Knowledge + Practice

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1351–1425

1966 questions total · 27pages · All types, answers revealed

Take a mock exam Exam hub

Page 19 of 27

1351

MCQmedium

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# debug ip bgp updates And sees the following output: *Mar 1 00:25:44.789: BGP(0): 10.1.1.2 UPDATE out about 192.168.10.0/24, NEXT_HOP 10.1.1.1, LOCAL_PREF 100, MED 0, origin i, path 65000 65001 *Mar 1 00:25:44.790: BGP(0): 10.1.1.2 UPDATE run, update sent *Mar 1 00:25:44.791: BGP(0): 10.1.1.2 UPDATE in about 10.2.2.0/24, NEXT_HOP 10.1.1.2, LOCAL_PREF 100, MED 0, origin i, path 65002 What does this output indicate?

A.BGP is redistributing routes from OSPF into BGP, as shown by the AS path.

B.R1 is advertising 192.168.10.0/24 to neighbor 10.1.1.2 and learning 10.2.2.0/24 from the same neighbor.

C.The route 192.168.10.0/24 is being filtered due to AS path length.

D.BGP is not receiving any routes because of a redistribution issue.

AnswerB

The output shows outbound update for 192.168.10.0/24 and inbound update for 10.2.2.0/24, indicating BGP peering is working.

Why this answer

The debug ip bgp updates output shows BGP updates being sent and received. R1 sends an update for 192.168.10.0/24 with AS path 65000 65001 and receives an update for 10.2.2.0/24 with AS path 65002. This indicates BGP is exchanging routes, but if redistribution is expected, the AS path may indicate the route origin.

Full explanation →

1352

Multi-Selecthard

Which TWO statements about the behavior of administrative distance in Cisco IOS are correct? (Choose TWO.)

Select 2 answers

A.The default administrative distance for an EIGRP summary route is 5.

B.The default administrative distance for OSPF is 90.

C.The distance command applied under a routing protocol can modify the AD for all routes, including connected and static routes, learned via that protocol.

D.The show ip route command displays the administrative distance of each route in the routing table.

E.When two different routing protocols provide routes to the same destination, the route with the higher administrative distance is installed in the routing table.

AnswersA, D

Correct. EIGRP summary routes have a default AD of 5, which is lower than the AD of any dynamic routing protocol, ensuring they are preferred.

Why this answer

Administrative distance (AD) is a trustworthiness metric used to select the best route among multiple routing protocols. A lower AD is preferred. The default AD for EIGRP summary routes is 5, which is lower than the default AD for OSPF (110).

The distance command can be applied to a routing process to change the AD for all routes learned via that protocol, but it does not affect connected or static routes unless explicitly configured. The show ip route command displays the AD of each route, and the AD value is used to break ties when multiple protocols provide routes to the same destination.

Full explanation →

1353

MCQhard

A network engineer configures EEM to monitor memory usage on R1. R1 has: event manager applet MEM-MONITOR event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op gt entry-val 90 poll-interval 10 action 1.0 cli command "enable" action 2.0 cli command "show processes memory" action 3.0 syslog msg "High memory usage detected". After a few days, the engineer notices that the applet never triggers, even though memory usage exceeds 90%. Router R2 shows: memory usage is at 95%, but no syslog from EEM. What is the root cause?

A.The SNMP OID is for free memory, and the condition checks if free memory is greater than 90%, which is not met when memory is low.

B.The poll-interval of 10 seconds is too short and causes the applet to be suppressed.

C.The SNMP community string is not configured, so the OID cannot be polled.

D.The applet requires 'event manager applet MEM-MONITOR trigger' to start.

AnswerA

The OID returns free memory; the applet triggers only when free memory >90%, which never happens when memory is high.

Why this answer

The SNMP OID used (1.3.6.1.4.1.9.9.48.1.1.1.6.1) is for the free memory, not used memory. The applet checks if free memory is greater than 90%, which is false when memory is low. The correct OID should be for used memory or the comparison operator should be 'lt' for free memory below 10%.

Full explanation →

1354

Drag & Dropmedium

Drag and drop the steps to establish a DMVPN Phase 2 spoke-to-spoke tunnel into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically. First, the spoke must have a valid NHRP registration to the hub. When traffic from one spoke to another triggers an NHRP resolution request, the hub forwards it to the target spoke, which replies.

The spoke then initiates a direct mGRE tunnel, and finally, the spoke-to-spoke IPsec session is established.

Full explanation →

1355

MCQmedium

Which of the following statements about MPLS L3VPN label operations is true?

A.The ingress PE pushes two labels: the outer IGP label and the inner VPN label.

B.The egress PE uses the IGP label to determine the VRF.

C.The P routers swap the VPN label as they forward the packet.

D.The ingress PE pushes only one label (the VPN label) and uses the IP destination for forwarding.

AnswerA

The outer label is used to reach the egress PE, and the inner label identifies the VRF and the specific prefix.

Why this answer

In MPLS L3VPN, the PE router assigns a per-VRF label (VPN label) for each prefix in the VRF. When forwarding a packet from the CE, the ingress PE pushes an IGP label (for the egress PE) and the VPN label. The egress PE pops the IGP label and uses the VPN label to identify the VRF and forward to the correct CE.

Full explanation →

1356

MCQeasy

In a VRF-Lite scenario with OSPF, what is the default network type on a physical Ethernet interface?

A.Point-to-point

B.Broadcast

C.Non-broadcast

D.Point-to-multipoint

AnswerB

Ethernet defaults to broadcast network type in OSPF.

Why this answer

By default, OSPF sets the network type to broadcast on Ethernet interfaces, which enables DR/BDR election.

Full explanation →

1357

MCQmedium

Which BGP path attribute is used as the tie-breaker after the local preference and AS-path length in the BGP best path selection algorithm?

A.MED (Multi-Exit Discriminator)

B.Origin type

C.Neighbor IP address

D.Router ID

AnswerB

Correct. Origin type is the third tie-breaker: IGP > EGP > incomplete.

Why this answer

After comparing local preference (highest wins) and AS-path length (shortest wins), the next tie-breaker is the origin type, where IGP is preferred over EGP, and EGP over incomplete.

Full explanation →

1358

MCQmedium

Which BGP attribute is considered the highest priority (most preferred) in the BGP best path selection process?

A.Local preference

B.AS path length

C.Weight

D.MED

AnswerC

Weight is the first attribute checked in the BGP best path selection process (Cisco-specific).

Why this answer

C is correct because the Weight attribute is Cisco-proprietary and is evaluated first in the BGP best path selection process. It has the highest priority, with a higher weight being preferred, and it is local to the router only.

Exam trap

Cisco often tests the order of BGP path selection attributes, and the trap here is that candidates confuse Local Preference as the highest priority because it is the first well-known mandatory attribute, forgetting that the Cisco-proprietary Weight is evaluated first.

How to eliminate wrong answers

Option A is wrong because Local Preference is evaluated after Weight; it is the second step in the BGP best path selection and is used to influence outbound traffic from an AS. Option B is wrong because AS path length is evaluated after Local Preference (step 4) and is used to prefer shorter paths, not as the highest priority. Option D is wrong because MED (Multi-Exit Discriminator) is evaluated after AS path length (step 5) and is used to influence inbound traffic to an AS, not as the highest priority.

Full explanation →

1359

MCQeasy

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 150 10 permit ip 10.0.0.0 0.255.255.255 any (500 matches) 20 deny ip any any (100 matches) Based on this output, which statement is correct?

A.Traffic from 10.0.0.0/8 is denied.

B.Traffic not from 10.0.0.0/8 is denied.

C.All traffic is permitted.

D.The ACL has no effect.

AnswerB

Line 20 denies all other traffic with 100 matches.

Why this answer

The ACL 150 has a permit entry for source 10.0.0.0/8 (wildcard 0.255.255.255) followed by a deny any any. Traffic matching the permit (from 10.0.0.0/8) is allowed, while all other traffic is denied by the implicit deny or the explicit deny entry. Thus, traffic not from the 10.0.0.0/8 network is denied, making option B correct.

Exam trap

Cisco often tests the misconception that an ACL with a permit entry followed by a deny entry permits all traffic, when in fact the deny explicitly blocks everything not matching the earlier permit.

How to eliminate wrong answers

Option A is wrong because the ACL permits traffic from 10.0.0.0/8 (500 matches), not denies it. Option C is wrong because the ACL includes an explicit deny ip any any (100 matches), which blocks all traffic not matching the permit, so not all traffic is permitted. Option D is wrong because the ACL is applied (matches are shown) and actively filters traffic, so it has an effect.

Full explanation →

1360

Multi-Selectmedium

Which TWO commands can be used to verify the operation of IPv6 First Hop Security features such as RA Guard and DHCPv6 Guard on a Cisco IOS-XE switch? (Choose TWO.)

Select 2 answers

A.show ipv6 snooping

B.show ipv6 dhcp guard

C.show ipv6 nd raguard

D.show ipv6 dhcp binding

E.show ipv6 source guard

AnswersA, B

This command displays the operational status of IPv6 snooping features, including RA Guard and DHCPv6 Guard, and is a primary verification tool.

Why this answer

The 'show ipv6 snooping' command is the primary verification tool for IPv6 First Hop Security (FHS) features, including RA Guard and DHCPv6 Guard. It displays the IPv6 snooping policy database, which tracks all discovered IPv6 neighbors and their binding states, directly reflecting the operational status of RA Guard and DHCPv6 Guard enforcement on the switch.

Exam trap

Cisco often tests the distinction between the generic 'show ipv6 snooping' command and the specific but non-existent 'show ipv6 nd raguard' command, leading candidates to incorrectly assume each FHS feature has its own dedicated show command.

Full explanation →

1361

MCQmedium

Which TCP flag combination triggers the NAT translation timeout to change from the default to the 'ip nat translation tcp-timeout' value?

A.SYN

B.FIN or RST

C.ACK

D.URG

AnswerB

FIN and RST indicate connection termination, causing the NAT entry to expire quickly.

Why this answer

By default, NAT translations for TCP sessions use a timeout based on the TCP connection's state. When a TCP session ends with a FIN or RST flag, the NAT device immediately transitions the translation to a 'finish' or 'reset' state, which then uses the value configured under 'ip nat translation tcp-timeout' (default 60 seconds) instead of the longer default idle timeout (typically 86400 seconds). This allows the NAT table to reclaim resources quickly after a connection is explicitly terminated.

Exam trap

Cisco often tests the misconception that any TCP flag (like SYN or ACK) can trigger the shorter timeout, but only FIN or RST explicitly signal connection termination and thus change the NAT timeout to the configured tcp-timeout value.

How to eliminate wrong answers

Option A (SYN) is wrong because the SYN flag initiates a TCP connection and triggers the default idle timeout, not the shorter tcp-timeout value. Option C (ACK) is wrong because ACK is used for acknowledging data and maintaining an established connection; it does not signal termination, so the translation remains under the default idle timeout. Option D (URG) is wrong because the URG flag indicates urgent data within a segment and has no effect on NAT translation timers; it is unrelated to connection teardown.

Full explanation →

1362

MCQhard

In MPLS, what is the default label distribution control mode for LDP on Cisco IOS-XE?

A.Ordered Label Distribution Control mode

B.Independent Label Distribution Control mode

C.Liberal Label Retention mode

D.Conservative Label Retention mode

AnswerB

Independent Label Distribution Control mode is the default for LDP on Cisco IOS-XE. Routers can advertise labels without waiting for downstream labels, which is the correct answer.

Why this answer

The default label distribution control mode for LDP on Cisco IOS-XE is Independent. In Independent mode, a router can advertise a label for a FEC as soon as it has forwarding information (e.g., a route) for that FEC, without waiting for a label from its next hop. Ordered mode, on the other hand, requires the router to wait for a label from the next hop before advertising, which is not the default for LDP (though it is used for RSVP-TE and other applications).

Exam trap

Many candidates mistakenly think Ordered is the default for LDP, but it is actually Independent. Ordered is used in MPLS TE or when explicitly configured.

Full explanation →

1363

MCQhard

A network engineer is troubleshooting a redistribution issue between EIGRP and OSPF. Router R1 redistributes EIGRP routes into OSPF. The engineer configured a summary route 10.0.0.0/8 using the 'summary-address' command under the OSPF process. After the configuration, OSPF neighbors lose connectivity to the 10.1.0.0/16 subnet, which is one of the component routes. What is the most likely cause?

A.The summary-address command on R1 is configured with the 'tag' keyword, causing the summary to be ignored by other routers.

B.The summary route 10.0.0.0/8 is not being generated because the component routes are not all present in the OSPF database.

C.The OSPF neighbor relationship is down due to a mismatch in area IDs.

D.The engineer forgot to configure the 'network' command for the summary route under OSPF.

AnswerB

Correct. In OSPF, the summary-address command generates a summary only if at least one component route exists in the OSPF database. If the component route is missing due to redistribution issues, the summary may not be generated, and the specific routes may be suppressed.

Why this answer

The issue is that the summary-address command in OSPF can suppress the advertisement of more specific routes, but if the summary route is not installed due to a missing component or metric issue, it can cause a routing black hole.

Full explanation →

1364

MCQeasy

A network engineer runs the following command on Router R1: R1# show ip route vrf RED 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "connected", distance 0, metric 0 (connected, via interface) Routing Descriptor Blocks: * directly connected, via GigabitEthernet0/2 Route metric is 0, traffic share count is 1 Based on this output, which statement is correct?

A.The route is learned via OSPF.

B.The route is a static route.

C.The route is directly connected via GigabitEthernet0/2.

D.The route has a metric of 1.

AnswerC

The output states it is directly connected via GigabitEthernet0/2.

Why this answer

The output shows the route for 192.168.1.0/24 in VRF RED is a connected route via GigabitEthernet0/2. This is normal.

Full explanation →

1365

Multi-Selecthard

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Select 2 answers

A.'show crypto session' displays the IKEv2 SA status and the IPsec SA status.

B.'show crypto ipsec sa' shows the number of packets that have been encrypted and decrypted.

C.'show crypto isakmp sa' is the correct command to view IKEv2 SAs.

D.The 'pkts encaps' counter in 'show crypto ipsec sa' increments on the inbound SA.

E.'show crypto map' displays the current packet count for each IPsec SA.

AnswersA, B

Correct. This command shows both IKE and IPsec session information.

Why this answer

The 'show crypto session' command provides a concise summary of both IKEv2 SA (phase 1) and IPsec SA (phase 2) status, including the state (UP-ACTIVE) and peer IP. This makes it a quick troubleshooting tool for verifying that both security associations are established without needing separate commands for each phase.

Exam trap

Cisco often tests the distinction between IKEv1 and IKEv2 commands, so the trap here is that candidates mistakenly use 'show crypto isakmp sa' for IKEv2 SAs, not realizing that IKEv2 has its own dedicated 'show crypto ikev2 sa' command.

Full explanation →

1366

MCQeasy

What is the default administrative distance for OSPF routes in Cisco IOS?

A.90

B.100

C.110

D.120

AnswerC

Correct. OSPF routes have a default administrative distance of 110.

Why this answer

OSPF has a default administrative distance (AD) of 110 in Cisco IOS. This value is used by the router to select the best route when multiple routing protocols provide a route to the same destination, with lower AD values being preferred. OSPF's AD of 110 is higher than that of static routes (1) and EIGRP (90/170), but lower than RIP (120) and IS-IS (115).

Exam trap

Cisco often tests the default administrative distances of OSPF, EIGRP, and RIP together, and the trap here is confusing OSPF's AD of 110 with EIGRP's AD of 90 or RIP's AD of 120, especially since OSPF is commonly associated with link-state protocols that are often considered more reliable than distance-vector protocols like RIP.

How to eliminate wrong answers

Option A is wrong because 90 is the default administrative distance for EIGRP internal routes, not OSPF. Option B is wrong because 100 is not a standard default administrative distance for any common routing protocol in Cisco IOS; it is sometimes used for iBGP or as a custom value. Option D is wrong because 120 is the default administrative distance for RIP, not OSPF.

Full explanation →

1367

MCQeasy

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 130 10 deny ip 192.168.1.0 0.0.0.255 any (0 matches) 20 permit ip any any (1000 matches) Based on this output, which statement is correct?

A.Traffic from 192.168.1.0/24 is being denied.

B.Traffic from 192.168.1.0/24 is being permitted.

C.The ACL is blocking all traffic.

D.The ACL is misconfigured because line 10 is not needed.

AnswerB

Since line 10 has no matches, traffic from that subnet is matched by line 20 (permit any any) and permitted.

Why this answer

The ACL processes packets sequentially: line 10 denies traffic from 192.168.1.0/24 but has 0 matches, meaning no packets from that source have been evaluated. Line 20 permits all other traffic and has 1000 matches, so traffic from 192.168.1.0/24 is implicitly permitted by the permit any any statement since it is never denied.

Exam trap

The trap here is that candidates assume the deny statement is actively blocking traffic based on its configuration, ignoring the match counters that reveal no packets have actually matched that line.

How to eliminate wrong answers

Option A is wrong because the deny statement has 0 matches, indicating that no traffic from 192.168.1.0/24 has been denied; the permit any any statement allows all traffic, including from that subnet. Option C is wrong because the ACL is not blocking all traffic; line 20 permits any traffic, as shown by 1000 matches. Option D is wrong because the ACL is not misconfigured; line 10 may be intended for future use or logging, and its presence does not cause a misconfiguration—it simply has no effect until traffic from that subnet is seen.

Full explanation →

1368

MCQmedium

Consider this OSPF configuration on router R6: router ospf 1 network 10.0.0.0 0.255.255.255 area 0 area 0 stub What is the effect of the area 0 stub command?

A.Area 0 will become a stub area, blocking type 5 LSAs from entering the backbone.

B.The configuration is rejected by IOS because the backbone area cannot be a stub.

C.The command is ignored, and area 0 remains a normal area.

D.Only type 5 LSAs are blocked, but type 3 and 4 LSAs are still allowed.

AnswerB

Correct. RFC 2328 prohibits the backbone from being a stub.

Why this answer

The area 0 stub command is invalid because area 0 (the backbone) cannot be configured as a stub area. Stub areas are used to reduce LSA flooding, but the backbone must have full routing information. This configuration will be rejected by IOS.

Full explanation →

1369

MCQhard

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_CUSTOMER_A and VRF_CUSTOMER_B). The engineer notices that traffic from VRF_CUSTOMER_A is being routed to the wrong next-hop, causing connectivity issues. The 'show ip route vrf VRF_CUSTOMER_A' shows a route to the destination via a next-hop that belongs to VRF_CUSTOMER_B. What is the most likely cause?

A.The 'route-target import' command in VRF_CUSTOMER_A is importing routes from VRF_CUSTOMER_B.

B.The router has a default route that points to the next-hop in VRF_CUSTOMER_B.

C.The 'ip cef' command is disabled globally.

D.The 'ip vrf forwarding' command is applied to the same physical interface for both VRFs.

AnswerA

This causes routes from VRF_CUSTOMER_B to appear in VRF_CUSTOMER_A's routing table, leading to incorrect next-hop selection.

Why this answer

This issue is typically caused by route leaking between VRFs, which can happen if the route-target import/export commands are misconfigured or if there is a shared interface with incorrect VRF assignment.

Full explanation →

1370

MCQeasy

Which SNMPv3 security model provides both authentication and encryption by default?

A.Community-based Security Model (CSM)

B.User-based Security Model (USM) with authPriv

C.View-based Access Control Model (VACM)

D.Transport Layer Security (TLS) model

AnswerB

USM with authPriv provides both authentication and encryption (privacy).

Why this answer

SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv. The User-based Security Model (USM) with the authPriv security level provides both authentication (using HMAC-MD5 or HMAC-SHA) and encryption (using CBC-DES or CFB-AES). This is the only default combination within SNMPv3 that offers both services, making option B correct.

Exam trap

Cisco often tests the distinction between USM (which handles authentication and encryption) and VACM (which handles authorization and access control), leading candidates to mistakenly select VACM when asked about authentication and encryption.

How to eliminate wrong answers

Option A is wrong because the Community-based Security Model (CSM) is a deprecated SNMPv1/v2c concept that uses plaintext community strings and provides no authentication or encryption; it is not a security model for SNMPv3. Option C is wrong because the View-based Access Control Model (VACM) defines access control policies (which MIB objects a user can read/write) but does not provide authentication or encryption; it is a separate subsystem from USM. Option D is wrong because the Transport Layer Security (TLS) model is not a standard SNMPv3 security model; SNMPv3 uses USM for authentication and encryption, while TLS can be used as an external transport layer but is not part of the SNMPv3 security model defined in RFC 3410-3418.

Full explanation →

1371

Multi-Selecthard

Which TWO statements about NetFlow version 9 and Flexible NetFlow export format are true? (Choose TWO.)

Select 2 answers

A.NetFlow version 9 uses a template-based architecture that allows the collector to dynamically learn the fields being exported.

B.Flexible NetFlow can only export data using NetFlow version 5 format.

C.The default UDP port for NetFlow export is 2055.

D.The template refresh interval is fixed at 20 minutes and cannot be changed.

E.NetFlow version 9 supports only IPv4 flow data; IPv6 requires version 5.

AnswersA, C

Correct. Version 9 sends templates periodically; the collector uses them to parse the data records.

Why this answer

NetFlow version 9 uses templates to define the format of exported data, which allows flexibility. Flexible NetFlow uses version 9 as its default export format. Version 5 has a fixed format and does not support templates.

The exporter configuration includes the destination IP and UDP port (default 2055). The template refresh interval is configurable using the 'template timeout' command under the exporter. Version 9 supports both IPv4 and IPv6 in the same export stream via separate templates.

Full explanation →

1372

MCQmedium

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue: R1# debug ip packet 110 IP packet debugging is on for access list 110 *Mar 1 00:15:22.345: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x2, sport 12345, dport 23, access list 110: matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23 *Mar 1 00:15:22.346: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x10, sport 12345, dport 23, access list 110: matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23 What does this output indicate?

A.Telnet traffic from 10.1.1.1 to 10.2.2.2 is being denied by ACL 110.

B.Telnet traffic from 10.1.1.1 to 10.2.2.2 is being permitted by ACL 110.

C.ACL 110 is applied outbound on GigabitEthernet0/0.

D.ACL 110 has no line 10.

AnswerA

The debug shows the packets match the deny line.

Why this answer

The debug output shows packets with source IP 10.1.1.1 and destination IP 10.2.2.2, protocol TCP, destination port 23 (Telnet), and the log explicitly states 'matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23'. This confirms that ACL 110 is denying Telnet traffic from 10.1.1.1 to 10.2.2.2. The flags 0x2 (SYN) and 0x10 (ACK) indicate the initial and subsequent packets of the Telnet session are both being denied.

Exam trap

The trap here is that candidates may misinterpret the 'matched line 10 deny' as a permit action or assume the ACL is applied outbound based on the source interface, but the debug only shows the packet's ingress interface and the ACL match result, not the ACL's application direction.

How to eliminate wrong answers

Option B is wrong because the debug output clearly shows 'deny' on line 10, not 'permit', so Telnet traffic is being blocked, not permitted. Option C is wrong because the debug output shows the source interface as GigabitEthernet0/0, but the ACL could be applied inbound or outbound; the debug does not specify the direction, and the 's=10.1.1.1 (GigabitEthernet0/0)' indicates the packet entered on that interface, but the ACL could be applied inbound or outbound on another interface. Option D is wrong because the debug output explicitly states 'matched line 10', proving that line 10 exists in ACL 110.

Full explanation →

1373

MCQhard

A network engineer runs the following command to troubleshoot IPsec IKE phase 1: R1# debug crypto isakmp ISAKMP: (0:0:N/A:0) Starting aggressive mode exchange ISAKMP: (0:0:N/A:0) processing SA payload ISAKMP: (0:0:N/A:0) Checking ISAKMP transform 1 against priority 1 policy ISAKMP: (0:0:N/A:0) encryption 3DES ISAKMP: (0:0:N/A:0) hash SHA ISAKMP: (0:0:N/A:0) group 2 ISAKMP: (0:0:N/A:0) auth pre-share ISAKMP: (0:0:N/A:0) life type in seconds ISAKMP: (0:0:N/A:0) life duration (basic) of 86400 ISAKMP: (0:0:N/A:0) atts are not acceptable What does this output indicate?

A.IKE phase 1 is successful; the transform set is accepted.

B.IKE phase 1 fails due to transform set mismatch.

C.IKE phase 1 fails due to authentication failure.

D.IKE phase 1 fails due to lifetime mismatch.

AnswerB

The attributes are not acceptable, indicating a mismatch.

Why this answer

The debug output shows that the ISAKMP transform (3DES, SHA, group 2, pre-share) is being checked against the local policy, and the message 'atts are not acceptable' indicates a mismatch. This means the proposed transform set does not match any configured IKE policy on the responder, causing IKE phase 1 to fail. The failure is specifically due to a transform set mismatch, not authentication or lifetime issues.

Exam trap

Cisco often tests the distinction between transform set mismatch and authentication failure, where candidates mistakenly assume that any failure in IKE phase 1 is due to authentication, but the debug message 'atts are not acceptable' specifically points to a proposal mismatch.

How to eliminate wrong answers

Option A is wrong because the debug output explicitly states 'atts are not acceptable', which means the transform set is rejected, not accepted. Option C is wrong because authentication failure would occur later in the exchange (after SA parameters are agreed upon) and would show different debug messages, such as 'auth mode mismatch' or 'no suitable peer found'. Option D is wrong because the lifetime value of 86400 seconds is displayed without any indication of mismatch; the debug output does not flag the lifetime as unacceptable, and lifetime mismatches are typically negotiated or cause a different error message.

Full explanation →

1374

MCQeasy

In EIGRP, what is the default administrative distance of a summary route created with the 'ip summary-address eigrp' command?

A.5

B.90

C.170

D.1

AnswerA

Correct. EIGRP summary routes default to AD 5.

Why this answer

By default, EIGRP summary routes have an administrative distance of 5, which is lower than the default distance of 90 for internal EIGRP routes.

Full explanation →

1375

MCQhard

Which IPv6 traffic filter can be used to match traffic based on the Flow Label field?

A.IPv6 access-list with the 'flow-label' option

B.IPv6 prefix-list

C.IPv6 route-map with match ipv6 address

D.IPv6 uRPF

AnswerA

The 'flow-label' keyword allows matching the 20-bit Flow Label field in the IPv6 header.

Why this answer

The IPv6 access-list supports the 'flow-label' keyword, which allows matching packets based on the 20-bit Flow Label field in the IPv6 header. This field is defined in RFC 2460 and is used for per-flow processing, such as QoS or load balancing, without needing to inspect upper-layer headers.

Exam trap

Cisco often tests the distinction between packet-matching tools (access-lists) and route-matching tools (prefix-lists, route-maps), leading candidates to incorrectly select prefix-lists or route-maps when the question involves header fields like Flow Label.

How to eliminate wrong answers

Option B is wrong because an IPv6 prefix-list is designed to match IPv6 prefixes (network addresses and prefix lengths) in routing updates, not packet header fields like the Flow Label. Option C is wrong because a route-map with 'match ipv6 address' references an access-list or prefix-list to match routes, not traffic flows, and cannot directly match the Flow Label field. Option D is wrong because uRPF (unicast Reverse Path Forwarding) is a security feature that validates the source address of incoming packets against the routing table, and it does not filter based on the Flow Label field.

Full explanation →

1376

MCQmedium

An engineer is troubleshooting why the NMS is receiving duplicate SNMP traps from router R9 for the same event. The router has two 'snmp-server host' commands pointing to the same NMS IP address but with different community strings: 'public' and 'private'. The NMS is configured to process traps from both communities. What is the most likely cause?

A.The router sends one trap per 'snmp-server host' command, resulting in duplicate traps for the same event.

B.The NMS is configured to listen on two different ports, causing duplicate reception.

C.The router has an SNMP trap filter that is misconfigured, causing the same trap to be sent twice.

D.The engineer enabled both 'snmp-server enable traps' and 'snmp-server enable informs', causing duplicate notifications.

AnswerA

Correct because each host command generates a separate trap; using two communities causes duplication.

Why this answer

Each 'snmp-server host' command creates a separate trap destination entry in the router's SNMP configuration. When a trap-generating event occurs, the router sends a trap to each configured destination. Since both commands point to the same NMS IP address but with different community strings ('public' and 'private'), the router sends two identical traps (one with each community string) for the same event, causing the NMS to receive duplicates.

Exam trap

Cisco often tests the misconception that multiple 'snmp-server host' commands with the same IP but different communities are redundant or that the router deduplicates them, when in fact each command generates a separate trap transmission.

How to eliminate wrong answers

Option B is wrong because SNMP traps are sent to UDP port 162 by default, and the NMS listening on two different ports would not cause duplicate reception unless the router is configured to send to different ports, which is not stated. Option C is wrong because SNMP trap filters control which traps are sent or suppressed, not the duplication of traps; a misconfigured filter would either block or allow traps, not send the same trap twice. Option D is wrong because 'snmp-server enable traps' and 'snmp-server enable informs' enable different notification types (traps vs. informs), but informs require acknowledgment and are not sent as duplicates of traps; the scenario specifies traps, not informs.

Full explanation →

1377

MCQmedium

When an SNMP agent sends an InformRequest, what is the default behavior regarding acknowledgment?

A.The agent does not expect any acknowledgment; it is fire-and-forget.

B.The agent expects a Response PDU from the manager; if not received, it retransmits.

C.The manager sends an acknowledgment at the transport layer only.

D.The agent sends the inform multiple times by default regardless of acknowledgment.

AnswerB

Informs are confirmed notifications; the agent waits for a Response and retransmits if needed.

Why this answer

An SNMP InformRequest is a confirmed notification: the agent expects a Response PDU from the manager to acknowledge receipt. If the agent does not receive this response within a timeout period, it will retransmit the InformRequest. This is defined in RFC 3416 and distinguishes InformRequests from Traps, which are unacknowledged.

Exam trap

Cisco often tests the distinction between Traps (unacknowledged) and Informs (acknowledged), and the trap here is that candidates confuse the transport-layer acknowledgment (TCP ACK) with the SNMP application-layer Response PDU, leading them to pick option C.

How to eliminate wrong answers

Option A is wrong because an InformRequest is not fire-and-forget; it requires an acknowledgment via a Response PDU, unlike a Trap. Option C is wrong because the acknowledgment occurs at the SNMP application layer via a Response PDU, not merely at the transport layer (e.g., TCP ACK). Option D is wrong because the agent does not send the inform multiple times by default; retransmission only occurs if the expected Response PDU is not received within the configured timeout.

Full explanation →

1378

Drag & Drophard

Drag and drop the steps to troubleshoot NetFlow and Flexible NetFlow connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Troubleshooting connectivity failures starts with checking the exporter reachability using ping, then verifying the exporter configuration for correct IP and UDP port, then checking if the collector is listening on the expected port, then inspecting ACLs that might block the flow, and finally using debug ip flow export to see actual packet drops.

Full explanation →

1379

MCQhard

A network engineer runs the following command to troubleshoot BFD session flapping: R1# debug bfd packet *Mar 1 00:15:23.456: BFD: [R1-to-R3] received async packet from 10.5.5.2, state UP, diag 0 *Mar 1 00:15:23.457: BFD: [R1-to-R3] sending async packet, state UP *Mar 1 00:15:23.458: BFD: [R1-to-R3] received echo packet from 10.5.5.2, state UP *Mar 1 00:15:23.459: BFD: [R1-to-R3] echo packet lost, no echo received for 300 ms *Mar 1 00:15:23.460: BFD: [R1-to-R3] state UP -> DOWN (echo failure) What does this output indicate?

A.BFD session is UP and stable.

B.BFD session went DOWN because of echo timeout, indicating possible path issue.

C.BFD async packets are failing, causing session down.

D.BFD session is flapping due to misconfigured multiplier.

AnswerB

Echo packets were lost, causing BFD to declare the session down.

Why this answer

The debug output shows that BFD detected an echo failure (no echo packets received for 300 ms), causing the session to go DOWN. This indicates a connectivity issue or misconfiguration affecting echo mode.

Full explanation →

1380

Multi-Selecthard

Which TWO configuration steps are required to enable BFD for OSPF on a Cisco IOS-XE router? (Choose TWO.)

Select 2 answers

A.Configure 'bfd' under the interface

B.Configure 'bfd all-interfaces' under the OSPF process

C.Configure 'ip ospf bfd' under the interface

D.Configure 'bfd interval 50 min_rx 50 multiplier 3' globally

E.Configure 'router bfd' globally

AnswersA, B

This enables BFD on the interface, allowing BFD sessions to be established.

Why this answer

To enable BFD for OSPF, you must first enable BFD on the interface using the 'bfd' interface command, and then enable BFD support for OSPF under the OSPF routing process with 'bfd all-interfaces' or per-neighbor. The other options are either incorrect or not required.

Full explanation →

1381

MCQmedium

Consider the following EIGRP configuration on Router R4: router eigrp 300 variance 2 network 172.16.0.0 What is the purpose of the variance command?

A.It sets the maximum number of equal-cost paths to 2.

B.It allows load balancing over paths with metrics up to twice the best metric.

C.It enables unequal-cost load balancing with a factor of 2.

D.It sets the EIGRP metric weight for delay to 2.

AnswerB

Correct. Variance 2 allows any feasible successor with a metric ≤ 2 × best metric to be installed and used for load balancing.

Why this answer

The variance command in EIGRP allows unequal-cost load balancing by instructing the router to include routes in the routing table whose metric is less than or equal to the best metric multiplied by the variance value. With variance 2, any feasible successor route with a metric up to twice the best metric (i.e., ≤ best_metric × 2) will be installed and used for load balancing, provided it satisfies the feasibility condition (reported distance < feasible distance). Only option B accurately describes this behavior; option C is tempting but less precise because unequal-cost load balancing also requires feasible successors.

Exam trap

Cisco often tests the distinction between 'variance' (which enables unequal-cost load balancing) and 'maximum-paths' (which limits the number of paths), leading candidates to mistakenly think variance controls the number of paths.

How to eliminate wrong answers

Option A is wrong because the variance command does not set the maximum number of equal-cost paths; that is the purpose of the 'maximum-paths' command (default is 4, maximum 16). Option D is wrong because the variance command does not set EIGRP metric weights; metric weights are configured with the 'metric weights' command (or 'metric tos k1 k2 k3 k4 k5'), and the delay component is controlled by the 'delay' interface command or the 'k3' weight, not by variance.

Full explanation →

1382

MCQhard

An engineer configures SNMPv2c with a read-write community string 'private' on a router. The NMS can poll interface statistics and modify some objects, but when trying to shut down an interface via SNMP, the NMS receives an error. Which is the most likely explanation?

A.The interface is a loopback interface, which does not support the ifAdminStatus transition to down via SNMP.

B.The community string 'private' is read-only, not read-write.

C.The NMS is using the wrong OID for the interface.

D.The router requires SNMPv3 for write operations.

AnswerA

Loopback interfaces are virtual and cannot be shut down via SNMP; the MIB returns an error because the operation is not supported.

Why this answer

Loopback interfaces do not support the ifAdminStatus transition to 'down' via SNMP. The ifAdminStatus object (RFC 2863) can be set to 'down' for physical interfaces, but loopback interfaces are virtual and always remain in an 'up' state; attempting to change their administrative status via SNMP results in an error. The NMS can poll and modify other objects because the read-write community string 'private' is correctly configured, but the specific operation of shutting down a loopback interface is not supported.

Exam trap

Cisco often tests the misconception that all interfaces support the same SNMP write operations, but loopback interfaces are a common exception where ifAdminStatus cannot be changed via SNMP, leading candidates to incorrectly blame the community string or SNMP version.

How to eliminate wrong answers

Option B is wrong because the community string 'private' is explicitly configured as read-write, so it supports both read and write operations; the error is not due to a read-only community. Option C is wrong because the NMS can poll interface statistics and modify some objects, indicating it is using the correct OIDs for those operations; the error is specific to the ifAdminStatus transition, not a general OID mismatch. Option D is wrong because SNMPv2c supports write operations with a read-write community string; SNMPv3 is not required for write operations, and the configuration explicitly allows writes.

Full explanation →

1383

MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a service provider. The router has a default route pointing to the ISP. Traffic from the ISP is being dropped by uRPF. Which is the most likely explanation?

A.Strict mode uRPF does not use the default route for verification unless the 'allow-default' option is enabled.

B.The interface is configured with the wrong IP address, causing uRPF to fail.

C.uRPF should be configured in loose mode to work with default routes.

D.The router has multiple default routes, causing uRPF to fail.

AnswerA

By default, strict mode ignores default routes; 'allow-default' includes them.

Why this answer

Strict mode uRPF checks that the source IP of incoming packets has a matching route in the routing table that points back to the same interface. If the router has a default route, it may not match the specific source IP, causing drops. However, the edge case is that the default route is not considered by strict mode unless the 'allow-default' option is configured.

Without 'allow-default', strict mode requires a specific route back to the interface.

Full explanation →

1384

MCQeasy

Which IP SLA operation type uses ICMP to discover the path (hops) between source and destination?

A.ICMP Echo

B.ICMP Path Echo

C.UDP Jitter

D.TCP Connect

AnswerB

Correct. ICMP Path Echo discovers the path by incrementing TTL.

Why this answer

The ICMP Path Echo operation (type 10) uses ICMP Echo requests with increasing TTL values to trace the path from source to destination, similar to traceroute.

Full explanation →

1385

MCQhard

An engineer configures 'ipv6 verify source' with 'allow-default' on a switch port connected to a router that uses a default route via a static route. The router's traffic is being dropped by Source Guard. The engineer sees that the router's source address is in the binding table. What is the most likely cause?

A.The 'allow-default' option only permits traffic with source address matching the default route entry, not all traffic.

B.The router's source address is a link-local address, which is not supported by Source Guard.

C.The 'allow-default' option requires the router to send an NA for the default route.

D.The switch port must be configured as 'trusted' for Source Guard to work with routers.

AnswerA

It allows traffic from the default prefix, not all sources.

Why this answer

The 'allow-default' keyword in the 'ipv6 verify source' command only permits traffic whose source IPv6 address matches the default route entry (::/0) in the binding table. It does not allow all traffic; it specifically allows traffic from the default router's link-local address that is associated with the default route. Since the router's source address is in the binding table but the traffic is still dropped, the issue is that the router is sending packets with a source address that does not match the default route entry, or the default route entry itself is not properly installed in the binding table.

The 'allow-default' option is not a blanket pass for all traffic from the router.

Exam trap

Cisco often tests the misconception that 'allow-default' permits all traffic from a router, when in fact it only permits traffic matching the specific default route entry in the binding table, typically the router's link-local address learned via RA.

How to eliminate wrong answers

Option B is wrong because Source Guard supports link-local addresses; they are included in the binding table when learned via Neighbor Discovery (ND) or DHCPv6, and the 'allow-default' option specifically works with the default router's link-local address. Option C is wrong because the 'allow-default' option does not require the router to send a Neighbor Advertisement (NA) for the default route; the default route is typically learned via Router Advertisement (RA) or configured statically, and the binding table entry is populated from ND snooping or DHCPv6 snooping, not from an NA for the route itself. Option D is wrong because configuring a switch port as 'trusted' disables Source Guard on that port, which would allow all traffic, but the question states that Source Guard is dropping traffic, and the engineer wants to use 'allow-default' to permit specific traffic without disabling Source Guard entirely.

Full explanation →

1386

Multi-Selecthard

Which TWO configuration steps are required to enable a Cisco IOS router as a stateful DHCPv6 server for clients on interface GigabitEthernet0/0? (Choose TWO.)

Select 2 answers

A.Configure a DHCPv6 pool with the 'ipv6 dhcp pool POOL_NAME' command and define an address prefix.

B.Apply the DHCPv6 pool to the interface using 'ipv6 dhcp server POOL_NAME' under the interface configuration.

C.Configure the interface with 'ipv6 dhcp client POOL_NAME'.

D.Set the 'ipv6 nd managed-config-flag' on the interface.

E.Enable IPv6 on the interface with 'ipv6 enable'.

AnswersA, B

The pool defines the address range and parameters for stateful assignment.

Why this answer

The 'ipv6 dhcp pool POOL_NAME' command creates a DHCPv6 pool, and defining an address prefix within that pool is required to specify the IPv6 addresses that the server can assign to clients. This is the fundamental step for configuring a stateful DHCPv6 server, as the pool holds the address allocation parameters.

Exam trap

Cisco often tests the distinction between server-side and client-side DHCPv6 commands, and the trap here is that candidates confuse 'ipv6 dhcp server' (server) with 'ipv6 dhcp client' (client) or think that enabling IPv6 on the interface alone is sufficient for DHCPv6 operation.

Full explanation →

1387

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail GigabitEthernet0/1 IP-EIGRP interfaces for process 100 Xmit Queue Mean Pacing Time Multicast Pending Interface Peers Un/Reliable SRTT Un/Reliable Flow Timer Routes Gi0/1 1 0/0 10 0/10 50 0 Hello interval is 5 sec Next xmit serial <none> Un/reliable mcasts: 0/0 Un/reliable ucasts: 0/0 Mcast exceptions: 0 CR packets: 0 ACKs suppressed: 0 Retransmissions: 0 Out of sequence: 0 Authentication mode: none Redistribution: redistributed Based on this output, what is the problem?

A.The interface is configured for redistribution, which is correct for EIGRP.

B.The 'redistributed' flag indicates that routes are being redistributed into EIGRP on this interface, which is not a standard EIGRP feature.

C.The interface has one EIGRP neighbor, and redistribution is working correctly.

D.The output shows that redistribution is enabled, but the interface is not sending hellos.

AnswerB

EIGRP does not have per-interface redistribution; this output is likely from a different context or a misinterpretation.

Why this answer

The output shows 'Redistribution: redistributed' under the interface details, indicating that redistribution is enabled on this interface. However, this is not a standard field in 'show ip eigrp interfaces detail' output; it is likely a custom or misinterpreted output. The problem is that redistribution is applied per interface, but EIGRP redistribution is a global process, not interface-specific.

This could cause confusion or misconfiguration.

Full explanation →

1388

MCQhard

R1 and R2 are connected via an IPsec VPN tunnel. They are running EIGRP over the tunnel. R1's show ip eigrp neighbors shows R2 as up, but R1's show ip eigrp topology shows all routes from R2 in passive state. However, R1's show ip route does not have any EIGRP routes from R2. What is the root cause?

A.R2 is using a route-map to set EIGRP metric to 4294967295, making routes inaccessible.

B.EIGRP variance is set to 1, preventing load balancing.

C.The tunnel interface is down on R2.

D.R1 has a passive interface for the tunnel.

AnswerA

EIGRP routes with metric 4294967295 are considered unreachable and are not installed in the routing table, even though they appear in topology.

Why this answer

The EIGRP metric of 4294967295 is the maximum possible metric (32-bit value), effectively making the route unreachable. When R2 applies a route-map to set this metric, R1 receives the routes but considers them inaccessible, so they appear in the topology table as passive (since the neighbor is up and the route is learned) but are not installed in the routing table. This matches the symptoms: neighbor adjacency is established, routes are in the topology table, but no EIGRP routes appear in the IP routing table.

Exam trap

The trap here is that candidates see routes in the EIGRP topology table as passive and assume they are installed in the routing table, but Cisco tests the distinction between the topology table (which stores all learned routes) and the routing table (which only stores feasible successors with valid metrics).

How to eliminate wrong answers

Option B is wrong because EIGRP variance controls load balancing among multiple feasible successors, not the installation of routes into the routing table; a variance of 1 is the default and does not prevent route installation. Option C is wrong because if the tunnel interface were down on R2, R1 would not have an EIGRP neighbor adjacency (show ip eigrp neighbors would show R2 as down or not present). Option D is wrong because if R1 had a passive interface for the tunnel, R1 would not form an EIGRP neighbor relationship with R2 at all, contradicting the fact that R2 is shown as an EIGRP neighbor.

Full explanation →

1389

Multi-Selecthard

Which TWO statements about TACACS+ and RADIUS are true? (Choose TWO.)

Select 2 answers

A.TACACS+ encrypts the entire packet body, including the username and password, using a shared secret.

B.RADIUS encrypts the entire packet payload, including the username and password, using a shared secret.

C.TACACS+ uses UDP port 49 by default for communication.

D.RADIUS combines authentication and authorization in a single packet, while TACACS+ separates them.

E.Both TACACS+ and RADIUS support per-command authorization for exec sessions.

AnswersA, D

TACACS+ encrypts the entire payload (except the header) using the shared secret, providing full confidentiality for authentication data.

Why this answer

A is correct because TACACS+ encrypts the entire packet body, including the username and password, using a shared secret. This provides confidentiality for all authentication and authorization data, unlike RADIUS which only encrypts the password field.

Exam trap

Cisco often tests the misconception that RADIUS encrypts the entire payload like TACACS+, or that TACACS+ uses UDP, leading candidates to incorrectly select option B or C.

Full explanation →

1390

MCQmedium

Examine the following EEM applet configuration: !--- event manager applet LOGIN_ALERT event syslog occurs 1 period 60 action 1.0 syslog msg "Login event detected" !--- What is the problem with this configuration?

A.The 'event syslog occurs' command is missing the required 'pattern' keyword.

B.The period of 60 seconds is too short and will cause high CPU usage.

C.The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

D.The applet will trigger on every syslog message, which is not the intended behavior.

AnswerA

Correct. The event must specify a pattern to match; otherwise, the applet will not trigger.

Why this answer

The 'event syslog occurs' command requires a pattern to match against syslog messages. Without a pattern, the applet will never trigger because the event is not properly defined. The correct syntax is 'event syslog pattern <string> occurs <number> period <seconds>'.

Full explanation →

1391

MCQhard

An engineer configures IPsec site-to-site VPN between two routers. The tunnel establishes, but traffic does not pass. The 'show crypto ipsec sa' shows packets being encapsulated but no decapsulation. Which is the most likely explanation?

A.The transform set on the remote peer is missing ESP encryption.

B.The crypto ACL on the local router permits traffic, but the remote router's crypto ACL does not match the decrypted traffic.

C.The IKE policy uses aggressive mode, which is incompatible with main mode.

D.The 'crypto isakmp key' command uses a different pre-shared key on each side.

AnswerB

Mismatched interesting traffic ACLs cause the remote peer to not recognize the traffic as IPsec-protected.

Why this answer

If packets are encapsulated but not decapsulated, the remote peer is likely not receiving the encrypted traffic or cannot decrypt it. A common edge case is that the interesting traffic ACL on one side does not match the actual traffic (e.g., mismatched source/destination), causing the remote peer to receive packets that do not match its crypto map ACL, so it drops them.

Full explanation →

1392

MCQhard

A DMVPN network with EIGRP as the routing protocol experiences spoke-to-spoke tunnel failures. Hub router R1 has configuration: 'interface Tunnel0 ip nhrp network-id 1 ip nhrp map multicast dynamic ip nhrp redirect' and 'router eigrp 100 network 10.0.0.0'. Spoke router R2 shows 'show ip nhrp brief' output: '10.0.0.1/32 via 192.168.1.1, Tunnel0 created 00:10:00, dynamic' but 'show ip eigrp neighbors' shows only the hub. What is the root cause?

A.Spoke routers are missing 'ip nhrp shortcut' interface configuration, preventing dynamic spoke-to-spoke tunnel establishment.

B.EIGRP is not configured to advertise the tunnel network; need 'network 10.0.0.0' on spokes.

C.The hub router needs 'ip nhrp map multicast dynamic' to forward multicast for EIGRP; it is already present.

D.NHRP authentication mismatch between hub and spokes causes NHRP registration failure.

AnswerA

The 'ip nhrp shortcut' command on spokes enables them to install NHRP redirect routes for direct communication.

Why this answer

Spoke-to-spoke tunnels require NHRP redirect and shortcut features to trigger direct communication. The hub has 'ip nhrp redirect' but spokes must have 'ip nhrp shortcut' to install direct routes. Without this, spokes only communicate via hub, causing suboptimal routing and potential failure if hub is overloaded.

Full explanation →

1393

MCQhard

Which statement about the default behavior of 'auto-summary' in EIGRP for DMVPN tunnel interfaces in IOS-XE is correct?

A.Auto-summary is enabled by default and summarizes routes at classful boundaries.

B.Auto-summary is disabled by default, preventing classful summarization.

C.Auto-summary is enabled by default but only for tunnel interfaces.

D.Auto-summary is disabled by default but can be enabled only for DMVPN.

AnswerB

Correct. Auto-summary is off by default in IOS-XE.

Why this answer

In modern IOS-XE versions (15.x and later), auto-summary is disabled by default for EIGRP. This is a change from older IOS versions where it was enabled by default. Disabling auto-summary is essential in DMVPN to prevent incorrect summarization at classful boundaries.

Full explanation →

1394

MCQhard

According to RFC 5880, what is the maximum number of BFD sessions that can be uniquely identified using the discriminator fields?

A.2^16 (65536)

B.2^24 (16,777,216)

C.2^32 (4,294,967,296)

D.Unlimited

AnswerC

The discriminator fields are 32-bit, providing over 4 billion unique session identifiers.

Why this answer

The discriminator fields are 32-bit values, allowing up to 2^32 (approximately 4.29 billion) unique session identifiers.

Full explanation →

1395

MCQeasy

Which EIGRP metric component is disabled by default?

A.Bandwidth

B.Delay

C.Reliability

D.MTU

AnswerC

Reliability is disabled by default (K2=0).

Why this answer

C is correct because EIGRP uses a composite metric based on bandwidth, delay, reliability, and load, but reliability and load are disabled by default. Reliability is a dynamic metric that reflects the link's error rate; it is not used in the default metric calculation to ensure stability and avoid route flapping. Only bandwidth and delay are enabled by default, as configured via the 'metric weights' command (default: 0 1 0 1 0 0).

Exam trap

Cisco often tests the misconception that MTU is a metric component because it appears in the 'show interface' output alongside delay and reliability, but MTU is never used in the EIGRP metric calculation.

How to eliminate wrong answers

Option A is wrong because bandwidth is a mandatory component of the default EIGRP metric; it is enabled by default and used in the metric formula (K1=1). Option B is wrong because delay is also enabled by default (K3=1) and is a key part of the composite metric calculation. Option D is wrong because MTU is not a component of the EIGRP metric at all; it is used only for path MTU discovery and is not included in the metric weights (K5=0).

Full explanation →

1396

MCQhard

A router has CoPP configured with a class-map that matches BGP traffic (TCP port 179) and polices it to 500 pps. The router has multiple iBGP peers. After applying the policy, some BGP sessions flap, but others remain stable. The flapping peers are those with higher latency. Which is the most likely explanation?

A.CoPP drops BGP packets based on source IP, and high-latency peers have different source IPs.

B.High-latency peers generate more TCP retransmissions, which are more likely to be dropped by the police rate, causing session flaps.

C.BGP uses UDP for keepalives, and CoPP only polices TCP.

D.The CoPP policy is applied to the wrong control plane; it should be applied to the forwarding plane.

AnswerB

TCP retransmissions increase with latency, and CoPP may drop them, leading to BGP session failure.

Why this answer

B is correct because high-latency BGP peers experience more TCP retransmissions due to delayed acknowledgments. The CoPP policer drops packets exceeding 500 pps, and these retransmissions increase the packet rate for those sessions, making them more likely to exceed the policer and be dropped. Dropping BGP TCP segments (including keepalives) causes the BGP hold timer to expire, leading to session flaps.

Exam trap

Cisco often tests the misconception that CoPP drops packets based on source IP or that BGP uses UDP for keepalives, leading candidates to overlook the impact of TCP retransmissions from high-latency peers on policer thresholds.

How to eliminate wrong answers

Option A is wrong because CoPP class-maps match on protocol and port (TCP/179), not source IP; it does not differentiate per peer IP unless an ACL is explicitly used in the class-map. Option C is wrong because BGP uses TCP for all its messages, including keepalives and updates, not UDP; CoPP policing TCP/179 correctly targets BGP traffic. Option D is wrong because CoPP is applied to the control plane (via 'service-policy input' under 'control-plane' configuration), not the forwarding plane; the forwarding plane handles data traffic, not BGP control traffic.

Full explanation →

1397

MCQmedium

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue: R1# show bgp ipv4 unicast 192.168.1.0/24 BGP routing table entry for 192.168.1.0/24, version 12 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 65001, (received & used) 10.1.1.2 from 10.1.1.2 (10.1.1.2) Origin IGP, metric 0, localpref 100, valid, external, best Community: 100:200 What does this output indicate?

A.The prefix 192.168.1.0/24 has a community attribute of 100:200, which may affect routing decisions.

B.The prefix 192.168.1.0/24 is not installed in the routing table.

C.The prefix 192.168.1.0/24 is being filtered due to the community value.

D.The community 100:200 indicates the prefix is from a confederation.

AnswerA

The community 100:200 is shown in the output and can be used for policy.

Why this answer

The show bgp output for a specific prefix shows one path with community 100:200 attached. The community is a BGP community value that can be used for route tagging and policy enforcement. The path is valid and best.

Full explanation →

1398

MCQmedium

What is the default OSPF metric for a route learned over a DMVPN tunnel interface when the OSPF network type is broadcast?

A.1

B.10

C.100

D.0

AnswerA

Correct. With default reference bandwidth 100 Mbps and tunnel bandwidth 100 Mbps, metric = 100/100 = 1.

Why this answer

OSPF default metric for a route is based on the reference bandwidth (default 100 Mbps) divided by the interface bandwidth. For a tunnel interface, the default bandwidth is 100 Mbps (on many platforms), so the metric is 1. However, if the tunnel bandwidth is set differently, the metric changes.

The default metric is 1 when bandwidth is 100 Mbps.

Full explanation →

1399

MCQmedium

A network engineer is troubleshooting a Cisco router that is configured for RADIUS authentication. The engineer issues 'debug radius authentication' and sees that the RADIUS server is not responding. The router can ping the RADIUS server. What is the most likely cause?

A.UDP port 1812 is blocked between the router and the RADIUS server.

B.The RADIUS server shared key is incorrect.

C.The router's IP address is not in the RADIUS server's client list.

D.The RADIUS server is down.

AnswerA

Correct because RADIUS authentication uses UDP port 1812; if blocked, the server will not receive or respond to requests.

Why this answer

The RADIUS protocol uses UDP port 1812 for authentication. Since the router can ping the RADIUS server, network-layer connectivity exists, but the lack of response in the debug output indicates that the UDP packets are not reaching the server. A firewall or ACL blocking UDP 1812 between the router and the server is the most likely cause, as it prevents the RADIUS request from being received while ICMP (ping) traffic is permitted.

Exam trap

Cisco often tests the distinction between network-layer reachability (ping) and application-layer reachability (UDP port), leading candidates to incorrectly assume that a successful ping means the RADIUS server is fully operational and reachable.

How to eliminate wrong answers

Option B is wrong because an incorrect shared key would result in an Access-Reject or a 'RADIUS server not responding' message only after the server receives and processes the packet, but the debug shows no response at all, indicating the packet never reached the server. Option C is wrong because if the router's IP address were not in the RADIUS server's client list, the server would typically drop the packet silently or send a 'RADIUS server not responding' message, but the debug output shows no response, which is consistent with a network-level block rather than a server-side configuration issue. Option D is wrong because the router can ping the RADIUS server, proving the server is reachable at the IP layer; if the server were down, the ping would fail.

Full explanation →

1400

Multi-Selecthard

Which TWO statements about BGP route reflectors are true? (Choose TWO.)

Select 2 answers

A.A route reflector modifies the NEXT_HOP attribute to its own address when reflecting routes.

B.A route reflector adds its own cluster ID to the cluster-list attribute when reflecting a route.

C.A route reflector reflects routes received from a non-client to all other non-clients.

D.A route reflector reflects routes received from a client to all clients and non-clients.

E.A route reflector always sets the originator-id attribute to the router ID of the route reflector.

AnswersB, D

Correct. The RR adds its cluster ID to the cluster-list to prevent loops in hierarchical RR deployments.

Why this answer

Route reflectors (RRs) are used to reduce IBGP full mesh. They reflect routes from clients and non-clients, but with specific rules to prevent loops. An RR does not modify the AS_PATH or NEXT_HOP by default.

The 'cluster-list' attribute is used to detect loops. When an RR receives a route from a non-client, it reflects it only to clients, not to other non-clients. The 'originator-id' attribute is set by the RR to the router ID of the originator.

Full explanation →

1401

MCQhard

A network engineer runs the following command to troubleshoot an EEM issue: R1# show event manager detector Detector Name : syslog Detector Type : system Detector State : enabled Detector Queue Size : 100 Detector Queue Max : 200 Detector Events Triggered : 15 Detector Name : timer Detector Type : system Detector State : enabled Detector Queue Size : 0 Detector Queue Max : 50 Detector Events Triggered : 3 What does this output indicate?

A.Both syslog and timer detectors are enabled. The syslog detector has triggered 15 events and has 100 events in its queue.

B.The syslog detector is disabled and needs to be enabled for EEM to work.

C.The timer detector has triggered 3 events and has 50 events in its queue.

D.The queue size of 100 for syslog indicates that 100 events have been dropped.

AnswerA

Correct. The syslog detector is enabled, has triggered 15 events, and has a queue size of 100 (pending events).

Why this answer

The output shows the status of EEM detectors. Detectors are components that monitor for specific events (syslog, timer, etc.). The output shows each detector's state (enabled/disabled), queue size and maximum, and the number of events triggered.

Queue size indicates pending events waiting to be processed.

Full explanation →

1402

MCQmedium

Examine this MPLS configuration on a router: ip cef ! interface GigabitEthernet0/0 ip address 172.16.1.1 255.255.255.252 mpls ip ! interface GigabitEthernet0/1 ip address 172.16.2.1 255.255.255.252 ! router eigrp 100 network 172.16.0.0 ! mpls ldp router-id Loopback0 force What is the problem with this configuration?

A.EIGRP is not supported with MPLS; OSPF or IS-IS must be used.

B.The 'mpls ldp router-id' command references Loopback0, but no loopback interface is configured, causing LDP to fail.

C.The 'mpls ip' command is missing on GigabitEthernet0/1, so MPLS will not work on that interface.

D.CEF must be enabled under each interface, not just globally.

AnswerB

If the specified router-id interface does not exist, LDP cannot determine its router ID and will not operate. A loopback must be created.

Why this answer

The LDP router-id is set to Loopback0, but Loopback0 is not configured. This will cause LDP to fail to establish a router ID, and LDP sessions will not form. Additionally, EIGRP is used but that is fine.

The missing loopback interface is the key issue.

Full explanation →

1403

Multi-Selecthard

Which TWO statements about OSPFv2 authentication troubleshooting are true? (Choose TWO.)

Select 2 answers

A.The 'show ip ospf interface' command displays the authentication type and key ID configured on an interface.

B.The 'debug ip ospf adj' command can show authentication mismatch errors during neighbor adjacency formation.

C.OSPFv2 supports only MD5 authentication; SHA is not supported.

D.Plaintext authentication is the most secure method and is recommended for production networks.

E.The 'ip ospf authentication-key' command is used to configure SHA authentication.

AnswersA, B

Correct. The output of 'show ip ospf interface' includes fields like 'Auth' and 'Key ID' when authentication is configured.

Why this answer

OSPFv2 supports MD5 and SHA authentication, and the 'show ip ospf interface' command can verify authentication configuration. The 'debug ip ospf adj' command can reveal authentication failures. Plaintext authentication is supported but deprecated, and the 'area authentication' command is used for area-level configuration.

Full explanation →

1404

MCQhard

An engineer configures IPv6 uRPF strict mode on an interface of a router that participates in OSPFv3. The router starts dropping OSPFv3 Hello packets received on that interface, causing the OSPFv3 neighbor adjacency to fail. Which is the most likely explanation?

A.The OSPFv3 Hello packets have a source IPv6 address that is not in the routing table, causing uRPF strict mode to drop them.

B.The OSPFv3 Hello packets are multicast to ff02::5, and uRPF strict mode drops all multicast traffic by default.

C.The OSPFv3 Hello packets have a hop limit of 1, and uRPF strict mode requires a hop limit of at least 2.

D.The interface has IPv6 unicast-routing disabled, which prevents uRPF from functioning correctly.

AnswerA

Correct. OSPFv3 uses link-local source addresses, which are not globally routable and not present in the routing table, so uRPF strict mode drops them.

Why this answer

IPv6 uRPF strict mode checks that the source IPv6 address of an incoming packet matches a route in the routing table and that the incoming interface is the same as the outgoing interface for that route. OSPFv3 Hello packets are sent with the link-local address of the sending interface as the source IPv6 address. If that link-local address is not present in the IPv6 routing table (e.g., because OSPFv3 has not yet installed the neighbor's link-local route), uRPF strict mode drops the packet, preventing the adjacency from forming.

Exam trap

Cisco often tests the misconception that uRPF drops multicast traffic by default, but the real issue is that OSPFv3's link-local source addresses are not yet in the routing table when strict mode is applied, causing the adjacency to fail.

How to eliminate wrong answers

Option B is wrong because uRPF does not drop all multicast traffic by default; it performs a source address check, and multicast packets like OSPFv3 Hellos (destined to ff02::5) are subject to that check, not blanket-dropped. Option C is wrong because OSPFv3 Hello packets have a hop limit of 1 (as per RFC 5340), but uRPF strict mode does not enforce a minimum hop limit; it only validates the source address against the routing table. Option D is wrong because the 'ipv6 unicast-routing' command enables IPv6 routing globally, but its absence would prevent OSPFv3 from running at all, not cause uRPF to drop packets; uRPF itself requires IPv6 CEF to be enabled, not unicast-routing.

Full explanation →

1405

MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# show policy-map control-plane input class class-default Class-map: class-default (match-any) 140225 packets, 12345678 bytes 5 minute offered rate 1000 bps, drop rate 0 bps Match: any police: cir 1000000 bps, bc 31250 bytes conformed 140225 packets, 12345678 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop What does this output indicate?

A.The CoPP policy is policing traffic to 1 Mbps, and all traffic so far has been within the limit and transmitted.

B.The CoPP policy is dropping all traffic because the CIR is too low.

C.The CoPP policy is not matching any traffic because the class-default does not match any packets.

D.The CoPP policy is only policing traffic that exceeds the CIR, but all traffic is being transmitted.

AnswerA

The conformed counter matches the total packets, and exceeded/violated counters are zero, meaning no drops.

Why this answer

The output shows that the class-default class in the CoPP policy has a police configuration with a CIR of 1,000,000 bps (1 Mbps). All 140,225 packets have been counted as conforming, with zero exceeded or violated packets, and the conform action is 'transmit'. This means all traffic has been within the policed rate and has been forwarded without drops.

Exam trap

Cisco often tests the interpretation of police counters in CoPP output, where candidates mistakenly think that a police configuration always drops traffic or that class-default does not match traffic, when in fact the counters clearly show conformed packets and zero drops.

How to eliminate wrong answers

Option B is wrong because the output shows zero exceeded and zero violated packets, indicating no traffic is being dropped; the CIR is not too low for the current traffic load. Option C is wrong because the class-default class uses 'match any', and the packet count of 140,225 proves that traffic is being matched and policed. Option D is wrong because the police configuration applies to all traffic in the class, not just traffic that exceeds the CIR; the output shows all traffic is conforming and being transmitted, not that only exceeding traffic is policed.

Full explanation →

1406

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp topology 10.0.0.0 255.255.252.0 IP-EIGRP (AS 100): Topology entry for 10.0.0.0/22 State: Passive, Origin: Internal, Metric [90/2172416], Tag 0 Number of successors: 1 FD is 2172416, Serno: 5 Route is Summary Advertised by R2 (via Serial0/0/0) Reply status: 0 Based on this output, what is true about the route 10.0.0.0/22?

A.The route is a summary route generated by R1.

B.The route is a summary route learned from R2.

C.The route is an external route redistributed into EIGRP.

D.The route is in active state and being queried.

AnswerB

The output shows 'Advertised by R2' and 'Route is Summary', indicating it is a summary route received from neighbor R2.

Why this answer

The 'Route is Summary' line indicates this is a summary route in the EIGRP topology table. The output shows it is passive and has a successor, confirming it is a valid summary route.

Full explanation →

1407

MCQhard

An engineer enables unicast RPF (uRPF) in strict mode on an interface. Afterward, some legitimate traffic from a BGP neighbor is dropped. The neighbor has two paths to the router, and traffic may arrive on a different interface than the return path. What is the most likely explanation?

A.Strict uRPF drops packets if the source IP is not reachable via the receiving interface, which fails in asymmetric routing scenarios.

B.The uRPF 'allow-default' option was not configured, so default routes are ignored.

C.The neighbor's BGP updates have a source IP that is not in the routing table.

D.Loose mode should be used instead, but strict mode was configured by mistake.

AnswerA

Strict mode requires the source IP to be in the routing table with the same interface as the incoming packet.

Why this answer

Strict uRPF checks that the source IP of incoming packets matches the routing table entry for the interface it arrived on. If asymmetric routing occurs, packets from a valid neighbor may arrive on a different interface than the return path, causing them to be dropped.

Full explanation →

1408

MCQmedium

A network engineer is troubleshooting BGP route summarization on a border router that advertises a summary route 172.16.0.0/16 to an ISP neighbor. The engineer notices that the ISP is receiving the summary route but also receiving the more specific routes (172.16.1.0/24, 172.16.2.0/24), causing suboptimal routing. What should the engineer do to ensure only the summary route is advertised?

A.Configure the 'network' command for the summary route and remove the network statements for the specific subnets.

B.Use the 'aggregate-address 172.16.0.0 255.255.0.0 summary-only' command under the BGP process.

C.Apply a route-map to the neighbor to filter out the specific routes using an ACL.

D.Configure the 'summary-address' command under the BGP process.

AnswerB

Correct. The aggregate-address with summary-only keyword creates the summary and suppresses all more specific routes from being advertised.

Why this answer

In BGP, to suppress more specific routes when advertising a summary, the engineer must use the 'aggregate-address' command with the 'summary-only' keyword.

Full explanation →

1409

MCQmedium

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue: R1# show ip access-lists 160 Extended IP access list 160 10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 20 permit tcp 172.16.0.0 0.15.255.255 any eq 22 30 permit tcp 192.168.0.0 0.0.255.255 any eq 22 40 deny ip any any What does this output indicate?

A.The ACL permits SSH from private IP ranges and denies all other traffic.

B.The ACL permits all traffic from private IP ranges.

C.The ACL denies SSH from private IP ranges.

D.The ACL is applied inbound on an interface and is blocking all traffic.

AnswerA

The entries permit SSH from the specified ranges and deny everything else.

Why this answer

The ACL permits TCP traffic to destination port 22 (SSH) from the three private IP ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) using wildcard masks that match the respective network prefixes. The final explicit deny ip any any statement blocks all other traffic, so only SSH from private IP ranges is permitted.

Exam trap

Cisco often tests the distinction between 'permit all traffic' and 'permit specific traffic (e.g., SSH only)', leading candidates to overlook the port-specific 'eq 22' and incorrectly assume the ACL permits all traffic from the private ranges.

How to eliminate wrong answers

Option B is wrong because the ACL only permits TCP traffic to port 22, not all traffic; it specifically filters by destination port. Option C is wrong because the permit statements allow SSH from private IP ranges, not deny it. Option D is wrong because the output shows only the ACL content, not its application direction or interface; the ACL could be applied inbound or outbound, and the deny ip any any does not inherently indicate it is blocking all traffic—it only blocks traffic not matching earlier permits.

Full explanation →

1410

Drag & Dropmedium

Drag and drop the steps to verify and validate the operational state of Control Plane Policing (CoPP) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Verification starts with confirming the policy is applied globally, then checking per-class statistics for drops, using show commands to examine packet counters, testing reachability to the control plane, and finally reviewing logs for any CoPP-related messages. This ensures the policy is working as intended.

Full explanation →

1411

MCQeasy

Which EIGRP packet type is used to confirm receipt of a reliable update?

A.Hello

B.ACK

C.Update

D.Reply

AnswerB

Correct. ACK packets are used to acknowledge reliable EIGRP packets (updates, queries, replies).

Why this answer

EIGRP uses reliable transport for updates, queries, and replies. The receiver sends an ACK packet (a Hello packet with no data) to confirm receipt.

Full explanation →

1412

MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show ip ospf database summary 10.0.0.0 OSPF Router with ID (1.1.1.1) (Process ID 1) Summary Net Link States (Area 0) LS age: 100 Options: (No TOS-capability, DC) LS Type: Summary Links(Network) Link State ID: 10.0.0.0 (summary Network Number) Advertising Router: 2.2.2.2 LS Seq Number: 80000001 Checksum: 0x1234 Length: 28 Network Mask: /16 TOS: 0 Metric: 20 What does this output indicate?

A.The summary route 10.0.0.0/16 is being advertised by router 2.2.2.2 as a Type 3 LSA into Area 0.

B.The summary route is a Type 5 external LSA from an ASBR.

C.The summary route is a Type 1 router LSA from router 2.2.2.2.

D.The summary route is not installed because the metric is too high.

AnswerA

The LS Type and advertising router confirm it is a Type 3 summary LSA.

Why this answer

This output shows the OSPF database entry for a summary route 10.0.0.0/16. The LS Type is Summary Links, indicating it is a Type 3 LSA generated by an ABR (advertising router 2.2.2.2). The metric of 20 suggests it is a summary route injected into Area 0.

Full explanation →

1413

MCQmedium

Which statement about IPv6 uRPF loose mode is true?

A.It requires the source address to be reachable via the same interface.

B.It only verifies that the source address exists in the FIB.

C.It drops packets with link-local source addresses.

D.It is enabled by default on all interfaces.

AnswerB

Loose mode checks for any route to the source address.

Why this answer

In IPv6 unicast Reverse Path Forwarding (uRPF) loose mode, the router checks the FIB (Forwarding Information Base) to verify that the source address of an incoming packet exists in the routing table. It does not require the source address to be reachable via the same interface, which is the key distinction from strict mode. This allows loose mode to be used in asymmetric routing scenarios where the return path may not match the ingress interface.

Exam trap

The trap here is that candidates often confuse loose mode with strict mode, assuming loose mode still requires interface-level reachability, when in fact it only checks for the source address's existence in the FIB.

How to eliminate wrong answers

Option A is wrong because requiring the source address to be reachable via the same interface is the behavior of uRPF strict mode, not loose mode. Option C is wrong because uRPF loose mode does not specifically drop packets with link-local source addresses; link-local addresses are typically dropped by default in IPv6 due to RFC 4291, not by uRPF. Option D is wrong because uRPF is not enabled by default on any interface; it must be explicitly configured using the 'ipv6 verify unicast source reachable-via any' command for loose mode.

Full explanation →

1414

MCQhard

An engineer configures Control Plane Policing (CoPP) with a policy map that includes a class-map matching BGP traffic. The policy map has a 'police' action that sets the rate-limit in bps. After applying the policy to the control plane, BGP sessions start flapping. Which is the most likely explanation?

A.The police rate is configured in bps, but BGP keepalives are small packets; pps should be used to avoid dropping.

B.The class-map matches BGP traffic incorrectly; it should match on protocol BGP.

C.The policy map is applied to the control plane inbound, but BGP packets are sent outbound.

D.The default class is not configured, causing all other traffic to be dropped.

AnswerA

bps rate-limit can drop many small packets; pps is recommended for control plane traffic.

Why this answer

CoPP rate-limits are often configured in bps by default, but for control plane traffic, pps (packets per second) is more appropriate. If the rate-limit is set in bps, it may be too low for BGP keepalive packets, which are small. The edge case is that the engineer used bps instead of pps, causing the policer to drop BGP packets.

Full explanation →

1415

MCQmedium

Which statement correctly describes the behavior of IPv6 Unicast Reverse Path Forwarding (uRPF) in strict mode?

A.It verifies that the source address is in the routing table, but does not check the incoming interface.

B.It checks that the source address is reachable via the same interface and that the route is a connected route.

C.It verifies that the source address is reachable via the same interface and that the route points back to that interface.

D.It only checks that the source address is not a multicast or link-local address.

AnswerC

This is the definition of strict mode uRPF.

Why this answer

IPv6 uRPF strict mode requires that the source address of an incoming packet is reachable via the exact same interface on which the packet arrived, and that the best matching route in the FIB points back to that interface. This prevents spoofed traffic by ensuring the source is topologically correct from the router's perspective, as defined in RFC 3704.

Exam trap

Cisco often tests the distinction between strict and loose mode, and the trap here is that candidates confuse 'route points back to that interface' with 'route is a connected route,' leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because strict mode does check the incoming interface; it requires the source address to be reachable via that specific interface, not just present in the routing table. Option B is wrong because strict mode does not require the route to be a connected route; it only requires the route to point back to the incoming interface, which can be a static or dynamic route. Option D is wrong because uRPF strict mode does not filter based on address type (multicast or link-local); it performs a reachability check on the source address, and multicast/link-local sources are typically dropped by other mechanisms or are not routable.

Full explanation →

1416

MCQmedium

Consider the following MPLS configuration on a Cisco router: ip cef ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.252 mpls ip ! interface GigabitEthernet0/1 ip address 192.168.2.1 255.255.255.252 mpls ip ! mpls ldp router-id GigabitEthernet0/0 What is the likely problem with this configuration?

A.The router-id command is incorrectly referencing a physical interface; LDP may flap if GigabitEthernet0/0 goes down.

B.Missing 'mpls label protocol ldp' under the interfaces will prevent LDP from running.

C.Cisco Express Forwarding (CEF) must be explicitly enabled globally; it is not enabled by default.

D.The configuration is correct and will work without any issues.

AnswerA

Using a physical interface as the LDP router ID is not recommended because if that interface fails, LDP sessions will reset. A loopback interface should be used for stability.

Why this answer

The 'mpls ldp router-id' command expects a loopback interface or a stable IP address, not a physical interface name. Using a physical interface can cause LDP to flap if the interface goes down. Also, the command typically uses an interface's IP address, not the interface name directly.

The correct syntax is 'mpls ldp router-id <interface> [force]', but it is best practice to use a loopback.

Full explanation →

1417

MCQmedium

A network engineer is troubleshooting an OSPF adjacency that is not forming. Both routers are running OSPF with BFD enabled. The engineer checks the BFD session and sees it is 'Up'. However, the OSPF neighbor state is stuck in 'INIT'. What is the most likely cause?

A.The OSPF hello interval is mismatched between the two routers.

B.The OSPF network type is mismatched (e.g., broadcast vs point-to-point).

C.The OSPF area ID is mismatched between the two routers.

D.The interface is configured with 'ip ospf bfd' but the OSPF process is not configured with 'bfd all-interfaces'.

AnswerC

If the area ID does not match, the router will ignore the hello packets, causing the neighbor to remain in INIT state.

Why this answer

OSPF stuck in INIT usually indicates that the router is not receiving OSPF hello packets from the neighbor. BFD being up suggests Layer 2 connectivity is fine, so the issue is likely OSPF configuration, such as a mismatch in area ID or authentication.

Full explanation →

1418

MCQhard

A network engineer is troubleshooting a BGP IPv6 peering issue between two routers, R1 and R2, connected via a point-to-point link. The engineer notices that the BGP session is flapping with error 'BGP Notification sent: 3/2 (Update malformed)'. The engineer checks the IPv6 ACL applied to the interface on R1 and sees an inbound ACL that permits only TCP port 179 from the neighbor's link-local address. The BGP peering uses the global unicast addresses of the interfaces. What is the most likely cause of the BGP session failure?

A.The ACL is blocking TCP packets from the neighbor's global unicast address because it only permits traffic from the link-local address.

B.The BGP update is malformed because the neighbor does not have the correct route-map applied.

C.The ACL is missing a permit statement for ICMPv6 neighbor discovery messages.

D.The BGP session is using link-local addresses, but the ACL permits global addresses.

AnswerA

Correct because BGP uses TCP, and the ACL permits only traffic from the link-local address, but the BGP session is established using global addresses, causing the TCP handshake to fail.

Why this answer

The BGP session is flapping because the inbound ACL on R1 permits only TCP port 179 traffic sourced from the neighbor's link-local address, but the BGP peering is configured using global unicast addresses. Therefore, TCP packets from R2's global unicast address are dropped by the ACL, causing the BGP session to fail with a 'Notification sent: 3/2 (Update malformed)' error, as the TCP connection cannot be established or maintained.

Exam trap

Cisco often tests the misconception that ACLs for BGP peering should permit the neighbor's link-local address when using IPv6, but the trap here is that the BGP session is configured with global unicast addresses, so the ACL must permit the global unicast address, not the link-local address.

How to eliminate wrong answers

Option B is wrong because a malformed update error (code 3, subcode 2) is not caused by a missing route-map; route-maps affect route filtering or attribute manipulation, not the TCP transport or session establishment. Option C is wrong because ICMPv6 neighbor discovery messages (e.g., Neighbor Solicitation/Advertisement) are used for IPv6 address resolution and are not required for BGP session establishment over a point-to-point link; the ACL blocking TCP from the global address is the direct cause. Option D is wrong because the BGP session is using global unicast addresses, not link-local addresses, and the ACL permits traffic from the link-local address, which would not match the actual source address of the BGP packets.

Full explanation →

1419

MCQmedium

An engineer applies a CoPP policy to a router to protect the control plane. The policy includes a class-map that matches all ICMP traffic and polices it to 5000 bps. After the policy is applied, the engineer notices that OSPF adjacencies are going down. The OSPF hello packets are not being received. What is the most likely cause?

A.The CoPP policy is policing OSPF packets because the class-map matches all IP traffic, not just ICMP.

B.The CoPP policy has a default class that drops all unmatched traffic, including OSPF packets.

C.The OSPF hello packets are being rate-limited because they are ICMP packets.

D.The CoPP policy is applied to the wrong interface, causing OSPF packets to be dropped.

AnswerB

If the CoPP policy does not explicitly permit OSPF packets, a default drop class will cause OSPF adjacencies to fail.

Why this answer

The CoPP policy includes a class-map that matches only ICMP traffic, but when applied, it uses a default class that drops all unmatched traffic. OSPF hello packets, which are not ICMP, fall into this default class and are dropped, causing adjacencies to fail. This is a common misconfiguration where the policy lacks an explicit permit for essential control plane protocols like OSPF.

Exam trap

Cisco often tests the trap that candidates assume only the explicitly matched class affects traffic, forgetting that the default class in a CoPP policy drops all unmatched traffic unless explicitly configured otherwise.

How to eliminate wrong answers

Option A is wrong because the class-map explicitly matches only ICMP traffic, not all IP traffic, so OSPF packets are not policed by that class. Option C is wrong because OSPF hello packets are IP protocol 89, not ICMP (protocol 1), so they are not rate-limited by the ICMP-specific policer. Option D is wrong because CoPP is applied globally to the control plane, not to a specific interface, so interface application is not relevant to this issue.

Full explanation →

1420

MCQmedium

A network administrator is configuring AAA for device access on a Cisco router. After configuring the RADIUS server and AAA authentication login default group radius local, the engineer tests Telnet access and receives 'Access denied' even with correct credentials. The RADIUS server is reachable. What is the most likely cause?

A.The VTY lines are not configured with 'login authentication default'.

B.The RADIUS server shared key is incorrect.

C.The enable password is not set.

D.The 'aaa new-model' command is missing.

AnswerA

Correct because the AAA login method list must be explicitly applied to the VTY lines using the 'login authentication' command.

Why this answer

The 'login authentication default' command must be applied to the VTY lines to use the AAA authentication method set globally with 'aaa authentication login default group radius local'. Without this, the VTY lines default to using the local enable password for authentication, ignoring the AAA configuration. Since the RADIUS server is reachable and credentials are correct, the missing VTY line configuration is the most likely cause of the 'Access denied' error.

Exam trap

Cisco often tests the distinction between global AAA authentication configuration and per-line application, trapping candidates who assume 'aaa authentication login default' automatically applies to all lines without the 'login authentication default' command on the VTY lines.

How to eliminate wrong answers

Option B is wrong because if the RADIUS server shared key were incorrect, the router would not be able to communicate with the server, resulting in a timeout or fallback to local authentication (if configured), not an immediate 'Access denied' with correct credentials. Option C is wrong because the enable password is used for privilege escalation (enable mode), not for Telnet login authentication; the VTY lines are using AAA, which does not require an enable password for initial access. Option D is wrong because 'aaa new-model' is required to enable AAA services globally, and without it, the 'aaa authentication login default' command would not be accepted; the fact that the administrator configured AAA commands implies 'aaa new-model' is already present.

Full explanation →

1421

MCQhard

An engineer configures OSPFv3 with multiple areas. On the ABR, routes from area 1 are not being advertised into area 0. Which is the most likely explanation?

A.The ABR does not have a direct interface in area 0.

B.The ABR has a higher router ID than the other routers.

C.The OSPFv3 process is configured with the 'no-redistribution' command.

D.The ABR is configured as a stub router.

AnswerA

An ABR must be directly connected to area 0 to advertise routes between areas.

Why this answer

OSPFv3 requires that the ABR have a direct connection to area 0. If the ABR is not directly connected to area 0, it will not advertise inter-area routes. Additionally, OSPFv3 uses the same rule as OSPFv2: an ABR must have at least one interface in area 0 to function as an ABR.

Full explanation →

1422

MCQhard

An engineer configures OSPF on a DMVPN Phase 1 network with a single hub and multiple spokes. The hub is configured with 'ip ospf network broadcast' and the spokes with 'ip ospf network point-to-multipoint'. The hub's OSPF priority is set to 255, and all spokes have priority 0. Unexpectedly, the hub does not become the DR, and no OSPF adjacency is formed. Which is the most likely explanation?

A.The OSPF network type mismatch causes the hub to send multicast Hellos, but the spokes expect unicast Hellos, so no adjacency forms.

B.The hub's OSPF priority of 255 ensures it becomes the DR, but the spokes with priority 0 cannot become BDR, causing the election to fail.

C.The spokes are configured with 'ip ospf network point-to-multipoint' but the hub is broadcast; the hub will still form adjacencies with the spokes if the MTU matches.

D.The OSPF process on the hub has a lower Router ID than the spokes, causing the spokes to become DR instead of the hub.

AnswerA

Broadcast network uses multicast 224.0.0.5, while point-to-multipoint uses unicast; without matching, Hellos are not received.

Why this answer

In OSPF, the DR election is based on priority and Router ID. However, on a broadcast network, all routers must have the same network type to participate in the election. With a mix of broadcast and point-to-multipoint, the point-to-multipoint routers do not participate in the DR election, and the broadcast router may still attempt to elect a DR.

But if the hub is the only router with broadcast network type, it will become the DR (since no other routers participate). However, the adjacency may still fail because the point-to-multipoint routers do not respond to multicast Hellos from the hub. The corner case is that the hub's OSPF interface is configured as broadcast, but the spokes are point-to-multipoint, which means the spokes send unicast Hellos and expect unicast Hellos in return.

The hub sends multicast Hellos, which the spokes ignore, and vice versa, leading to no adjacency.

Full explanation →

1423

Multi-Selectmedium

Which TWO configuration steps are required to implement IPv6 traffic filtering using a named ACL on a Cisco router? (Choose TWO.)

Select 2 answers

A.Create the ACL using the ipv6 access-list command.

B.Apply the ACL to the interface using the ipv6 traffic-filter command.

C.Create the ACL using the access-list command.

D.Apply the ACL to the interface using the ip access-group command.

E.Apply the ACL to the interface using the ipv6 access-group command.

AnswersA, B

Correct: 'ipv6 access-list NAME' enters IPv6 ACL configuration mode.

Why this answer

The `ipv6 access-list` command is the standard Cisco IOS command used to create a named IPv6 ACL, which supports filtering based on IPv6 headers, extension headers, and upper-layer protocols. Option B is correct because the `ipv6 traffic-filter` command is the interface-level command that applies the named IPv6 ACL to filter inbound or outbound IPv6 traffic, analogous to `ip access-group` for IPv4.

Exam trap

Cisco often tests the distinction between IPv4 and IPv6 ACL commands, and the trap here is that candidates mistakenly apply the IPv4 `ip access-group` command or the non-existent `ipv6 access-group` command instead of the correct `ipv6 traffic-filter` command.

Full explanation →

1424

Multi-Selecthard

Which TWO statements about the use of 'mpls ldp autoconfig' in an MPLS L3VPN environment are true? (Choose TWO.)

Select 2 answers

A.It automatically enables LDP on all interfaces that are part of the OSPF or IS-IS process.

B.It can be overridden on a specific interface by configuring 'no mpls ip' under that interface.

C.It automatically enables LDP on loopback interfaces to facilitate BGP next-hop reachability.

D.It configures LDP on all interfaces, including those not running the IGP, as long as they are IP-enabled.

E.It is required for the PE-CE routing protocol to exchange labels with the CE router.

AnswersA, B

Correct. The command enables LDP on all interfaces running the IGP, reducing manual configuration.

Why this answer

The 'mpls ldp autoconfig' command is used under an OSPF or IS-IS process to automatically enable LDP on all interfaces participating in that IGP. It simplifies configuration but can be overridden per interface. It does not affect BGP sessions, nor does it enable LDP on loopback interfaces by default (loopbacks are not typically used for LDP label exchange).

It does not enable MPLS on core interfaces automatically if they are not part of the IGP process.

Full explanation →

1425

MCQhard

An experienced network engineer configures a DMVPN Phase 2 network with OSPF as the routing protocol. On the hub router, the tunnel interface is configured with 'ip ospf network broadcast' and the spokes with 'ip ospf network point-to-multipoint'. Unexpectedly, the hub OSPF neighbor state with each spoke remains stuck in EXSTART/EXCHANGE. Which is the most likely explanation?

A.The OSPF MTU mismatch between hub and spokes causes the adjacency to stall during the DD exchange phase.

B.The OSPF network type mismatch between hub (broadcast) and spokes (point-to-multipoint) prevents proper Hello and DD packet exchange, causing the stuck state.

C.The NHRP registration process is incomplete, causing OSPF to fail to establish neighbor relationships over the DMVPN tunnel.

D.The hub router's OSPF priority is set to 0, preventing it from becoming the DR, which disrupts the adjacency formation.

AnswerB

Mismatched OSPF network types lead to different Hello packet formats (multicast vs unicast) and DR election behavior, preventing the adjacency from progressing beyond EXSTART/EXCHANGE.

Why this answer

OSPF requires matching network types to form a full adjacency. A broadcast network type expects a DR/BDR election and uses multicast Hellos, while point-to-multipoint uses unicast Hellos. The mismatch causes the hub to send Database Descriptor packets (DD) expecting a response from a DR, but the spoke, configured as point-to-multipoint, does not participate in DR election and responds differently, leading to a stuck state in EXSTART/EXCHANGE.

The fix is to use 'ip ospf network broadcast' on all routers or use 'ip ospf network point-to-multipoint' consistently.

Full explanation →

Page 19 of 27

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 Technologies VPN Technologies Infrastructure Security Infrastructure Services

See all domains with question counts →