Knowledge + Practice

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1276–1350

1966 questions total · 27pages · All types, answers revealed

Take a mock exam Exam hub

Page 18 of 27

1276

MCQmedium

Examine the following configuration: ``` interface GigabitEthernet0/1 ip vrf forwarding CUSTOMER_C ip address 10.1.1.1 255.255.255.0 no shutdown ``` What is missing from this configuration to ensure that routes from VRF CUSTOMER_C are properly isolated?

A.A route-target import/export statement under the VRF definition.

B.The command 'ip vrf forwarding CUSTOMER_C' must be preceded by 'no ip address' to avoid IP address removal.

C.Nothing is missing; this configuration provides proper VRF isolation.

D.A 'vrf definition CUSTOMER_C' must be used instead of 'ip vrf' on newer IOS versions.

AnswerC

This is correct. The interface is in a VRF, so all traffic uses the VRF-specific routing table, ensuring isolation.

Why this answer

The configuration is complete for basic VRF-Lite. VRF isolation is achieved by associating the interface with a VRF, which creates a separate routing table. No additional commands are required for isolation.

Full explanation →

1277

MCQmedium

A network engineer runs the following command on Router R1: R1# show snmp trap SNMP Trap: enabled Trap receiver: 192.168.1.100 Community: PUBLIC Version: 2c UDP port: 162 Enable traps: snmp, interface, bgp Trap receiver: 192.168.1.200 Community: PRIVATE Version: 2c UDP port: 162 Enable traps: snmp, ospf Based on this output, which statement is correct?

A.BGP traps will be sent to 192.168.1.100 but not to 192.168.1.200.

B.Both receivers will receive OSPF traps.

C.The traps are sent using SNMPv3.

D.Interface traps are sent to 192.168.1.200.

AnswerA

The first receiver has 'bgp' in its enable traps list, while the second does not.

Why this answer

The output shows that traps are configured per receiver. The first receiver (192.168.1.100) has 'Enable traps: snmp, interface, bgp', while the second receiver (192.168.1.200) has 'Enable traps: snmp, ospf'. Since BGP is not listed for the second receiver, BGP traps will only be sent to 192.168.1.100, making option A correct.

Exam trap

Cisco often tests the misconception that all trap receivers receive the same set of traps, but in reality, trap enablement can be configured per receiver, and the 'show snmp trap' output clearly shows which traps are enabled for each host.

How to eliminate wrong answers

Option B is wrong because OSPF traps are only enabled for the second receiver (192.168.1.200), not for the first receiver (192.168.1.100), so both receivers will not receive OSPF traps. Option C is wrong because the output explicitly shows 'Version: 2c' for both receivers, indicating SNMPv2c is used, not SNMPv3. Option D is wrong because interface traps are enabled only for the first receiver (192.168.1.100), not for 192.168.1.200.

Full explanation →

1278

MCQhard

An engineer configures OSPFv2 with a route-map to set the metric on redistributed routes. After redistribution, the metric is not being set as expected. Which is the most likely explanation?

A.The route-map does not have a match statement, so it applies to no routes.

B.The redistribution command uses the 'subnets' keyword, which overrides the route-map.

C.The route-map is applied to the wrong direction.

D.The OSPF process is configured with 'default-metric' command, which overrides the route-map.

AnswerA

Without a match statement, the route-map does not apply to any routes, and the default metric is used.

Why this answer

When redistributing routes into OSPF, the metric is set using the 'metric' keyword in the redistribution command or via a route-map. However, if the route-map does not explicitly match the routes, the default metric (20 for external type 2) is used. Additionally, if the route-map uses 'set metric' but the redistribution command also has a 'metric' keyword, the route-map overrides the redistribution command.

Full explanation →

1279

MCQhard

An OSPF network has a multi-access link between routers R1 and R2. R1 is configured with 'ip ospf network point-to-point' on the interface, while R2 uses the default broadcast network type. R1 shows: 'show ip ospf neighbor' lists R2 as FULL/DR, but R2 shows: 'show ip ospf neighbor' lists R1 as FULL/DROTHER. Traffic from R1 to R2's loopback is fine, but from R2 to R1's loopback is intermittent. What is the root cause?

A.R1's point-to-point configuration disables DR/BDR election, but R2 still expects it, causing R1 to ignore R2's LSUs.

B.R2's DR election is incorrect because it has a higher router ID, but R1 should be the DR.

C.R1's interface has an MTU mismatch that causes OSPF packets to be dropped.

D.R2 has a firewall that blocks OSPF packets from R1.

AnswerA

With mismatched network types, R1 sends packets without a DR, but R2 expects them from the DR, leading to packet loss.

Why this answer

R1's 'ip ospf network point-to-point' command disables DR/BDR election on its interface, meaning R1 will not participate in the election and will not form a full adjacency with a DR or BDR. However, R2, using the default broadcast network type, expects a DR/BDR election and elects itself as DR (likely due to higher router ID). R1 sees R2 as FULL/DR because R1 still receives Hellos and forms a neighbor relationship, but R1 ignores LSUs from R2 because R1's point-to-point logic does not recognize the DR as a valid next hop for flooding, causing intermittent reachability to R1's loopback.

Exam trap

Cisco often tests the misconception that 'ip ospf network point-to-point' only affects hello/dead timers or neighbor state, when in reality it fundamentally changes the OSPF operational model on that link, including DR/BDR election and flooding behavior.

How to eliminate wrong answers

Option B is wrong because the DR election is not 'incorrect' based on router ID; R2 becomes DR because R1's point-to-point configuration effectively removes R1 from the election, so R2 wins by default. The issue is not about which router should be DR, but that R1's point-to-point mode breaks the expected DR/BDR flooding mechanism. Option C is wrong because an MTU mismatch would cause OSPF packets to be dropped entirely, preventing the neighbor relationship from reaching FULL state, but here both routers show FULL adjacency.

Option D is wrong because a firewall blocking OSPF packets would prevent neighbor formation altogether, not cause intermittent traffic while maintaining FULL neighbor state.

Full explanation →

1280

Multi-Selecthard

Which TWO statements about the 'ip nat outside source' feature are true? (Choose TWO.)

Select 2 answers

A.It translates the source IP address of packets arriving on an interface configured as 'ip nat outside'.

B.It can be used to map an external public IP to an internal private IP so that inside routers can route to the private address.

C.It requires the 'overload' keyword to perform Port Address Translation.

D.It translates the destination IP address of packets leaving the inside network.

E.The translation is unidirectional; return traffic is not translated back.

AnswersA, B

Correct. The command translates the source address of outside-originated traffic.

Why this answer

The 'ip nat outside source' command translates the source IP address of packets that arrive on an interface configured as 'ip nat outside'. This is used when an external host's source address needs to be translated to a different address, typically to allow inside routers to route return traffic to a private address that the external host is mapped to.

Exam trap

Cisco often tests the distinction between 'ip nat inside source' and 'ip nat outside source', and candidates mistakenly assume that 'outside source' translates destination addresses or that translations are unidirectional.

Full explanation →

1281

MCQeasy

What is the default BGP hold timer value in an MPLS L3VPN deployment on Cisco IOS-XE?

A.60 seconds

B.90 seconds

C.120 seconds

D.180 seconds

AnswerD

Correct. The default hold timer is 180 seconds.

Why this answer

The default BGP hold timer is 180 seconds, meaning a peer is declared dead if no keepalive or update is received within that interval.

Full explanation →

1282

MCQhard

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down R1# show ip eigrp neighbors IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:02:00 40 200 0 5 Based on this output, what is the most likely problem?

A.The EIGRP neighbor is down.

B.The EEM policy has been triggered.

C.The EIGRP neighbor is up, and the EEM policy is ready to trigger if it goes down.

D.The EEM policy is misconfigured.

AnswerC

The neighbor is operational, so the down event has not occurred.

Why this answer

The EEM policy EIGRP_Neighbor_Down is registered, but the EIGRP neighbor is present with an uptime of 2 minutes. The correct answer is that the EEM policy has not been triggered because the neighbor is up; however, the policy is ready to act if the neighbor goes down.

Full explanation →

1283

MCQhard

An engineer applies a Control Plane Policing (CoPP) policy to a router. After applying, OSPF adjacencies go down. The policy has a class that matches OSPF traffic with a police rate of 1000 pps. The 'show policy-map control-plane' shows no drops. Which is the most likely explanation?

A.The CoPP policy uses 'match protocol ospf' but the router runs OSPFv3, which is not matched by that statement.

B.The police rate is configured in bps instead of pps, causing OSPF hellos to be dropped.

C.The 'class class-default' is configured with a police rate that drops all traffic.

D.The CoPP policy is applied to the input direction, but OSPF packets are sent from the router.

AnswerA

OSPFv3 uses IPv6; 'match protocol ospf' matches OSPFv2 only.

Why this answer

CoPP policies have an implicit 'deny all' at the end. If the OSPF traffic is not matched by any class, it will be dropped by the implicit deny. However, the engineer may have configured a class that matches OSPF but the police rate is in bps, not pps, causing OSPF hellos to be dropped if they exceed the rate.

But the question states no drops, so the issue is likely that the OSPF class is not matching due to incorrect match criteria (e.g., match protocol ospf vs match access-group).

Full explanation →

1284

MCQhard

A network engineer configures CoPP to protect the control plane, but after redistributing routes, some legitimate routing updates are dropped. Router R1 config: control-plane service-policy input COPP ! class-map match-all ROUTING match access-group name ROUTING ! policy-map COPP class ROUTING police 100000 15000 15000 conform-action transmit exceed-action drop ! access-list ROUTING permit tcp any any eq bgp access-list ROUTING permit udp any any eq 520 access-list ROUTING permit ospf any any R1# show policy-map control-plane input Class-map: ROUTING (match-all) 100 packets, 10000 bytes 5 minute offered rate 0 bps drop rate 0 bps Match: access-group name ROUTING police: cir 100000 bps, bc 15000 bytes, be 15000 bytes conformed 90 packets, 9000 bytes; actions: transmit exceeded 10 packets, 1000 bytes; actions: drop What is the root cause?

A.The CoPP police rate is too low for the volume of routing updates during redistribution, causing drops.

B.The access-list is missing EIGRP protocol, causing EIGRP packets to be dropped.

C.The class-map is match-all, which requires all conditions to match, but only one ACL is present.

D.The policy-map is applied to the input of the control-plane, but redistribution uses output.

AnswerA

Redistribution generates many routing updates; the police rate is insufficient, leading to drops.

Why this answer

The CoPP policy is policing routing protocol traffic at 100 kbps, which may be insufficient during redistribution bursts. The exceeded drops indicate that some packets are being dropped, likely due to the burst size being too small. The fix is to increase the police rate or burst size to accommodate the redistribution traffic.

Full explanation →

1285

MCQhard

A DMVPN Phase 3 network with OSPF as the IGP experiences routing loops between hubs. R1 and R2 are both hubs with OSPF adjacencies to each other and to spokes. R1 has a route to 10.0.0.0/8 via a spoke, and redistributes it into OSPF. R2 learns this route and also has a direct connection to the same spoke, causing a loop. What is the root cause?

A.R1 is redistributing a route learned from a spoke into OSPF, and R2 learns this route and forwards traffic back to R1, creating a loop due to lack of route tagging and filtering.

B.OSPF network type is set to broadcast on both hubs, causing DR/BDR election issues.

C.NHRP redirect is enabled on both hubs, causing conflicting redirect messages.

D.R2 has a higher OSPF router ID, causing it to become DR and attract traffic.

AnswerA

Correct. Redistribution without route tagging (e.g., using a route-map with tag) can cause loops. The route should be tagged to prevent re-redistribution.

Why this answer

Redistribution of routes from one routing protocol into OSPF can cause routing loops if not properly filtered. In this case, R1 redistributes a route learned from a spoke into OSPF, and R2 learns it and may forward traffic back to R1, creating a loop. The issue is that OSPF does not have a mechanism to prevent loops from redistribution without proper route tagging and filtering.

Full explanation →

1286

MCQhard

In BFD multihop sessions, what is the default value for the TTL (or hop limit) in outgoing BFD Control packets on Cisco IOS-XE?

A.1

B.64

C.128

D.255

AnswerD

The default TTL for BFD multihop sessions is 255, as per Cisco IOS-XE and RFC 5883.

Why this answer

For BFD multihop sessions, Cisco IOS-XE defaults to a TTL of 255, as per RFC 5883, to ensure the packet can traverse multiple hops.

Full explanation →

1287

MCQmedium

A network engineer runs the following command to troubleshoot OSPFv3 adjacency: R1# debug ipv6 ospf adj *Mar 1 00:15:23.456: OSPFv3-1-IPv6 ADJ Gi0/0: Rcv pkt from 2001:DB8:1::2, src 2001:DB8:1::2, area 0 *Mar 1 00:15:23.457: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Our address 2001:DB8:1::1, his address 2001:DB8:1::2 *Mar 1 00:15:23.458: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Neighbor is not DR, state 2WAY *Mar 1 00:15:23.459: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: DR is 2001:DB8:1::2, BDR is 2001:DB8:1::1 *Mar 1 00:15:23.460: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Build the Start DBD *Mar 1 00:15:23.462: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Master/Slave negotiation done *Mar 1 00:15:23.464: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Exchange done, loading started *Mar 1 00:15:23.466: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Loading done *Mar 1 00:15:23.468: OSPFv3-1-IPv6 ADJ Gi0/0: Nbr 2.2.2.2: Full What does this output indicate?

A.The OSPFv3 adjacency failed due to area mismatch.

B.The OSPFv3 adjacency formed successfully between routers with router IDs 1.1.1.1 and 2.2.2.2.

C.The adjacency is stuck in Exstart state due to interface MTU mismatch.

D.The router is the DR on this segment.

AnswerB

The debug shows the neighbor with router ID 2.2.2.2 and the adjacency reaching Full.

Why this answer

The debug output shows the successful OSPFv3 adjacency formation between two routers on interface Gi0/0.

Full explanation →

1288

MCQmedium

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Down R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:36 192.168.1.2 GigabitEthernet0/0 Based on this output, what is the most likely conclusion?

A.The OSPF neighbor is down.

B.The EEM policy has been triggered.

C.The EEM policy is registered but not yet triggered because the OSPF neighbor is up.

D.The EEM policy is misconfigured.

AnswerC

The neighbor state FULL shows the neighbor is operational, so the down event has not occurred.

Why this answer

The EEM policy OSPF_Neighbor_Down is registered, but the OSPF neighbor is in FULL state. The correct answer is that the EEM policy has not been triggered because the OSPF neighbor is up.

Full explanation →

1289

MCQmedium

A network engineer runs the following command on Router R1: R1# show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete N: NATed, L: Local, X: No Socket #Ent -> Number of NHRP entries with same NBMA peer NHS Status: E => Expecting Replies, R => Responding, W => Waiting UpDn Time -> Up or Down Time for a Tunnel ========================================================================== Interface: Tunnel0, IPv4 NHRP Details Type:Hub, NHRP Peers:2, # Ent Peer NBMA Addr Peer Tunnel Addr State UpDn Tm Attrb ----- --------------- ---------------- ----- -------- ----- 1 10.1.1.2 172.16.0.2 UP 00:02:15 D 1 10.1.1.3 172.16.0.3 UP 00:01:45 D Based on this output, which statement is correct?

A.Router R1 is a spoke with two hub peers.

B.Router R1 is a hub with two dynamically registered spokes.

C.The NHRP peers are static and not dynamic.

D.One spoke is experiencing a registration failure.

AnswerB

Type:Hub and two dynamic (D) entries confirm this.

Why this answer

The show dmvpn command displays NHRP peers. The output shows two dynamic peers (D) with their NBMA and tunnel addresses. The hub has two spokes registered, both in UP state.

The correct answer identifies the role and peer count.

Full explanation →

1290

MCQmedium

A network engineer is troubleshooting a site-to-site VPN that intermittently drops. The engineer configured IP SLA 10 to track reachability of the remote LAN gateway (10.1.2.1) using ICMP echo probes every 5 seconds. The IP SLA is used in a static route to influence failover. The engineer notices that the IP SLA state shows 'Active' but the tracked route is not installed. What is the most likely cause?

A.The IP SLA probe is sending packets to the wrong destination IP.

B.The track object is configured with 'ip sla 10 reachability' but the static route references the track object incorrectly.

C.The IP SLA probe frequency is too high, causing the router to ignore the results.

D.The remote gateway is not responding to ICMP echo requests due to firewall rules.

AnswerB

If the track object is not properly linked (e.g., 'track 1 ip sla 10 reachability' missing), or the static route uses a different track number, the route will not be installed even though the IP SLA is active.

Why this answer

The IP SLA is active, but the tracked object might not be configured correctly to react to the IP SLA state. The issue is that the track object is not linked to the IP SLA or the threshold is misconfigured.

Full explanation →

1291

MCQmedium

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue: R1# show bgp neighbors 10.0.0.2 advertised-routes Output: BGP table version is 10, local router ID is 10.0.0.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.1.1.0/24 0.0.0.0 0 32768 i *> 10.2.2.0/24 0.0.0.0 0 32768 i Total number of prefixes 2 What does this output indicate?

A.R1 is advertising two local prefixes to BGP neighbor 10.0.0.2

B.R1 is receiving two prefixes from BGP neighbor 10.0.0.2

C.R1 has no BGP routes

D.R1 is using OSPF to learn these prefixes

AnswerA

The output shows two prefixes with next hop 0.0.0.0, indicating local origin, being advertised.

Why this answer

The show bgp neighbors advertised-routes command displays routes that the router is advertising to the specified neighbor. Here, R1 is advertising two prefixes (10.1.1.0/24 and 10.2.2.0/24) to neighbor 10.0.0.2. Both are locally originated (next hop 0.0.0.0) with origin IGP.

Full explanation →

1292

MCQhard

Router R1 and R2 are running EIGRP as the IGP, and R1 is redistributing a connected subnet 10.1.1.0/24 into EIGRP. R2 also runs BGP with an external peer, and BGP is redistributing the same prefix 10.1.1.0/24 into EIGRP with a route-map that sets the administrative distance to 100. On R3, a downstream EIGRP router, 'show ip route 10.1.1.0' shows the route via R2. What is the most likely cause of suboptimal routing?

A.The route-map set distance 100 overrides the default AD, making the redistributed route preferred over the internal route (AD 90).

B.The internal EIGRP route is not present in R3's routing table due to a distribute-list inbound from R1, so the redistributed route with AD 100 is the only path.

C.The redistributed route has AD 170 by default, and the route-map is ignored because redistribution from BGP always uses AD 170.

D.R3 prefers routes with lower metric, not AD, and the redistributed route has a better metric.

AnswerB

If the internal route is filtered, the redistributed route becomes the best path, causing suboptimal routing.

Why this answer

EIGRP internal routes have AD 90, external routes AD 170. Redistribution from BGP into EIGRP creates external routes (AD 170) unless a route-map changes the distance. Setting AD to 100 makes the redistributed route preferred over the original internal route (AD 90) because 100 > 90, so the internal route should be preferred.

However, if the internal route is not present due to a filter, or if the distance is set lower than 90, the redistributed route is chosen. The correct answer is that the route-map set distance 100 is higher than 90, so the internal route (AD 90) is still preferred; the issue is that the internal route is being suppressed by a distribute-list on R3.

Full explanation →

1293

MCQeasy

Which default administrative distance is assigned to routes learned via the Open Shortest Path First (OSPF) protocol?

A.90

B.110

C.115

D.120

AnswerB

110 is the correct default AD for OSPF routes.

Why this answer

OSPF routes have a default administrative distance of 110, as defined by Cisco IOS.

Full explanation →

1294

MCQeasy

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 3000(3) Gi0/0 Session state is UP and not using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 3000(0) Rx Count: 100, Tx Count: 100 Based on this output, what is the BFD session's local discriminator?

A.The local discriminator is 1.

B.The local discriminator is 3.

C.The local discriminator is 10.1.1.1.

D.The local discriminator is 10.1.1.2.

AnswerA

The LD (Local Discriminator) is 1 as shown in the output.

Why this answer

The local discriminator is the LD value shown in the output. In this case, it is 1.

Full explanation →

1295

MCQmedium

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue: R1# show bgp neighbors 10.1.1.2 advertised-routes BGP table version is 14, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.0.0.0/24 0.0.0.0 0 32768 i *> 192.168.1.0/24 0.0.0.0 0 32768 i Total number of prefixes 2 What does this output indicate?

A.R1 is receiving two routes from neighbor 10.1.1.2.

B.R1 is advertising two routes to neighbor 10.1.1.2, both originated locally.

C.R1 is advertising two routes, but one is suppressed due to dampening.

D.R1 is advertising two routes, but the neighbor is not receiving them due to filtering.

AnswerB

The next hop 0.0.0.0 indicates local origin, and the output shows two prefixes.

Why this answer

The show bgp neighbors advertised-routes command shows routes that R1 is advertising to neighbor 10.1.1.2. The output lists two prefixes: 10.0.0.0/24 and 192.168.1.0/24. The next hop of 0.0.0.0 indicates these are locally originated routes (e.g., via network statement or redistribution).

Full explanation →

1296

MCQhard

A network engineer is troubleshooting a redistribution issue between OSPF and EIGRP. Router R1 redistributes OSPF into EIGRP, and Router R2 redistributes EIGRP into OSPF. After configuration, some routes are missing, and routing loops occur. R1 has: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 route-map OSPF-to-EIGRP. R2 has: router ospf 1 redistribute eigrp 100 subnets route-map EIGRP-to-OSPF. Show ip route on R1 shows an OSPF route 172.16.1.0/24 learned via R2, but also an EIGRP route for the same prefix with a better administrative distance. What is the root cause?

A.The route-map OSPF-to-EIGRP on R1 should include a match clause to filter out routes learned from R2 via OSPF, preventing feedback.

B.The redistribute command on R2 should have a metric-type 1 to avoid suboptimal routing.

C.The administrative distance of OSPF should be changed to 85 on R1 to prefer OSPF over EIGRP.

D.The EIGRP metric on R1 should be set to a higher value to make the redistributed route less preferred.

AnswerA

Adding a match route-map that tags routes from R2 and denies them, or using a tag-based filter, stops the redistribution loop.

Why this answer

The route-map OSPF-to-EIGRP on R1 is not filtering out the OSPF route 172.16.1.0/24 that was originally redistributed from EIGRP into OSPF by R2. This creates a routing feedback loop: R1 learns the prefix via OSPF (from R2) and then redistributes it back into EIGRP, causing R2 to see an EIGRP route with a better administrative distance (90 vs. 110) and prefer it, leading to missing routes and loops. The route-map should include a match clause to deny routes that were originally EIGRP (e.g., via a tag or prefix-list) to prevent mutual redistribution.

Exam trap

Cisco often tests the concept of mutual redistribution and route feedback loops, where candidates mistakenly focus on metric or administrative distance adjustments instead of recognizing that a route-map filter is required to break the redistribution cycle.

How to eliminate wrong answers

Option B is wrong because changing the metric-type to 1 on R2's redistribute command would affect the OSPF metric type (E1 vs. E2) but does not address the root cause of route feedback and administrative distance preference. Option C is wrong because modifying OSPF's administrative distance to 85 on R1 would make OSPF routes preferred over EIGRP (AD 90), but this only masks the symptom; the feedback loop would still exist, and routes could still be missing or cause instability.

Option D is wrong because increasing the EIGRP metric on R1's redistribute command would make the redistributed route less preferred within EIGRP, but the problem is that R1 is redistributing a route it learned via OSPF back into EIGRP, and the metric adjustment does not prevent the feedback loop.

Full explanation →

1297

MCQhard

A network engineer is troubleshooting why the NMS cannot poll SNMP data from router R5. The router has 'snmp-server community cisco RO' configured. The NMS is on subnet 192.168.1.0/24, and the router has an ACL applied to the VTY lines that permits only 10.0.0.0/8. The NMS can ping the router. What is the most likely cause?

A.The engineer applied an ACL to the SNMP community that denies the NMS subnet, but the VTY ACL is unrelated.

B.The VTY ACL is blocking SNMP packets because SNMP uses TCP port 161.

C.The router needs the 'snmp-server ifindex persist' command to enable polling.

D.The NMS is using SNMPv3, but the router only has SNMPv2c configured.

AnswerA

Correct because the community string's ACL must permit the NMS; the VTY ACL does not affect SNMP.

Why this answer

The NMS can ping the router, confirming IP connectivity, but it cannot poll SNMP data. The VTY ACL only controls Telnet/SSH access to the router's VTY lines, not SNMP traffic, which uses UDP port 161. The most likely cause is that an ACL has been applied directly to the SNMP community string (via the `snmp-server community cisco RO <acl-number>` command) that denies the NMS subnet 192.168.1.0/24, blocking SNMP polling while leaving ping and VTY access unaffected.

Exam trap

Cisco often tests the misconception that VTY ACLs control all management plane traffic, including SNMP, when in fact VTY ACLs only apply to Telnet/SSH sessions, and SNMP is controlled by ACLs applied directly to the community string or via SNMP views.

How to eliminate wrong answers

Option B is wrong because SNMP uses UDP port 161 for polling (not TCP), and VTY ACLs only filter inbound Telnet/SSH sessions, not SNMP traffic. Option C is wrong because the `snmp-server ifindex persist` command is used to maintain interface index persistence across reboots for MIB stability, not to enable or disable SNMP polling. Option D is wrong because if the NMS were using SNMPv3 and the router only had SNMPv2c configured, the NMS would typically receive a 'noResponse' or authentication error, but the question states the router has `snmp-server community cisco RO` configured, which is an SNMPv2c community string; the NMS could still fall back to SNMPv2c, and this scenario does not explain why polling fails while ping succeeds.

Full explanation →

1298

MCQmedium

Examine the following EIGRP configuration on Router R6: interface GigabitEthernet0/2 ip hello-interval eigrp 100 15 ip hold-time eigrp 100 45 What is the effect of these commands?

A.EIGRP will send hello packets every 15 seconds and wait 45 seconds before declaring a neighbor down.

B.EIGRP will send hello packets every 45 seconds and wait 15 seconds.

C.EIGRP will use the default hello interval of 5 seconds and hold time of 15 seconds.

D.EIGRP will not form neighbor adjacencies because the hold time is not a multiple of the hello interval.

AnswerA

The hello interval is set to 15 seconds, and hold time to 45 seconds.

Why this answer

The commands set a non-default hello interval of 15 seconds and a hold time of 45 seconds for EIGRP AS 100 on GigabitEthernet0/2. EIGRP uses the hello interval to determine how often it sends hello packets, and the hold time is the duration the router waits without receiving a hello before declaring the neighbor down. Option A correctly describes this behavior.

Exam trap

The trap here is that candidates often assume the hold time must be a multiple of the hello interval (e.g., 3x), but Cisco does not enforce this mathematically—only that the hold time is greater than the hello interval to avoid premature neighbor loss.

How to eliminate wrong answers

Option B is wrong because it reverses the values: the hello interval is 15 seconds, not 45, and the hold time is 45 seconds, not 15. Option C is wrong because the commands explicitly override the default hello interval (5 seconds on high-speed interfaces) and hold time (15 seconds) with the configured values. Option D is wrong because EIGRP does not require the hold time to be a multiple of the hello interval; the hold time must simply be greater than the hello interval to prevent flapping, and 45 is greater than 15, so adjacency can form.

Full explanation →

1299

Drag & Dropmedium

Drag and drop the steps to troubleshoot IP SLA adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Start by verifying the IP SLA operation state to see if it is active or failed, then check reachability to the target using extended ping with the same source, inspect the IP SLA configuration for errors, review access lists or routing that may block probes, and finally adjust parameters like threshold or timeout as needed.

Full explanation →

1300

MCQhard

A network engineer configures EEM to monitor routing table changes on R1. R1 has: event manager applet ROUTE-MONITOR event syslog pattern "%ROUTING-5-ROUTECHANGE" action 1.0 cli command "enable" action 2.0 cli command "show ip route" action 3.0 syslog msg "Routing table changed". After a route update, the engineer notices that the applet runs but the show ip route output does not reflect the change. Router R2 shows: the route is present in the routing table. What is the root cause?

A.The syslog message is generated before the routing table is updated, so the show command shows the old table.

B.The syslog pattern is incorrect; it should be %ROUTING-5-ROUTECHANGED.

C.The routing protocol is not fully converged due to a hold-down timer.

D.The 'show ip route' command is not executed in privileged mode.

AnswerA

The applet executes before the routing table change is committed; a delay is needed.

Why this answer

The syslog message %ROUTING-5-ROUTECHANGE is generated before the routing table is fully updated. The EEM applet runs immediately, capturing the routing table before the change is applied. The correct fix is to add a delay using 'action wait' to allow the routing table to converge.

Full explanation →

1301

MCQmedium

An engineer is troubleshooting an EIGRP issue where a router is not learning any routes from a neighbor, but the neighbor adjacency is up. The engineer checks the EIGRP topology table on the local router and sees that the neighbor is listed, but no routes from that neighbor are present. The engineer also verifies that the neighbor has routes to advertise. What is the most likely cause?

A.The neighbor is configured as an EIGRP stub router.

B.The local router has a distribute-list out applied to the neighbor.

C.The EIGRP metric weights are different on the two routers.

D.The local router has a route-map applied to the EIGRP process that is filtering all routes.

AnswerA

Correct because a stub router only advertises connected and summary routes by default, so if the neighbor has other routes, they will not be advertised.

Why this answer

When an EIGRP neighbor adjacency is up but no routes are received from the neighbor, the most likely cause is that the neighbor is configured as an EIGRP stub router. A stub router advertises only a default route or its directly connected and summary routes, depending on the stub setting, and does not advertise all learned routes. Since the engineer confirmed the neighbor has routes to advertise, the stub configuration on the neighbor would prevent those routes from being sent, even though the adjacency remains established.

Exam trap

Cisco often tests the distinction between conditions that prevent adjacency formation (like mismatched K values or AS numbers) versus conditions that allow adjacency but suppress route advertisement (like stub configuration), leading candidates to incorrectly select metric weight mismatches when the adjacency is already up.

How to eliminate wrong answers

Option B is wrong because a distribute-list out applied to the neighbor would filter routes on the local router before sending them, not affect routes received from the neighbor; the issue is about not learning routes, not about sending them. Option C is wrong because mismatched EIGRP metric weights (K values) prevent the neighbor adjacency from forming entirely, but the adjacency is up, so this cannot be the cause. Option D is wrong because a route-map applied to the EIGRP process on the local router would filter routes after they are received, but the topology table shows no routes from the neighbor at all, indicating the routes are not being advertised by the neighbor, not that they are being filtered inbound.

Full explanation →

1302

MCQhard

DMVPN phase 2 network: spoke-to-spoke tunnels fail. Router Spoke1 has: tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp nhs 10.0.0.1. Router Spoke2 shows: show dmvpn includes Spoke1 in NHRP cache but no spoke-to-spoke tunnel. What is the root cause?

A.Spoke1 and Spoke2 have different NHRP network IDs.

B.The hub is not configured with ip nhrp redirect, preventing shortcut initiation.

C.Spoke1 has a firewall blocking GRE traffic.

D.The tunnel mode should be point-to-point for spoke-to-spoke.

AnswerB

Without redirect, spokes do not learn each other's real IPs for direct tunnels.

Why this answer

In a DMVPN Phase 2 network, spoke-to-spoke tunnels require the hub to send NHRP redirect messages to inform spokes of the shortcut path. Without the 'ip nhrp redirect' command on the hub, spokes will not attempt to build direct tunnels, even if they have each other's NHRP cache entries. This is the root cause because Spoke1 and Spoke2 can see each other in the NHRP cache but lack the trigger to initiate the spoke-to-spoke GRE tunnel.

Exam trap

Cisco often tests the distinction between NHRP cache entries (which indicate registration and mapping) and the actual tunnel establishment, which requires additional mechanisms like NHRP redirect in Phase 2 or NHRP shortcut switching in Phase 3.

How to eliminate wrong answers

Option A is wrong because different NHRP network IDs would prevent the spokes from registering with the hub and appearing in each other's NHRP cache, but the scenario states Spoke1 is in the NHRP cache of Spoke2, so the network IDs must match. Option C is wrong because a firewall blocking GRE traffic would prevent any tunnel establishment, including the hub-to-spoke tunnels, but the scenario indicates that spoke-to-hub tunnels are working (since NHRP registration succeeded). Option D is wrong because DMVPN Phase 2 requires multipoint GRE (mGRE) on spokes to support multiple tunnel endpoints; point-to-point tunnels would only allow a single destination and break the DMVPN architecture.

Full explanation →

1303

MCQhard

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, OSPF adjacencies go down. The policy includes a class that matches OSPF traffic with a police rate of 1000 pps. Which is the most likely explanation?

A.The OSPF traffic is matched by class-default, which has a low police rate or is set to drop, causing hello packets to be dropped.

B.The police rate of 1000 pps is too low for OSPF hello packets.

C.CoPP only applies to management traffic, not routing protocols.

D.The OSPF process is not configured to use the control plane policy.

AnswerA

If OSPF is not explicitly matched in a higher class, it falls to class-default, which may have a restrictive policy.

Why this answer

When CoPP is applied, any traffic not explicitly matched by a user-defined class falls into class-default. If class-default has a low police rate or is configured to drop packets, OSPF hello packets (which are critical for adjacency maintenance) will be dropped, causing OSPF adjacencies to go down. The OSPF traffic is likely not being matched by the intended class due to incorrect classification or ordering, leaving it to be processed by class-default.

Exam trap

Cisco often tests the misconception that CoPP only affects management traffic, but the trap here is that class-default can inadvertently drop critical routing protocol packets if not properly configured, leading to adjacency loss.

How to eliminate wrong answers

Option B is wrong because a police rate of 1000 pps is generally more than sufficient for OSPF hello packets, which are small and sent every 10 seconds (default) or 30 seconds on broadcast networks; the issue is not the rate but the misclassification. Option C is wrong because CoPP is explicitly designed to protect the control plane by policing all traffic destined to the router, including routing protocol traffic like OSPF, not just management traffic (e.g., SSH, SNMP). Option D is wrong because CoPP is applied globally via the 'control-plane' configuration and does not require per-protocol configuration; OSPF automatically uses the control plane for packet processing.

Full explanation →

1304

MCQhard

A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: event manager applet BGP-MONITOR event syslog pattern "%BGP-3-NOTIFICATION" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp *" action 3.0 syslog msg "BGP session cleared by EEM". Router R2 shows: BGP neighbor 10.1.1.1 has been up for 0:00:05, state Established. What is the root cause?

A.The EEM applet is triggered by the BGP notification and clears all BGP sessions, causing a reset loop.

B.The BGP keepalive timer is set too low on R1.

C.The syslog pattern is incorrect and matches unrelated messages.

D.There is an MTU mismatch between R1 and R2.

AnswerA

The applet clears all BGP sessions upon any BGP notification, which exacerbates the issue.

Why this answer

The EEM applet triggers on any BGP notification syslog and then executes a clear ip bgp * command, which resets all BGP sessions. This creates a loop: a BGP notification causes a clear, which causes more notifications, leading to persistent flapping. The correct fix is to make the applet more specific or avoid clearing all sessions.

Full explanation →

1305

MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes for the same prefix. The engineer also applies an inbound ACL on the OSPF interface to deny certain routes from being learned via OSPF. After the ACL is applied, the router still has the prefix in the routing table, but it is learned via EIGRP instead of OSPF. What is the most likely explanation?

A.The ACL blocks OSPF updates, so the router learns the prefix via EIGRP with a lower AD.

B.The ACL is applied outbound, so it filters OSPF routes being sent to the neighbor.

C.The router has a static route for the prefix with AD 1.

D.The OSPF process has a distribute-list that is filtering the route.

AnswerA

The ACL prevents OSPF from learning the route, but redistribution allows EIGRP to carry it, and EIGRP's lower AD makes it the best path.

Why this answer

The inbound ACL on the OSPF interface blocks the OSPF-learned route from being installed in the routing table. Since mutual redistribution is configured, the same prefix is also learned via EIGRP. EIGRP has a default administrative distance (AD) of 90 for internal routes, which is lower than OSPF's AD of 110.

Therefore, the router selects the EIGRP route as the best path, and the prefix remains in the routing table but now points to the EIGRP next hop.

Exam trap

Cisco often tests the distinction between filtering routing updates via an interface ACL (which blocks the entire OSPF packet, preventing route learning) versus using a distribute-list (which filters specific routes within the routing process), leading candidates to confuse the two mechanisms.

How to eliminate wrong answers

Option B is wrong because the question explicitly states the ACL is applied inbound on the OSPF interface, not outbound; an outbound ACL would filter routes being sent to a neighbor, not affect routes received by the local router. Option C is wrong because a static route with AD 1 would always be preferred over both OSPF (AD 110) and EIGRP (AD 90), but the scenario describes the prefix being learned via EIGRP, not a static route; there is no mention of a static route being configured. Option D is wrong because a distribute-list under the OSPF process could filter the route, but the question states the ACL is applied directly on the OSPF interface, not as a distribute-list; a distribute-list is a separate filtering mechanism that operates on routing updates within the OSPF process, not on the interface itself.

Full explanation →

1306

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf database external 10.1.1.0 OSPF Router with ID (1.1.1.1) (Process ID 1) Type-5 AS External Link States (Area 0) LS age: 120 Options: (No TOS-capability, DC) LS Type: AS External Link Link State ID: 10.1.1.0 (External Network Number) Advertising Router: 2.2.2.2 LS Seq Number: 80000001 Checksum: 0x1234 Length: 36 Network Mask: /24 Metric Type: 2 (Larger than any link state path) TOS: 0 Metric: 20 Forward Address: 0.0.0.0 External Route Tag: 100 Based on this output, which statement is correct?

A.The route 10.1.1.0/24 is redistributed into OSPF from another protocol with a route-map setting the tag to 100.

B.The route 10.1.1.0/24 is an OSPF inter-area route from area 0.

C.The metric of 20 indicates the route is redistributed with a default metric of 20, which is correct for Type 1 external routes.

D.The forward address of 0.0.0.0 indicates that the next hop is the advertising router 2.2.2.2.

AnswerA

The External Route Tag of 100 is a common indicator that a route-map was used during redistribution to set the tag.

Why this answer

The output shows an OSPF Type-5 external LSA for 10.1.1.0/24 with Metric Type 2 and Metric 20. The default metric for redistributed routes in OSPF is 20 for Type 2. The External Route Tag of 100 indicates a redistribution tag, often used for filtering or route-maps.

Full explanation →

1307

Multi-Selecthard

Which THREE commands are used to troubleshoot and verify device access control when using TACACS+ authentication on a Cisco IOS router? (Choose THREE.)

Select 3 answers

A.debug tacacs

B.show tacacs

C.test aaa group tacacs+ <username> <password>

D.debug radius authentication

E.show aaa method-list

AnswersA, B, C

This command provides detailed debugging of TACACS+ authentication and authorization packets.

Why this answer

The 'debug tacacs' command enables real-time logging of TACACS+ authentication, authorization, and accounting transactions, allowing you to observe the exact packets exchanged between the router and the TACACS+ server, including authentication failures or successes. Option B is correct because 'show tacacs' displays the current TACACS+ server statistics, including the number of successful and failed authentication attempts, server status, and the number of pending requests, which is essential for verifying connectivity and performance. Option C is correct because 'test aaa group tacacs+ <username> <password>' directly tests the TACACS+ authentication process by sending a simulated authentication request to the configured TACACS+ server group, confirming whether the server is reachable and the credentials are valid.

Exam trap

Cisco often tests the distinction between TACACS+ and RADIUS troubleshooting commands, so the trap here is that candidates may confuse 'debug radius authentication' (Option D) as applicable to TACACS+ or assume that 'show aaa method-list' (Option E) is a valid command for verifying TACACS+ server status, when in fact it does not exist and the correct command is 'show aaa method-lists'.

Full explanation →

1308

MCQmedium

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show monitor session 3 detail Session 3 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/0 Destination IP : 10.1.1.1 ERSPAN ID : 100 What does this output indicate?

A.The session is correctly configured as an ERSPAN source session.

B.The session is misconfigured because the destination must be a VLAN, not an IP.

C.The session is misconfigured because the source port must be a VLAN.

D.The session is misconfigured because the ERSPAN ID must match on both source and destination.

AnswerA

The output confirms an ERSPAN source session with a destination IP and ERSPAN ID.

Why this answer

The output shows an ERSPAN source session with source port Gi0/0, destination IP 10.1.1.1, and ERSPAN ID 100. This is the source side of an ERSPAN configuration.

Full explanation →

1309

MCQmedium

Examine the following EEM applet configuration: !--- event manager applet BACKUP_CONFIG event timer watchdog time 86400 action 1.0 cli command "enable" action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg" !--- What is the effect of this configuration?

A.The applet will copy the running configuration to the TFTP server every 24 hours.

B.The applet will copy the startup configuration instead of the running configuration.

C.The applet will fail because the TFTP server IP address is not reachable.

D.The applet will only trigger once because the watchdog timer is a one-shot timer.

AnswerA

Correct. The watchdog timer triggers the applet every 86400 seconds, and the CLI command copies the running config to the TFTP server.

Why this answer

The applet uses a watchdog timer event that triggers every 86400 seconds (24 hours). When triggered, it copies the running configuration to a TFTP server. This is a valid configuration for periodic backup.

Full explanation →

1310

MCQhard

In Flexible NetFlow, what is the default 'collect counter bytes' setting for a flow record?

A.Byte counters are collected by default.

B.Byte counters are never collected in Flexible NetFlow.

C.Byte counters are collected only if the flow monitor includes the 'collect counter bytes' command.

D.Byte counters are collected by default only for IPv6 flows.

AnswerC

Correct. Byte counters require explicit configuration.

Why this answer

By default, byte counters are not collected unless explicitly configured with 'collect counter bytes' in the flow record.

Full explanation →

1311

Multi-Selecthard

Which TWO statements about the 'show policy-map control-plane' command output are true? (Choose TWO.)

Select 2 answers

A.The output displays the number of packets that matched each class in the CoPP policy.

B.The output includes the number of packets dropped by each class due to policing.

C.The output shows the routing table entries that are affected by the CoPP policy.

D.The output displays the CoPP policy applied to each physical interface.

E.The output includes the ARP cache entries that are protected by CoPP.

AnswersA, B

Correct. The command shows per-class packet and byte counters for matched traffic.

Why this answer

The 'show policy-map control-plane' command output displays per-class packet statistics, including the number of packets that matched each class in the Control Plane Policing (CoPP) policy. This allows administrators to verify which traffic types are being classified and how much traffic is hitting the control plane.

Exam trap

Cisco often tests the distinction between CoPP (control plane-wide policy) and per-interface QoS policies, leading candidates to incorrectly assume that 'show policy-map control-plane' shows interface-level details.

Full explanation →

1312

MCQeasy

An engineer is troubleshooting an EIGRP issue where a router is not learning a specific route from a neighbor, but other routes from the same neighbor are being learned. The engineer checks the EIGRP topology table and sees that the route is not present. The engineer also checks the neighbor's routing table and confirms that the route exists. What is the most likely cause?

A.A distribute-list in is applied on the local router that filters the specific route.

B.The neighbor is configured as a stub router.

C.The route is a summary route that is being suppressed by the 'summary-address' command.

D.The EIGRP metric for the route is too high, so it is not considered feasible.

AnswerA

Correct because a distribute-list can filter specific routes based on prefix or other criteria.

Why this answer

A distribute-list in applied on the local router can filter specific incoming routes from an EIGRP neighbor while allowing others. Since the neighbor has the route in its routing table and other routes from the same neighbor are learned, the most likely cause is an inbound filter that explicitly denies that particular prefix.

Exam trap

Cisco often tests the distinction between inbound and outbound filtering, and candidates may mistakenly think a stub router or metric issue causes selective route absence, but only a distribute-list in can filter a single route from an otherwise fully functional neighbor relationship.

How to eliminate wrong answers

Option B is wrong because a stub router advertises only a default route or connected/summary routes, but the neighbor still has the specific route in its routing table, so stub configuration would not cause selective filtering of one route. Option C is wrong because a summary route suppressed by the 'summary-address' command would affect the advertisement from the local router, not the learning of a specific route from a neighbor. Option D is wrong because EIGRP metric values do not prevent a route from being learned; if the route is not feasible due to metric, it would appear in the topology table as an active or stuck-in-active state, not be completely absent.

Full explanation →

1313

MCQhard

An engineer enables 'ipv6 destination guard' on a switch to prevent IPv6 address spoofing. After configuration, a legitimate host on a port is unable to receive traffic from the network, although it can send traffic. The host has a global unicast address. The switch logs show that destination guard is dropping packets destined to that host. What is the most likely cause?

A.The host uses IPv6 privacy extensions and changes its address frequently, but the binding table only has the original address.

B.Destination Guard blocks all global unicast addresses by default.

C.The switch port is not configured as 'trusted' for destination guard.

D.The host is using a link-local address, which destination guard does not support.

AnswerA

Destination Guard relies on static bindings; privacy addresses are not learned.

Why this answer

IPv6 destination guard relies on the IPv6 neighbor discovery (ND) binding table to validate destination addresses. If the host uses IPv6 privacy extensions (RFC 4941), it generates temporary addresses that change frequently. The binding table only contains the original address learned from the initial ND exchange, so packets destined to the new temporary address are dropped as spoofed, even though the traffic is legitimate.

Exam trap

Cisco often tests the interaction between IPv6 first-hop security features and privacy extensions, where candidates mistakenly think the issue is a trust configuration or address type rather than the dynamic nature of temporary addresses in the binding table.

How to eliminate wrong answers

Option B is wrong because destination guard does not block all global unicast addresses by default; it only blocks addresses that are not in the binding table. Option C is wrong because the 'trusted' port configuration is used for IPv6 source guard or RA guard, not for destination guard; destination guard uses the binding table regardless of trust state. Option D is wrong because destination guard fully supports link-local addresses; the issue described involves a global unicast address, and the host can send traffic, which indicates link-local communication is working.

Full explanation →

1314

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip bgp neighbors 192.168.1.2 BGP neighbor is 192.168.1.2, remote AS 65001, external link BGP version 4, remote router ID 10.2.2.2 BGP state = Established, up for 00:15:00 Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds Neighbor sessions: 1 active, is multisession capable Neighbor capabilities: Route refresh: advertised and received(new) Four-octets ASN: advertised and received Address family IPv4 Unicast: advertised and received Enhanced Refresh: advertised Message statistics: InQ depth is 0 OutQ depth is 0 Sent Rcvd Opens: 1 1 Notifications: 0 0 Updates: 10 5 Keepalives: 15 15 Route Refresh: 0 0 Total: 26 21 Default minimum time between advertisement runs is 30 seconds For address family: IPv4 Unicast Session: 192.168.1.2 BGP table version 14, neighbor version 14/0 Output queue size : 0 Index 1, Advertise bit 0 1 update-group member Incoming update prefix filter list: FILTER_IN Outgoing update prefix filter list: FILTER_OUT Sent Rcvd Prefixes: 2 2 Updates: 10 5 Based on this output, what is the effect of the prefix lists?

A.The prefix lists FILTER_IN and FILTER_OUT are allowing only 2 prefixes in each direction.

B.The prefix lists are blocking all prefixes.

C.The prefix lists are not applied because the session is established.

D.The prefix lists are misconfigured and causing route flapping.

AnswerA

The counters show 2 prefixes sent and received, matching the filter lists.

Why this answer

The output shows that incoming and outgoing prefix filters (FILTER_IN and FILTER_OUT) are applied. The prefixes sent and received are both 2, indicating that the filters are allowing exactly 2 prefixes in each direction. The correct answer is that the prefix lists are filtering routes to only 2 prefixes.

Full explanation →

1315

MCQhard

What is the default behavior of BGP synchronization in Cisco IOS-XE?

A.Enabled by default

B.Disabled by default

C.Enabled only for iBGP

D.Disabled only for eBGP

AnswerB

Correct. BGP synchronization is off by default.

Why this answer

BGP synchronization is disabled by default in IOS-XE; routes can be advertised without being in the IGP.

Full explanation →

1316

MCQmedium

A network engineer runs the following command to troubleshoot a SPAN issue: R1# debug monitor session 1 *Mar 1 00:00:01.123: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1 *Mar 1 00:00:02.456: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1 What does this output indicate?

A.The SPAN session is correctly forwarding packets from Gi0/0 to Gi0/1.

B.The SPAN session is misconfigured because packets should not be forwarded.

C.The SPAN session is misconfigured because the debug output shows errors.

D.The SPAN session is misconfigured because the destination port is not specified.

AnswerA

The debug output confirms successful packet forwarding.

Why this answer

The debug output shows that packets captured on source port Gi0/0 are being forwarded to destination port Gi0/1 for session 1. This indicates that the SPAN session is operational.

Full explanation →

1317

MCQmedium

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

A.Disable all EEM applets.

B.Use the 'show event manager statistics' command to see which applets are triggered most often.

C.Increase the router's CPU priority for the EEM process.

D.Change the syslog trigger to use a less frequent pattern.

AnswerB

Correct because this command provides per-applet trigger counts, helping pinpoint the culprit.

Why this answer

High CPU from EEM is often due to excessive syslog triggers. The engineer should first identify which applets are being triggered most frequently and either optimize their conditions or reduce the number of applets.

Full explanation →

1318

MCQeasy

What is the default OSPF network type for a tunnel interface configured with 'tunnel mode gre multipoint'?

A.Broadcast

B.Point-to-multipoint

C.Point-to-point

D.Non-broadcast

AnswerA

The default OSPF network type for multipoint GRE tunnels is broadcast.

Why this answer

By default, a multipoint GRE tunnel interface uses the broadcast network type, which requires DR/BDR elections.

Full explanation →

1319

MCQeasy

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show crypto engine connections active Crypto Engine Connections ID Type Algorithm Encrypt Decrypt LastSeqNo 1 IPsec ESP-3DES+SHA 0 0 0 2 IPsec ESP-3DES+SHA 0 0 0 3 IPsec ESP-AES+SHA 0 0 0 What does this output indicate?

A.The IPsec VPN is actively encrypting and decrypting traffic.

B.The IPsec SAs are established but no traffic is flowing, possibly due to routing or ACL issues.

C.The crypto engine is overloaded and cannot process packets.

D.The IPsec SAs are using the wrong transform set.

AnswerB

Zero packets suggest the SAs are idle; the issue is likely with traffic matching the crypto ACL or routing.

Why this answer

The output shows three IPsec Security Associations (SAs) with zero encrypted and zero decrypted packets, and a LastSeqNo of 0. This indicates the SAs are established (the tunnels are up) but no traffic is being processed through them. The most common causes are routing issues preventing traffic from reaching the tunnel interface, or ACLs that do not match the interesting traffic for encryption.

Exam trap

Cisco often tests the misconception that a non-zero number of SAs in 'show crypto engine connections active' automatically means traffic is flowing, when in fact the Encrypt/Decrypt counters must be checked to confirm actual data processing.

How to eliminate wrong answers

Option A is wrong because the Encrypt and Decrypt counters are both 0, which means no traffic is being encrypted or decrypted; active encryption would show non-zero counts. Option C is wrong because the crypto engine is not overloaded; an overloaded engine would typically show high packet counts or errors, not all zeros. Option D is wrong because the output does not indicate a transform set mismatch; mismatched transform sets would prevent SA establishment entirely, but here the SAs are listed (ID 1, 2, 3), meaning Phase 2 negotiation succeeded.

Full explanation →

1320

Multi-Selectmedium

Which TWO commands verify the operational status of a local SPAN session on a Cisco IOS-XE switch? (Choose TWO.)

Select 2 answers

A.show monitor session 1

B.show monitor

C.show spanning-tree

D.show interfaces

E.show vlan

AnswersA, B

Displays detailed information about a specific SPAN session, including source, destination, and operational status.

Why this answer

The 'show monitor session 1' command displays details of a specific SPAN session, including source and destination interfaces and operational state. The 'show monitor' command lists all configured SPAN sessions and their status. 'show spanning-tree' is unrelated, 'show interfaces' does not show SPAN status, and 'show vlan' is for VLAN information.

Full explanation →

1321

MCQmedium

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# show route-map PBR-MAP route-map PBR-MAP, permit, sequence 10 Match clauses: ip address (access-lists): 101 Set clauses: ip next-hop 10.1.1.2 ip next-hop verify-availability Policy routing matches: 0 packets, 0 bytes What does this output indicate?

A.The route-map is correctly configured but no traffic has matched it yet.

B.The next-hop 10.1.1.2 is unreachable, causing PBR to fail.

C.The access-list 101 is misconfigured and blocking all traffic.

D.The verify-availability feature is preventing any matches.

AnswerA

The packet counter shows 0 matches, so no packets have triggered PBR.

Why this answer

The output shows that the route-map PBR-MAP has a match clause referencing access-list 101 and a set clause with next-hop 10.1.1.2 and next-hop verify-availability. The packet counter is 0, meaning no packets have been policy-routed yet.

Full explanation →

1322

MCQeasy

What is the default OSPF reference bandwidth used in the cost calculation formula on Cisco IOS?

A.10 Mbps

B.100 Mbps

C.1000 Mbps

D.1 Gbps

AnswerB

Cisco IOS uses 100 Mbps as the reference bandwidth by default.

Why this answer

The default reference bandwidth is 100 Mbps, meaning the cost is calculated as 100,000,000 / interface bandwidth in bps.

Full explanation →

1323

MCQhard

A network uses Control Plane Policing (CoPP) to protect the router. Router R1 has CoPP policy applied that rate-limits all traffic to 1 Mbps. R1 shows: 'show policy-map control-plane' indicates drops for EIGRP packets. R1's EIGRP neighbor R2 is flapping. What is the root cause?

A.The CoPP policy rate-limits EIGRP packets to 1 Mbps, but EIGRP hellos are small and frequent; the rate-limit may still drop them if the policer is not properly configured for burst.

B.R2 is sending too many EIGRP packets, exceeding the rate-limit.

C.R1 has an ACL that blocks EIGRP packets before they reach the control plane.

D.The CoPP policy is applied to the wrong interface.

AnswerA

Even small packets can be dropped if the policer uses a strict rate without adequate burst size.

Why this answer

EIGRP hello packets are small and sent frequently (every 5 seconds on most LAN interfaces by default). A CoPP policer that rate-limits all traffic to 1 Mbps without an adequate burst parameter will treat the burst of small hello packets as exceeding the committed burst (Bc), causing drops. These drops prevent EIGRP neighbor keepalives from reaching the control plane, leading to neighbor flapping.

The root cause is not the total bandwidth but the policer's inability to accommodate the packet-per-second (PPS) burst of small EIGRP hellos.

Exam trap

Cisco often tests the misconception that CoPP drops are caused by exceeding the bandwidth rate-limit, when in reality the trap is that small, frequent control-plane packets (like EIGRP hellos) are dropped due to an insufficient burst size, not the overall traffic rate.

How to eliminate wrong answers

Option B is wrong because EIGRP packets, especially hellos, are very small (typically 40-60 bytes) and the total bandwidth used by EIGRP is far below 1 Mbps; the issue is not the volume of traffic but the burst characteristic. Option C is wrong because the question states that drops are shown for EIGRP packets in the CoPP policy, not that packets are blocked by an ACL before reaching the control plane; an ACL would cause drops at the interface level, not within the CoPP policy-map counters. Option D is wrong because CoPP is applied globally to the control plane, not to a specific interface; the 'show policy-map control-plane' output confirms the policy is correctly applied to the control plane itself.

Full explanation →

1324

MCQhard

A network engineer is troubleshooting a router that is generating excessive syslog messages, filling up the local logging buffer and causing performance issues. The engineer wants to reduce the volume of messages sent to the remote syslog server while still capturing critical alerts locally. The current configuration includes 'logging buffered 4096 debugging' and 'logging host 10.1.1.100'. What is the best approach?

A.Change 'logging buffered 4096 debugging' to 'logging buffered 4096 errors' to reduce local messages.

B.Configure 'logging trap errors' under the logging host configuration to limit remote messages to severity 3 and above.

C.Remove the 'logging buffered' command to stop all local logging.

D.Add 'logging rate-limit 10' to limit the number of messages per second.

AnswerB

Correct because 'logging trap errors' sets the remote syslog threshold to severity 3 (errors), reducing volume while keeping local debugging intact.

Why this answer

The 'logging trap errors' command limits the severity of syslog messages sent to the remote syslog server (10.1.1.100) to level 3 (errors) and above, reducing the volume of remote messages while leaving the local 'logging buffered 4096 debugging' unchanged to capture critical alerts locally. This directly addresses the requirement to reduce remote syslog traffic without affecting local logging of critical alerts.

Exam trap

Cisco often tests the distinction between 'logging buffered' (local logging) and 'logging trap' (remote logging severity), and the trap here is that candidates may confuse which command controls local vs. remote syslog filtering, leading them to incorrectly modify the local buffer command (Option A) instead of the remote trap level.

How to eliminate wrong answers

Option A is wrong because changing 'logging buffered 4096 debugging' to 'logging buffered 4096 errors' would reduce local messages to severity 3 and above, which contradicts the requirement to capture critical alerts locally (the engineer wants to keep local logging for critical alerts, not reduce it). Option C is wrong because removing the 'logging buffered' command would stop all local logging entirely, which is not the goal—the engineer wants to keep capturing critical alerts locally. Option D is wrong because 'logging rate-limit 10' limits the rate of syslog messages per second globally (both local and remote), which could suppress critical alerts and does not specifically target remote syslog traffic reduction.

Full explanation →

1325

MCQmedium

A network engineer runs the following command on Router R1: R1# show route-map TEST route-map TEST, permit, sequence 10 Match clauses: ip address (access-lists): 100 Set clauses: metric 50 Policy routing matches: 0 packets, 0 bytes route-map TEST, deny, sequence 20 Match clauses: ip address (access-lists): 101 Set clauses: Policy routing matches: 0 packets, 0 bytes Based on this output, which statement is correct?

A.The route-map is applied to an interface but no traffic has matched it yet.

B.The route-map is misconfigured because sequence 20 does not have a set clause.

C.The route-map will set the metric to 50 for all packets.

D.The route-map is applied globally and is affecting all routing decisions.

AnswerA

The 'Policy routing matches: 0 packets' indicates that the route-map is configured but has not yet been used to route any packets.

Why this answer

The output shows 'Policy routing matches: 0 packets, 0 bytes' for both sequences, which indicates the route-map has been applied to an interface (for policy-based routing) but no traffic has matched any of the match clauses yet. This is the only conclusion that can be drawn from the provided data.

Exam trap

Cisco often tests the distinction between route-maps used for policy-based routing (which show 'Policy routing matches' counters) versus those used for redistribution or routing protocol filtering (which do not show those counters), leading candidates to incorrectly assume a route-map is globally applied.

How to eliminate wrong answers

Option B is wrong because a set clause is not required in a deny sequence; the deny action itself is sufficient to reject matching traffic, and the set clause is irrelevant. Option C is wrong because the route-map only sets the metric to 50 for packets that match access-list 100 in sequence 10, not for all packets; packets matching sequence 20 (deny) or not matching any sequence will not have their metric set. Option D is wrong because the output shows 'Policy routing matches' which is specific to policy-based routing applied on an interface, not a global routing process; route-maps used globally (e.g., with redistribute or route-map in BGP) would not display 'Policy routing matches' counters.

Full explanation →

1326

MCQmedium

A network engineer is troubleshooting an OSPF adjacency that is flapping between two routers. The adjacency forms and then drops repeatedly. Both routers are configured for BFD on the OSPF interface. The engineer checks the BFD session and sees it is up, but the OSPF neighbor state transitions from FULL to DOWN every few seconds. What is the most likely cause of this issue?

A.The BFD timers are set too low on one router.

B.The OSPF dead interval is mismatched between the two routers.

C.The interface is flapping due to a physical issue.

D.BFD is configured with the 'strict-mode' command, causing OSPF to ignore BFD state.

AnswerB

A mismatch in OSPF dead interval (or hello interval) causes the adjacency to reset even if BFD is healthy, because OSPF uses its own keepalive mechanism.

Why this answer

The BFD session is up, so BFD is not causing the flap. The issue is likely a mismatch in OSPF parameters that causes the adjacency to reset independently of BFD.

Full explanation →

1327

Multi-Selecthard

Which TWO statements correctly describe the behavior of automatic 6to4 tunneling? (Choose TWO.)

Select 2 answers

A.The 6to4 prefix is 2002::/16, where the next 32 bits are the IPv4 address of the tunnel source in hexadecimal.

B.A 6to4 relay router must have an IPv6 route to 2002::/16 pointing to the tunnel interface.

C.6to4 tunnels can use private IPv4 addresses as the tunnel source.

D.The 6to4 prefix is 2001::/16, and the IPv4 address is embedded in the interface ID.

E.The tunnel interface must be configured with tunnel mode ipv6ip.

AnswersA, B

Correct. The 6to4 prefix is 2002::/16, and the IPv4 address is embedded in hex in the next 32 bits.

Why this answer

RFC 3056 defines the 6to4 prefix as 2002::/16, and the next 32 bits are the IPv4 address of the tunnel source converted to hexadecimal. This embeds the IPv4 address directly into the IPv6 prefix, allowing automatic tunnel creation without explicit peer configuration.

Exam trap

Cisco often tests the distinction between 6to4 (2002::/16) and Teredo (2001::/16), and candidates mistakenly think private IPv4 addresses are acceptable for 6to4 tunnel sources.

Full explanation →

1328

MCQhard

A large enterprise network is experiencing intermittent IPv6 connectivity between two remote sites connected via an IPv6-in-IPv4 manual tunnel. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 ipv6 route 2001:DB8:2::/64 Tunnel0. Router R2 shows: R2# show ipv6 route 2001:DB8:1::/64 % Route not found. The tunnel interface is up/up on both routers, and IPv4 reachability between tunnel endpoints is verified. What is the root cause?

A.The tunnel destination on R1 is incorrect and should be 198.51.100.2.

B.R2 is missing a static route for 2001:DB8:1::/64 pointing to its Tunnel0 interface.

C.The tunnel mode must be changed to ipv6ip for IPv6-in-IPv4 tunneling.

D.IPv6 unicast-routing is disabled on R2.

AnswerB

Without a return route, R2 cannot forward packets back to R1's IPv6 network.

Why this answer

The issue is that R2 has no route to the 2001:DB8:1::/64 network, which is the tunnel subnet on R1's side. Even though the tunnel is up/up and IPv4 reachability exists, R2 cannot return traffic to R1's tunnel endpoint address because it lacks a static route pointing to its own Tunnel0 interface. This is a common misconfiguration in point-to-point IPv6-in-IPv4 manual tunnels where both sides must have reciprocal static routes for the remote tunnel networks.

Exam trap

Cisco often tests the misconception that if the tunnel is up/up and IPv4 reachability is verified, IPv6 routing will automatically work, but they intentionally omit the reciprocal static route to trap candidates who overlook the need for explicit routing on both sides.

How to eliminate wrong answers

Option A is wrong because the tunnel destination on R1 is 198.51.100.1, which is the tunnel source address of R2; changing it to 198.51.100.2 would be incorrect as that is not the configured tunnel source on R2. Option B is correct and not wrong. Option C is wrong because the default tunnel mode for a manual IPv6-in-IPv4 tunnel is 'ipv6ip' (or 'tunnel mode ipv6ip'), and no mode change is needed; the configuration shown uses the correct default.

Option D is wrong because the 'ipv6 unicast-routing' command enables IPv6 routing globally, but the symptom here is a missing route, not a routing protocol or forwarding issue; R2 can still forward packets with static routes even if unicast-routing is disabled (though it is typically required for dynamic routing).

Full explanation →

1329

MCQhard

What is the default SNMPv3 engine ID format on a Cisco IOS device?

A.A random 32-bit integer

B.The IP address of the management interface

C.The MAC address of the lowest-numbered interface

D.A manually configured string; no default exists

AnswerC

Cisco IOS uses the MAC address of the lowest-numbered interface (e.g., GigabitEthernet0/0) to form the engine ID.

Why this answer

The default SNMPv3 engine ID on a Cisco IOS device is derived from the MAC address of the lowest-numbered interface (e.g., GigabitEthernet0/0). This ensures a unique identifier for the SNMP engine, as required by RFC 3411, without requiring manual configuration. The engine ID is constructed by concatenating a 12-character hex string representing the MAC address with a fixed enterprise-specific prefix.

Exam trap

Cisco often tests the misconception that the default SNMPv3 engine ID is based on the management interface's IP address, but the actual default uses the MAC address of the lowest-numbered interface to ensure persistence and uniqueness.

How to eliminate wrong answers

Option A is wrong because the default SNMPv3 engine ID is not a random 32-bit integer; it is derived from a fixed MAC address to guarantee uniqueness within a network. Option B is wrong because the IP address of the management interface is not used; IP addresses can change or be duplicated, making them unsuitable for a persistent engine ID. Option D is wrong because a default engine ID does exist on Cisco IOS devices; it is automatically generated from the MAC address, so manual configuration is optional, not required.

Full explanation →

1330

MCQeasy

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) is an eBGP peer of R2 (AS 65002). R1 is advertising the prefix 10.0.0.0/8 to R2. R2 has an iBGP session with R3 (AS 65002). R3's BGP table shows the prefix 10.0.0.0/8 with next-hop 10.1.1.1 (R1's interface). However, R3 does not install this route in its routing table. The output of 'show ip route 10.0.0.0' on R3 shows no route. The engineer checks the routing table on R3 and sees that the interface connected to 10.1.1.0/24 is down. What is the most likely cause?

A.The next-hop 10.1.1.1 is not reachable because the directly connected interface is down.

B.The route is not installed because BGP synchronization is enabled.

C.The route is not installed because the prefix is being filtered by an inbound route-map on R3.

D.The route is not installed because the administrative distance of the route is too high.

AnswerA

Correct because BGP requires the next-hop to be reachable; a down interface makes the next-hop unreachable.

Why this answer

For BGP to install a route, the next-hop must be reachable. If the interface to the next-hop is down, the route is considered unreachable and will not be installed.

Full explanation →

1331

MCQhard

An engineer configures iBGP between two PE routers in an MPLS L3VPN. The PE routers are in the same AS and are directly connected. The engineer configures 'neighbor x.x.x.x next-hop-self' on the route reflector (RR) but notices that the RR is not sending the VPNv4 routes to the client PE with the next-hop set to itself. The client PE receives the routes but the next-hop remains the original PE. What is the most likely explanation?

A.The 'next-hop-self' command is not applied to the route-reflector client session; it must be applied to the client's neighbor statement on the RR, but it is ignored for reflected routes.

B.The 'next-hop-self' command is only applicable to eBGP sessions, not iBGP.

C.The 'next-hop-self' command requires the 'soft-reconfiguration inbound' to be configured to take effect.

D.The 'next-hop-self' command is overridden by the 'next-hop-unchanged' command on the route reflector.

AnswerA

Correct. 'next-hop-self' is not effective for routes reflected by a route reflector; the RR preserves the original next-hop.

Why this answer

In BGP, the 'next-hop-self' command is only effective for eBGP sessions or for iBGP sessions when the neighbor is not a route-reflector client. When a route reflector sends a route to a client, it does not change the next-hop attribute by default, even if 'next-hop-self' is configured. This is because the route reflector is expected to preserve the next-hop as learned from the original router.

To change the next-hop on a route reflector, the engineer must use 'neighbor x.x.x.x next-hop-self' on the RR for the client, but this command is ignored for routes that are reflected from another iBGP speaker. This is a known edge case that can cause reachability issues if the client cannot reach the original next-hop.

Full explanation →

1332

MCQhard

An engineer configures a route map to filter OSPF routes using a distribute-list in OSPF process 1. The distribute-list references a prefix-list that permits only the 10.0.0.0/8 network. After applying the distribute-list in, the engineer notices that the OSPF neighbor state remains stuck in EXSTART/EXCHANGE. Which is the most likely explanation?

A.The distribute-list is applied incorrectly; it should be applied out instead of in.

B.The distribute-list filters LSAs during the exchange, causing the neighbor to be stuck.

C.There is an MTU mismatch between the OSPF neighbors, preventing the exchange of Database Description packets.

D.The prefix-list is misconfigured; it should permit 10.0.0.0/8 with a ge 24 operator.

AnswerC

MTU mismatch causes OSPF to get stuck in EXSTART/EXCHANGE because DBD packets are dropped.

Why this answer

OSPF distribute-list in only filters routes in the routing table, not LSAs. It does not affect the exchange of LSAs during adjacency formation. The adjacency stall is unrelated to the distribute-list; the issue is likely an MTU mismatch between the interfaces.

Full explanation →

1333

MCQeasy

What is the maximum hop count for a route in RIPv2 by default?

A.15

B.16

C.255

D.32

AnswerA

15 is the maximum metric; 16 means infinity (unreachable).

Why this answer

RIP uses a maximum hop count of 15, with 16 considered unreachable, to prevent routing loops.

Full explanation →

1334

MCQeasy

Which DHCPv6 option carries the DNS recursive name server information?

A.Option 6 (Domain Name Server)

B.Option 23 (DNS Recursive Name Server)

C.Option 24 (Domain Search List)

D.Option 21 (SIP Server Domain Name)

AnswerB

Option 23 is the DHCPv6 option for DNS servers.

Why this answer

DHCPv6 Option 23 (DNS Recursive Name Server) is specifically defined in RFC 3646 to carry the IPv6 addresses of DNS recursive name servers to DHCPv6 clients. This is the standard mechanism for IPv6 hosts to learn DNS server addresses via DHCPv6, analogous to DHCPv4 Option 6 for IPv4.

Exam trap

Cisco often tests the distinction between DHCPv4 Option 6 and DHCPv6 Option 23, trapping candidates who assume the same option number applies to both protocols.

How to eliminate wrong answers

Option A is wrong because DHCPv6 Option 6 does not exist; Option 6 is a DHCPv4 option (Domain Name Server) that carries IPv4 DNS server addresses, not IPv6. Option C is wrong because DHCPv6 Option 24 (Domain Search List) carries the domain search list for DNS resolution, not the recursive name server addresses. Option D is wrong because DHCPv6 Option 21 (SIP Server Domain Name) is used to provide SIP server domain names, not DNS recursive name server information.

Full explanation →

1335

MCQmedium

A network engineer runs the following command on Router R1: R1# show snmp host Host: 192.168.1.100 Port: 162 Timeout: 1.5 seconds Retries: 3 Version: 2c Community: PUBLIC Host: 192.168.1.200 Port: 162 Timeout: 3 seconds Retries: 5 Version: 3 User: admin Security level: authPriv Based on this output, which statement is correct?

A.SNMP traps sent to 192.168.1.200 will be encrypted.

B.Both hosts use the same SNMP version.

C.The host at 192.168.1.100 uses SNMPv3 with user 'admin'.

D.Traps to 192.168.1.200 will be sent with community string 'admin'.

AnswerA

The security level 'authPriv' requires both authentication and privacy (encryption).

Why this answer

The SNMPv3 security level 'authPriv' for the host at 192.168.1.200 means authentication and privacy (encryption) are both enabled. SNMPv3 with authPriv uses the User-based Security Model (USM) to encrypt the entire SNMP packet payload, including the trap data, using protocols like AES or DES. This ensures that traps sent to 192.168.1.200 are encrypted.

Exam trap

Cisco often tests the distinction between SNMPv2c community strings and SNMPv3 users/security levels, leading candidates to mistakenly associate a community string or user with the wrong host or version.

How to eliminate wrong answers

Option B is wrong because the output shows Host 192.168.1.100 uses SNMP version 2c, while Host 192.168.1.200 uses SNMP version 3, so they do not use the same SNMP version. Option C is wrong because Host 192.168.1.100 is configured with SNMPv2c and community string 'PUBLIC', not SNMPv3 with user 'admin'; the user 'admin' is only associated with Host 192.168.1.200. Option D is wrong because SNMPv3 does not use community strings; traps to 192.168.1.200 are sent with the user 'admin' and security level authPriv, not a community string.

Full explanation →

1336

MCQmedium

A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?

A.The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.

B.The router is performing NAT on the flow data before exporting.

C.The flow record is configured to match the router's interface IP as the source.

D.The collector is misconfigured to display the export packet source instead of the flow source.

AnswerA

The export source IP is the source of the NetFlow packets, not the flow data. The collector should display flow source IPs separately.

Why this answer

In legacy NetFlow, the 'ip flow-export source' command sets the source IP of export packets, not the flow data. The symptom described is normal; the collector sees the source IP of the export packets, not the flow source IPs. However, if the collector is misconfigured to interpret the export source as flow source, that is a collector issue.

But more likely, the engineer is misreading the collector output. The question tests understanding that export source IP is not the flow source.

Full explanation →

1337

Multi-Selecthard

Which TWO configuration steps are required to enable NETCONF over SSH on a Cisco IOS-XE device? (Choose TWO.)

Select 2 answers

A.Configure 'netconf-yang' under the 'router' configuration mode.

B.Issue the command 'netconf ssh' in global configuration mode.

C.Enable the 'netconf-yang' feature using the command 'netconf-yang' in global configuration mode.

D.Configure 'ip ssh version 2' to ensure SSH is available.

E.Issue the command 'netconf' in global configuration mode.

AnswersB, C

This command enables the NETCONF SSH subsystem.

Why this answer

'netconf ssh' is the command that enables the NETCONF-over-SSH subsystem on a Cisco IOS-XE device, binding the NETCONF protocol to the SSH transport. Option C is correct because 'netconf-yang' in global configuration mode enables the NETCONF YANG data model service, which is a prerequisite for NETCONF operations. Both steps are required: the feature must be enabled, and the SSH transport must be explicitly configured.

Exam trap

Cisco often tests the distinction between enabling the NETCONF YANG service ('netconf-yang') and binding it to SSH ('netconf ssh'), leading candidates to mistakenly think only one command is needed or that 'netconf' alone is sufficient.

Full explanation →

1338

MCQeasy

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

A.The variable is evaluated at the start of the applet, so the 'if' condition uses the original value.

B.The variable is evaluated at the time the 'if' condition is executed, so it uses the updated value.

C.The 'set' action cannot modify a variable that is used in an 'if' condition.

D.The applet will fail if a variable is modified after being used in an 'if' condition.

AnswerB

Correct. EEM actions are executed sequentially, so the 'if' condition uses the current value of the variable.

Why this answer

EEM applets execute actions sequentially. If a 'set' action modifies a variable, that new value is used in any subsequent 'if' condition that references the same variable. Variables are not pre-evaluated; they are evaluated at the time the action is executed.

Full explanation →

1339

MCQhard

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global tcp 192.0.2.10:80 10.0.0.10:80 203.0.113.5:12345 203.0.113.5:12345 tcp 192.0.2.10:80 10.0.0.11:80 203.0.113.5:67890 203.0.113.5:67890 R1# show ip nat statistics Total active translations: 2 (0 static, 2 dynamic; 2 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 50 Misses: 0 CEF Translated packets: 50, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload refcount 2 Based on this output, what is the problem?

A.PAT is not assigning unique source ports; both translations use port 80, which will cause conflicts.

B.The NAT pool is misconfigured because it uses the interface address.

C.The inside and outside interfaces are swapped.

D.Static NAT is interfering with dynamic NAT.

AnswerA

In PAT, the router should change the source port to a unique value. Both translations showing the same inside global port 80 indicates a problem.

Why this answer

The output shows two dynamic NAT translations mapping different inside local hosts (10.0.0.10 and 10.0.0.11) to the same inside global IP address (192.0.2.10) and the same source port (80). PAT (Port Address Translation) should assign unique source ports to differentiate the sessions, but here both translations use port 80, which will cause conflicts when return traffic arrives because the router cannot determine which inside host should receive the packet. This indicates a misconfiguration or a bug where PAT is not performing port overload correctly.

Exam trap

Cisco often tests the misconception that PAT always works automatically without verifying unique port assignments, leading candidates to overlook the duplicate port issue in the translation output.

How to eliminate wrong answers

Option B is wrong because the NAT pool is not misconfigured; the configuration uses 'ip nat inside source list ACL1 interface GigabitEthernet0/1 overload', which correctly uses the interface address for PAT, and the output shows translations are active. Option C is wrong because the interfaces are correctly assigned: GigabitEthernet0/1 is the outside interface and GigabitEthernet0/0 is the inside interface, as shown in the statistics output. Option D is wrong because there are no static NAT entries (0 static translations), so static NAT cannot be interfering with dynamic NAT.

Full explanation →

1340

MCQhard

R1 and R2 are iBGP peers. R1 has: neighbor 10.1.1.2 route-map RM_SET in. The route-map RM_SET sets community 100:100. R2 advertises a prefix 172.16.1.0/24 with community 200:200. R1 receives the prefix and the community is changed to 100:100. However, R1's BGP table shows the prefix with community 100:100, but R1 does not propagate this prefix to its other iBGP peer R3. R3 has no special configuration. What is the root cause?

A.iBGP split-horizon rule prevents R1 from advertising routes learned from an iBGP peer to another iBGP peer.

B.The community 100:100 is being filtered by R3's inbound policy.

C.The route-map RM_SET should have been applied outbound on R2 instead.

D.R1 must have a network statement for 172.16.1.0/24 to advertise it.

AnswerA

iBGP does not advertise routes learned from one iBGP neighbor to another iBGP neighbor unless route reflection or confederation is used.

Why this answer

By default, iBGP learned routes are not advertised to other iBGP peers to prevent loops, unless the router is a route reflector or confederation. R1 is not a route reflector, so it will not advertise the prefix learned from R2 to R3. The community manipulation is irrelevant to the propagation issue.

The root cause is that iBGP split-horizon prevents R1 from advertising the prefix to R3.

Full explanation →

1341

MCQhard

A network engineer runs the following command to troubleshoot SNMPv3: R1# show snmp user User name: admin Engine ID: 800000090300001122334455 Storage-type: nonvolatile Authentication Protocol: SHA Privacy Protocol: AES128 Group: admin-group User name: monitor Engine ID: 800000090300001122334455 Storage-type: nonvolatile Authentication Protocol: MD5 Privacy Protocol: DES Group: monitor-group What does this output indicate?

A.Two SNMPv3 users are configured: 'admin' with SHA/AES128 and 'monitor' with MD5/DES.

B.SNMPv3 is not configured because no users are shown.

C.Both users use the same authentication and privacy protocols.

D.The users are in the same SNMP group.

AnswerA

The output shows the authentication and privacy protocols for each user.

Why this answer

The output from 'show snmp user' displays two SNMPv3 users: 'admin' with SHA authentication and AES128 privacy, and 'monitor' with MD5 authentication and DES privacy. This confirms that both users are configured with different security levels, making option A correct.

Exam trap

Cisco often tests the ability to read the 'show snmp user' output carefully, where candidates may overlook the different groups or security protocols and assume all users share the same settings.

How to eliminate wrong answers

Option B is wrong because the output clearly shows two SNMPv3 users, indicating SNMPv3 is configured. Option C is wrong because 'admin' uses SHA/AES128 while 'monitor' uses MD5/DES, which are different authentication and privacy protocols. Option D is wrong because the users belong to different groups: 'admin' is in 'admin-group' and 'monitor' is in 'monitor-group'.

Full explanation →

1342

MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto isakmp sa dst src state conn-id slot status 10.1.1.2 10.1.1.1 MM_NO_STATE 1 0 ACTIVE Based on this output, what is the problem?

A.The IPsec SA is established and working correctly.

B.The IKE phase 1 negotiation has failed; the pre-shared key may be mismatched.

C.The tunnel is up but no interesting traffic is triggering the IPsec SA.

D.The ISAKMP SA is in MM_ACTIVE state, meaning phase 1 is complete.

AnswerB

MM_NO_STATE indicates no ISAKMP SA has been formed, often due to pre-shared key mismatch or firewall blocking UDP 500.

Why this answer

The MM_NO_STATE indicates that the IKE phase 1 negotiation has not progressed past the initial state. This typically means the peer is not responding to the ISAKMP proposals, often due to mismatched pre-shared keys or access-list blocking UDP port 500.

Full explanation →

1343

MCQhard

A network uses PBR to route traffic from a specific subnet (192.168.1.0/24) through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being sent to the WAN link but is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'debug ip policy' shows traffic being forwarded to 10.10.10.2, but 'show ip route 10.10.10.2' shows a route via a different interface (GigabitEthernet0/1). What is the root cause?

A.The next-hop 10.10.10.2 is not directly connected to the interface where PBR is applied. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.

B.The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.

C.The routing table on R1 has a better route to the destination via a different next-hop, overriding PBR.

D.The interface where PBR is applied is in a different VRF, causing the next-hop to be unreachable.

AnswerA

PBR's 'set ip next-hop' command requires the next-hop to be on a directly connected subnet. If it is reachable via a route, PBR will drop the packet. This is a common misconfiguration when the next-hop is on a remote subnet.

Why this answer

PBR requires that the next-hop specified in the 'set ip next-hop' command be directly connected to the router. If the next-hop is reachable via a route through another interface (as in this case where 10.10.10.2 is reachable via GigabitEthernet0/1), the router will attempt to forward the packet but will drop it because the next-hop is not on the same subnet as the outgoing interface. The debug output showing 'forwarding to 10.10.10.2' indicates that the route-map matched and the next-hop was set, but the actual packet is dropped.

To fix this, ensure the next-hop is directly connected or use a different next-hop.

Full explanation →

1344

MCQmedium

Router R3 has the following DHCP configuration: ip dhcp pool POOL2 network 10.10.10.0 255.255.255.0 default-router 10.10.10.1 dns-server 10.10.10.2 lease 7 ! interface GigabitEthernet0/0 ip address 10.10.10.1 255.255.255.0 ip dhcp relay information option no shutdown What is the problem with this configuration?

A.The relay information option should not be configured on the server interface; it is intended for relay agents and may cause DHCP packets to be dropped or misprocessed.

B.The lease duration of 7 days is invalid; valid lease values are in hours or minutes only.

C.The default-router address is missing the subnet mask, which will cause clients to receive an incomplete configuration.

D.The DNS server address is on the same subnet as the clients, which is not allowed.

AnswerA

The ip dhcp relay information option is meant for interfaces acting as DHCP relay agents. On a server interface, it can cause the server to add Option 82 to its own packets, leading to confusion or packet rejection.

Why this answer

The 'ip dhcp relay information option' command is intended for DHCP relay agents to insert Option 82 (Relay Agent Information) into DHCP packets. When configured on a DHCP server interface, it causes the server to expect and process Option 82, but since the server itself is not a relay agent, this can lead to malformed packets, dropped requests, or misprocessing of DHCP messages. In this scenario, R3 is acting as the DHCP server on GigabitEthernet0/0, so the command should be removed to ensure normal DHCP operation.

Exam trap

Cisco often tests the misconception that 'ip dhcp relay information option' is a generic DHCP feature that can be applied anywhere, when in fact it is strictly for relay agents and causes problems if enabled on a DHCP server interface.

How to eliminate wrong answers

Option B is wrong because the lease duration of 7 days is valid; Cisco IOS DHCP supports lease values in days, hours, or minutes (e.g., 'lease 7' means 7 days). Option C is wrong because the 'default-router' command does not require a subnet mask; the mask is derived from the 'network' statement, and clients receive the default gateway IP without a mask. Option D is wrong because there is no restriction preventing the DNS server from being on the same subnet as the clients; in fact, it is common and fully supported.

Full explanation →

1345

MCQmedium

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue: R1# show ip route summary Output: Route Source Networks Subnets Overhead Memory (bytes) connected 0 2 0 0 static 0 0 0 0 ospf 1 5 10 0 0 bgp 65001 3 5 0 0 Total 8 17 0 0 What does this output indicate?

A.The routing table contains 8 networks and 17 subnets, with OSPF contributing the most routes.

B.The router has a routing table with 25 total routes.

C.The router is using BGP as the primary routing protocol.

D.The router has no static routes configured.

AnswerA

The totals show 8 networks and 17 subnets; OSPF has 5 networks and 10 subnets.

Why this answer

The output shows the routing table summary, including the number of networks and subnets from each routing protocol. This helps in understanding the routing table size and protocol contributions.

Full explanation →

1346

MCQhard

An engineer configures IPsec between two VRF-Lite routers using a site-to-site VPN. The tunnel is established, but no traffic is encrypted. The engineer verifies that the crypto map is applied to the correct interface and that the ACL for interesting traffic matches the VRF traffic. Which is the most likely explanation?

A.The crypto map is applied to the wrong interface; it should be applied to the VRF interface, not the physical interface.

B.The ACL for interesting traffic is not matching the VRF traffic because the ACL is evaluated in the global routing table, not the VRF.

C.The IPsec transform set has a mismatch in the encryption algorithm, causing the tunnel to fail to establish.

D.The 'crypto isakmp key' command is missing the VRF keyword, causing IKE to fail.

AnswerB

IPsec crypto maps are evaluated in the global routing table. VRF traffic must be redirected to the global table using PBR or the crypto map must be VRF-aware.

Why this answer

In VRF-Lite, traffic is forwarded based on the VRF routing table. However, IPsec crypto maps operate on the global routing table by default. If the traffic is in a VRF, the crypto map must be applied with the VRF keyword or the traffic must be redirected using a policy-based route (PBR) to the global table.

Without this, the crypto engine does not see the traffic as interesting, so it is not encrypted.

Full explanation →

1347

Drag & Dropmedium

Drag and drop the steps to verify and validate OSPF operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The verification process starts by checking the OSPF neighbor state with show ip ospf neighbor. Next, examine the OSPF database using show ip ospf database to see LSAs. Then, verify the routing table for OSPF routes with show ip route ospf.

After that, check interface-specific OSPF details with show ip ospf interface. Finally, test end-to-end connectivity with extended ping to validate reachability.

Full explanation →

1348

MCQmedium

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla history 10 Point by Point History Entry = 10 Life = 1 Time of Event = 12:34:56.789 UTC Mon Mar 1 2021 Start Time = 12:34:56.789 UTC Mon Mar 1 2021 Completion Time = 12:34:57.001 UTC Mon Mar 1 2021 Return Code = OK RTT = 12 ms Life = 2 Time of Event = 12:35:56.789 UTC Mon Mar 1 2021 Start Time = 12:35:56.789 UTC Mon Mar 1 2021 Completion Time = 12:35:57.001 UTC Mon Mar 1 2021 Return Code = OK RTT = 14 ms Life = 3 Time of Event = 12:36:56.789 UTC Mon Mar 1 2021 Start Time = 12:36:56.789 UTC Mon Mar 1 2021 Completion Time = 12:36:57.001 UTC Mon Mar 1 2021 Return Code = OK RTT = 11 ms What does this output indicate?

A.The IP SLA operation has experienced multiple timeouts.

B.The IP SLA operation shows a history of successful probes with low RTT values.

C.The IP SLA operation has failed because the RTT values are inconsistent.

D.The IP SLA operation is not configured because no history is shown.

AnswerB

Each entry shows 'Return Code = OK' and RTT between 11-14 ms.

Why this answer

This output shows historical data for IP SLA operation 10. Each entry shows a successful probe with RTT around 11-14 ms, indicating consistent performance over time.

Full explanation →

1349

MCQmedium

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 3000(3) Gi0/0 Session state is UP and not using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 3000(0) Rx Count: 100, Tx Count: 100 Based on this output, what is the BFD session's detection time?

A.The detection time is 3000 ms.

B.The detection time is 1000 ms.

C.The detection time is 1500 ms.

D.The detection time is 9000 ms.

AnswerA

It is the holddown timer shown in the output, which is 3000 ms.

Why this answer

The detection time is the holddown timer, which is the negotiated transmit interval multiplied by the multiplier. The negotiated transmit interval is 1000 ms (maximum of local MinTxInt and received MinRxInt), and the multiplier is 3, so the detection time is 3000 ms.

Full explanation →

1350

MCQmedium

A network engineer runs the following command on Router R1: R1# show snmp group group name: readonly security model: v3 security level: authNoPriv context: <none> read view: iso write view: <none> notify view: <none> Group name: admin security model: v3 security level: authPriv context: <none> read view: iso write view: iso notify view: iso Based on this output, which statement is correct?

A.The 'readonly' group can read all MIB objects because its read view is 'iso'.

B.The 'admin' group requires only authentication, not encryption.

C.The 'readonly' group can send SNMP traps.

D.Both groups have the same security level.

AnswerA

The read view 'iso' typically includes the entire MIB tree, allowing read access to all objects.

Why this answer

The 'readonly' group has a read view set to 'iso', which corresponds to the entire ISO OID tree (1.3.6.1). This means the group can read all MIB objects accessible under that subtree, effectively granting full read access to all standard SNMP MIBs.

Exam trap

Cisco often tests the distinction between security levels and view configurations, where candidates mistakenly assume 'authNoPriv' includes encryption or that a missing notify view still allows traps.

How to eliminate wrong answers

Option B is wrong because the 'admin' group has security level 'authPriv', which requires both authentication and encryption (privacy), not just authentication. Option C is wrong because the 'readonly' group has a notify view set to '<none>', meaning it cannot send SNMP traps or notifications; a notify view must be configured for trap generation. Option D is wrong because the 'readonly' group uses security level 'authNoPriv' (authentication only) while the 'admin' group uses 'authPriv' (authentication and encryption), so they have different security levels.

Full explanation →

Page 18 of 27

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 Technologies VPN Technologies Infrastructure Security Infrastructure Services

See all domains with question counts →