R1 has 'eigrp stub' but is missing the 'receive-only' keyword, causing it to not advertise routes, but BFD is fine. The BFD session is up, so the problem is EIGRP, not BFD.

Full explanation →
1133
MCQhard

Two OSPF domains are redistributed into each other on router R1. R1 has: router ospf 1 redistribute ospf 2 subnets router ospf 2 redistribute ospf 1 subnets Router R2 (in OSPF 1) shows: R2# show ip route ospf O E2 10.1.1.0/24 [110/20] via 10.2.1.1, 00:00:05, Serial0/0/0 O E2 10.2.1.0/24 [110/20] via 10.2.1.1, 00:00:05, Serial0/0/0 R2# traceroute 10.1.1.1 source 10.2.1.2 Type escape sequence to abort. Tracing the route to 10.1.1.1 1 10.2.1.1 4 msec 4 msec 4 msec 2 10.1.1.1 8 msec 8 msec 8 msec R2# traceroute 10.2.1.1 source 10.1.1.2 Type escape sequence to abort. Tracing the route to 10.2.1.1 1 10.1.1.1 4 msec 4 msec 4 msec 2 10.2.1.1 8 msec 8 msec 8 msec Traffic between the two domains is taking suboptimal paths. What is the root cause?

A.The redistribution is mutual without any route filtering, causing routing loops.
B.The 'subnets' keyword is missing from one of the redistribute commands.
C.OSPF administrative distance is set incorrectly, preferring external routes.
D.R1 has a routing table entry for 10.1.1.0/24 pointing to R2.
AnswerA

Routes from OSPF 1 are redistributed into OSPF 2 and then back into OSPF 1, creating a loop.

Why this answer

Mutual redistribution without route filtering creates a routing loop. Routes from OSPF 1 are redistributed into OSPF 2, and then back into OSPF 1, causing suboptimal paths. The traceroute shows traffic going through R1 twice.

The fix is to use route tagging and filtering to prevent re-redistribution.

Full explanation →
1134
MCQmedium

A network engineer runs the following command on Router R1: R1# show flow exporter EXPORTER-1 Flow Exporter EXPORTER-1: Description: Exports to collector Export protocol: NetFlow Version 9 Transport Configuration: Destination IP address: 192.168.1.100 Source IP address: 10.0.0.1 Transport Protocol: UDP Destination Port: 2055 Source Port: 0 Collector Configuration: VRFs: Default Options Configuration: Sampler: Not configured Export Statistics: Number of Flows exported: 0 Number of Packets exported: 0 Number of Source IP address unreachable: 0 Number of Packets dropped: 0 Based on this output, what is the most likely reason that no flows are being exported?

A.The destination port is incorrect; NetFlow version 9 requires port 9996.
B.The flow exporter is not referenced in any flow monitor applied to an interface.
C.The source IP address is not reachable from the destination.
D.The sampler is not configured, causing all packets to be dropped.
AnswerB

The exporter statistics show no flows exported, but no errors, meaning the exporter is idle. This typically occurs when no flow monitor using this exporter is applied to an interface.

Why this answer

The output shows 0 flows exported, but no errors. This often indicates that the flow monitor is not applied to an interface or the exporter is not referenced in a flow monitor. The exporter itself is configured correctly with a valid destination.

Full explanation →
1135
MCQmedium

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla statistics 10 detail Round Trip Time (RTT) for Index 10 Latest RTT: 12 ms Latest RTT (milliseconds): 12 Latest RTT (microseconds): 12000 Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Last operation return code: OK Number of successes: 100 Number of failures: 0 Operation time to live: Forever Last operation response time: 12 ms Latest operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Latest operation return code: OK Over thresholds occurred: FALSE Threshold (milliseconds): 5000 RTT Values: RTTAvg: 12 RTTMin: 10 RTTMax: 15 RTTNum: 100 RTTStdDev: 1 What does this output indicate?

A.The IP SLA operation has high jitter because the RTT standard deviation is 1 ms.
B.The IP SLA operation is experiencing packet loss because the number of failures is 0.
C.The IP SLA operation shows stable performance with low jitter and no threshold violations.
D.The IP SLA operation has exceeded the threshold because the RTTMax is 15 ms.
AnswerC

The low standard deviation and 'Over thresholds occurred: FALSE' confirm stability.

Why this answer

This detailed output shows RTT statistics including average, minimum, maximum, and standard deviation. The low standard deviation (1 ms) and no thresholds exceeded indicate stable performance.

Full explanation →
1136
MCQhard

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down R1# show bgp neighbors 192.168.1.2 BGP neighbor is 192.168.1.2, remote AS 65002, external link BGP version 4, remote router ID 10.0.0.2 BGP state = Idle Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds Neighbor sessions: 1 active, is not multisession capable Based on this output, what is the most likely conclusion?

A.The BGP neighbor is up and running.
B.The BGP neighbor is down, and the EEM policy may have been triggered.
C.The EEM policy is not registered.
D.The BGP session is established.
AnswerB

The Idle state indicates the session is down, which would likely trigger the BGP_Neighbor_Down event.

Why this answer

The EEM policy BGP_Neighbor_Down is registered, and the BGP neighbor is in Idle state, indicating the session is down. The correct answer is that the BGP neighbor is down, and the EEM policy may have been triggered.

Full explanation →
1137
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer confirms that the route for the customer subnet exists in the routing table and points to the correct interface. What is the most likely explanation?

A.Asymmetric routing is in use, and the return route for the source IP points to a different interface.
B.The 'allow-default' option is not enabled, so default routes are not considered.
C.The 'ip verify unicast source reachable-via any' command was used instead of 'rx'
D.The customer subnet is a summary route, and the more specific route is missing.
AnswerA

Strict uRPF requires that the best route to the source IP address points back to the same interface on which the packet was received. If asymmetric routing is present, the return path may be via a different interface, causing strict uRPF to drop the packet.

Why this answer

Strict uRPF checks that the source IP address of an incoming packet has a route in the routing table that points back to the same interface. If the customer network uses asymmetric routing (i.e., traffic comes in one interface but the return route points out a different interface), strict uRPF will drop the traffic. The edge case is that even if the route exists, if it does not point to the incoming interface, the packet is dropped.

Full explanation →
1138
MCQeasy

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp traffic IP-EIGRP Traffic Statistics for process 100 Hellos sent/received: 500/495 Updates sent/received: 10/8 Queries sent/received: 2/1 Replies sent/received: 1/2 Acks sent/received: 8/10 Input queue high water mark: 2, Input queue depth: 0 Total packets sent: 521, received: 516 What does this output indicate?

A.The network is experiencing a high number of queries, indicating instability.
B.The EIGRP process is functioning normally with no signs of congestion or issues.
C.There is a problem with packet loss because more hellos were sent than received.
D.The router is not receiving acknowledgments for its updates.
AnswerB

The traffic statistics are balanced and the input queue is empty, indicating normal operation.

Why this answer

The output shows a balanced exchange of EIGRP packets with no retransmissions, a low input queue depth of 0, and a high water mark of only 2. These metrics indicate the EIGRP process is stable, with no congestion, packet loss, or neighbor issues. The slight difference between hellos sent (500) and received (495) is normal due to timing or asymmetric paths and does not indicate a problem.

Exam trap

Cisco often tests the misconception that any asymmetry in hello packet counts indicates packet loss, when in fact EIGRP hellos are sent unreliably and a slight mismatch is normal due to timing differences or interface delays.

How to eliminate wrong answers

Option A is wrong because the query count (2 sent, 1 received) is very low, not high; a high number of queries would indicate route recomputation or instability, but these numbers show a stable topology. Option C is wrong because a small difference in hellos sent vs received is normal in EIGRP due to hello interval timing variations or asymmetric links, and does not indicate packet loss. Option D is wrong because the Ack counts (8 sent, 10 received) are balanced and consistent with the update and query/reply exchanges, showing that acknowledgments are being received properly.

Full explanation →
1139
Multi-Selectmedium

Which THREE symptoms indicate that IPv6 First Hop Security features are misconfigured or not functioning correctly? (Choose THREE.)

Select 3 answers
A.IPv6 hosts on a segment are unable to obtain a global unicast address via SLAAC, even though a legitimate router is present.
B.A newly connected switch causes existing hosts to lose IPv6 connectivity to the default gateway.
C.Hosts on a VLAN receive Router Advertisements but do not update their default gateway.
D.IPv6 pings between two hosts on the same VLAN succeed, but pings to the router fail.
E.The switch logs show frequent 'IPv6 address collision' messages.
AnswersA, B, C

This could be due to RA Guard blocking the router's Router Advertisements, preventing SLAAC.

Why this answer

SLAAC relies on Router Advertisements (RAs) to provide the prefix and other configuration information. If IPv6 First Hop Security features such as RA Guard or RA snooping are misconfigured, they may block or drop legitimate RAs, preventing hosts from generating a global unicast address via SLAAC even though a valid router is present.

Exam trap

Cisco often tests the distinction between First Hop Security failures (which block control-plane messages like RAs and DHCPv6) and other IPv6 issues like routing problems or DAD collisions, so candidates must recognize that symptoms like inter-host ping success but router ping failure point to routing, not First Hop Security.

Full explanation →
1140
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail Gi0/0 EIGRP-IPv4 Interfaces for AS(100) Interface: GigabitEthernet0/0 Peers: 1 Xmit Queue Un/Reliable: 0/0 Mean SRTT: 12 Pacing Time Un/Reliable: 0/10 Multicast Flow Timer: 50 Pending Routes: 0 Hello interval: 5 Hold time: 15 Split horizon: Enabled Next multicast: 0.0.0.0 Next broadcast: 0.0.0.0 Based on this output, what is the problem?

A.Split horizon is enabled, which is a normal and expected configuration.
B.Split horizon is disabled, which could cause routing loops.
C.The hold time of 15 seconds is too short and may cause instability.
D.The interface has no peers, indicating a problem.
AnswerA

Split horizon is enabled by default on EIGRP interfaces and helps prevent routing loops.

Why this answer

Split horizon is a default and expected behavior in EIGRP for most interface types, including GigabitEthernet. The output shows 'Split horizon: Enabled', which is normal and prevents routing loops by ensuring that routing information learned on an interface is not advertised back out of that same interface. There is no problem indicated by this setting.

Exam trap

The trap here is that candidates may mistakenly think split horizon is a problem or misconfiguration, when in fact it is a standard loop-prevention mechanism, and Cisco often tests this by showing a normal default value and asking if it indicates an issue.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Split horizon: Enabled', not disabled, so the premise of the option is factually incorrect. Option C is wrong because a hold time of 15 seconds with a hello interval of 5 seconds is the default for EIGRP on high-speed interfaces (hello=5, hold=15) and is not too short; it provides adequate time to detect neighbor failures without causing instability. Option D is wrong because the output shows 'Peers: 1', indicating that the interface does have an EIGRP neighbor, so there is no peer problem.

Full explanation →
1141
Multi-Selectmedium

Which THREE symptoms indicate a potential issue with NHRP registration in a DMVPN network? (Choose THREE.)

Select 3 answers
A.The spoke router does not receive an NHRP Registration Reply from the hub.
B.The hub router's NHRP cache does not contain an entry for the spoke.
C.The spoke router's tunnel interface shows 'UP/UP' but NHRP registration status is 'NOT REGISTERED'.
D.The spoke router's tunnel interface shows 'UP/DOWN'.
E.The spoke router's routing table shows routes learned from the hub.
AnswersA, B, C

This indicates that the registration request failed, possibly due to authentication mismatch or reachability issues.

Why this answer

Common symptoms of NHRP registration problems include the spoke not receiving a registration reply from the hub, the spoke not appearing in the hub's NHRP cache, and the spoke's tunnel interface showing a status of 'UP/UP' but the NHRP registration being 'NOT REGISTERED'. The other options are not direct symptoms of NHRP registration issues.

Full explanation →
1142
Drag & Dropmedium

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Validation begins with checking the uRPF configuration on the interface, then verifying the interface status, inspecting uRPF statistics, testing connectivity with ping, and finally confirming the routing table for expected routes.

Full explanation →
1143
MCQmedium

A network engineer runs the following command on Router PE7: PE7# show bgp vpnv4 unicast vrf CUSTOMER_E labels Network Next Hop In Label/Out Label 10.10.10.0/24 10.0.0.8 18/22 10.20.20.0/24 10.0.0.9 19/23 Based on this output, which statement is correct?

A.The router is correctly assigning labels for VPNv4 routes.
B.The router is not receiving labels from its BGP peers.
C.The VRF CUSTOMER_E has no routes.
D.The label allocation is failing.
AnswerA

Both entries have valid incoming and outgoing labels.

Why this answer

The show bgp vpnv4 unicast vrf labels command displays the label bindings for VPNv4 routes in a VRF. Each entry shows the incoming label (assigned locally) and outgoing label (assigned by the next hop). The output shows correct label assignments for two prefixes.

Full explanation →
1144
MCQmedium

A network engineer is troubleshooting OSPFv2 route redistribution. R1 is an ASBR redistributing static routes into OSPF. R2, an internal router, receives the redistributed routes but they appear as O E2 routes. However, R1 also has a directly connected network 10.1.1.0/24 that is not being advertised as an OSPF route. 'show ip ospf database external' on R2 shows the redistributed static routes but not the connected network. What is the most likely cause?

A.The connected network is not included in the redistribution because the engineer used 'redistribute static' without the 'subnets' keyword.
B.The connected network is not being advertised because it is not part of the OSPF process; the engineer must configure 'network 10.1.1.0 0.0.0.255 area 0' under router ospf.
C.The ASBR is missing the 'redistribute connected' command under the OSPF process.
D.The connected network is a loopback interface, and OSPF does not advertise loopback networks by default.
AnswerC

Without 'redistribute connected', the directly connected network is not advertised into OSPF, even if the interface is enabled for OSPF (which it may not be).

Why this answer

By default, OSPF does not redistribute connected routes unless explicitly configured. The ASBR must use the 'redistribute connected' command under the OSPF process to advertise directly connected networks. The static routes are being redistributed because they are matched by the 'redistribute static' command, but the connected network is not part of the static route set unless it is also a static route.

The engineer likely forgot to add 'redistribute connected' or use the 'subnets' keyword.

Full explanation →
1145
Multi-Selecthard

Which THREE symptoms indicate that a route-map applied to a redistribution configuration is not working as intended? (Choose THREE.)

Select 3 answers
A.Routes that should be filtered are still present in the routing table of the receiving router.
B.Routes that are redistributed have an incorrect metric or metric type.
C.After modifying the route-map, the redistributed routes do not change until the route-map is reapplied or the routing process is cleared.
D.Routes have the correct next-hop but an incorrect administrative distance.
E.Routes appear in the routing table with the correct attributes as defined in the route-map.
AnswersA, B, C

This indicates the route-map is not denying the intended routes.

Why this answer

Common symptoms of misconfigured route-maps include missing routes in the routing table, routes with wrong metrics, and no change after modifying the route-map (due to route-map caching or not reapplying). Routes with correct next hops but wrong administrative distance usually indicate a different issue. Routes appearing in the routing table with correct attributes suggest the route-map is working.

Full explanation →
1146
MCQmedium

Examine the following partial configuration on a PE router: interface GigabitEthernet0/1 ip vrf forwarding CUSTOMER-A ip address 10.1.1.1 255.255.255.252 ! router bgp 65000 neighbor 192.168.1.1 remote-as 65000 neighbor 192.168.1.1 update-source Loopback0 ! address-family ipv4 vrf CUSTOMER-A neighbor 10.1.1.2 remote-as 65001 neighbor 10.1.1.2 activate exit-address-family What is the effect of this configuration?

A.The eBGP session between PE and CE will be established successfully.
B.The BGP session will fail because the neighbor must be configured under the global BGP process.
C.The BGP session will fail because the neighbor remote-as must match the AS of the PE router.
D.The BGP session will fail because the update-source is not specified for the VRF neighbor.
AnswerA

The VRF is defined, the interface is in the VRF, and the BGP neighbor is correctly configured under the VRF address-family. The neighbor IP is on the same subnet, so the eBGP session should come up.

Why this answer

The configuration correctly assigns the interface to a VRF, then in BGP the neighbor under the VRF address-family is activated. However, the neighbor is directly connected on a /30 link, so a remote-as of 65001 is valid for an eBGP session. The configuration is correct and will establish an eBGP session with the CE router.

Full explanation →
1147
MCQmedium

Which statement correctly describes the behavior of the 'default-information originate' command in OSPF?

A.It always injects a default route into OSPF regardless of the routing table.
B.It injects a default route as a Type 3 LSA.
C.It injects a default route as a Type 5 LSA only if a default route exists in the routing table.
D.It injects a default route as a Type 7 LSA in all OSPF areas.
AnswerC

By default, OSPF requires an existing default route to originate a Type 5 LSA for 0.0.0.0/0.

Why this answer

The 'default-information originate' command in OSPF generates a default route (0.0.0.0/0) as a Type 5 LSA, but only if a default route exists in the routing table, unless the 'always' keyword is used.

Full explanation →
1148
Multi-Selecthard

Which TWO statements about the behavior of IPv4 ACLs with the 'established' keyword are true? (Choose TWO.)

Select 1 answer
A.The 'established' keyword matches TCP packets that have the ACK or RST bit set.
B.The 'established' keyword can be applied to extended ACLs for UDP traffic to permit return packets.
C.The 'established' keyword checks the state of the session in the router's state table.
D.The 'established' keyword can be used in both standard and extended ACLs.
E.The 'established' keyword will match a TCP SYN packet sent from a client to initiate a connection.
AnswersA

Correct. The 'established' keyword matches TCP packets that have the ACK or RST bit set, allowing return traffic for established sessions.

Why this answer

Only option A is true. The 'established' keyword matches TCP packets with the ACK or RST bit set. It is a stateless TCP flag check, cannot be used with UDP, and is not supported in standard ACLs.

Exam trap

Cisco often tests the misconception that the 'established' keyword performs stateful inspection or works with UDP, when in reality it is a simple stateless TCP flag check limited to extended ACLs.

Full explanation →
1149
MCQmedium

In a CoPP policy, what is the effect of the 'violate-action' parameter in the police command?

A.It specifies the action for packets that exceed the conform rate but are within the excess burst.
B.It specifies the action for packets that exceed both the conform rate and the excess burst.
C.It specifies the action for packets that are below the conform rate.
D.It is only used in two-rate policers and is ignored in single-rate policers.
AnswerB

Correct. The violate-action applies to packets that exceed the excess burst (i.e., violate the token bucket).

Why this answer

In a Control Plane Policing (CoPP) policy, the 'violate-action' parameter in the police command specifies the action taken for packets that exceed both the conform rate and the excess burst (i.e., packets that are beyond the peak rate). This is part of a three-color policer (conform, exceed, violate), where violate-action handles the most severe traffic violations, such as dropping or remarking packets that exceed the excess burst.

Exam trap

Cisco often tests the distinction between 'exceed-action' and 'violate-action' in three-color policers, and the trap here is that candidates confuse the exceed-action (for packets within excess burst) with the violate-action (for packets beyond the excess burst), especially in single-rate policers where both are configurable.

How to eliminate wrong answers

Option A is wrong because it describes the 'exceed-action' parameter, not the 'violate-action'; the exceed-action handles packets that exceed the conform rate but are within the excess burst. Option C is wrong because it describes the 'conform-action' parameter, which applies to packets below the conform rate. Option D is wrong because the 'violate-action' parameter is used in both single-rate and two-rate policers; in single-rate policers, it is valid and not ignored, as the three-color marker (e.g., RFC 2697) defines conform, exceed, and violate actions.

Full explanation →
1150
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla statistics 2 Round Trip Time (RTT) for Index 2 Latest RTT: No connection Latest RTT (milliseconds): No connection Latest RTT (microseconds): No connection Number of successes: 0 Number of failures: 100 Operation time to live: Forever Output: No connection Based on this output, which statement is correct?

A.The IP SLA operation is working correctly but the RTT is too high to measure.
B.The target device is not responding to ICMP echo requests, or there is a routing problem.
C.The IP SLA operation has been manually disabled.
D.The IP SLA responder is misconfigured on the source router.
AnswerB

'No connection' indicates that the probe failed to reach the target, likely due to unreachability or lack of response.

Why this answer

The output shows 'No connection' for RTT and 'Output: No connection'. This indicates that the IP SLA operation cannot reach the target. The 100 failures confirm this.

This is a clear sign of a connectivity issue.

Full explanation →
1151
MCQhard

Management traffic is being dropped. Router R1 has: access-list 100 deny ip any any log, applied to VTY lines. Remote access via SSH fails, but console works. What is the root cause?

A.The ACL should permit SSH before the deny statement.
B.The VTY lines require transport input ssh, but the ACL is irrelevant.
C.The ACL is applied to the wrong interface.
D.The log keyword causes performance issues, not drops.
AnswerA

Without a permit statement for SSH, the deny blocks all traffic.

Why this answer

The ACL `access-list 100 deny ip any any log` applied to VTY lines denies all IP traffic, including SSH, before any permit statement can match. Since SSH traffic is denied, remote access fails. The correct fix is to add a `permit tcp any any eq 22` statement before the deny to allow SSH management traffic.

Exam trap

The trap here is that candidates often think the ACL is applied to an interface (Option C) or that the `log` keyword causes the problem, when in fact the issue is the order of ACL entries—specifically, the missing permit for SSH before the global deny.

How to eliminate wrong answers

Option B is wrong because the VTY lines do require `transport input ssh` for SSH access, but the ACL is directly relevant—it is the cause of the drops, and without a permit for SSH, even with correct transport settings, traffic is denied. Option C is wrong because the ACL is correctly applied to VTY lines (using `access-class`), not to an interface; applying it to an interface would affect transit traffic, not management traffic. Option D is wrong because the `log` keyword does not cause drops; it only generates log messages for matched packets, and the drops are due to the `deny` action itself.

Full explanation →
1152
MCQmedium

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 3000(3) Gi0/0 Session state is UP and using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 3000(0) Rx Count: 150, Tx Count: 150 Echo function: Active Based on this output, which statement is correct?

A.The BFD session is using echo mode, which reduces the load on the control plane because echo packets are processed in hardware.
B.The BFD session is using echo mode, but the holddown timer is incorrect because echo mode should halve the timer.
C.The BFD session is up, but the echo function is not working because Rx and Tx counts are equal.
D.The BFD session is up and using echo function, but the neighbor must also have echo mode enabled for it to work.
AnswerA

Echo mode offloads detection to the data plane, reducing control plane processing.

Why this answer

The output shows that the BFD session is up and using echo function. The echo function allows faster failure detection by sending echo packets that are looped back by the neighbor. The holddown timer is 3000 ms, which is consistent with MinRxInt * Multiplier = 3000 ms.

The Rx and Tx counts are equal, indicating bidirectional communication.

Full explanation →
1153
MCQmedium

Router R4 has the following configuration: !--- R4 configuration route-map SETTAG permit 10 match tag 100 set tag 200 ! route-map SETTAG permit 20 ! router bgp 65100 neighbor 10.0.0.1 route-map SETTAG in ! What is the effect of this configuration?

A.All routes from neighbor 10.0.0.1 are permitted; routes with tag 100 have their tag changed to 200.
B.Routes with tag 100 are denied; all other routes are permitted.
C.Only routes with tag 100 are permitted; all other routes are denied.
D.The route-map is misconfigured because sequence 20 has no match statement; it should have a match any statement.
AnswerA

Correct. Sequence 10 changes the tag for routes with tag 100; sequence 20 permits all others.

Why this answer

The route-map SETTAG has two permit sequences. Sequence 10 matches routes with tag 100 and sets the tag to 200. Sequence 20 is a catch-all permit with no match or set statements.

Routes from neighbor 10.0.0.1 that have tag 100 will have their tag changed to 200; all other routes are permitted unchanged. No routes are filtered.

Full explanation →
1154
MCQeasy

A network engineer runs the following command on Router R1: R1# show route-map TEST route-map TEST, permit, sequence 10 Match clauses: ip address (access-lists): 10 Set clauses: metric 50 route-map TEST, deny, sequence 20 Match clauses: ip address (access-lists): 20 Set clauses: Based on this output, what is the effect of this route-map when applied to a redistribution command?

A.All routes are redistributed with metric 50.
B.Routes matching ACL 10 are redistributed with metric 50; routes matching ACL 20 are denied; all other routes are also denied.
C.Routes matching ACL 20 are redistributed with default metric.
D.The route-map has no effect because set clauses are missing in sequence 20.
AnswerB

This matches the route-map logic.

Why this answer

Route-map TEST processes sequences in order. Sequence 10 permits routes matching ACL 10 and sets their metric to 50. Sequence 20 denies routes matching ACL 20.

Since there is no explicit permit for other routes, the implicit deny at the end of the route-map denies all unmatched routes. Thus, only routes matching ACL 10 are redistributed with metric 50.

Exam trap

Cisco often tests the implicit deny at the end of a route-map, leading candidates to forget that unmatched routes are denied, not permitted with default values.

How to eliminate wrong answers

Option A is wrong because not all routes are redistributed with metric 50; only routes matching ACL 10 are permitted and get metric 50, while routes matching ACL 20 are denied and all other routes are implicitly denied. Option C is wrong because routes matching ACL 20 are denied (sequence 20 is deny), not redistributed with any metric. Option D is wrong because a missing set clause in a deny sequence does not affect the route-map's operation; the deny action is still applied, and the implicit deny at the end handles unmatched routes.

Full explanation →
1155
Multi-Selectmedium

Which TWO configuration steps are required to enable EIGRP authentication between two directly connected routers? (Choose TWO.)

Select 2 answers
A.Configure a key chain with a key string on both routers.
B.Apply the authentication mode and key chain under the EIGRP router process.
C.Use the 'ip authentication mode eigrp <as> md5' command on the connecting interfaces.
D.Set the same autonomous system number in the key chain configuration.
E.Ensure the key chain name is different on each router to prevent conflicts.
AnswersA, C

The key chain defines the authentication key; it must be created globally with at least one key and a key string.

Why this answer

EIGRP authentication requires a key chain to be configured on both routers, which defines the key string (the actual password) used for authentication. Without a matching key string in the key chain, the authentication process will fail, as the routers cannot validate each other's EIGRP packets.

Exam trap

Cisco often tests the misconception that EIGRP authentication is configured under the router process (like OSPF) rather than on the interface, leading candidates to incorrectly select Option B.

Full explanation →
1156
MCQhard

What is the default number of packets sent per IP SLA UDP Jitter operation?

A.1
B.10
C.20
D.100
AnswerB

Correct. The default is 10 packets per operation.

Why this answer

The default number of packets per UDP Jitter operation is 10. This is the number of UDP packets sent in each probe interval to measure jitter and packet loss.

Full explanation →
1157
MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto ipsec sa peer 10.1.1.2 interface: Tunnel0 Crypto map tag: VPN-MAP, local addr 10.1.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 100, #pkts encrypt: 100, #pkts digest: 100 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0 Based on this output, what is the problem?

A.The tunnel is working correctly; all packets are being encrypted and decrypted.
B.The remote peer is not sending traffic back; check routing on the remote router.
C.The local crypto ACL is misconfigured; it is not matching traffic.
D.The IPsec SA is not established; the tunnel is down.
AnswerB

Outbound packets are being sent but none received; the remote side may not have a route back or the crypto ACL is misconfigured.

Why this answer

The outbound packet count (encaps) is 100, but inbound (decaps) is 0. This suggests that traffic is being sent through the tunnel but no responses are being received, possibly due to a routing issue on the remote side or a firewall blocking return traffic.

Full explanation →
1158
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on the outside interface of a router that terminates an IPsec site-to-site VPN. After the configuration, the VPN tunnel establishes, but traffic from the remote site is not forwarded correctly. The engineer verifies that the IPsec tunnel is up and that the routing table has the correct routes. What is the most likely explanation?

A.The IPsec tunnel uses transport mode, which does not encapsulate the original source IP, causing uRPF to see the remote router's physical IP as the source.
B.The return route for the remote site's physical IP points to the tunnel interface, but the packet arrives on the physical interface, so uRPF drops it because the source IP is not reachable via the incoming interface.
C.The uRPF configuration includes the 'allow-default' option, which allows packets with a default route, but the remote site's IP is not in the default route.
D.The IPsec transform set uses ESP with authentication, which changes the source IP of the packet.
AnswerB

Strict uRPF requires that the source IP of the incoming packet has a route back through the same interface. If the route points to the tunnel, the check fails, and the packet is dropped.

Why this answer

In strict mode, uRPF checks that the source IP address of an incoming packet is reachable via the exact interface on which the packet arrived. For IPsec site-to-site VPN traffic, the encapsulated (original) packet arrives on the physical outside interface, but the routing table's return route for the remote site's physical IP (the tunnel endpoint) points to the tunnel interface (e.g., a virtual tunnel interface or crypto map). Because the source IP is not reachable via the physical incoming interface, uRPF drops the packet, even though the IPsec tunnel is up and the routes are correct.

Exam trap

Cisco often tests the subtle interaction between uRPF strict mode and IPsec VPNs, where candidates mistakenly think the tunnel mode or encryption causes the issue, rather than the interface-specific reverse path check.

How to eliminate wrong answers

Option A is wrong because transport mode does not change the source IP of the original packet; it only encapsulates the IP payload, and uRPF checks the original source IP, not the outer IP header. Option C is wrong because the 'allow-default' option permits packets whose source IP matches a default route, but the remote site's IP is typically a specific address, not a default route, and the core issue is interface mismatch, not default route coverage. Option D is wrong because ESP with authentication (ESP auth) does not alter the source IP address of the packet; it only adds an authentication trailer to the ESP payload, leaving the IP header unchanged.

Full explanation →
1159
MCQhard

A network engineer runs the following command on Router R1: R1# show ip bgp neighbors 10.1.1.1 advertised-routes BGP table version is 10, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.0.0.0/8 0.0.0.0 0 32768 i *> 10.1.0.0/16 0.0.0.0 0 32768 i *> 10.1.1.0/24 0.0.0.0 0 32768 i *> 10.1.2.0/24 0.0.0.0 0 32768 i Based on this output, what is a problem with the BGP advertisements?

A.The router is not advertising any routes.
B.The router is advertising overlapping prefixes, including both summary and specific routes.
C.The router is only advertising the summary route.
D.The router is using incorrect next-hop.
AnswerB

The presence of 10.0.0.0/8 and more specific prefixes like 10.1.1.0/24 indicates overlapping advertisements, which is inefficient.

Why this answer

The router is advertising both a summary route (10.0.0.0/8) and more specific routes (10.1.0.0/16, 10.1.1.0/24, etc.), which defeats the purpose of summarization and can cause routing loops or suboptimal routing.

Full explanation →
1160
MCQmedium

A network engineer is troubleshooting MPLS LDP where the LDP session between two directly connected routers is not forming. The engineer runs show mpls ldp discovery and sees that LDP hellos are being sent and received on the link. However, show mpls ldp neighbor shows no neighbors. What is the most likely cause?

A.The LDP router-id is not reachable via the IGP.
B.The mpls label protocol ldp command is missing globally.
C.The interface is configured with mpls ldp igp sync.
D.The LDP session is using a non-default transport address.
AnswerA

Correct because LDP uses TCP to establish the session, and the router-id must be reachable; if the IGP does not have a route to the peer's LDP router-id, the TCP connection fails.

Why this answer

LDP hellos are exchanged, but the session does not form, indicating a problem with the transport connection. The most common cause is that the routers cannot establish a TCP connection to the LDP transport address, often due to a missing route to the LDP router-id or an ACL blocking TCP port 646.

Full explanation →
1161
MCQmedium

A network engineer runs the following command to troubleshoot a Flexible NetFlow issue: R1# show flow monitor FLOW-MONITOR-1 cache format table Cache type: Normal Cache size: 1000 Current entries: 25 High Watermark: 50 Flows added: 1234 Flows aged: 1209 - Active timeout ( 1800 secs): 100 - Inactive timeout ( 15 secs): 1100 - Event aged: 9 - Watermark aged: 0 - Emergency aged: 0 What does the output indicate?

A.The cache is experiencing watermark aging, indicating memory pressure.
B.Most flows are being aged due to the active timeout, suggesting long-lived flows.
C.The majority of flows are being aged due to the inactive timeout, indicating many short-lived flows.
D.Emergency aging is occurring, which means the cache is full.
AnswerC

1100 out of 1209 aged flows are due to inactive timeout, which is typical for short-lived traffic like DNS or web requests.

Why this answer

The output shows the current state of the Flexible NetFlow cache. The high number of flows aged due to inactive timeout (1100 out of 1209) indicates that most flows are short-lived. The cache is not full (25 out of 1000 entries used), and no watermark or emergency aging has occurred.

This is normal for traffic with many brief connections.

Full explanation →
1162
MCQeasy

What is the default OSPF hello interval on a point-to-point serial interface?

A.10 seconds
B.30 seconds
C.40 seconds
D.20 seconds
AnswerA

Correct. Point-to-point and broadcast networks use a 10-second hello interval.

Why this answer

OSPF hello interval defaults are based on the network type. For point-to-point and broadcast networks, the default hello interval is 10 seconds. For NBMA and point-to-multipoint, it is 30 seconds.

Full explanation →
1163
MCQmedium

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

A.Check the EEM applet's script for errors.
B.Use the 'show event manager statistics' command to see how often the applet is triggered.
C.Temporarily disable the EEM applet and monitor the packet loss.
D.Increase the logging level to debug to see more details.
AnswerC

Correct because disabling the applet and observing if packet loss stops confirms the applet as the cause.

Why this answer

To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor the network for any improvement in packet loss.

Full explanation →
1164
Drag & Drophard

Drag and drop the steps to troubleshoot VRF-Lite adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking if the VRF is defined correctly with show vrf. Then verify interface assignment to the correct VRF. Next, confirm that the IP address on the interface is in the VRF context.

After that, test basic connectivity with ping using the VRF keyword. Finally, examine routing protocol adjacency status within the VRF.

Full explanation →
1165
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nhrp traffic NHRP Traffic Statistics Sent: 100 requests, 50 replies Received: 50 requests, 100 replies Based on this output, what is the problem?

A.There is a mismatch between sent requests and received replies, indicating packet loss.
B.The router is receiving more replies than requests.
C.The NHRP process is functioning normally.
D.The router is configured as a hub.
AnswerA

100 requests sent vs 50 replies received shows loss.

Why this answer

The output shows NHRP traffic statistics. The router sent 100 requests but received only 50 replies, indicating that half of the requests are not being answered. This could be due to network issues, misconfiguration, or packet loss.

Full explanation →
1166
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 nd raguard policy Interface Policy Role State Gi0/0/0 RA_GUARD router ACTIVE Gi0/0/1 RA_GUARD host ACTIVE Gi0/0/2 (default) host ACTIVE Based on this output, which statement is correct?

A.Interface Gi0/0/0 is allowed to send Router Advertisements.
B.Interface Gi0/0/1 is allowed to send Router Advertisements.
C.Interface Gi0/0/2 is allowed to send Router Advertisements.
D.All interfaces are blocked from sending Router Advertisements.
AnswerA

Role 'router' under RA guard permits sending RAs.

Why this answer

The 'show ipv6 nd raguard policy' output shows that interface Gi0/0/0 is configured with the RA_GUARD policy in the 'router' role and is ACTIVE. In IPv6 RA Guard, a port in the 'router' role is explicitly permitted to send Router Advertisements (RAs), while ports in the 'host' role are blocked from sending RAs. Therefore, only Gi0/0/0 is allowed to send RAs, making option A correct.

Exam trap

Cisco often tests the misconception that all interfaces with an active RA Guard policy are blocked, but the key differentiator is the 'role' (router vs. host), not just the policy being active.

How to eliminate wrong answers

Option B is wrong because interface Gi0/0/1 has the RA_GUARD policy with the 'host' role, which blocks it from sending Router Advertisements. Option C is wrong because interface Gi0/0/2 uses the default policy with the 'host' role, which also blocks it from sending Router Advertisements. Option D is wrong because interface Gi0/0/0 is in the 'router' role and is allowed to send Router Advertisements, so not all interfaces are blocked.

Full explanation →
1167
MCQeasy

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show crypto isakmp sa detail IPv4 Crypto ISAKMP SA C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap. 1001 192.168.1.1 192.168.2.2 ACTIVE des sha pre 2 23:59:21 1002 192.168.1.1 192.168.2.2 ACTIVE 3des sha pre 2 23:58:15 IPv6 Crypto ISAKMP SA What does this output indicate?

A.The IPsec VPN is functioning correctly with two redundant ISAKMP SAs.
B.There are two active ISAKMP SAs between the peers, which suggests a configuration error such as multiple ISAKMP policies or aggressive mode issues.
C.The ISAKMP SA is using DES encryption, which is weak and should be upgraded.
D.The ISAKMP SA lifetime is about 24 hours, which is the default.
AnswerB

Having two SAs is abnormal; it often results from misconfigured policies or aggressive mode causing duplicate SAs.

Why this answer

The output shows two active ISAKMP SAs between the same peers (192.168.1.1 and 192.168.2.2) with different encryption algorithms (DES and 3DES). Under normal operation, only one ISAKMP SA should exist per peer pair. Having multiple SAs indicates a configuration error, such as multiple ISAKMP policies that both match, or aggressive mode causing duplicate SAs.

This is not a sign of redundancy; ISAKMP SAs are not redundant by design.

Exam trap

Cisco often tests the misconception that multiple active ISAKMP SAs between the same peers are normal or provide redundancy, when in fact they indicate a configuration error that can break the VPN tunnel.

How to eliminate wrong answers

Option A is wrong because ISAKMP SAs are not designed for redundancy; having two active SAs between the same peers indicates a misconfiguration, not a functional redundancy feature. Option C is wrong because while DES is indeed weak, the output shows both DES and 3DES SAs, and the question asks what the output indicates—the core issue is the duplicate SAs, not the encryption strength. Option D is wrong because the lifetimes shown (23:59:21 and 23:58:15) are close to 24 hours, which is the default for ISAKMP, but this is not the key finding; the presence of two SAs is the abnormal condition.

Full explanation →
1168
MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp summary BGP router identifier 10.1.1.1, local AS number 65001 BGP table version is 15, main routing table version 15 2 network entries using 288 bytes of memory 2 path entries using 160 bytes of memory 2/1 BGP path/bestpath attribute entries using 288 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 736 total bytes of memory BGP activity 4/2 prefixes, 4/2 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.1.12.2 4 65002 1023 1047 15 0 0 00:12:34 0 192.168.1.2 4 65003 0 0 0 0 0 never Active Based on this output, what is the problem with the BGP session to 192.168.1.2?

A.The neighbor 192.168.1.2 is not reachable.
B.The neighbor 192.168.1.2 is in Idle state due to a misconfigured AS number.
C.The BGP session to 192.168.1.2 has never been established and is in Active state, likely due to a lack of TCP connectivity.
D.The BGP session to 192.168.1.2 is established but not exchanging prefixes.
AnswerC

Active state with 'never' uptime indicates the session has never come up, and R1 is actively trying to initiate the TCP connection.

Why this answer

The neighbor 192.168.1.2 is in Active state, meaning R1 is trying to establish a TCP connection but is not receiving a response. This could be due to reachability issues, incorrect AS number, or ACL blocking. The session has never been up (Up/Down: never).

Full explanation →
1169
MCQmedium

Which OSPF LSA type is used to advertise external routes and is flooded throughout the entire OSPF domain?

A.Type 1 (Router LSA)
B.Type 3 (Summary LSA)
C.Type 4 (ASBR Summary LSA)
D.Type 5 (AS-external LSA)
AnswerD

Correct. Type 5 LSAs are flooded throughout the entire OSPF domain (except stub areas) and advertise external routes.

Why this answer

Type 5 (AS-external LSA) is correct because it is originated by an ASBR to advertise external routes redistributed into OSPF from another routing domain. These LSAs are flooded throughout the entire OSPF domain, including all areas, and their flooding scope is AS-wide, as defined in RFC 2328.

Exam trap

Cisco often tests the distinction between Type 3 and Type 5 LSAs, where candidates mistakenly think Type 3 LSAs carry external routes because they are also 'summary' LSAs, but Type 3 LSAs only carry inter-area routes, not external routes.

How to eliminate wrong answers

Option A is wrong because Type 1 (Router LSA) describes the state and cost of a router's interfaces within a single area and is flooded only within that area, not the entire OSPF domain. Option B is wrong because Type 3 (Summary LSA) is generated by an ABR to advertise inter-area routes and is flooded only within a single area, not the entire domain. Option C is wrong because Type 4 (ASBR Summary LSA) is also generated by an ABR to advertise the location of an ASBR to other areas, but its flooding scope is limited to a single area, not the entire OSPF domain.

Full explanation →
1170
MCQhard

A service provider is using 6rd (IPv6 Rapid Deployment) tunnels to provide IPv6 to customers. Customer router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel mode ipv6ip 6rd ipv6 6rd prefix 2001:DB8::/32 6rd-br 198.51.100.1. Router R2 (BR) shows: R2# show ipv6 route 2001:DB8:1::/64 % Route not found. What is the root cause?

A.The 6rd prefix on R1 should match the BR's configured 6rd prefix, and the BR must have a route for the customer's delegated prefix.
B.The tunnel mode should be ipv6ip 6rd on both ends, but the BR is missing the 6rd configuration.
C.The customer's IPv4 address is not reachable from the BR.
D.The 6rd prefix length should be /64 instead of /32.
AnswerA

The BR must have a route for the customer's IPv6 prefix, which is derived from the 6rd prefix and the customer's IPv4 address.

Why this answer

The 6rd (IPv6 Rapid Deployment) tunnel requires both the customer router (R1) and the border relay (BR, R2) to agree on the same 6rd prefix. R1 is configured with prefix 2001:DB8::/32, but the BR has no route for the delegated prefix 2001:DB8:1::/64, which is derived from R1's IPv4 address (192.0.2.1) and the 6rd prefix. Without this route in the BR's IPv6 routing table, the BR cannot forward traffic to the customer's 6rd tunnel, causing the 'Route not found' error.

Exam trap

Cisco often tests the misconception that 6rd requires matching tunnel configurations on both ends, when in reality the BR only needs a route for the delegated prefix and does not run a 6rd tunnel interface itself.

How to eliminate wrong answers

Option B is wrong because the tunnel mode 'ipv6ip 6rd' is correctly configured on R1, and the BR does not need the same tunnel interface or 6rd configuration; it only needs a route for the delegated prefix and the ability to decapsulate 6rd packets. Option C is wrong because the issue is not IPv4 reachability between R1 (192.0.2.1) and the BR (198.51.100.1); the BR can reach R1's IPv4 address, but it lacks the specific IPv6 route for the delegated prefix. Option D is wrong because the 6rd prefix length is /32, which is correct for aggregating customer prefixes; the delegated prefix length (e.g., /64) is derived from the IPv4 address and is separate from the 6rd prefix length.

Full explanation →
1171
MCQmedium

A network engineer is troubleshooting a BGP session that is dropping intermittently. The routers are connected via a Layer 2 switch. BFD is configured for the BGP session. The engineer notices that the BFD session goes down briefly, causing the BGP session to reset. The BFD timers are set to 100 ms interval with a multiplier of 3. The switch is not configured for BFD. What is the most likely cause?

A.The BFD timers are too aggressive for the switch's processing capabilities, causing BFD packets to be dropped during high traffic.
B.The BGP session is not configured with the 'bfd' command under the neighbor statement.
C.The switch is running Spanning Tree Protocol (STP) and causing delays.
D.One router has 'bfd slow-timers' configured, causing a mismatch.
AnswerA

Aggressive BFD timers (100 ms) can overwhelm a switch that is not optimized for fast packet forwarding, leading to intermittent BFD failures.

Why this answer

BFD sessions can be affected by congestion or processing delays in the Layer 2 switch, especially with aggressive timers. The switch not supporting BFD does not inherently cause issues, but high CPU or buffer drops can cause BFD packets to be dropped.

Full explanation →
1172
Multi-Selecthard

Which TWO configuration steps are required to change the administrative distance for routes learned from a specific neighbor in EIGRP? (Choose TWO.)

Select 2 answers
A.Configure a prefix list to match the routes from the neighbor.
B.Use the distance eigrp command in router configuration mode.
C.Use the distance command with the neighbor IP address and prefix list.
D.Configure an access list to permit the routes from the neighbor.
E.Use the redistribute command to change the administrative distance.
AnswersA, C

The prefix list is used to identify which routes to match for the distance override.

Why this answer

To change the AD for routes from a specific EIGRP neighbor, you must first configure a prefix list to match the routes, then apply it using the distance command in EIGRP router configuration mode. The distance command can specify a different AD for routes matching a prefix list from a specific neighbor.

Full explanation →
1173
MCQmedium

A network engineer runs the following command to troubleshoot DHCPv6 relay on router R1: R1# debug ipv6 dhcp relay Output: IPv6 DHCP relay: Received SOLICIT message from FE80::1 on GigabitEthernet0/0 IPv6 DHCP relay: Forwarding SOLICIT to server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Received ADVERTISE message from server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Forwarding ADVERTISE to client FE80::1 via GigabitEthernet0/0 IPv6 DHCP relay: Received REQUEST message from FE80::1 on GigabitEthernet0/0 IPv6 DHCP relay: Forwarding REQUEST to server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Received REPLY message from server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Forwarding REPLY to client FE80::1 via GigabitEthernet0/0 What does this output indicate?

A.The DHCPv6 relay agent is not functioning because messages are not being forwarded.
B.The DHCPv6 relay agent is successfully forwarding messages between the client and server.
C.The DHCPv6 server is unreachable because no REPLY is received.
D.The DHCPv6 client is using a global unicast address as its link-local address.
AnswerB

The relay receives client messages, forwards them to the server, and forwards server responses back to the client.

Why this answer

The debug output shows a complete DHCPv6 four-message exchange (SOLICIT-ADVERTISE-REQUEST-REPLY) being relayed between the client (FE80::1) and the server (2001:DB8:2::1). Each message is received on one interface and forwarded out the other, confirming the relay agent is functioning correctly. Therefore, option B is correct.

Exam trap

Cisco often tests the ability to interpret debug output by showing a successful message flow, leading candidates to incorrectly assume a failure because they expect an error message or because they misread the link-local address as a global address.

How to eliminate wrong answers

Option A is wrong because the debug output clearly shows messages being forwarded in both directions, proving the relay agent is functioning. Option C is wrong because the output includes a REPLY message from the server, indicating the server is reachable and responding. Option D is wrong because FE80::1 is a link-local address (fe80::/10), not a global unicast address, and the client correctly uses it as its link-local address for DHCPv6 communication.

Full explanation →
1174
Drag & Drophard

Drag and drop the troubleshooting steps for DMVPN adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Troubleshooting DMVPN connectivity starts with verifying physical and IP reachability to the hub. Next, check NHRP registration status on the spoke. Then verify mGRE tunnel interface parameters and IPsec phase 1 (IKE) status.

Finally, examine NHRP resolution between spokes to isolate the failure point.

Full explanation →
1175
MCQhard

What is the default value of the 'hold-down' timer in IPv6 FHS's ND Snooping feature on Cisco IOS-XE?

A.5 seconds
B.10 seconds
C.15 seconds
D.20 seconds
AnswerB

Correct. The default hold-down timer is 10 seconds.

Why this answer

The default hold-down timer for IPv6 First Hop Security's Neighbor Discovery (ND) Snooping feature on Cisco IOS-XE is 10 seconds. This timer defines how long the device maintains a binding entry in the ND snooping database after the last valid advertisement is received, preventing rapid flapping and ensuring stability in the binding table.

Exam trap

Cisco often tests the default hold-down timer value by making candidates confuse it with the default reachable time (30 seconds) or the default binding lifetime (300 seconds), leading them to pick a larger number like 15 or 20 seconds.

How to eliminate wrong answers

Option A is wrong because 5 seconds is not the default hold-down timer; it is too short to provide sufficient stability against transient ND messages. Option C is wrong because 15 seconds is not the default; this value might be used in other FHS features like DHCPv6 guard but not for ND snooping hold-down. Option D is wrong because 20 seconds is also not the default; it would unnecessarily delay the removal of stale bindings, potentially causing resource exhaustion in dynamic environments.

Full explanation →
1176
MCQhard

An engineer configures a BGP route reflector with a route map that sets a higher local preference on routes received from a client. The route map is applied to the neighbor statement for the client. Unexpectedly, the route reflector does not reflect the modified local preference to other clients. Which is the most likely explanation?

A.The route map is applied outbound, not inbound, so the local preference is set after the route is reflected.
B.Route reflectors do not modify local preference; only the route reflector itself can set local preference.
C.The route map must be applied to the route reflector's cluster list, not the neighbor.
D.The local preference is overridden by the next-hop-self command.
AnswerA

Outbound route maps affect routes sent to the neighbor, not routes received; reflection happens before outbound processing.

Why this answer

When a route map is applied to a BGP neighbor inbound, it modifies the route before it is installed in the BGP table. However, route reflectors reflect routes based on the best path selection, and if the local preference is set, it should be reflected. The issue is that the route map is applied outbound instead of inbound, or the route map does not explicitly set the local preference before the route is processed.

The most common edge case is that the route map is applied outbound, which does not affect the route before reflection.

Full explanation →
1177
MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After a few minutes, the router's CPU spikes and routes start flapping. Which is the most likely explanation?

A.The redistribution is creating a routing loop because there is no route tagging or filtering to prevent re-redistribution.
B.The seed metric is not configured, so the routes are not redistributed.
C.The administrative distance is set too low, causing the router to prefer the wrong route.
D.The OSPF process ID is the same on both routers.
AnswerA

Correct. Without tagging, routes can loop between protocols.

Why this answer

Mutual redistribution without route tagging or filtering causes the redistributed routes to be re-injected back into the original routing protocol, creating a routing loop. This loop leads to continuous route updates, CPU spikes, and route flapping as the router repeatedly processes and advertises the same prefixes.

Exam trap

Cisco often tests the concept that mutual redistribution inherently causes loops unless explicit filtering or tagging is applied, and candidates mistakenly focus on missing metrics or administrative distance instead of the re-redirection loop.

How to eliminate wrong answers

Option B is wrong because a missing seed metric would prevent redistribution from EIGRP into OSPF (OSPF requires a metric), but it would not cause a routing loop or flapping; the routes simply would not be redistributed. Option C is wrong because setting administrative distance too low could cause route preference issues but does not directly create the feedback loop of mutual redistribution; the core problem is re-redistribution, not AD. Option D is wrong because the OSPF process ID is locally significant and does not need to match between routers; mismatched process IDs do not cause redistribution loops or flapping.

Full explanation →
1178
MCQhard

An engineer configures IPsec site-to-site VPN between two routers. The tunnel is established, but no traffic is encrypted. The engineer checks the crypto map and access-list and confirms they match the interesting traffic. What is the most likely explanation?

A.The crypto map is applied to the wrong interface, and traffic is not being matched.
B.The 'transform-set' is configured with ESP-NULL, which provides no encryption.
C.The 'crypto isakmp key' is mismatched between the two routers.
D.The 'crypto map' is not applied globally, so it does not affect traffic.
AnswerA

If the crypto map is applied to a different interface than the one carrying the interesting traffic, the traffic will not be encrypted even if the tunnel is up. The tunnel establishment only requires the crypto map to be present on the interface, but encryption only occurs for traffic matching the access-list on that specific interface.

Why this answer

A common edge case is that the crypto map is applied to the wrong interface or the access-list is not correctly referencing the traffic. However, if the tunnel is established, the issue may be that the crypto map is applied to a subinterface but the traffic is flowing through the main interface, or the 'crypto map' command is missing the 'local-address' option for multiple crypto maps. Another possibility is that the 'set peer' command is missing or the peer address is incorrect.

Full explanation →
1179
MCQmedium

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp neighbors detail IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.2.2 Gi0/0 13 00:12:34 12 200 0 145 Version 12.4/1.2, Retrans: 0, Retries: 0, Prefixes: 5 Topology-ids from peer - 0 Stub Peer Advertising (CONNECTED STATIC) Routes Suppressing queries What does this output indicate?

A.The neighbor is a stub router that only advertises connected and static routes, and it does not participate in query propagation.
B.The neighbor is a normal EIGRP peer that forwards all routes and queries.
C.The neighbor is not forming an adjacency due to a version mismatch.
D.The neighbor is using a different autonomous system number.
AnswerA

The output shows 'Stub Peer Advertising (CONNECTED STATIC) Routes' and 'Suppressing queries', confirming stub behavior.

Why this answer

The output shows 'Stub Peer Advertising (CONNECTED STATIC) Routes' and 'Suppressing queries', which indicates the neighbor is configured as an EIGRP stub router. A stub router advertises only connected and static routes (as specified) and does not participate in query propagation, meaning it will not forward queries from other routers, reducing the query domain and improving convergence.

Exam trap

Cisco often tests the distinction between a normal EIGRP peer and a stub peer by hiding the 'Suppressing queries' line in the output, leading candidates to overlook the stub behavior and incorrectly assume the peer is a normal router forwarding all routes.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Suppressing queries' and 'Stub Peer Advertising', which means the neighbor is not a normal EIGRP peer that forwards all routes and queries; normal peers do not suppress queries. Option C is wrong because the output shows 'Version 12.4/1.2', indicating a successful version match between the peers; a version mismatch would prevent adjacency formation and would not show neighbor details. Option D is wrong because the output shows 'IP-EIGRP neighbors for process 100', confirming both routers are using the same autonomous system number (100); a different AS would prevent adjacency.

Full explanation →
1180
MCQhard

An engineer configures MPLS on a router with OSPF as the IGP. The OSPF neighbor is stuck in EXSTART state. The engineer verifies that both routers have matching MTU values on the connecting interfaces. What is the most likely cause of this issue?

A.The OSPF network type is mismatched between the two routers.
B.The OSPF hello and dead intervals are mismatched.
C.The router ID is duplicated on one of the routers.
D.The interface is configured with 'ip ospf mtu-ignore' on one side only.
AnswerA

A mismatch in OSPF network type (e.g., broadcast vs point-to-point) can cause the neighbor to remain in EXSTART because the DD packet exchange process differs between network types, even if MTU is consistent.

Why this answer

In OSPF, a neighbor stuck in EXSTART is often due to MTU mismatch, but if MTU is confirmed matching, the issue may be a mismatch in OSPF network type (e.g., one side broadcast, the other point-to-point). This causes different behavior in the Database Description (DD) packet exchange, leading to the stuck state even with matching MTU.

Full explanation →
1181
MCQhard

An engineer configures EIGRP named mode on two routers in the same AS. One router uses classic mode configuration. The routers fail to form an adjacency. Which is the most likely explanation?

A.Named mode and classic mode are incompatible and cannot form an adjacency under any circumstances.
B.The K values must match exactly, but named mode defaults to different K values than classic mode.
C.Named mode requires authentication, while classic mode does not.
D.The routers must be in the same autonomous system number, but named mode uses a different AS number format.
AnswerA

EIGRP named mode and classic mode use different packet structures and metric computation; they are not interoperable for adjacency formation.

Why this answer

EIGRP named mode and classic mode use different packet formats and TLVs, making them incompatible at the protocol level. Even though both operate within the same autonomous system, the routers cannot form an adjacency because the hello packets are not recognized by the other mode. This incompatibility is fundamental and cannot be overcome by configuration adjustments.

Exam trap

The trap here is that candidates often assume named mode and classic mode can interoperate because they share the same protocol number and AS number, but Cisco specifically designed them to be incompatible to enforce a clean migration path.

How to eliminate wrong answers

Option B is wrong because both named mode and classic mode default to the same K values (K1=1, K2=0, K3=1, K4=0, K5=0), so K value mismatch is not the issue. Option C is wrong because authentication is optional in both named mode and classic mode; named mode does not require authentication by default. Option D is wrong because both modes use the same 16-bit autonomous system number format; named mode does not introduce a different AS number format.

Full explanation →
1182
MCQhard

Router R8 is configured with SNMP and IP SLA. The IP SLA operation sends SNMP traps to the NMS when a threshold is crossed. The configuration includes: ip sla 1, icmp-echo 192.168.1.1, threshold 100, timeout 1000, frequency 10, ip sla schedule 1 life forever start-time now, snmp-server enable traps ip sla. However, the NMS receives no traps when the threshold is crossed. The IP SLA operation shows 'Over threshold' in show ip sla statistics. What is the root cause?

A.The IP SLA operation is missing the 'ip sla reaction-configuration' command to trigger SNMP traps when the threshold is exceeded.
B.The NMS is not configured to receive IP SLA traps.
C.The SNMP community string is incorrect for trap sending.
D.The IP SLA operation is not scheduled correctly.
AnswerA

IP SLA traps require a reaction configuration that specifies the threshold and action (e.g., 'ip sla reaction-configuration 1 react timeout threshold 100 action trapOnly'). Without it, no traps are sent.

Why this answer

The 'ip sla reaction-configuration' command is required to define the condition (e.g., threshold violation) that triggers an SNMP trap. Without this command, the IP SLA operation can detect and report 'Over threshold' in statistics, but it has no mechanism to generate an SNMP trap to the NMS. The 'snmp-server enable traps ip sla' command only enables the router to send IP SLA traps globally; it does not link a specific reaction to the threshold event.

Exam trap

Cisco often tests the distinction between enabling SNMP traps globally ('snmp-server enable traps ip sla') and configuring the specific reaction that triggers those traps ('ip sla reaction-configuration'), leading candidates to overlook the missing reaction command.

How to eliminate wrong answers

Option B is wrong because the NMS's ability to receive traps is not configured on the router; the router's SNMP trap configuration (destination, community) is independent of the NMS's readiness. Option C is wrong because the SNMP community string for trap sending is not mentioned in the scenario, and the issue is specifically about the missing reaction-configuration, not authentication. Option D is wrong because the IP SLA operation is scheduled correctly with 'ip sla schedule 1 life forever start-time now', and the statistics show it is running and detecting the threshold crossing.

Full explanation →
1183
MCQmedium

Consider the following partial configuration on router R4: interface GigabitEthernet0/0 ip address 192.168.2.1 255.255.255.0 ipv6 address 2001:db8:1::1/64 ipv6 ospf 1 area 0 ! interface GigabitEthernet0/1 ip address 10.0.0.1 255.255.255.0 ipv6 address 2001:db8:2::1/64 ipv6 ospf 1 area 0 ! ipv6 router ospf 1 router-id 4.4.4.4 What is the effect of this configuration?

A.OSPFv3 will not form adjacencies because the router-id must be an IPv6 address.
B.OSPFv3 will only form adjacency on GigabitEthernet0/0 because the router-id is not configured under the interface.
C.OSPFv3 will form adjacencies on both interfaces as intended because the router-id is correctly set and OSPFv3 is enabled on each interface.
D.OSPFv3 will not form any adjacency because the network type is not specified.
AnswerC

The configuration is correct: router-id is set, interfaces are enabled for OSPFv3 in area 0. OSPFv3 will operate normally.

Why this answer

OSPFv3 (OSPF for IPv6) uses a 32-bit router-id, which can be an IPv4 address (like 4.4.4.4) or any arbitrary 32-bit value, and does not require an IPv6 address. The configuration enables OSPFv3 process 1 under the global 'ipv6 router ospf 1' command, sets the router-id, and activates OSPFv3 on both interfaces with 'ipv6 ospf 1 area 0', allowing adjacencies to form normally on both GigabitEthernet0/0 and GigabitEthernet0/1.

Exam trap

Cisco often tests the misconception that OSPFv3 requires an IPv6 router-id, when in fact it uses a 32-bit router-id (like an IPv4 address), and candidates may also incorrectly assume that OSPFv3 needs per-interface router-id configuration or explicit network type statements.

How to eliminate wrong answers

Option A is wrong because OSPFv3 does not require the router-id to be an IPv6 address; it uses a 32-bit router-id (typically an IPv4 address or a custom value), as defined in RFC 5340. Option B is wrong because the router-id is configured globally under the OSPFv3 process and does not need to be configured per interface; both interfaces will form adjacencies as long as OSPFv3 is enabled on them. Option D is wrong because OSPFv3 defaults to the broadcast network type on Ethernet interfaces, and no explicit network type specification is required for adjacency formation.

Full explanation →
1184
MCQmedium

An engineer is troubleshooting why the NMS is not receiving SNMP traps for interface up/down events on router R4. The configuration includes 'snmp-server enable traps snmp linkdown linkup' and 'snmp-server host 10.1.1.200 version 2c public'. The NMS can receive other traps from R4. What is the most likely cause?

A.The engineer combined 'linkdown' and 'linkup' in a single command; they must be configured as separate 'snmp-server enable traps' commands.
B.The NMS is configured to filter out link up/down traps, so they are not displayed.
C.The router needs the 'snmp-server trap-source' command to specify the loopback interface for traps.
D.The 'snmp-server host' command must include the 'udp-port' option to specify port 162.
AnswerA

Correct because the IOS syntax requires separate commands for each trap type; combining them is invalid.

Why this answer

Cisco IOS requires that 'linkdown' and 'linkup' be configured in separate 'snmp-server enable traps' commands when using the 'snmp-server enable traps snmp' syntax. Combining them in a single command is syntactically invalid; the router will not enable either trap type, which explains why the NMS receives other traps but not link up/down events.

Exam trap

Cisco often tests the misconception that multiple trap keywords can be combined in a single 'snmp-server enable traps' command, when in fact each specific trap (like 'linkdown' and 'linkup') requires its own separate command to be enabled.

How to eliminate wrong answers

Option B is wrong because the NMS can receive other traps from R4, indicating it is not filtering traps globally; if it were filtering link up/down specifically, the engineer would need to verify NMS configuration, but the question states the NMS receives other traps, making this unlikely. Option C is wrong because the 'snmp-server trap-source' command is used to set the source IP address for traps, but the NMS already receives other traps from R4, so the source is reachable and not the issue. Option D is wrong because the default UDP port for SNMP traps is 162, and the 'udp-port' option is only needed if a non-standard port is used; the NMS already receives other traps on the default port, so this is not the cause.

Full explanation →
1185
Multi-Selecthard

Which THREE commands can be used to verify VRF-Lite configuration and operation on a Cisco IOS-XE router? (Choose THREE.)

Select 3 answers
A.show vrf
B.show ip route vrf BLUE
C.show ip interface vrf BLUE
D.show vrf interfaces
E.show vrf detail
AnswersA, B, C

Correct. This command lists all VRFs, their route distinguishers (RD), and interfaces.

Why this answer

Common verification commands for VRF-Lite include: 'show vrf' to list VRFs and their RD/RT, 'show ip route vrf <name>' to display the VRF-specific routing table, and 'show ip interface vrf <name>' to show interfaces assigned to a VRF. Option A is correct. Option B is correct.

Option C is correct. Option D is incorrect because 'show ip vrf interfaces' is the correct command, not 'show vrf interfaces'. Option E is incorrect because 'show vrf detail' is not a valid command; the correct command is 'show vrf' or 'show vrf <name>'.

Full explanation →
1186
Multi-Selecthard

Which THREE symptoms indicate a BGP route dampening issue that is causing routes to be suppressed? (Choose THREE.)

Select 3 answers
A.The BGP neighbor state flaps between Established and Idle.
B.The show ip bgp command displays the route with a 'd' status code.
C.The route is present in the BGP table but missing from the IP routing table.
D.The show ip bgp dampened-paths command shows the suppressed routes.
E.The show ip prefix-list command indicates that routes are being filtered.
AnswersB, C, D

The 'd' status code indicates the route is dampened.

Why this answer

Route dampening suppresses routes that flap frequently. Symptoms include routes showing as 'dampened' in the BGP table, routes being absent from the routing table despite being in the BGP table, and the show ip bgp dampened-paths command listing those routes. Option A is incorrect because dampening does not affect the neighbor state.

Option E is incorrect because the prefix-list is not directly related to dampening.

Full explanation →
1187
MCQeasy

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# show ip route summary And sees the following output: Route Source Networks Subnets Replicates Overhead Memory (bytes) connected 2 0 0 0 512 static 1 0 0 0 256 ospf 1 5 0 0 0 1280 eigrp 100 3 0 0 0 768 bgp 65000 2 0 0 0 512 internal 1 0 0 0 256 Total 14 0 0 0 3584 What does this output indicate?

A.The router has 14 routes total, with OSPF contributing the most routes.
B.The router is not redistributing any routes because the counts are low.
C.BGP is the only protocol with external routes.
D.EIGRP has 3 routes, all of which are redistributed from OSPF.
AnswerA

The output shows OSPF has 5 routes, which is the highest count. This indicates OSPF is learning many routes, possibly via redistribution.

Why this answer

The show ip route summary output provides a count of routes from each source. It shows that OSPF has 5 routes, EIGRP has 3, BGP has 2, and static has 1. This can help identify if redistribution is working by comparing expected routes.

Full explanation →
1188
Multi-Selecthard

Which TWO statements about the 'logging rate-limit' command and its effects are correct? (Choose TWO.)

Select 2 answers
A.The command 'logging rate-limit 200 all' limits all syslog messages to 200 messages per second.
B.By default, Cisco IOS applies a rate limit of 100 messages per second to all logging destinations.
C.The 'logging rate-limit' command can be applied on a per-interface basis using interface configuration mode.
D.The 'logging rate-limit' command only affects messages sent to the console port.
E.The 'show logging rate-limit' command displays the current rate-limit configuration.
AnswersA, C

Correct. The 'all' keyword applies the rate limit to every syslog message, regardless of severity.

Why this answer

The 'logging rate-limit' command limits the number of syslog messages per second to prevent CPU overload. It can be applied globally or per interface. The 'all' option applies the limit to all messages, while 'except' allows certain severities to bypass the limit.

The default rate is not unlimited; it depends on the IOS version but typically no rate limit is applied by default. The command does not affect console logging rate by default; it primarily affects logging to buffer and remote servers. The 'show logging' command displays the current rate-limit configuration.

Full explanation →
1189
MCQhard

An engineer configures EIGRP named mode on two routers in an MPLS L3VPN. The routers are directly connected and can ping each other. The engineer notices that the EIGRP adjacency forms but then the neighbor relationship goes down and the routers become stuck-in-active (SIA) for certain routes. The engineer checks the logs and sees no errors. What is the most likely explanation?

A.The 'metric weights' (k-values) are mismatched between the two routers, causing query propagation to fail.
B.The 'auto-summary' command is enabled on one router, causing route summarization to break the adjacency.
C.The 'passive-interface' command is applied to the interface, preventing the adjacency from forming.
D.The 'bandwidth' setting on the interface is set to a very low value, causing the EIGRP metric to be too high for the route to be installed.
AnswerA

Correct. EIGRP requires matching k-values between neighbors. If they differ, the adjacency may form but queries can be dropped, leading to SIA.

Why this answer

In EIGRP named mode, the default hello interval and hold time are different from classic mode. Named mode uses a default hello interval of 5 seconds and hold time of 15 seconds, while classic mode uses 5 and 15 as well, but the key difference is that named mode uses a different metric calculation (wide metrics) by default. However, the most common edge case causing SIA in named mode is that the 'metric weights' or 'k-values' must match between neighbors.

If one router is using named mode with default k-values (1,0,1,0,0) and the other is using classic mode with different k-values (e.g., 1,0,1,0,0), the adjacency will form but queries may not be processed correctly, leading to SIA. Additionally, named mode requires the 'address-family' configuration to be consistent. A more specific edge case is that named mode uses a different 'graceful-restart' mechanism by default, which can cause issues if not supported on both sides.

Full explanation →
1190
Drag & Dropmedium

Drag and drop the steps to configure OSPF inter-area summarization on an ABR into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, enter OSPF configuration mode for the process. Then, configure the area where the routes originate. Next, apply the range command to summarize prefixes into that area.

After that, verify the summary route is present in the routing table. Finally, check that the summary is advertised to neighboring areas.

Full explanation →
1191
MCQhard

An engineer configures a route reflector cluster with two route reflectors in the same cluster ID. After convergence, some iBGP routes are missing on clients, and 'show ip bgp' shows the path with 'r' flag. What is the most likely explanation?

A.The cluster ID is misconfigured and should be unique per route reflector.
B.The route reflectors have different BGP AS numbers, causing the 'r' flag to indicate a routing loop.
C.The clients have 'no bgp default route-reflector-client' configured, preventing them from receiving reflected routes.
D.The route reflectors have 'bgp cluster-id' set to 0.0.0.0, which disables cluster-based loop prevention.
AnswerA

Route reflectors with the same cluster ID will reject routes from each other to prevent loops, leading to missing routes on clients.

Why this answer

When two route reflectors share the same cluster ID, they treat each other's updates as if from the same cluster. The route reflector loop prevention mechanism drops routes learned from another RR in the same cluster, causing route loss if the clients are not fully meshed.

Full explanation →
1192
MCQhard

An engineer configures a DMVPN Phase 2 network with IPsec protection. Spoke-to-spoke tunnels form, but traffic between spokes is not being forwarded directly; it still goes through the hub. The engineer verifies that NHRP registrations are successful and that the spoke-to-spoke IPsec sessions are established. What is the most likely explanation?

A.The hub router is not configured with the 'no ip split-horizon' command for EIGRP or the 'neighbor' command for OSPF, preventing spoke-to-spoke route propagation.
B.The IPsec transform set on the spokes uses different encryption algorithms, preventing the spoke-to-spoke tunnel from passing traffic.
C.The NHRP authentication string is mismatched between spokes, causing NHRP resolution to fail.
D.The spoke routers have a static default route pointing to the hub, overriding the dynamic routes.
AnswerA

In DMVPN Phase 2, the hub must disable split horizon (EIGRP) or use a network type that allows route propagation (OSPF) so that spokes learn each other's subnets. Without this, spokes only have a default route via the hub, so traffic goes through the hub.

Why this answer

In a DMVPN Phase 2 network, spoke-to-spoke traffic requires that each spoke learns the remote spoke's prefix via the hub. For EIGRP, the hub must disable split horizon with 'no ip split-horizon eigrp <as>' to propagate routes learned from one spoke to other spokes. Without this, the hub advertises only its own routes, so spokes lack the necessary routing information to forward traffic directly, causing it to be sent through the hub despite working NHRP and IPsec.

Exam trap

Cisco often tests the subtle distinction between NHRP resolution success and actual routing table propagation—candidates assume that if NHRP and IPsec are working, traffic must flow directly, but they overlook the hub's routing protocol configuration that prevents spoke-to-spoke route advertisement.

How to eliminate wrong answers

Option B is wrong because mismatched IPsec transform sets would prevent the spoke-to-spoke IPsec session from establishing, but the scenario states that spoke-to-spoke IPsec sessions are already established. Option C is wrong because mismatched NHRP authentication would cause NHRP registrations and resolutions to fail, but the scenario confirms NHRP registrations are successful. Option D is wrong because a static default route pointing to the hub does not override dynamic routes for specific spoke prefixes; spokes would still use the dynamically learned routes for direct forwarding if they exist.

Full explanation →
1193
Multi-Selecthard

Which TWO statements about IPv6 manual tunnels (IPv6-in-IPv4) are true? (Choose TWO.)

Select 2 answers
A.The tunnel mode must be configured as tunnel mode ipv6ip.
B.The tunnel interface requires both an IPv4 address and an IPv6 address.
C.Manual tunnels support multicast traffic natively.
D.The tunnel destination can be a multicast IPv4 address.
E.The IPv4 address of the tunnel source is automatically embedded in the IPv6 prefix.
AnswersA, B

Correct. Manual IPv6-in-IPv4 tunnels use tunnel mode ipv6ip.

Why this answer

The `tunnel mode ipv6ip` command explicitly configures the tunnel interface for IPv6-in-IPv4 manual tunneling. This mode encapsulates IPv6 packets directly into IPv4 packets using protocol type 41, as defined in RFC 4213. Without this mode, the tunnel interface would not properly handle the encapsulation and decapsulation of IPv6 traffic over an IPv4 infrastructure.

Exam trap

Cisco often tests the distinction between manual tunnels and automatic 6to4 tunnels, where candidates mistakenly think the IPv4 source address is embedded in the IPv6 prefix (true for 6to4) or that multicast destinations are allowed (true for GRE tunnels, not manual IPv6-in-IPv4).

Full explanation →
1194
MCQmedium

Given this configuration: ``` interface GigabitEthernet0/4 ip access-group BLOCK_FTP in ! ip access-list extended BLOCK_FTP deny tcp any any eq 21 deny tcp any any eq 20 permit ip any any ``` What is the effect of this ACL when applied inbound on GigabitEthernet0/4?

A.It blocks all FTP traffic entering the interface, but permits all other IP traffic.
B.It blocks all FTP traffic leaving the interface.
C.It permits FTP traffic and blocks all other IP traffic.
D.It has no effect because the ACL is missing a sequence number.
AnswerA

Correct. The ACL denies FTP ports and permits everything else.

Why this answer

The ACL is applied inbound on GigabitEthernet0/4, meaning it filters traffic as it enters the interface. The first two deny statements block TCP traffic destined for ports 21 (FTP control) and 20 (FTP data), which are the standard ports for FTP. The final permit ip any any allows all other IP traffic.

Thus, only FTP traffic is blocked, and all other IP traffic is permitted.

Exam trap

Cisco often tests the distinction between inbound and outbound ACL application, and the trap here is that candidates may confuse the direction (in vs out) and incorrectly think the ACL blocks outbound traffic, or they may overlook that the explicit permit ip any any is required to allow other traffic after the deny statements.

How to eliminate wrong answers

Option B is wrong because the ACL is applied inbound (ip access-group BLOCK_FTP in), so it filters traffic entering the interface, not leaving it; outbound filtering would require the out keyword. Option C is wrong because the ACL explicitly denies FTP traffic (ports 20 and 21) and permits all other IP traffic, so it blocks FTP, not permits it. Option D is wrong because Cisco IOS extended ACLs do not require sequence numbers; sequence numbers are optional and used for editing, not for the ACL to function.

Full explanation →
1195
MCQeasy

Which RFC defines the IPv6 Neighbor Discovery Protocol that is the basis for many First Hop Security features?

A.RFC 4861
B.RFC 2460
C.RFC 4291
D.RFC 4443
AnswerA

RFC 4861 is the standard for IPv6 Neighbor Discovery.

Why this answer

RFC 4861 defines the IPv6 Neighbor Discovery Protocol (NDP), which is the foundation for IPv6 First Hop Security (FHS) features. NDP replaces ARP in IPv6 and provides address resolution, router discovery, neighbor unreachability detection, and redirect functions, all of which are leveraged by FHS mechanisms like RA Guard, DHCPv6 Guard, and Source Address Validation Improvement (SAVI).

Exam trap

Cisco often tests the distinction between the RFC that defines the protocol itself (RFC 4861 for NDP) versus RFCs that define supporting technologies like ICMPv6 (RFC 4443) or addressing (RFC 4291), leading candidates to confuse the foundational RFC with related but separate standards.

How to eliminate wrong answers

Option B is wrong because RFC 2460 defines the IPv6 base protocol specification (header format, extension headers, etc.), not Neighbor Discovery. Option C is wrong because RFC 4291 defines the IPv6 addressing architecture, including address types and scopes, not NDP. Option D is wrong because RFC 4443 defines ICMPv6 for IPv6, which is used by NDP for messaging but is not the defining RFC for the Neighbor Discovery Protocol itself.

Full explanation →
1196
MCQmedium

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

A.The destination port is not in the same VLAN as the source port.
B.The destination port is configured as a trunk port.
C.The destination port is in a blocking state due to Spanning Tree Protocol.
D.The source interface is not in the same VLAN as the destination interface.
AnswerC

Correct because SPAN destination ports are not expected to participate in STP; they should be configured with 'spanning-tree portfast' to avoid blocking.

Why this answer

SPAN destination ports must be configured with the 'spanning-tree portfast' command to avoid being blocked by Spanning Tree Protocol (STP). Without this, the destination port may remain in a blocking state.

Full explanation →
1197
MCQhard

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

A.The flow record does not include any VLAN match fields.
B.The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.
C.The flow monitor is applied only to the physical interface, not the subinterfaces.
D.The collector does not support VLAN fields.
AnswerA

Without 'match dot1q vlan' in the flow record, VLAN information is not captured, so all flows appear with the same (or zero) VLAN ID.

Why this answer

To capture VLAN information in Flexible NetFlow, the flow record must include 'match dot1q vlan' or 'match vlan' fields. Without these, the VLAN ID is not recorded, and the collector may show a default or incorrect value.

Full explanation →
1198
Multi-Selectmedium

Which TWO commands would a network engineer use to verify the NHRP registration status of a spoke router in a DMVPN Phase 2 network? (Choose TWO.)

Select 2 answers
A.show dmvpn
B.show ip nhrp
C.show crypto isakmp sa
D.show ip route
E.show ip eigrp neighbors
AnswersA, B

This command shows the DMVPN tunnel status, including the NHRP registration state (e.g., 'UP/UP' with registration status).

Why this answer

The 'show dmvpn' command displays the current DMVPN tunnel status, including the NHRP registration state of each peer. The 'show ip nhrp' command shows the NHRP cache entries, which include the registration status and mapping information. The other commands either do not show NHRP registration details or are for different purposes.

Full explanation →
1199
Multi-Selectmedium

Which TWO statements are true regarding the use of VRF-Lite in a Cisco Enterprise network? (Choose TWO.)

Select 2 answers
A.VRF-Lite enables multiple virtual routing tables on a single router, providing traffic separation without MPLS.
B.VRF-Lite supports dynamic routing protocols such as OSPF and EIGRP within each VRF.
C.VRF-Lite requires MPLS to exchange VPNv4 routes between routers.
D.VRF-Lite can automatically encrypt traffic between VRFs using IPsec.
E.VRF-Lite can only be used with static routing.
AnswersA, B

VRF-Lite creates separate routing tables per VRF, isolating traffic at Layer 3 without needing MPLS.

Why this answer

VRF-Lite allows multiple routing tables on a single router, enabling traffic separation without MPLS. It relies on static routes or dynamic routing protocols like OSPF, EIGRP, or BGP within each VRF. The incorrect options: MPLS is not required for VRF-Lite; VRF-Lite does not support MPLS VPNv4 route exchange (that requires MPLS); and VRF-Lite does not inherently provide encryption.

Full explanation →
1200
MCQhard

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# show ip bgp vpnv4 vrf CUSTOMER routes And sees the following output: Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:1 (default for vrf CUSTOMER) *> 192.168.10.0/24 10.1.1.2 0 100 0 65001 i *> 192.168.20.0/24 10.1.1.2 0 100 0 65001 i What does this output indicate?

A.The VRF CUSTOMER has two routes learned via BGP from AS 65001.
B.The routes are redistributed from OSPF into BGP within the VRF.
C.The VRF is not receiving any routes because of a redistribution issue.
D.The routes are locally originated within the VRF.
AnswerA

The output shows two routes with next hop 10.1.1.2 and AS path 65001.

Why this answer

The show ip bgp vpnv4 vrf output shows routes in a VRF. The routes are learned from neighbor 10.1.1.2 with AS path 65001. This indicates that the VRF is receiving routes via BGP, possibly from a PE router.

If redistribution is expected from another protocol into BGP within the VRF, these routes may be the result.

Full explanation →
Page 15

Page 16 of 27

Page 17

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →