Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1201–1275

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 16

Page 17 of 27

Page 18
1201
MCQmedium

Given the following partial configuration on a router: ip access-list standard FILTER_SNMP permit 192.168.1.0 0.0.0.255 deny any ! snmp-server community public RO FILTER_SNMP snmp-server location DataCenter snmp-server contact admin@example.com What is the effect of this configuration?

A.Only SNMP requests from the 192.168.1.0/24 network are allowed with the community string 'public'.
B.SNMP requests from any source are allowed because the ACL is not applied correctly.
C.The community string 'public' allows read-write access.
D.The ACL is applied outbound, so SNMP responses are filtered.
AnswerA

The ACL permits the specified subnet, and the community string is tied to that ACL.

Why this answer

The configuration applies the standard ACL 'FILTER_SNMP' to the SNMP community string 'public' with read-only (RO) access. The ACL permits only the 192.168.1.0/24 network, so SNMP requests (e.g., GET, GETNEXT) from that subnet are allowed, while all other sources are denied. This is the intended effect of using an ACL to restrict SNMP access by source IP.

Exam trap

Cisco often tests the distinction between applying an ACL to an SNMP community versus applying it to an interface; the trap here is that candidates may think the ACL filters outbound SNMP responses or that the ACL is not applied correctly, but in reality, it filters incoming SNMP requests based on source IP.

How to eliminate wrong answers

Option B is wrong because the ACL is correctly applied to the SNMP community string via the 'snmp-server community public RO FILTER_SNMP' command, which filters incoming SNMP requests. Option C is wrong because the 'RO' keyword explicitly grants read-only access, not read-write (RW). Option D is wrong because the ACL is applied to incoming SNMP requests, not outbound responses; standard ACLs on SNMP communities filter the source of the request, not the direction of the response.

Full explanation →
1202
MCQhard

R1 and R2 are eBGP peers. R1 advertises a prefix 172.16.1.0/24 with AS_PATH 65001 65002. R2 receives the prefix and its BGP table shows AS_PATH 65001 65002. R2 has a route-map applied inbound that sets local-preference 150 for routes with AS_PATH containing 65002. R2 also has another eBGP peer R3 that advertises the same prefix with AS_PATH 65001 65003. R2's BGP best path selection chooses the path via R3 because of shorter AS_PATH length (2 vs 3). However, the network engineer expects the path via R1 to be preferred due to the higher local-preference. What is the root cause?

A.The route-map applied inbound on R2 from R1 has a match ip address prefix-list that does not include 172.16.1.0/24, so local-preference is not set.
B.AS_PATH length is always preferred over local-preference in BGP best path selection.
C.The route-map should be applied outbound on R1 instead.
D.R2's BGP table shows the local-preference as 150 for the path via R1, but the best path selection ignores it due to a bug.
AnswerA

If the match condition fails, the set commands are not executed, and the default local-preference (100) applies.

Why this answer

Local-preference is evaluated before AS_PATH length in BGP best path selection. If the local-preference is set to 150 on the path via R1, it should be preferred over the path via R3 (which likely has default local-preference 100). The fact that R2 chooses R3 indicates that the local-preference was not applied correctly.

The root cause is that the route-map is applied inbound on R2 from R1, but the route-map may have a match clause that does not match the prefix, or the set local-preference command is missing. In this scenario, the route-map is applied but the set local-preference is not executed because the match condition fails (e.g., match ip address prefix-list that does not include 172.16.1.0/24).

Full explanation →
1203
MCQmedium

In MPLS L3VPN, which LSA type is used by OSPF to advertise prefix information from a PE router into a customer VRF instance?

A.Type 1 (Router LSA)
B.Type 2 (Network LSA)
C.Type 3 (Summary LSA)
D.Type 5 (External LSA)
AnswerC

Correct. PE routers inject VPN routes as Type 3 LSAs into the customer OSPF domain.

Why this answer

When OSPF is used as the PE-CE protocol, the PE router redistributes VPN routes into OSPF as Type 3 LSAs (Summary LSAs) by default, unless the 'capability vrf-lite' command is configured.

Full explanation →
1204
MCQhard

A router configured as a DHCPv4 server uses a pool with 'bootfile' and 'next-server' options for PXE boot. Clients receive the DHCP offer with the correct bootfile, but they fail to download it. Which is the most likely explanation?

A.The 'next-server' is configured with a hostname, but the client does not have DNS resolution capabilities at boot time.
B.The 'bootfile' name is case-sensitive, and the client is requesting a different case.
C.The DHCP server is not configured with the 'option 150' for TFTP server.
D.The client's subnet does not have a route to the TFTP server, but the DHCP server cannot control that.
AnswerA

Correct: PXE clients typically cannot resolve hostnames; they need an IP address in the 'next-server' field.

Why this answer

During PXE boot, the client does not yet have an IP address or DNS resolver configured. When the DHCP server specifies a hostname in the 'next-server' option, the client cannot resolve that hostname to an IP address to initiate the TFTP download. The client requires the TFTP server's IP address directly, not a DNS name, at this stage of the boot process.

Exam trap

Cisco often tests the distinction between hostname and IP address in DHCP options, where candidates assume DNS is available during PXE boot, but the client's firmware lacks DNS resolution at that stage.

How to eliminate wrong answers

Option B is wrong because the 'bootfile' name is case-sensitive on the TFTP server, but the client requests the exact filename provided in the DHCP offer; the issue is not about case mismatch but about the inability to reach the server. Option C is wrong because 'option 150' is a Cisco-specific option for TFTP server address in VoIP deployments, not for PXE boot; PXE boot uses the standard 'next-server' (siaddr) field and 'bootfile' option. Option D is wrong because while a missing route could cause the failure, the DHCP server can control the TFTP server address via the 'next-server' option, and the question states the client receives the correct bootfile, implying the DHCP server is functioning; the core issue is the client's inability to resolve the hostname, not routing.

Full explanation →
1205
MCQhard

A network engineer runs the following command to troubleshoot Flexible NetFlow cache usage: R1# show flow monitor FLOW-MONITOR-1 statistics Cache type: Normal Cache size: 1000 Current entries: 900 High Watermark: 950 Flows added: 50000 Flows aged: 49100 - Active timeout ( 1800 secs): 40000 - Inactive timeout ( 15 secs): 9000 - Event aged: 100 - Watermark aged: 0 - Emergency aged: 0 What does this output indicate?

A.The cache is mostly empty and flows are aging normally.
B.The cache is nearly full, with many long-lived flows causing active timeout aging. No watermark or emergency aging has occurred yet.
C.Emergency aging is occurring because the cache is full.
D.Watermark aging has occurred, indicating the cache size needs to be increased.
AnswerB

900 entries used out of 1000, and 40000 flows aged due to active timeout, indicating long flows. Watermark and emergency aging counters are zero.

Why this answer

The cache is nearly full (900 out of 1000 entries). The high watermark is 950, which is close to the cache size. Most flows are aged due to active timeout (40000), indicating long-lived flows.

The cache is under pressure but not yet experiencing watermark or emergency aging.

Full explanation →
1206
MCQeasy

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show crypto ipsec transform-set Transform set combined-des-sha: { esp-des esp-sha-hmac } will negotiate = { Tunnel, }, Transform set myset: { esp-3des esp-sha-hmac } will negotiate = { Tunnel, }, Transform set strong: { esp-aes 256 esp-sha-hmac } will negotiate = { Tunnel, }, What does this output indicate?

A.All transform sets are using strong encryption and are acceptable for production.
B.The transform set 'combined-des-sha' uses DES, which is not recommended due to security vulnerabilities.
C.The transform sets are not configured correctly because they do not specify the mode.
D.The transform set 'strong' is not supported because it uses AES 256.
AnswerB

DES is deprecated and insecure; AES should be used instead.

Why this answer

The output shows three transform sets, including 'combined-des-sha', which uses DES (Data Encryption Standard) with a 56-bit key. DES is considered cryptographically weak and has been deprecated due to known vulnerabilities, such as susceptibility to brute-force attacks. Cisco recommends using AES or 3DES as a minimum for production IPsec VPNs, making option B correct.

Exam trap

Cisco often tests the candidate's awareness of deprecated or weak cryptographic algorithms (like DES) versus strong ones (like AES), and the trap here is assuming that all listed transform sets are equally valid or that the missing mode keyword indicates a misconfiguration.

How to eliminate wrong answers

Option A is wrong because not all transform sets use strong encryption; 'combined-des-sha' uses DES, which is insecure and not recommended for production. Option C is wrong because the transform sets do specify the mode implicitly; the output shows 'will negotiate = { Tunnel, }', indicating that the default tunnel mode is used, and the configuration is valid without explicitly stating the mode in the output. Option D is wrong because AES 256 is fully supported by Cisco IOS and is a strong, recommended encryption algorithm for IPsec.

Full explanation →
1207
MCQeasy

What is the default OSPF dead interval on a point-to-point network when the hello interval is set to 10 seconds?

A.10 seconds
B.20 seconds
C.30 seconds
D.40 seconds
AnswerD

Correct: OSPF dead interval defaults to 4 times the hello interval (4 x 10 = 40 seconds).

Why this answer

The default OSPF dead interval is four times the hello interval. On a point-to-point network, the default hello interval is 10 seconds, so the dead interval defaults to 40 seconds. This relationship is defined in RFC 2328 and is not configurable independently unless explicitly overridden.

Exam trap

Cisco often tests the 4x multiplier rule, and the trap here is that candidates mistakenly think the dead interval equals the hello interval or use a 2x or 3x multiplier, confusing OSPF timers with other protocols like EIGRP or forgetting the default values for different network types.

How to eliminate wrong answers

Option A is wrong because 10 seconds equals the hello interval, but the dead interval must be a multiple (typically 4x) to allow for hello packet loss before declaring a neighbor down. Option B is wrong because 20 seconds is only 2x the hello interval, which is not the default multiplier; Cisco OSPF uses a 4x multiplier by default. Option C is wrong because 30 seconds is 3x the hello interval, but the standard default dead interval is 4x the hello interval, not 3x.

Full explanation →
1208
MCQmedium

Analyze the following partial configuration: access-list 101 permit tcp any any eq 179 access-list 101 permit udp any any eq 646 access-list 101 permit ospf any any ! class-map match-all COPP-BGP match access-group 101 ! policy-map COPP-POLICY class COPP-BGP police 48000 conform-action transmit exceed-action drop class class-default police 128000 conform-action transmit exceed-action drop ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ! control-plane service-policy input COPP-POLICY Which statement is true?

A.The ACL matches OSPF, BGP, and LDP traffic, and all are rate-limited to 48000 bps.
B.The ACL is missing 'permit eigrp any any' to include EIGRP traffic.
C.The class-map must use 'match-all' to match all protocols simultaneously, but the ACL uses 'permit' which is OR logic, so the class-map will not work.
D.The policy-map should be applied to the interface, not the control-plane.
AnswerA

Correct. The ACL permits OSPF (protocol 89), BGP (TCP 179), and LDP (UDP 646). The class-map matches all three and applies the 48000 bps policer.

Why this answer

The ACL permits TCP port 179 (BGP), UDP port 646 (LDP), and OSPF (protocol 89). The class-map COPP-BGP matches all three protocols via the match-all keyword, and the policy-map applies a police rate of 48000 bps to this class. Since the policy is applied to the control-plane input, all matched traffic (BGP, LDP, OSPF) is rate-limited to 48000 bps.

Exam trap

Cisco often tests the misconception that 'match-all' in a class-map requires all protocols in the ACL to be matched simultaneously, but in reality, 'match-all' applies to the match statements within the class-map, not to the individual entries within the referenced ACL.

How to eliminate wrong answers

Option B is wrong because EIGRP is not included in the ACL, but the question does not require EIGRP; the ACL is intentionally limited to BGP, LDP, and OSPF, and the statement about missing EIGRP is irrelevant to the correctness of the configuration. Option C is wrong because the class-map uses 'match-all' correctly—it requires all match criteria to be met, but since there is only one match (match access-group 101), the 'match-all' behaves the same as 'match-any'; the ACL's 'permit' statements are OR logic within the ACL itself, but the class-map only references the entire ACL, so the class-map works as intended. Option D is wrong because CoPP is specifically designed to be applied to the control-plane, not to an interface; applying it to an interface would police all traffic, not just traffic destined to the control plane.

Full explanation →
1209
MCQmedium

A network engineer is troubleshooting an IPsec site-to-site VPN between two routers. The tunnel interface is up/up, but traffic from the local LAN to the remote LAN is not passing. The engineer checks the crypto map and sees it is applied to the outside interface. What is the most likely cause of the traffic failure?

A.The crypto map is not applied to the tunnel interface.
B.The access list in the crypto map does not match the LAN-to-LAN traffic.
C.The IPsec transform set is missing the esp-aes encryption algorithm.
D.The IKE phase 1 proposal is mismatched between the two routers.
AnswerB

Correct because the crypto map uses an access list to define which traffic is encrypted; if it does not match the actual LAN subnets, traffic will be sent unencrypted and may be dropped by the remote router.

Why this answer

The tunnel interface being up/up indicates the GRE tunnel is operational, but traffic may still fail if the crypto map is not correctly triggering IPsec encryption for the actual data traffic. The most common cause is a missing or incorrect access list in the crypto map that defines interesting traffic.

Full explanation →
1210
MCQmedium

Which statement correctly describes the behavior of the 'subnets' keyword when redistributing into OSPF?

A.It causes OSPF to redistribute only classful network routes.
B.It allows OSPF to redistribute subnetted routes in addition to classful networks.
C.It changes the metric of redistributed routes to the interface cost.
D.It is required only when redistributing BGP routes into OSPF.
AnswerB

The 'subnets' keyword enables redistribution of routes with subnet masks, ensuring all prefixes are advertised.

Why this answer

Without the 'subnets' keyword, OSPF redistributes only classful network routes; the 'subnets' keyword allows redistribution of subnetted routes, which is essential for proper routing.

Full explanation →
1211
MCQeasy

In IPsec site-to-site VPN, what is the purpose of the 'match address' command under a crypto map?

A.It specifies the peer IP address for the tunnel.
B.It defines the encryption and authentication algorithms.
C.It identifies the traffic that will be encrypted and sent through the tunnel.
D.It sets the lifetime for the IPsec SA.
AnswerC

The ACL defines interesting traffic; only that traffic is protected.

Why this answer

The 'match address' command under a crypto map references an access list (ACL) that defines which traffic should be protected by IPsec. When a packet matches a permit entry in that ACL, it triggers the IPsec process to encrypt and tunnel the traffic to the remote peer. This is the fundamental mechanism for selecting interesting traffic in a site-to-site VPN.

Exam trap

Cisco often tests the distinction between 'match address' (traffic selection) and 'set peer' (tunnel endpoint), leading candidates to confuse the purpose of these two commands under a crypto map.

How to eliminate wrong answers

Option A is wrong because the peer IP address for the tunnel is specified using the 'set peer' command under the crypto map, not 'match address'. Option B is wrong because encryption and authentication algorithms are defined using the 'set transform-set' command, which references an IPsec transform set. Option D is wrong because the lifetime for the IPsec SA is set using the 'set security-association lifetime' command, either globally or under the crypto map, not by 'match address'.

Full explanation →
1212
MCQhard

What is the default OSPF network type for a serial interface configured with HDLC encapsulation on Cisco routers?

A.Broadcast
B.Non-broadcast (NBMA)
C.Point-to-point
D.Point-to-multipoint
AnswerC

Correct: Serial HDLC defaults to point-to-point, enabling faster convergence without DR/BDR election.

Why this answer

On Cisco routers, a serial interface using HDLC encapsulation defaults to the OSPF network type point-to-point. This is because HDLC is a synchronous framing protocol that inherently implies a direct, single-neighbor link, so OSPF automatically sets the network type to point-to-point, which requires no DR/BDR election and uses multicast Hello packets (224.0.0.5).

Exam trap

The trap here is that candidates often confuse the default OSPF network type for serial interfaces with the default for Ethernet (broadcast) or Frame Relay (NBMA), forgetting that HDLC encapsulation forces a point-to-point OSPF network type.

How to eliminate wrong answers

Option A is wrong because broadcast network type is the default for Ethernet interfaces (e.g., GigabitEthernet), not for serial interfaces with HDLC; broadcast expects multi-access capabilities like ARP and DR/BDR election. Option B is wrong because non-broadcast (NBMA) is the default for Frame Relay or ATM interfaces, where neighbors must be statically configured and DR/BDR election occurs; HDLC does not use NBMA. Option D is wrong because point-to-multipoint is a non-default OSPF network type used for hub-and-spoke topologies (e.g., Frame Relay with subinterfaces) and requires manual configuration; it is never assigned automatically to a serial HDLC link.

Full explanation →
1213
MCQhard

A VRF-aware network has VRF BLUE on routers R1 and R2. Routes are leaked between VRF BLUE and the global table on R1 using route-replicate. R2 shows: 'show ip route vrf BLUE' includes a route 10.10.10.0/24 learned via OSPF, but 'show ip route' (global) on R1 does not include this route. R1 configuration: ip vrf BLUE, rd 100:1, route-target export 100:1, route-target import 100:1, and 'route-replicate from vrf BLUE to global unicast 10.10.10.0 255.255.255.0'. What is the root cause?

A.The 'route-replicate' command is not configured under the VRF, so it does not take effect; it must be placed under 'ip vrf BLUE'.
B.The OSPF route in VRF BLUE has a tag that prevents it from being leaked.
C.The route 10.10.10.0/24 is not in the VRF BLUE table on R1 because it is learned via R2.
D.The route-replicate command requires a route-map to specify the prefix, but none is provided.
AnswerA

The route-replicate command is a subcommand of the VRF configuration; if entered in global configuration mode, it is ignored or causes an error.

Why this answer

The 'route-replicate' command must be configured under the VRF configuration mode (i.e., 'ip vrf BLUE') to take effect. In the given scenario, it was likely applied in global configuration mode, which is incorrect. Without proper placement, the route replication does not occur, so the 10.10.10.0/24 route remains only in the VRF BLUE table on R1 and is not copied to the global routing table.

Exam trap

Cisco often tests the exact placement of VRF-related commands, and the trap here is that candidates assume 'route-replicate' is a global command like 'router ospf', when in fact it must be nested under the VRF configuration.

How to eliminate wrong answers

Option B is wrong because OSPF route tags do not inherently block route-replicate; unless a route-map explicitly filters based on tags, the tag alone does not prevent leaking. Option C is wrong because the route 10.10.10.0/24 is present in the VRF BLUE table on R1 (as shown by R2's output), and route-replicate operates on the local VRF table regardless of where the route was learned. Option D is wrong because the 'route-replicate' command can specify a prefix directly without requiring a route-map; a route-map is optional for more granular filtering.

Full explanation →
1214
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 interface tunnel 0 Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::A8BB:CCFF:FE00:1 No global unicast address is configured Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:1 MTU is 1480 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ICMP unreachables are sent ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfiguration for addresses. Based on this output, what is a likely problem?

A.The tunnel interface is down.
B.The tunnel is not configured with a global IPv6 address, which may prevent routing of IPv6 traffic.
C.The MTU is too small for IPv6.
D.IPv6 is not enabled on the tunnel.
AnswerB

No global unicast address means the tunnel cannot be used for IPv6 routing beyond link-local.

Why this answer

The output shows that the tunnel interface has no global unicast address configured, only a link-local address. Without a global IPv6 address, the router cannot route IPv6 traffic beyond the local link, as global reachability requires a globally routable address. This is a common misconfiguration in IPv6 tunneling scenarios where the tunnel source and destination are set but the interface itself lacks a global IPv6 address.

Exam trap

Cisco often tests the misconception that a link-local address alone is sufficient for IPv6 routing, but in fact, global unicast addresses are required for traffic to be routable beyond the local segment.

How to eliminate wrong answers

Option A is wrong because the output clearly states 'Tunnel0 is up, line protocol is up', so the interface is not down. Option C is wrong because the MTU of 1480 bytes is typical for IPv6 tunnels (e.g., GRE or IPv6-in-IPv4) and is not too small; IPv6 requires a minimum MTU of 1280 bytes, so 1480 is sufficient. Option D is wrong because the output explicitly says 'IPv6 is enabled' and shows the link-local address and joined multicast groups, confirming IPv6 is operational on the tunnel.

Full explanation →
1215
MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show ip bgp 10.0.0.0/16 BGP routing table entry for 10.0.0.0/16, version 2 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local, (aggregated by 65000 1.1.1.1) 10.1.1.2 from 10.1.1.2 (2.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best Atomic-aggregate What does this output indicate?

A.The route 10.0.0.0/16 is an aggregate route, and the atomic-aggregate attribute indicates that the AS path may be incomplete.
B.The route is a normal BGP learned route without summarization.
C.The route is suppressed and not advertised to neighbors.
D.The route is learned via redistribution from OSPF.
AnswerA

The 'aggregated' keyword and 'Atomic-aggregate' attribute confirm this is a summary route with potential AS path loss.

Why this answer

This output shows the BGP table entry for prefix 10.0.0.0/16. The path is marked as 'aggregated', indicating it is a summary route. The 'Atomic-aggregate' attribute suggests that the route is an aggregate and may have lost some AS path information.

Full explanation →
1216
MCQmedium

A network engineer runs the following command to verify IPv6 access-list hits: R1# show ipv6 access-list FILTER | include matches permit ipv6 2001:DB8:1::/48 any sequence 10 (10 matches) deny ipv6 2001:DB8:2::/48 any sequence 20 (5 matches) permit ipv6 any any sequence 30 (100 matches) What does this output indicate?

A.5 packets from 2001:DB8:2::/48 have been denied, and 110 packets have been permitted.
B.All packets from 2001:DB8:2::/48 have been permitted.
C.The access list has been applied to an interface but not used.
D.The access list is invalid because of the order of entries.
AnswerA

Correct. 5 matches on the deny entry, and 10+100=110 matches on permit entries.

Why this answer

The output shows the hit counts for each ACL entry: sequence 10 has permitted 10 packets from 2001:DB8:1::/48, sequence 30 has permitted 100 packets from any source, and sequence 20 has denied 5 packets from 2001:DB8:2::/48. The total permitted packets are 10 + 100 = 110, and the denied count is 5, matching the statement in A.

Exam trap

Cisco often tests the misconception that hit counts on a deny entry mean the traffic was permitted, but in reality, the hit count indicates how many packets matched that deny rule and were dropped.

How to eliminate wrong answers

Option B is wrong because the hit count of 5 on the deny entry (sequence 20) indicates that packets from 2001:DB8:2::/48 were explicitly denied, not permitted. Option C is wrong because the non-zero hit counts (10, 5, 100) prove the ACL has been actively used on an interface, not just applied without traffic. Option D is wrong because the order of entries is valid: the more specific permit for 2001:DB8:1::/48 comes first, followed by a deny for 2001:DB8:2::/48, and a catch-all permit at the end; this is a standard and correct ACL design.

Full explanation →
1217
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- R1# show ip nat statistics Total active translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 10 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 2 map-id 1 [Id] ip nat inside source list ACL1 pool POOL1 refcount 2 Based on this output, what is the problem?

A.NAT translations exist but no packets are being translated (0 hits), indicating a possible routing or ACL issue.
B.The NAT pool is exhausted.
C.PAT is enabled but not working.
D.The inside and outside interfaces are reversed.
AnswerA

The 0 hits with 10 misses suggest that translations are created but no successful data flow; packets are missing or not returning.

Why this answer

The output shows two dynamic NAT translations (192.0.2.10→10.0.0.10 and 192.0.2.11→10.0.0.11) but zero hits, meaning no packets have been translated. The misses counter is 10, indicating that packets arrived but failed to match the translation. This typically occurs when the access control list (ACL1) does not permit the source traffic, or the routing path does not direct traffic through the NAT inside interface, preventing the translation from being used.

Exam trap

Cisco often tests the distinction between 'Hits' and 'Misses' in NAT statistics — the trap here is that candidates see existing translations and assume NAT is working, but the zero hits indicate no actual traffic has been translated, pointing to an ACL or routing problem rather than pool exhaustion or interface reversal.

How to eliminate wrong answers

Option B is wrong because the NAT pool POOL1 has addresses 192.0.2.10 through 192.0.2.20 (netmask 255.255.255.240, which provides 14 usable addresses), and only two addresses are currently allocated, so the pool is far from exhausted. Option C is wrong because the output shows dynamic NAT (not PAT) — the translations are '---' for protocol and no port numbers are listed, indicating standard one-to-one NAT, and there is no evidence that PAT is configured or failing. Option D is wrong because the 'show ip nat statistics' explicitly lists 'Outside interfaces: GigabitEthernet0/1' and 'Inside interfaces: GigabitEthernet0/0', which are correctly assigned; reversed interfaces would typically cause translations to fail entirely or show different symptoms like no translations at all.

Full explanation →
1218
MCQmedium

What is the default LDP keepalive timer value on Cisco IOS-XE routers?

A.180 seconds
B.120 seconds
C.60 seconds
D.300 seconds
AnswerA

The default LDP keepalive timer is 180 seconds.

Why this answer

The default LDP keepalive timer is 180 seconds, which is used to maintain the LDP session if no other messages are exchanged.

Full explanation →
1219
MCQmedium

A network engineer is troubleshooting a DMVPN phase 2 network where the hub router is not learning the loopback interface routes from the spokes via EIGRP. The spokes have EIGRP configured on the tunnel interface and are advertising their loopback0 interface. The hub's EIGRP neighbor relationship with the spokes is established. However, the hub's routing table does not contain the loopback routes. The engineer checks the spoke's EIGRP configuration and sees that the loopback interface is not included in any network statement. What is the most likely cause?

A.The spoke's EIGRP network statement does not include the loopback subnet.
B.The hub's EIGRP is configured with a distribute-list that filters the loopback routes.
C.The tunnel interface on the spoke has 'no ip split-horizon' configured.
D.The loopback interface on the spoke is in a different VRF than the tunnel interface.
AnswerA

Correct because EIGRP must have a network statement that matches the loopback subnet to advertise it.

Why this answer

EIGRP only advertises networks that are included in a network statement or configured under the EIGRP process. If the loopback interface is not included in a network statement, EIGRP will not advertise it.

Full explanation →
1220
MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto map Crypto Map "VPN-MAP" 10 ipsec-isakmp Peer = 10.1.1.2 Extended IP access list 100 access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255 Current peer: 10.1.1.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ESP-AES256-SHA,} Interfaces using crypto map VPN-MAP: Tunnel0 Based on this output, which statement is correct?

A.The crypto map is applied to interface Tunnel0 and uses ACL 100 to define interesting traffic.
B.Perfect Forward Secrecy (PFS) is enabled.
C.The crypto map uses dynamic IPsec peer discovery.
D.The crypto map is not applied to any interface.
AnswerA

The output shows Tunnel0 uses this crypto map and ACL 100 defines the traffic.

Why this answer

The crypto map is applied to Tunnel0 and uses ACL 100 to match traffic from 10.1.1.0/24 to 192.168.1.0/24. This is a typical site-to-site VPN configuration.

Full explanation →
1221
Multi-Selecthard

An engineer must configure a Cisco IOS router to log messages to a syslog server at 192.168.1.100 with a severity level of 3 (errors) and above, while also ensuring that console messages are limited to severity 5 (notifications) and above. Which TWO configuration changes are required? (Choose TWO.)

Select 2 answers
A.Configure 'logging host 192.168.1.100' and 'logging trap errors'.
B.Configure 'logging console debugging' to ensure all messages are seen on console.
C.Configure 'logging console notifications'.
D.Configure 'logging buffered errors' to store logs locally.
E.Configure 'logging source-interface Loopback0' to use a specific source IP.
AnswersA, C

Correct. 'logging host 192.168.1.100' specifies the syslog server, and 'logging trap errors' sets the global trap severity to errors (level 3), so messages of severity 3 and higher are sent.

Why this answer

'logging host 192.168.1.100' specifies the syslog server, and 'logging trap errors' sets the severity level for syslog messages to 3 (errors) and above. This ensures only messages with severity 0–3 are sent to the server. Option C is correct because 'logging console notifications' limits console output to severity 5 (notifications) and above, which includes severities 0–5, meeting the requirement.

Exam trap

Cisco often tests the distinction between 'logging trap' (for syslog server) and 'logging console' (for console output), and candidates may confuse 'logging console debugging' as a way to limit messages when it actually enables all messages.

Full explanation →
1222
MCQhard

What is the default behavior for an IPv4 ACL applied to an outbound interface when the packet is generated by the router itself (e.g., ping from the router)?

A.The outbound ACL filters the packet normally.
B.The packet bypasses the outbound ACL and is forwarded directly.
C.The packet is dropped by the implicit deny.
D.The ACL is applied only if the packet matches a permit statement.
AnswerB

Locally generated packets are not subject to outbound ACL filtering.

Why this answer

When a router generates a packet (e.g., from a ping sourced from its own IP address), the packet is not subject to outbound ACL filtering. Instead, it is forwarded directly out the interface because the ACL is applied only to packets that are routed through the router, not to locally generated traffic. This behavior is consistent with Cisco IOS, where outbound ACLs inspect packets entering the router from another interface, not those originating from the router itself.

Exam trap

Cisco often tests the misconception that outbound ACLs apply to all traffic leaving an interface, including locally generated packets, leading candidates to incorrectly select Option A or C.

How to eliminate wrong answers

Option A is wrong because outbound ACLs do not filter locally generated packets; they only filter packets that are routed through the router from another interface. Option C is wrong because the implicit deny at the end of an ACL applies only to packets that are actually processed by the ACL; locally generated packets bypass the ACL entirely, so they are not dropped by the implicit deny. Option D is wrong because the ACL is not applied at all to locally generated packets, regardless of whether they match a permit statement; the packet is forwarded without ACL inspection.

Full explanation →
1223
MCQmedium

Which of the following is the correct formula for EIGRP composite metric calculation using default K values?

A.metric = bandwidth + delay
B.metric = bandwidth * delay
C.metric = bandwidth + delay + reliability
D.metric = bandwidth + delay + load
AnswerA

Correct. Default K values make the metric simply bandwidth (scaled) plus delay (scaled).

Why this answer

With default K values (K1=1, K2=0, K3=1, K4=0, K5=0), the EIGRP composite metric simplifies to metric = bandwidth + delay, where bandwidth is calculated as (10^7 / minimum path bandwidth in kbps) * 256 and delay is the sum of interface delays in tens of microseconds multiplied by 256. This formula is used to select the best loop-free path to a destination.

Exam trap

Cisco often tests the misconception that EIGRP uses a product of bandwidth and delay (like OSPF cost) or that reliability and load are included by default, when in fact they are only considered if non-default K values are configured.

How to eliminate wrong answers

Option B is wrong because EIGRP does not multiply bandwidth and delay; the metric is a sum, not a product, even with non-default K values. Option C is wrong because reliability (K2) is not included by default; its K value is 0, so it is omitted from the calculation. Option D is wrong because load (K4) is also not included by default; its K value is 0, so it does not contribute to the metric.

Full explanation →
1224
MCQhard

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are established, but traffic between spokes is intermittently dropped. The engineer captures packets and sees that IPsec packets are being fragmented. The tunnel interface MTU is set to 1400 bytes, and the physical interface MTU is 1500 bytes. The engineer also notices that the IPsec transform set uses ESP with AES-256 and SHA-256. What is the most likely cause of the intermittent drops?

A.The IPsec transform set uses AES-256, which requires more CPU and causes performance drops.
B.The tunnel MTU is set too high for the IPsec overhead, causing fragmentation and potential drops.
C.The physical interface MTU is set to 1500, which is too high for DMVPN.
D.The spokes have different IPsec transform sets configured.
AnswerB

Correct because the tunnel MTU of 1400 bytes does not account for IPsec overhead, leading to fragmentation and drops.

Why this answer

IPsec adds overhead (ESP header, trailer, and authentication data). With AES-256 and SHA-256, the overhead can be around 50-60 bytes. If the tunnel MTU is set to 1400, the effective payload MTU is lower.

Fragmentation can cause drops if the DF bit is set or if intermediate routers drop fragments. The issue is that the tunnel MTU is too high for the IPsec overhead, causing fragmentation.

Full explanation →
1225
MCQmedium

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# debug eigrp packets hello *Mar 1 00:05:23.123: EIGRP: received packet with MD5 authentication, key id = 1 *Mar 1 00:05:23.123: EIGRP: int GigabitEthernet0/0, src 10.1.1.2 dst 224.0.0.10, seq 0, ttl 1, opcode = 1 (Hello) *Mar 1 00:05:23.123: EIGRP: authentication failed for packet from 10.1.1.2, key id = 1, integrity check failed What does this output indicate?

A.The EIGRP neighbor relationship is up, but authentication is failing intermittently.
B.The MD5 key ID or key string does not match between R1 and 10.1.1.2, preventing neighbor formation.
C.EIGRP is using plain-text authentication and the key is incorrect.
D.The neighbor 10.1.1.2 is not configured for EIGRP authentication.
AnswerB

The integrity check failure indicates a key mismatch, which blocks neighbor adjacency.

Why this answer

The debug output shows an EIGRP packet with MD5 authentication was received from 10.1.1.2, but the integrity check failed. This indicates that the MD5 key ID or key string configured on R1 does not match the one on the neighbor, which prevents the neighbor relationship from forming. The 'integrity check failed' message is a definitive sign of an authentication mismatch, not an intermittent issue.

Exam trap

Cisco often tests the distinction between authentication failure due to a mismatch (which prevents neighbor formation) versus intermittent packet loss or misconfiguration of the authentication mode (e.g., confusing MD5 with plain-text).

How to eliminate wrong answers

Option A is wrong because the neighbor relationship cannot be up if authentication fails; the 'integrity check failed' message means the packet is discarded, so no adjacency is established. Option C is wrong because the debug output explicitly states 'MD5 authentication', not plain-text authentication, and the failure is due to an integrity check, not a plain-text key mismatch. Option D is wrong because the debug output shows that the neighbor 10.1.1.2 is sending packets with MD5 authentication (key id = 1), so it is configured for EIGRP authentication; the issue is a mismatch between the two devices.

Full explanation →
1226
Multi-Selecthard

Which THREE commands can be used to verify the operation and effectiveness of a CoPP policy on a Cisco IOS router? (Choose THREE.)

Select 3 answers
A.show policy-map control-plane
B.show control-plane
C.show access-lists
D.show ip route
E.show interfaces
AnswersA, B, C

Correct. This command displays the CoPP policy and per-class packet/drop statistics.

Why this answer

The 'show policy-map control-plane' command displays the applied policy map for the control plane, including class maps, match criteria, and action statistics (e.g., packets dropped or permitted). This directly verifies that the CoPP policy is active and how it is treating traffic.

Exam trap

Cisco often tests that candidates confuse general show commands (like 'show interfaces' or 'show ip route') with CoPP-specific verification commands, expecting you to know that only commands referencing 'control-plane' or the policy-map applied to it provide direct verification.

Full explanation →
1227
MCQhard

An engineer configures a distribute-list on an OSPF router to filter routes. However, the routes are still being advertised to neighbors. Which is the most likely explanation?

A.The distribute-list filters routes in the routing table, not the LSAs sent in OSPF updates.
B.The distribute-list is applied to the wrong interface.
C.The distribute-list uses an incorrect prefix-list.
D.The OSPF process needs to be restarted for the distribute-list to take effect.
AnswerA

Distribute-lists in OSPF only control which routes are installed in the local routing table, not which LSAs are advertised.

Why this answer

A distribute-list in OSPF filters routes in the inbound or outbound direction of the routing table, but it does not filter the actual LSA advertisements. OSPF uses LSAs to propagate routes; filtering with distribute-list only affects the local routing table, not the LSAs sent to neighbors.

Full explanation →
1228
Multi-Selecthard

Which TWO statements about DHCPv6 stateless autoconfiguration (SLAAC) are true? (Choose TWO.)

Select 2 answers
A.SLAAC requires the 'A' flag to be set in Router Advertisements.
B.When using SLAAC, DHCPv6 can still be used to provide DNS server information.
C.The 'M' flag in Router Advertisements must be set for SLAAC to operate.
D.The command 'ipv6 nd other-config-flag' sets the 'M' flag in Router Advertisements.
E.SLAAC can only be used on Ethernet interfaces.
AnswersA, B

Correct. The 'A' (autonomous) flag in the RA prefix information option indicates that hosts can use SLAAC to generate addresses from that prefix.

Why this answer

SLAAC (Stateless Address Autoconfiguration) requires the 'A' (Autonomous) flag to be set in Router Advertisements (RAs). This flag tells hosts to generate their own IPv6 address using the prefix in the RA and an interface identifier (e.g., EUI-64 or privacy extension). Without the 'A' flag, hosts will not perform address autoconfiguration via SLAAC.

Exam trap

Cisco often tests the confusion between the 'M' (Managed) flag and the 'O' (Other Configuration) flag, as well as the misconception that SLAAC requires DHCPv6 or is restricted to specific interface types, leading candidates to incorrectly select options C or E.

Full explanation →
1229
MCQeasy

Which EIGRP packet type is used to acknowledge receipt of a reliable packet?

A.Hello
B.Update
C.Reply
D.Ack
AnswerD

Correct. The Ack packet is an empty packet used to confirm receipt of reliable packets.

Why this answer

D is correct because the EIGRP Ack (Acknowledgement) packet is a special packet used exclusively to confirm the reliable delivery of EIGRP packets such as Update, Query, and Reply. Ack packets are sent as unicast to the source router and contain no data, serving only as a delivery confirmation. This mechanism ensures that EIGRP's Reliable Transport Protocol (RTP) can guarantee ordered and guaranteed delivery of critical routing information.

Exam trap

Cisco often tests the distinction between packet types that are sent reliably versus unreliably, and the trap here is that candidates confuse the Reply packet (which is a response to a Query) with an acknowledgment, when in fact Reply packets are data-carrying reliable packets that themselves require an Ack.

How to eliminate wrong answers

Option A is wrong because Hello packets are used for neighbor discovery and maintenance, not for acknowledging reliable packets; they are sent unreliably (multicast) and do not confirm receipt of any specific packet. Option B is wrong because Update packets carry routing information and are themselves sent reliably, requiring an Ack in response; they do not serve as acknowledgments. Option C is wrong because Reply packets are sent in response to Query packets during route computation and are also sent reliably, requiring their own acknowledgment; they do not function as generic acknowledgments.

Full explanation →
1230
MCQhard

An engineer configures IPsec between two PE routers in an MPLS L3VPN using a site-to-site VPN. The engineer configures a transform-set with ESP encryption (AES-256) and ESP authentication (SHA-256). The engineer also configures an ACL to define interesting traffic. The VPN tunnel comes up, but no traffic is encrypted. The engineer verifies that the ACL is correct and that the crypto map is applied to the interface. What is the most likely explanation?

A.The ACL for interesting traffic is not mirrored on the remote router; it only permits traffic in one direction.
B.The transform-set uses AES-256, which is not supported on the remote router.
C.The 'crypto map' is applied to the wrong interface, such as the loopback instead of the physical interface.
D.The 'ipsec-over-tcp' command is missing, causing the IPsec packets to be dropped.
AnswerA

Correct. IPsec requires the ACL to be mirrored on both sides; otherwise, the traffic is not considered interesting for encryption.

Why this answer

A common edge case with IPsec is that the ACL for interesting traffic must be mirrored on both sides. If the ACL on one side permits traffic from source to destination, the other side must permit traffic from destination to source. If the ACLs are not mirrored, the tunnel may come up (due to IKE) but no traffic will be encrypted because the router does not consider the traffic as interesting.

Another edge case is that the crypto map is applied to the wrong interface or that the ACL is using the wrong protocol (e.g., TCP instead of IP). However, the most likely explanation here is that the ACL is not correctly matching the traffic in both directions.

Full explanation →
1231
MCQmedium

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-IN Class-map: CoPP-EIGRP (match-all) 200 packets, 12000 bytes 5 minute offered rate 1000 bps, drop rate 0000 bps Match: access-group 150 police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 200 packets, 12000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop R1# show ip eigrp neighbors EIGRP-IPv4 neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.1.2 Gi0/0 13 00:10:00 1 200 0 5 Based on this output, which statement is correct?

A.EIGRP packets are being dropped, causing neighbor flapping.
B.EIGRP traffic is being rate-limited but no packets are dropped.
C.The police rate is set to 8000 bps.
D.The EIGRP neighbor is not established.
AnswerB

All packets are conforming and transmitted.

Why this answer

The output shows that the CoPP policy 'CoPP-IN' matches EIGRP packets (via access-group 150) and applies a police rate of 16,000 bps. The 'conformed' counter shows 200 packets transmitted, while 'exceeded' and 'violated' counters are zero, indicating no packets have been dropped. The 'show ip eigrp neighbors' output confirms the neighbor is established with an uptime of 10 minutes, so EIGRP traffic is being rate-limited but not dropped, making option B correct.

Exam trap

Cisco often tests the misconception that a police rate being applied automatically means packets are being dropped, but the key is to check the actual packet counters (conformed/exceeded/violated) to determine if drops have occurred.

How to eliminate wrong answers

Option A is wrong because the 'exceeded' and 'violated' counters are zero, meaning no EIGRP packets have been dropped, and the neighbor uptime of 10 minutes with no flapping indicates stable adjacency. Option C is wrong because the police rate is explicitly set to 16,000 bps (cir 16000 bps), not 8,000 bps. Option D is wrong because the 'show ip eigrp neighbors' output clearly shows an established neighbor (10.1.1.2, interface Gi0/0, uptime 00:10:00).

Full explanation →
1232
MCQmedium

Examine this CoPP configuration: ip access-list extended COPP-ACL permit tcp any any eq 22 permit tcp any any eq 23 permit icmp any any echo ! class-map match-all COPP-CLASS match access-group name COPP-ACL ! policy-map COPP-POLICY class COPP-CLASS police 10000 1500 1500 conform-action transmit exceed-action drop violate-action drop class class-default police 64000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY What is the effect of the police command in class COPP-CLASS?

A.Traffic is limited to 10000 bps with a burst of 1500 bytes; excess traffic is dropped.
B.Traffic is limited to 10000 bps with a burst of 3000 bytes; excess traffic is dropped.
C.The police command is invalid because it uses three parameters after the rate.
D.Traffic is limited to 10000 bps, but the burst values are ignored because they are not configured in bytes.
AnswerA

Correct. The police command specifies conform rate 10000 bps, normal burst 1500, excess burst 1500. Exceed and violate actions are both drop.

Why this answer

The police command in class COPP-CLASS uses a committed information rate (CIR) of 10000 bps, a normal burst (Bc) of 1500 bytes, and an excess burst (Be) of 1500 bytes. The conform-action transmit, exceed-action drop, and violate-action drop ensure that any traffic exceeding the rate and burst limits is dropped, effectively limiting the matched traffic (SSH, Telnet, ICMP echo) to 10000 bps with a burst of 1500 bytes.

Exam trap

Cisco often tests the distinction between the normal burst (Bc) and excess burst (Be) parameters, where candidates mistakenly sum them or assume the second parameter is a time interval, leading to incorrect burst size calculations.

How to eliminate wrong answers

Option B is wrong because the burst size is 1500 bytes, not 3000 bytes; the two burst parameters (Bc and Be) are both set to 1500 bytes, and they are not summed. Option C is wrong because the police command with three parameters after the rate (Bc, Be, and actions) is valid in Cisco IOS; the syntax police rate bps [burst-normal] [burst-excess] conform-action action exceed-action action violate-action action is correct. Option D is wrong because the burst values are explicitly configured in bytes (1500 and 1500) and are not ignored; Cisco police command burst parameters are always in bytes by default.

Full explanation →
1233
MCQmedium

What is the default action for a CoPP policy-map class that does not have an explicit 'police' command?

A.Drop all packets in that class
B.Transmit all packets in that class
C.Log all packets in that class
D.Apply the default aggregate policer
AnswerB

The default action for a class without a police statement is to permit and transmit all matching traffic.

Why this answer

In Control Plane Policing (CoPP), if a class within a policy-map does not contain an explicit 'police' command, the default action is to transmit all packets matching that class. This is because CoPP operates on a permit-by-default model; only classes with a configured policer will have traffic rate-limited or dropped. The absence of a police action means no restriction is applied, so packets are allowed through to the control plane.

Exam trap

Cisco often tests the misconception that CoPP classes without a police command will drop traffic by default, similar to how an ACL ends with an implicit deny; the trap here is that CoPP uses a permit-by-default model for classes without explicit policing.

How to eliminate wrong answers

Option A is wrong because CoPP does not drop packets by default; dropping only occurs when a policer is configured and the traffic exceeds the specified rate. Option C is wrong because logging is not a default action in CoPP; logging must be explicitly configured using the 'log' keyword within a police action or via separate ACL logging. Option D is wrong because there is no default aggregate policer in CoPP; aggregate policers must be explicitly defined and referenced in the policy-map.

Full explanation →
1234
MCQmedium

A network engineer is troubleshooting a connectivity issue between two branches connected via a WAN link. Router R1 (10.1.0.0/16) is summarizing its directly connected subnets (10.1.1.0/24, 10.1.2.0/24, 10.1.3.0/24) as a single 10.1.0.0/16 route to Router R2 via EIGRP. Users at R2 report that they cannot reach the 10.1.4.0/24 subnet, which was recently added to R1. What is the most likely cause of the problem?

A.The summary route 10.1.0.0/16 was configured manually, and the new subnet 10.1.4.0/24 is not within the summary range because the mask is too specific.
B.The new subnet 10.1.4.0/24 was not advertised because the summary address command suppresses more specific routes, but the summary itself is not being generated due to a missing network statement under the EIGRP process.
C.The WAN link is down, causing R2 to lose the summary route.
D.The engineer forgot to configure the summary address on the interface facing R2 for the new subnet.
AnswerB

Correct. In EIGRP, a manually configured summary address suppresses the advertisement of more specific routes and generates the summary only if the component routes exist. If the new subnet is not in the EIGRP network, the summary may not be generated or the specific route is missing.

Why this answer

The summary route 10.1.0.0/16 includes the new subnet 10.1.4.0/24, but the issue indicates that the summary is not being updated or is too broad, causing a mismatch. The most likely cause is that the summary address was configured manually and does not automatically include new subnets unless the summary range is adjusted.

Full explanation →
1235
MCQmedium

A network engineer runs the following command to verify MPLS L3VPN operation: R1# show ip route vrf CUSTOMER-A summary Output: Route Source Networks Subnets Overhead Memory (bytes) connected 2 0 48 288 static 1 0 24 144 ospf 100 5 2 168 1008 bgp 65000 10 3 312 1872 External: 10, Internal: 0, Local: 0 Total 18 5 552 3312 What does this output indicate?

A.The VRF has 23 total routes
B.The VRF has 10 BGP routes
C.The VRF is using OSPF as the only IGP
D.The VRF has no external BGP routes
AnswerA

18 networks + 5 subnets = 23 total routes.

Why this answer

The show ip route vrf summary command provides a summary of routes in the VRF. It shows the number of networks and subnets from each routing source, along with overhead and memory usage. For BGP, it also breaks down external vs internal routes.

This output indicates the VRF has 18 networks and 5 subnets total, with BGP as the primary source.

Full explanation →
1236
MCQmedium

Given the following configuration: ``` interface GigabitEthernet0/2 ip access-group FILTER_SSH in ! ip access-list extended FILTER_SSH permit tcp any host 192.168.1.10 eq 22 permit udp any host 192.168.1.10 eq 22 ``` What is the issue with this ACL?

A.The ACL permits UDP port 22, which is not used by SSH; this could allow unwanted UDP traffic.
B.The ACL is missing a deny statement at the end to block other traffic.
C.The ACL should use the 'established' keyword to allow return traffic.
D.The ACL should be applied outbound instead of inbound.
AnswerA

Correct. SSH uses TCP, so the UDP permit is unnecessary and potentially risky.

Why this answer

The ACL permits both TCP and UDP traffic to destination port 22. SSH uses only TCP port 22; UDP port 22 is not used by SSH. The second permit statement allows any UDP traffic to port 22, which could be unwanted (e.g., UDP-based attacks or non-SSH services).

This is the issue.

Exam trap

Cisco often tests the misconception that SSH uses both TCP and UDP, or that permitting UDP port 22 is harmless, when in fact only TCP port 22 is valid for SSH.

How to eliminate wrong answers

Option B is wrong because an ACL implicitly denies all traffic at the end; a deny statement is not required unless you need explicit logging or a specific deny action. Option C is wrong because the 'established' keyword is used for TCP stateful filtering to allow return traffic, but this ACL is filtering inbound traffic to a specific host; return traffic would be handled by outbound ACLs or stateful inspection, and the issue here is the UDP permit. Option D is wrong because applying the ACL outbound would filter traffic leaving the interface, but the intent is to filter inbound SSH traffic to the host; inbound application is correct for this purpose.

Full explanation →
1237
Multi-Selectmedium

Which TWO commands are used to troubleshoot Control Plane Policing (CoPP) and identify which traffic is being dropped? (Choose TWO.)

Select 2 answers
A.show policy-map control-plane
B.debug policy-map control-plane
C.show control-plane host open-ports
D.show ip cache flow
E.show access-lists
AnswersA, C

This command displays packet counters for each class in the CoPP policy, including dropped (violate) packets.

Why this answer

The 'show policy-map control-plane' command displays the applied policy map on the control plane, including class maps, match criteria, and per-class statistics such as the number of packets matched and dropped. This allows you to verify which traffic is being classified and confirm that CoPP is dropping the intended packets. It is the primary verification command for CoPP.

Exam trap

Cisco often tests the distinction between commands that show CoPP configuration versus those that show actual drop statistics; the trap here is that candidates might think 'show access-lists' is sufficient because ACLs are used in class maps, but it does not show the policy-map actions or control-plane-specific drop counters.

Full explanation →
1238
MCQmedium

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

A.The syslog service on 10.1.1.200 is not running or is blocked by a firewall.
B.The router can only send to one syslog server at a time.
C.The 'logging host 10.1.1.200' command is missing the 'transport udp' keyword.
D.The second server is configured with a different severity level using 'logging trap' under the host.
AnswerA

Correct because if the server is not listening or traffic is blocked, messages will not be received even though the router sends them.

Why this answer

Cisco IOS allows multiple logging hosts, but each must be configured with a separate 'logging host' command. If the second server is not receiving messages, it may be because the 'logging trap' level for that specific host is set to a higher severity (e.g., 'logging host 10.1.1.200 trap errors') that filters out most messages, or the server is not listening. However, a common mistake is that the second host is configured with a different port or protocol that is not supported.

But the most typical cause is that the second server's syslog service is not running or is firewalled.

Full explanation →
1239
MCQmedium

Examine the following partial configuration on a Cisco IOS-XE router: interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip access-group MY_ACL in ! access-list 100 permit tcp any host 192.168.1.1 eq 22 access-list 100 deny ip any any ! line vty 0 4 transport input ssh login local ! username admin privilege 15 secret cisco What is the effect of this configuration?

A.Only SSH connections to the router are permitted; all other IP traffic is denied inbound on this interface.
B.The ACL permits SSH and HTTP traffic to the router; all other traffic is denied.
C.The ACL is applied outbound, so it filters traffic leaving the interface; SSH is permitted outbound.
D.The ACL has no effect because it is missing a 'permit ip any any' statement.
AnswerA

The ACL permits TCP port 22 (SSH) and denies all other IP traffic, applied inbound. This restricts management access to SSH only.

Why this answer

The ACL 100 is applied inbound on GigabitEthernet0/1 via the 'ip access-group MY_ACL in' command. It explicitly permits TCP traffic to host 192.168.1.1 on port 22 (SSH) and then denies all other IP traffic. Since the router's own IP address is 192.168.1.1, this allows only SSH management access from any source, while blocking all other inbound traffic to the router or through the interface.

Exam trap

Cisco often tests the distinction between inbound and outbound ACL application, and candidates may mistakenly think the 'in' keyword means 'into the router' for management traffic only, or they may overlook that the ACL is applied to the interface and filters all IP traffic, not just management plane traffic.

How to eliminate wrong answers

Option B is wrong because the ACL only permits TCP port 22 (SSH); it does not include any permit statement for HTTP (port 80 or 443), so HTTP traffic is denied. Option C is wrong because the ACL is applied with the 'in' keyword, making it an inbound ACL that filters traffic entering the interface, not outbound traffic. Option D is wrong because an ACL does not require a 'permit ip any any' statement to have effect; the implicit deny at the end of the ACL already denies all traffic not explicitly permitted, and the explicit 'deny ip any any' is redundant but does not negate the ACL's functionality.

Full explanation →
1240
MCQhard

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 30 to a collector at 192.168.1.100. The router has multiple VRFs: VRF A and VRF B. The source interface Gi0/0/0 is in VRF A. The collector is in VRF B. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 2 ip address 192.168.1.100 origin ip address 10.0.0.1. The collector is reachable via a route in VRF B. The router has a route-leaking configuration between VRFs. The collector receives no traffic. What is the root cause?

A.The ERSPAN session must be configured with the 'vrf' keyword under the destination to use VRF B.
B.The source interface is in VRF A, but the ERSPAN source IP must be in the same VRF as the destination.
C.The route-leaking configuration is incorrect, preventing reachability between VRFs.
D.The ERSPAN session ID 2 conflicts with a VRF ID.
AnswerA

Without the VRF keyword, ERSPAN uses the global routing table, which lacks a route to the collector in VRF B.

Why this answer

ERSPAN uses the global routing table by default to route the encapsulated packets to the destination IP. If the source interface is in a VRF, the mirrored traffic is still sent using the global routing table unless the ERSPAN session is configured with a VRF. The destination IP 192.168.1.100 is in VRF B, but the global routing table may not have a route to it.

The route-leaking between VRFs does not affect the ERSPAN process because the encapsulated packet is sourced from the global routing table. The fix is to configure the ERSPAN session with the 'vrf' keyword under the destination to specify the VRF. Alternatively, the source IP must be in the same VRF as the destination.

The correct root cause is that the ERSPAN session does not specify the VRF, so it uses the global table, which has no route to the collector.

Full explanation →
1241
Drag & Dropmedium

Drag and drop the steps to establish an eBGP session between two IOS routers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with configuring the BGP router ID, then the local AS and neighbor remote AS, followed by specifying the neighbor update source, enabling the neighbor, and finally verifying the session.

Full explanation →
1242
MCQhard

An engineer configures IP SLA to track a route to a server in a VRF. Router R1 has: ip sla 6 icmp-echo 10.10.10.10 source-ip 192.168.1.1 frequency 10 ip sla schedule 6 life forever start-time now track 6 ip sla 6 reachability ip route vrf BLUE 0.0.0.0 0.0.0.0 192.168.1.2 track 6 But the route is never installed in the VRF routing table. Show output: show ip route vrf BLUE | include 0.0.0.0 % No default route found What is the root cause?

A.The IP SLA is not configured with the vrf BLUE option, so the probe is sent in the global table and cannot reach the server in the VRF.
B.The source IP 192.168.1.1 is not in the VRF BLUE routing table.
C.The track 6 is not supported for VRF routes.
D.The IP SLA schedule must be configured with the vrf keyword.
AnswerA

The IP SLA must be configured with 'vrf BLUE' to send probes within the VRF; otherwise, the track will not work correctly.

Why this answer

The IP SLA probe is not VRF-aware. By default, IP SLA operates in the global routing table. To track a route in a VRF, the IP SLA must be configured with the vrf keyword.

The correct answer is that the IP SLA is not associated with the VRF, so the probe fails or is sent in the wrong context.

Full explanation →
1243
Multi-Selectmedium

Which TWO commands can be used to verify the effect of a route-map applied to a BGP neighbor? (Choose TWO.)

Select 2 answers
A.show ip bgp neighbors x.x.x.x advertised-routes
B.show ip bgp neighbors x.x.x.x routes
C.show route-map
D.show ip bgp
E.show ip bgp neighbors x.x.x.x
AnswersA, B

This command shows the routes that are actually advertised to the neighbor after any outbound route-map filtering.

Why this answer

The commands 'show ip bgp neighbors x.x.x.x advertised-routes' and 'show ip bgp neighbors x.x.x.x routes' directly show the routes being sent or received after route-map filtering. 'show route-map' only displays the route-map definition, not its effect on a specific neighbor. 'show ip bgp' displays the BGP table without neighbor-specific filtering context. 'show ip bgp neighbors' alone does not show the filtered routes.

Full explanation →
1244
MCQmedium

Examine this partial configuration: ``` interface GigabitEthernet0/0 ip vrf forwarding CUSTOMER_F ip address 10.10.10.1 255.255.255.0 ! interface GigabitEthernet0/1 ip vrf forwarding CUSTOMER_G ip address 10.10.20.1 255.255.255.0 ``` What is required to enable communication between VRF CUSTOMER_F and VRF CUSTOMER_G?

A.No additional configuration is needed; VRFs can communicate by default.
B.Configure a route-map and import/export route-targets between the VRFs.
C.Add static routes with the 'vrf' keyword to point to the other VRF's next hop.
D.Use the 'ip route vrf' command to create a global route that points to the VRF interface.
AnswerC

This is correct. Static routes can be used to leak routes between VRFs.

Why this answer

By default, VRFs are isolated. To enable communication between them, route leaking must be configured, typically using static routes with the 'vrf' keyword or using route-replicate commands.

Full explanation →
1245
MCQmedium

Consider the following configuration on a router running BGP and OSPF: ``` router bgp 65000 distance bgp 20 200 200 ``` What is the effect of this command?

A.It sets the administrative distance for eBGP routes to 20, iBGP routes to 200, and local BGP routes to 200.
B.It sets the administrative distance for all BGP routes to 20.
C.It sets the administrative distance for eBGP routes to 200 and iBGP routes to 20.
D.It sets the administrative distance for BGP routes to 20 for routes learned from AS 65000.
AnswerA

Syntax: `distance bgp <external> <internal> <local>`.

Why this answer

The `distance bgp` command sets AD for BGP routes: external (eBGP) to 20, internal (iBGP) to 200, and local to 200.

Full explanation →
1246
Multi-Selectmedium

Which TWO commands would a network engineer use to verify the operation of Policy-Based Routing (PBR) on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show route-map
B.show ip policy
C.show ip route
D.debug ip policy
E.show access-lists
AnswersA, B

Displays all configured route-maps, including match and set conditions used for PBR.

Why this answer

The 'show route-map' command displays the configured route-map statements and their match/set conditions. The 'show ip policy' command lists interfaces with PBR applied and the associated route-map. 'show ip route' does not show PBR policy details. 'debug ip policy' is a debug command, not a verification show command. 'show access-lists' only shows ACLs, not PBR-specific information.

Full explanation →
1247
MCQhard

A network engineer configures CoPP on a router to limit PIM-SM control plane traffic. The policy includes a class-map matching PIM packets and polices them to 10000 bps. After the policy is applied, the engineer notices that multicast traffic is not being forwarded correctly, and PIM neighbors are not forming. The router is a PIM-SM rendezvous point (RP). What is the most likely issue?

A.The CoPP policy is dropping PIM register messages because the police rate is too low for the burst of register traffic.
B.The CoPP class-map is not matching PIM packets because it uses the wrong protocol number.
C.The PIM hello interval is set too high, causing the router to miss hello packets from neighbors.
D.The CoPP policy is applied to the wrong control plane, such as the IPv6 control plane.
AnswerA

PIM register messages can be large and bursty, and a police rate of 10000 bps may not be sufficient, causing drops and preventing RP functionality.

Why this answer

When a router is configured as a PIM-SM rendezvous point (RP), it receives PIM register messages from first-hop routers. These messages are encapsulated unicast packets that can arrive in bursts, especially when multiple sources register simultaneously. If the CoPP police rate is set too low (10000 bps), the router may drop these register messages, preventing the RP from learning about new multicast sources and causing PIM neighbors to fail to form.

Exam trap

Cisco often tests the misconception that CoPP only affects routing protocol hellos or keepalives, when in fact it can drop critical control messages like PIM register messages that are essential for RP operation in PIM-SM.

How to eliminate wrong answers

Option B is wrong because PIM packets are identified by IP protocol number 103, not by a TCP/UDP port, and a correctly configured class-map using 'match protocol pim' or an ACL matching protocol 103 will match them. Option C is wrong because the PIM hello interval (default 30 seconds) affects neighbor keepalives but does not cause the router to miss hellos; CoPP dropping hellos would cause neighbor loss, but the issue is specifically register messages. Option D is wrong because CoPP is applied to the control plane of the router, not a specific IPv4 or IPv6 sub-plane; the 'service-policy input' command under 'control-plane' applies to all control plane traffic regardless of address family.

Full explanation →
1248
Multi-Selecthard

Which TWO statements correctly describe the behavior of BGP conditional route injection? (Choose TWO.)

Select 2 answers
A.The injected route is automatically redistributed into connected and static routes.
B.The condition for injection is defined by an exist-map, which must match a less specific prefix in the BGP table.
C.The inject-map specifies the more specific prefix to be injected along with optional attributes.
D.The 'show ip bgp neighbors' command displays the number of injected prefixes per neighbor.
E.The injected prefix must be learned from the neighbor specified in the inject-map.
AnswersB, C

Correct. The exist-map specifies the condition prefix that must be present for injection to occur.

Why this answer

BGP conditional route injection allows a router to inject a more specific prefix into BGP when a condition (the existence of a less specific prefix) is met. The injected route is sourced from a route-map that defines the inject-map, and the condition is checked via an exist-map. The injected route is not automatically redistributed into other protocols unless explicitly configured.

The 'show ip bgp neighbors' command does not display injection statistics; instead, 'show ip bgp injected-paths' is used. The injected prefix must be in the BGP table of the injecting router, but not necessarily learned from the neighbor specified in the inject-map.

Full explanation →
1249
MCQmedium

A network engineer runs the following command to debug MPLS LDP label advertisements: R1# debug mpls ldp labels Output: *Mar 1 00:01:23.456: LDP: Sent label mapping for 192.168.1.0/24, label 101 *Mar 1 00:01:23.789: LDP: Received label mapping for 192.168.2.0/24, label 201 *Mar 1 00:01:24.012: LDP: Sent label mapping for 10.0.0.0/8, label 102 *Mar 1 00:01:24.345: LDP: Received label mapping for 10.0.0.0/8, label 202 What does this output indicate?

A.LDP label bindings are being exchanged between R1 and its LDP neighbor
B.R1 is only receiving label mappings, not sending any
C.The LDP session is down
D.R1 is using implicit null label for 10.0.0.0/8
AnswerA

The output shows both sent and received label mappings, indicating successful exchange.

Why this answer

The debug output shows label mappings being exchanged between LDP peers. R1 is sending its own label bindings (e.g., label 101 for 192.168.1.0/24) and receiving label bindings from its neighbor (e.g., label 201 for 192.168.2.0/24).

Full explanation →
1250
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp traffic EIGRP-IPv4 Traffic Statistics for AS(100) Hellos sent/received: 5000/4995 Updates sent/received: 150/148 Queries sent/received: 10/8 Replies sent/received: 8/10 Acks sent/received: 300/298 Input queue high water mark: 10 Input queue drops: 0 SIA-Queries sent/received: 0/0 SIA-Replies sent/received: 0/0 Hello process ID: 123 PDM process ID: 124 Socket queue: 0/2000/10/0 (current/max/highest/drops) Input queue: 0/2000/10/0 (current/max/highest/drops) Based on this output, which statement is correct?

A.The EIGRP process is operating normally with no signs of issues.
B.There is a problem because more queries were sent than replies received.
C.The input queue drops of 0 indicate that the router is not processing EIGRP packets.
D.The SIA-Queries count of 0 indicates that the network has experienced stuck-in-active events.
AnswerA

No input drops, no SIA events, and balanced packet counts indicate a healthy EIGRP process.

Why this answer

The output shows normal EIGRP operation: Hellos are exchanged nearly equally (5000 sent vs 4995 received), Updates, Queries, Replies, and Acks are balanced, and both input queue drops and SIA counters are zero. This indicates stable neighbor relationships and no packet loss or stuck-in-active events, confirming the EIGRP process is functioning without issues.

Exam trap

Cisco often tests the misconception that an imbalance in query/reply counts automatically indicates a problem, when in fact small differences are normal and only significant, persistent mismatches with other symptoms (like SIA events) indicate trouble.

How to eliminate wrong answers

Option B is wrong because a slightly higher number of queries sent (10) than replies received (8) is normal in EIGRP; replies may be in transit or aggregated, and the difference is negligible without other signs of trouble. Option C is wrong because input queue drops of 0 indicate that the router is successfully processing all incoming EIGRP packets, not that it is failing to process them. Option D is wrong because SIA-Queries and SIA-Replies counts of 0 indicate that no stuck-in-active events have occurred, which is a healthy condition, not evidence of SIA events.

Full explanation →
1251
Multi-Selecthard

Which THREE symptoms indicate that an Embedded Event Manager (EEM) applet configured to send a syslog message upon interface down has failed to execute? (Choose THREE.)

Select 3 answers
A.No custom syslog message appears on the console or in the log buffer when the interface goes down.
B.The 'show event manager history events' output does not include an entry for the interface down event.
C.The 'show event manager policy active' output shows the applet with a non-zero 'fail count' field.
D.The interface goes down and the router generates a default syslog message like '%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down'.
E.The 'show event manager environment' output shows the variable '_event_type' as 'none'.
AnswersA, B, C

The applet is designed to generate a syslog; its absence suggests the applet did not execute.

Why this answer

If the applet fails, no custom syslog is generated, the 'show event manager history events' will not show the trigger, and the 'show event manager policy active' may show the policy but with a non-zero failure count. The other options either describe normal behavior or unrelated issues.

Full explanation →
1252
MCQmedium

What is the default CoPP behavior for traffic that does not match any class in the policy-map?

A.Dropped
B.Transmitted
C.Logged and dropped
D.Routed to the management plane
AnswerB

The default action for traffic not matching any class is to transmit it, unless a 'class class-default' is configured with a police action.

Why this answer

By default, Control Plane Policing (CoPP) uses a class-default in the policy-map that implicitly permits (transmits) all traffic not explicitly matched by a user-defined class. This default behavior ensures that only traffic matching a class with a 'drop' action is policed, preventing unintentional denial of service from misconfigured policies.

Exam trap

Cisco often tests the misconception that CoPP drops all unmatched traffic by default, similar to how ACLs have an implicit deny at the end, but CoPP's class-default actually permits traffic unless explicitly configured to drop.

How to eliminate wrong answers

Option A is wrong because CoPP does not drop unmatched traffic by default; it transmits it via the implicit class-default. Option C is wrong because logging and dropping is not a default action; logging requires explicit configuration (e.g., 'log' keyword under police) and is not applied to unmatched traffic. Option D is wrong because unmatched traffic is not routed to the management plane; it is forwarded to the control plane for normal processing (e.g., routing protocol packets) or punted to the CPU based on existing forwarding logic, not redirected to a separate plane.

Full explanation →
1253
MCQhard

What is the default rate-limit interval for the 'logging rate-limit' command in Cisco IOS-XE?

A.100 milliseconds
B.1 second
C.5 seconds
D.No default; it must be specified
AnswerB

The default interval for logging rate-limit is 1 second.

Why this answer

The default rate-limit interval is 1 second, meaning the specified number of messages per second is allowed.

Full explanation →
1254
MCQmedium

A network engineer runs the following command to troubleshoot BFD with static routes: R1# show ip route 10.8.8.0/24 Routing entry for 10.8.8.0/24 Known via "static", distance 1, metric 0 Routing Descriptor Blocks: * 10.9.9.2, via GigabitEthernet0/3 Route metric is 0, traffic share count is 1 BFD enabled, BFD state: UP What does this output indicate?

A.Static route is installed with BFD tracking, and BFD session is UP.
B.Static route is not using BFD.
C.BFD state is DOWN, so the static route is removed.
D.Static route is using BFD only for IPv6.
AnswerA

BFD is enabled and UP, so the static route is active and monitored.

Why this answer

The output shows that BFD is enabled for the static route and the BFD state is UP, meaning the next hop is reachable and BFD is providing fast failure detection.

Full explanation →
1255
MCQmedium

A network engineer runs the following command to verify MPLS L3VPN operation: R1# show bgp ipv4 unicast 10.1.1.0/24 Output: BGP routing table entry for 10.1.1.0/24, version 10 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 0.0.0.0 from 0.0.0.0 (10.0.0.1) Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best What does this output indicate?

A.The route is locally originated and is the best path
B.The route is learned from a BGP peer
C.The route has an MPLS label
D.The route is in a VRF
AnswerA

The output shows 'sourced' and 'best', indicating local origin and best path.

Why this answer

This shows the BGP IPv4 unicast table entry for prefix 10.1.1.0/24. The path is local, with next hop 0.0.0.0, and it is valid and best. This is a standard IPv4 route, not VPNv4, so it does not have extended communities or MPLS labels.

Full explanation →
1256
MCQhard

A network engineer runs the following command to troubleshoot an MPLS LDP issue: R1# debug mpls ldp transport LDP: Transport connection to 2.2.2.2:0 via TCP (passive) LDP: Connection from 2.2.2.2:0 to 1.1.1.1:646 LDP: Transport connection to 2.2.2.2:0 via TCP (active) LDP: Connection from 1.1.1.1:646 to 2.2.2.2:0 LDP: Hold timer expired for peer 2.2.2.2:0 LDP: Closing transport connection to 2.2.2.2:0 What does this output indicate?

A.LDP session is established and stable.
B.LDP session is flapping due to hold timer expiration.
C.LDP session is down because of authentication failure.
D.LDP session is down because of a transport address mismatch.
AnswerB

The hold timer expires, causing the session to close, which suggests flapping.

Why this answer

The output shows the LDP hold timer expiring for peer 2.2.2.2, followed by the transport connection being closed. This indicates the LDP session is repeatedly going up and down (flapping) because the hold timer expires before the session can stabilize, often due to network congestion, high CPU, or mismatched hello/hold timers. Option B correctly identifies this flapping behavior caused by hold timer expiration.

Exam trap

Cisco often tests the distinction between session flapping due to hold timer expiration versus session failure due to authentication or address mismatch, and the trap here is that candidates may see 'transport connection' messages and incorrectly assume the session is up, missing the critical 'Hold timer expired' line.

How to eliminate wrong answers

Option A is wrong because the hold timer expiration and connection closure indicate the session is not established or stable; a stable session would show 'LDP: Session up' or similar. Option C is wrong because authentication failure would produce debug messages like 'LDP: MD5 authentication failed' or 'LDP: Bad TLV', not hold timer expiration. Option D is wrong because a transport address mismatch would cause the connection to never establish or show 'LDP: Transport address mismatch' in debugs, not a hold timer expiration after a successful TCP connection.

Full explanation →
1257
MCQhard

A network engineer notices that IPv6 hosts on a segment are not receiving Router Advertisements, even though Router R1 has IPv6 unicast-routing enabled and an IPv6 address on the interface. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ipv6 address 2001:DB8:1::1/64 ipv6 nd suppress-ra ! Router R2, connected to the same segment, shows: no IPv6 neighbors in the neighbor cache for R1's link-local address. What is the root cause?

A.The interface is in a down state due to a Layer 1 issue, preventing RA generation.
B.The 'ipv6 nd suppress-ra' command is configured, which prevents Router Advertisements from being sent.
C.Router R2 has IPv6 routing disabled, so it cannot process RAs from R1.
D.The IPv6 address on R1 is not in the same subnet as the hosts, causing RA filtering.
AnswerB

This command suppresses all RAs, so hosts cannot autoconfigure or learn the default router.

Why this answer

The 'ipv6 nd suppress-ra' command explicitly disables the sending of Router Advertisements (RAs) on the interface. Even though IPv6 unicast-routing is enabled and an IPv6 address is configured, R1 will not transmit RAs, which prevents IPv6 hosts from autoconfiguring their addresses and default routes via SLAAC or DHCPv6. This is the direct root cause of the hosts not receiving RAs.

Exam trap

Cisco often tests the 'ipv6 nd suppress-ra' command as a direct countermeasure to RA generation, and the trap here is that candidates assume IPv6 unicast-routing alone is sufficient for RA generation, overlooking the explicit suppression command.

How to eliminate wrong answers

Option A is wrong because the interface is not in a down state; if it were, the IPv6 address would not be active and the neighbor cache issue would be different, but the problem explicitly states R1 has an IPv6 address on the interface. Option C is wrong because Router R2's ability to process RAs is irrelevant; the issue is that R1 is not sending RAs at all, not that R2 cannot receive them. Option D is wrong because RA filtering based on subnet mismatch is not a standard behavior; RAs are sent to the all-nodes multicast address (FF02::1) regardless of the configured subnet, and the hosts are on the same segment as R1's interface.

Full explanation →
1258
MCQmedium

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 1500(3) Gi0/0 Session state is UP and not using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 1500(0) Rx Count: 120, Tx Count: 150 Based on this output, which statement is correct?

A.The BFD session is down because the holddown timer is incorrect.
B.The BFD session is up and the holddown timer is 1500 ms, which is correct based on the configured multiplier and MinRxInt.
C.The BFD session is using echo mode, which is why the holddown timer is 1500 ms.
D.The BFD session is up but the multiplier is set to 1, causing the holddown timer to be 1500 ms.
AnswerB

The holddown timer is calculated as MinRxInt * Multiplier = 1000000 microseconds * 3 = 3000000 microseconds = 3000 ms, but the output shows 1500 ms. This is a known behavior where the holddown timer displayed is half of the actual holddown time due to a software implementation detail. The session is up.

Why this answer

The output shows BFD session details. The Holddown value of 1500 ms is calculated as MinRxInt * Multiplier (1000 ms * 3 = 3000 ms), but the output shows 1500 ms. This discrepancy indicates a misconfiguration or a bug, but the key point is that the session is UP and the holddown timer is 1500 ms, which is half of the expected value.

However, the correct interpretation is that the BFD session is established and operating, and the holddown timer is 1500 ms as shown.

Full explanation →
1259
MCQmedium

An engineer is troubleshooting why the NMS is not receiving SNMP traps from router R2. The configuration includes 'snmp-server enable traps', 'snmp-server host 10.1.1.100 version 2c public', and an extended ACL 100 that permits UDP port 162 from 10.1.1.100. The NMS can ping R2. What is the most likely cause?

A.The ACL is applied inbound on the interface, but it should be applied outbound to allow trap packets to leave the router.
B.The 'snmp-server host' command is missing the 'trap' keyword, causing the router to send informs instead.
C.The community string 'public' is case-sensitive; the NMS is using 'Public' with a capital P.
D.The router needs the 'snmp-server trap-source' command to specify the source interface for traps.
AnswerA

Correct because traps are sent from the router; the ACL must permit outbound UDP port 162 to the NMS, not inbound.

Why this answer

The most likely cause is that the ACL is applied inbound on the interface, but it should be applied outbound to allow trap packets to leave the router. SNMP traps are UDP packets sourced from the router (typically from a random high port) and destined to the NMS at UDP port 162. An inbound ACL filters traffic entering the interface, not leaving it, so it would not affect outgoing trap packets.

Applying the ACL outbound would permit the trap traffic to exit the router and reach the NMS.

Exam trap

Cisco often tests the distinction between inbound and outbound ACL application, and candidates mistakenly think an inbound ACL can filter locally generated traffic like SNMP traps, when in fact only outbound ACLs affect traffic leaving the router.

How to eliminate wrong answers

Option B is wrong because the 'snmp-server host' command without the 'trap' keyword defaults to sending traps, not informs; the 'inform' keyword is required to send SNMP informs. Option C is wrong because while community strings are case-sensitive, the NMS using 'Public' would cause authentication failure, but the question states the NMS can ping R2, implying basic reachability; however, the ACL misapplication is a more direct and common cause of trap loss. Option D is wrong because the 'snmp-server trap-source' command is optional and only needed when the source IP of traps must be a specific interface (e.g., for reachability or security); its absence does not prevent traps from being sent, as the router uses the outgoing interface IP by default.

Full explanation →
1260
MCQeasy

Given the configuration: logging buffered 8192 warnings logging console alerts logging monitor critical Which of the following is true?

A.The logging buffer stores messages of severity 0 through 4.
B.The console displays messages of severity 0 through 3.
C.The monitor receives messages of severity 0 through 4.
D.The buffer can store up to 8192 syslog messages.
AnswerA

Level 'warnings' (4) includes severities 0-4.

Why this answer

The buffer is set to 8192 bytes with level warnings (0-4). Console is alerts (0-2). Monitor is critical (0-3).

Note that the buffer size is in bytes, not messages.

Full explanation →
1261
MCQmedium

What is the default maximum number of NAT translations that can be created in Cisco IOS?

A.512 translations
B.1024 translations
C.Unlimited, limited only by available memory
D.4096 translations
AnswerC

Correct. Cisco IOS allows NAT translations up to the memory capacity of the device.

Why this answer

Cisco IOS does not impose a fixed upper limit on the number of NAT translations; instead, translations are dynamically allocated from router memory. The only constraint is the available DRAM and the size of the NAT translation table, making option C correct.

Exam trap

Cisco often tests the misconception that NAT has a hard-coded default limit (like 512 or 1024) to trick candidates who memorize arbitrary numbers instead of understanding that NAT is memory-bound.

How to eliminate wrong answers

Option A is wrong because 512 is not a default limit; it is a common misconception based on older platforms or arbitrary thresholds. Option B is wrong because 1024 is not a default maximum; it may appear in some documentation as a recommended limit but is not enforced by IOS. Option D is wrong because 4096 is not a default maximum; it is a value sometimes associated with hardware-specific limits or licensing, not a global IOS default.

Full explanation →
1262
Multi-Selectmedium

Which TWO configuration steps are required to troubleshoot and fix a BGP route that is not being advertised to an EBGP neighbor due to the next-hop-self issue? (Choose TWO.)

Select 2 answers
A.Configure a network statement under BGP to advertise the prefix.
B.Apply the neighbor next-hop-self command under the BGP router configuration for the EBGP neighbor.
C.Increase the EBGP multihop TTL using the neighbor ebgp-multihop command.
D.Ensure the next-hop IP is reachable via an IGP or static route on the advertising router.
E.Use the neighbor update-source command to change the source IP of BGP updates.
AnswersB, D

This forces the router to use its own IP as the next hop for routes advertised to the neighbor.

Why this answer

The next-hop-self command on the EBGP neighbor or the IBGP peer (if the route is from IBGP) ensures the next hop is set to the local router's address. Alternatively, if the next hop is reachable via an IGP, no change is needed. Option A is incorrect because network statements do not affect next-hop.

Option C is incorrect because EBGP multihop is for TTL issues. Option E is incorrect because the update-source command sets the source IP, not the next hop.

Full explanation →
1263
MCQhard

A network engineer runs the following command on Router R1: R1# show ip bgp neighbors 10.1.1.2 advertised-routes BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.10.10.0/24 0.0.0.0 0 32768 i *> 10.20.20.0/24 0.0.0.0 0 32768 i R1# show route-map route-map BLOCK_RFC1918, permit, sequence 10 Match clauses: ip address prefix-list RFC1918 Set clauses: Policy routing matches: 0 packets, 0 bytes route-map BLOCK_RFC1918, deny, sequence 20 Match clauses: Set clauses: Policy routing matches: 0 packets, 0 bytes R1# show ip prefix-list RFC1918 ip prefix-list RFC1918: 3 entries seq 5 deny 10.0.0.0/8 le 32 seq 10 deny 172.16.0.0/12 le 32 seq 15 deny 192.168.0.0/16 le 32 seq 20 permit 0.0.0.0/0 le 32 Based on this output, what is the most likely issue?

A.The route-map BLOCK_RFC1918 is not applied to the BGP neighbor, so RFC 1918 routes are being advertised.
B.The prefix-list RFC1918 is misconfigured and permits all routes.
C.The route-map is applied but the match clause is incorrect.
D.The BGP session is not established.
AnswerA

The prefix-list denies RFC 1918, but the route-map is not applied to the neighbor, so routes are advertised.

Why this answer

The route-map BLOCK_RFC1918 is applied to filter routes, but the advertised routes include 10.10.10.0/24 and 10.20.20.0/24, which are RFC 1918 addresses. The prefix-list RFC1918 should deny these, but the route-map is not being applied to the BGP neighbor, so routes are not filtered. The correct answer is that the route-map is not applied to the BGP neighbor.

Full explanation →
1264
MCQmedium

A network engineer is troubleshooting PAT (overload) on a Cisco router. The inside network uses 192.168.1.0/24, and the outside interface has IP 198.51.100.1. The engineer configured 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. Traffic from inside hosts works initially, but after a few minutes, new connections fail. 'Show ip nat translations' shows many entries with the same outside global IP but different ports. 'Show ip nat statistics' indicates that the number of translations is near 500. What is the most likely cause?

A.The NAT pool is not configured with overload.
B.The outside interface is flapping, causing translations to be cleared.
C.The router has run out of available port numbers for PAT.
D.The access list is denying some inside hosts.
AnswerC

Correct because PAT uses a limited port range (usually 1024-65535), and with many sessions, ports can be exhausted, preventing new translations.

Why this answer

The router is using PAT (Port Address Translation) with overload, which maps multiple inside local IP addresses to a single outside global IP (198.51.100.1) by using unique source port numbers. With approximately 500 active translations and the router nearing the default limit of around 500 PAT entries (or the available port range of 1024–65535 being exhausted), new connections fail because no unique port numbers are available to assign. This is the classic symptom of PAT port exhaustion.

Exam trap

Cisco often tests the distinction between NAT pool exhaustion (running out of IP addresses) and PAT port exhaustion (running out of port numbers), and candidates may mistakenly think the problem is with the access list or interface stability when the real issue is the finite number of available PAT ports.

How to eliminate wrong answers

Option A is wrong because the command 'ip nat inside source list 1 interface GigabitEthernet0/0 overload' already configures overload (PAT) on the interface, so a separate NAT pool is not required and the pool is not the issue. Option B is wrong because an interface flapping would clear all translations abruptly, not cause gradual exhaustion with many entries still visible in 'show ip nat translations'. Option D is wrong because the access list (list 1) is used to define which inside hosts are eligible for NAT; if it were denying some hosts, those hosts would never get translations, but the problem is that existing translations are working and new connections from all hosts are failing after port exhaustion.

Full explanation →
1265
MCQmedium

Which BGP attribute is used as the first tie-breaker when selecting the best path in a VRF-Lite environment?

A.Local preference
B.Weight
C.AS path length
D.MED
AnswerB

Weight is a Cisco-proprietary attribute and is checked first in the BGP best-path selection process.

Why this answer

BGP selects the path with the highest weight (Cisco proprietary) as the first tie-breaker, followed by local preference.

Full explanation →
1266
MCQhard

An engineer configures IP SLA with an ICMP echo operation and uses it to track a static default route. The engineer also configures a backup static route with a higher administrative distance. The IP SLA operation is configured with a timeout of 2000 ms and a frequency of 5 seconds. The engineer notices that when the primary route is removed due to IP SLA failure, the backup route is installed, but when the IP SLA operation recovers, the primary route is not reinstalled. The show ip route shows the backup route still present. Which is the most likely explanation?

A.The IP SLA operation has a frequency that is too low, causing a delay in detection of recovery.
B.The track object has a 'delay up' configured, causing a delay before the primary route is reinstalled.
C.The backup static route has a lower administrative distance than the primary route.
D.The IP SLA operation is still in the 'pending' state and has not yet recovered.
AnswerB

The delay up command in the track object introduces a hold-down period before the object state changes to up, so the primary route is not reinstalled immediately.

Why this answer

When a tracked static route is removed, the backup route with higher AD is installed. When the IP SLA operation recovers, the track object goes up, and the primary route should be reinstalled. However, if the IP SLA operation recovers but the track object has a delay up configured, or if the primary route's AD is not lower than the backup route, the primary route may not be reinstalled.

In this scenario, the most likely edge case is that the track object has a 'delay up' configured, which delays the route installation.

Full explanation →
1267
MCQhard

An EIGRP network is experiencing frequent stuck-in-active (SIA) events. Router R1 shows: 'show ip eigrp topology' includes routes in active state for several minutes. R1's configuration: router eigrp 100 timers active-time 3. R2, a neighbor, is reachable but has a large number of routes. What is the root cause?

A.The active-time timer is set too low (3 minutes), causing queries to time out before R2 can reply.
B.R2 has a stuck-in-active condition due to a routing loop.
C.R1 has a misconfigured distribute-list that blocks query replies from R2.
D.The network has a high latency link that delays query propagation.
AnswerA

The default active-time is 3 minutes. If R2 has many routes, it may take longer to process queries, leading to SIA.

Why this answer

The 'timers active-time 3' command sets the active-time timer to 3 minutes, which is the default value. In a network where R2 has a large number of routes, the query and reply process can take longer than 3 minutes, causing R1 to declare the route as stuck-in-active (SIA) and reset the neighbor relationship. This is a common misconfiguration where the active-time timer is not increased to accommodate slow query propagation or large route tables.

Exam trap

Cisco often tests the misconception that the default active-time timer is always sufficient, but the trap here is that candidates may overlook the need to increase the timer when the network has a large number of routes or high latency, leading to frequent SIA events.

How to eliminate wrong answers

Option B is wrong because a stuck-in-active condition on R2 would cause R2 to be unable to reply, but the scenario states R2 is reachable and the issue is with R1 timing out queries. Option C is wrong because a distribute-list blocking query replies would cause R1 to never receive replies, leading to routes staying in active state indefinitely, not timing out after 3 minutes. Option D is wrong because high latency links would delay query propagation, but the active-time timer of 3 minutes is the default and should be increased to accommodate such delays; the root cause is the timer being too low, not the latency itself.

Full explanation →
1268
MCQeasy

Which statement about the Next Hop Resolution Protocol (NHRP) in DMVPN is correct regarding the purpose of NHRP Registration Request packets?

A.They are used to resolve the NBMA address of a destination tunnel IP address.
B.They are used to register the spoke's tunnel IP and NBMA address with the hub.
C.They are used to purge outdated NHRP cache entries on the hub.
D.They are used to establish an IPsec security association between spokes.
AnswerB

Correct. Registration Request packets register the spoke's mapping with the hub.

Why this answer

NHRP Registration Request packets are sent from spoke routers to the hub to register their tunnel IP address (NHS) and corresponding NBMA address. This allows the hub to build a mapping database for forwarding.

Full explanation →
1269
MCQmedium

An engineer applies the following configuration to an interface: interface GigabitEthernet0/5 ipv6 dhcp guard attach-policy DHCP_GUARD ipv6 snooping database file nvram:ipv6-snoop.db Which statement is true?

A.The DHCP guard policy is applied to the interface, and the snooping database is stored in NVRAM.
B.The DHCP guard policy is applied only if the snooping database is present.
C.The interface will not forward any DHCP messages until the database is populated.
D.The snooping database is used to validate DHCP server messages.
AnswerA

Both commands are independent; the guard policy filters DHCP, and the database stores bindings.

Why this answer

The 'ipv6 dhcp guard attach-policy DHCP_GUARD' command applies the DHCP Guard policy to the interface, and the 'ipv6 snooping database file nvram:ipv6-snoop.db' command configures the snooping database to be stored in NVRAM. These two commands operate independently; the DHCP Guard policy is enforced immediately upon attachment, regardless of the database's presence or population state.

Exam trap

Cisco often tests the independence of First Hop Security features; the trap here is assuming that the snooping database must be present or populated for DHCP Guard to function, when in fact DHCP Guard operates based on the policy configuration alone.

How to eliminate wrong answers

Option B is wrong because the DHCP Guard policy is applied immediately when attached to the interface; it does not depend on the snooping database being present. Option C is wrong because the interface will forward DHCP messages normally; DHCP Guard only drops messages that violate the policy (e.g., unauthorized DHCP server messages), and the database does not need to be populated for forwarding to occur. Option D is wrong because the snooping database is used to store IPv6 snooping entries (e.g., bindings learned from ND and DHCP), not to validate DHCP server messages; validation is performed by the DHCP Guard policy itself based on the configured policy rules.

Full explanation →
1270
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip policy Interface Route-map GigabitEthernet0/0 PBR-SET R1# show route-map PBR-SET route-map PBR-SET, permit, sequence 10 Match clauses: ip address (access-lists): 160 Set clauses: ip next-hop 192.168.1.2 ip tos 184 Policy routing matches: 300 packets, 24000 bytes R1# show access-lists 160 Extended IP access list 160 10 permit ip 10.0.0.0 0.255.255.255 any R1# show interfaces GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Internet address is 10.0.0.1/24 Based on this output, a packet from source 10.0.0.5 to destination 8.8.8.8 arrives on GigabitEthernet0/0. What is the most likely behavior?

A.The packet is forwarded using the routing table because the next-hop is not specified correctly.
B.The packet is forwarded to 192.168.1.2 with the ToS field set to 184.
C.The packet is dropped because the ToS value is invalid.
D.The packet is forwarded to 192.168.1.2 but the ToS is not changed.
AnswerB

The route map matches the packet and sets both next-hop and ToS, so the packet is policy-routed with the new ToS value.

Why this answer

The packet matches ACL 160 (source 10.0.0.0/8). The route map sets both next-hop and ToS. The next-hop 192.168.1.2 must be reachable for PBR to apply.

Assuming it is reachable (not shown but implied by matches), the packet will be forwarded to 192.168.1.2 with ToS set to 184 (which is 0xB8, or IP precedence 5, DSCP 46).

Full explanation →
1271
Multi-Selecthard

Which TWO configuration steps are required to implement Control Plane Policing (CoPP) on a Cisco IOS-XE router? (Choose TWO.)

Select 2 answers
A.Apply the policy map to a physical interface using the 'service-policy input' command.
B.Create a policy map that defines a police action for the classified traffic.
C.Create a class map to match the traffic that should be policed.
D.Configure a 'shape average' command in the policy map to limit traffic rate.
E.Apply the policy map to the control plane using the 'service-policy input' command under the interface configuration mode.
AnswersB, C

A policy map with a 'police' command is required to specify the rate and action for CoPP.

Why this answer

A policy map is required to define the police action (e.g., 'police rate 10000 conform-action transmit exceed-action drop') that enforces rate limiting on the classified traffic. Without a policy map specifying the policing parameters, CoPP cannot apply any QoS action to the control plane traffic. Option C is correct because a class map is necessary to classify the specific traffic types (e.g., SSH, BGP, ICMP) that should be subjected to policing, using match statements based on access lists or protocol headers.

Exam trap

Cisco often tests the distinction between applying the policy map under 'control-plane' configuration mode versus under a physical interface, as candidates mistakenly use 'interface GigabitEthernet0/0' instead of 'control-plane' to attach the CoPP policy.

Full explanation →
1272
MCQmedium

A network engineer configures a DMVPN spoke with the following: interface Tunnel0 ip address 10.0.0.3 255.255.255.0 ip nhrp network-id 100 ip nhrp nhs 10.0.0.1 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp map 10.0.0.1 192.168.1.1 ip nhrp map multicast 192.168.1.1 ! What will happen when the spoke tries to send traffic to another spoke (10.0.0.4)?

A.The spoke will send traffic directly to 10.0.0.4 if it has a cached NHRP mapping, otherwise through the hub.
B.The spoke will always send traffic through the hub because of the static multicast map.
C.The spoke will send traffic directly to 10.0.0.4 without using the hub.
D.The spoke will drop the traffic because it does not have a route to 10.0.0.4.
AnswerA

Spokes can build direct tunnels if they have learned the mapping via NHRP; otherwise, traffic goes via the hub.

Why this answer

In DMVPN Phase 2/3, spokes initially send traffic through the hub. The hub then uses NHRP redirect (if configured) to tell the spoke to establish a direct tunnel. Without NHRP redirect on the hub, traffic always goes through the hub.

Full explanation →
1273
MCQmedium

Consider this OSPFv3 configuration on router R2: ipv6 router ospf 10 router-id 2.2.2.2 area 0 authentication ipsec spi 256 md5 1234567890abcdef1234567890abcdef interface GigabitEthernet0/0 ipv6 address 2001:db8:1::1/64 ipv6 ospf 10 area 0 What is the effect of this configuration?

A.OSPFv3 will use IPsec MD5 authentication for all packets in area 0, including on GigabitEthernet0/0.
B.Authentication is applied only to the GigabitEthernet0/0 interface, not the entire area.
C.The configuration is invalid because OSPFv3 does not support IPsec authentication.
D.The router-id is missing, so OSPFv3 will not start.
AnswerA

Correct. The area authentication command applies to all interfaces in that area.

Why this answer

The area authentication command under OSPFv3 enables IPsec authentication for the entire area. The interface is enabled for OSPFv3 in area 0, so it will use the area authentication. However, OSPFv3 authentication uses IPsec AH or ESP; the configuration shown is valid.

Full explanation →
1274
Drag & Dropmedium

Drag and drop the steps to verify and validate the operational state of IPv4 ACLs into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, display all ACLs with show access-list; second, check interface bindings with show ip interface; third, verify hits on each entry; fourth, confirm the ACL is active using show running-config; fifth, test traffic with extended ping or traffic generator.

Full explanation →
1275
MCQmedium

Examine the following configuration snippet: ``` interface GigabitEthernet0/0 ip access-group BLOCK_TELNET out ! ip access-list extended BLOCK_TELNET deny tcp any any eq 23 permit ip any any ``` What is the effect of applying this ACL outbound on GigabitEthernet0/0?

A.It blocks Telnet traffic entering the interface from the network.
B.It blocks Telnet traffic leaving the interface, but permits all other IP traffic.
C.It permits Telnet traffic and blocks all other IP traffic.
D.It has no effect because the ACL is missing a sequence number.
AnswerB

Correct. The outbound ACL denies Telnet and permits all other IP traffic.

Why this answer

The ACL is applied outbound on GigabitEthernet0/0, meaning it filters traffic as it leaves the interface. The first rule denies TCP traffic destined for port 23 (Telnet), and the second rule permits all other IP traffic. Therefore, Telnet sessions initiated from inside the network and exiting this interface are blocked, while all other traffic is allowed.

Exam trap

Cisco often tests the distinction between inbound and outbound ACL application, and the trap here is that candidates mistakenly think an outbound ACL filters traffic entering the interface rather than leaving it.

How to eliminate wrong answers

Option A is wrong because the ACL is applied outbound, not inbound; it blocks traffic leaving the interface, not entering. Option C is wrong because the ACL denies Telnet traffic (port 23) and permits all other IP traffic, not the reverse. Option D is wrong because sequence numbers are not required for named extended ACLs; the ACL is valid and functional as written.

Full explanation →
Page 16

Page 17 of 27

Page 18

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →