Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1501–1575

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 20

Page 21 of 27

Page 22
1501
MCQhard

A network engineer configures redistribution between OSPF and EIGRP on a multi-access link. After configuration, OSPF neighbors keep flapping. Router R1 config: interface GigabitEthernet0/0 ip ospf network broadcast ip ospf hello-interval 10 ! router ospf 1 redistribute eigrp 100 subnets ! router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.1.2 1 FULL/DR 00:00:35 10.1.1.2 GigabitEthernet0/0 192.168.1.3 1 2WAY/DROTHER 00:00:31 10.1.1.3 GigabitEthernet0/0 What is the root cause?

A.The OSPF hello interval is too low, causing neighbor flapping under load from redistribution.
B.The EIGRP metric is misconfigured, causing route inconsistency.
C.The OSPF network type broadcast requires a DR/BDR election, causing instability.
D.The redistribute command under OSPF is missing the metric type.
AnswerA

Redistribution increases CPU load, causing hello packets to be delayed and neighbors to time out.

Why this answer

The OSPF network type is broadcast, but the EIGRP redistribution may be causing OSPF LSAs to be flooded with high CPU load, leading to neighbor flapping. Additionally, the hello interval is set to 10 seconds, but the dead interval is not explicitly set, defaulting to 40 seconds. If the router is overloaded, hello packets may be missed.

The fix is to increase the dead interval or adjust the network type to point-to-point.

Full explanation →
1502
MCQmedium

A network engineer runs the following command on switch SW1: SW1# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : Both : Gi0/1, Gi0/2 Destination Ports : Gi0/3 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?

A.The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.
B.The SPAN session is monitoring traffic on Gi0/3 and sending it to Gi0/1 and Gi0/2.
C.The SPAN session is using RSPAN because the destination port has ingress disabled.
D.The SPAN session is not active because the destination port is not in forwarding state.
AnswerA

The output clearly shows source ports Gi0/1 and Gi0/2, destination port Gi0/3, and type Local Session, confirming this.

Why this answer

The output shows a local SPAN session with source ports Gi0/1 and Gi0/2, and destination port Gi0/3. The destination port is configured with native encapsulation and ingress is disabled, meaning traffic received on the destination port is not forwarded. The session is active and correctly configured.

Full explanation →
1503
MCQhard

An engineer configures IP SLA with an ICMP echo operation and uses it to track a static route. The engineer also configures a backup static route with a higher administrative distance. The engineer notices that when the primary route is removed due to IP SLA failure, the backup route is installed, but when the IP SLA operation recovers, the primary route is not reinstalled. The show ip sla statistics shows the operation is 'Active' and 'Success'. The show track shows the track object is 'Up'. Which is the most likely explanation?

A.The primary static route has a higher administrative distance than the backup route.
B.The IP SLA operation has a frequency that is too low, causing a delay in detection of recovery.
C.The track object has a 'delay up' configured, causing a delay before the primary route is reinstalled.
D.The backup static route is configured with a permanent keyword, preventing the primary route from being reinstalled.
AnswerA

If the primary route has a higher AD, it will not be installed even when the track object is up, because the backup route is preferred.

Why this answer

When a tracked static route is removed and the backup route is installed, the primary route may not be reinstalled if the primary route's administrative distance is not lower than the backup route. However, in this scenario, the track object is up, so the primary route should be reinstalled. The most likely edge case is that the primary static route has a higher administrative distance than the backup route, which would prevent it from being reinstalled even when the track object is up.

This can happen if the engineer misconfigured the AD values.

Full explanation →
1504
Multi-Selecthard

Which TWO statements about the interaction between IPv6 ACLs and uRPF are correct? (Choose TWO.)

Select 2 answers
A.When both uRPF and an inbound IPv6 ACL are configured on the same interface, uRPF is processed first.
B.An IPv6 ACL can be used to permit traffic that would otherwise be dropped by uRPF strict mode due to asymmetric routing.
C.uRPF can be configured to ignore IPv6 ACLs on the same interface.
D.An outbound IPv6 ACL can be used to filter traffic before uRPF checks.
E.If uRPF drops a packet, the inbound ACL is still evaluated for logging purposes.
AnswersA, B

Correct. uRPF checks occur before ACL processing in the input path.

Why this answer

When both uRPF and an inbound IPv6 ACL are configured on the same interface, Cisco IOS processes uRPF first. This is because uRPF is a routing-based security check that verifies the source address against the FIB before any ACL filtering occurs. The inbound ACL is evaluated only after the packet passes the uRPF check, ensuring that spoofed traffic is dropped before ACL processing.

Exam trap

The trap here is that candidates often assume ACLs are always processed before uRPF, or that uRPF can be configured to skip ACL checks, but Cisco explicitly tests the order of operations where uRPF is evaluated first on inbound interfaces.

Full explanation →
1505
MCQeasy

Which of the following is true regarding the placement of an IPv4 ACL to filter traffic between two internal subnets?

A.Standard ACLs should be placed closest to the source.
B.Extended ACLs should be placed closest to the destination.
C.Standard ACLs should be placed closest to the destination.
D.Placement does not affect ACL functionality.
AnswerC

Standard ACLs lack destination filtering; placing near destination prevents blocking traffic to other networks.

Why this answer

Standard ACLs filter based solely on the source IP address and lack the granularity to distinguish between different destination subnets. Placing a standard ACL closest to the destination ensures that traffic is filtered only after it has reached the target subnet, preventing the ACL from inadvertently blocking traffic to other destinations that share the same source. This placement aligns with the Cisco best practice of placing standard ACLs near the destination to minimize unintended filtering.

Exam trap

Cisco often tests the misconception that standard ACLs should be placed closest to the source (like extended ACLs), but the correct practice is to place standard ACLs closest to the destination due to their lack of destination-based filtering.

How to eliminate wrong answers

Option A is wrong because standard ACLs should be placed closest to the destination, not the source; placing them near the source can block all traffic from a source regardless of the destination, which is overly restrictive and can disrupt traffic to other subnets. Option B is wrong because extended ACLs should be placed closest to the source, not the destination; placing them near the destination wastes bandwidth by allowing unwanted traffic to traverse the network before being filtered. Option D is wrong because placement directly affects ACL functionality and efficiency; improper placement can cause unintended filtering or unnecessary network congestion.

Full explanation →
1506
MCQmedium

Consider this IP SLA configuration on router R3: ip sla 30 icmp-echo 192.168.2.1 frequency 5 ip sla schedule 30 life forever start-time now What is missing from this configuration?

A.A source IP address is missing; the router will use the outgoing interface IP.
B.The frequency is too low; it should be at least 60 seconds.
C.The destination IP is invalid; it must be a multicast address.
D.The operation type is wrong; it should be udp-echo.
AnswerA

Without source-ip, the router defaults to the interface IP used for the route to the destination.

Why this answer

The configuration lacks a source IP address. While optional, without a source-ip, the router uses the outgoing interface IP, which may not be desired for tracking specific paths.

Full explanation →
1507
MCQhard

A network engineer runs the following command on Router R1: R1# show flow monitor FLOW-MONITOR-1 cache format table Cache type: Normal Cache size: 1000 Current entries: 1000 High Watermark: 1000 Flows added: 50000 Flows aged: 49000 - Active timeout (1800 secs) 40000 - Inactive timeout (15 secs) 8000 - Event aged 0 - Watermark aged 1000 - Emergency aged 0 Based on this output, what is the most likely issue?

A.The cache size is too small, causing watermark aging and potential loss of flow data.
B.The active timeout is set too low at 1800 seconds.
C.The inactive timeout is set too low at 15 seconds.
D.The flow exporter is not configured.
AnswerA

The cache is full and watermark aging is occurring, meaning flows are being aged out due to lack of space, which can result in incomplete export data.

Why this answer

The cache is full (1000 current entries, high watermark 1000), and watermark aging has occurred (1000 flows aged due to watermark). This indicates the cache is overflowing, causing flows to be aged prematurely to make room for new flows. This can lead to incomplete data.

Full explanation →
1508
MCQhard

A DMVPN network is experiencing spoke-to-spoke tunnel failures. R1 (hub) has: event manager applet DMVPN-TRIGGER event syslog pattern "%DMVPN-5-UP" action 1.0 cli command "enable" action 2.0 cli command "clear crypto sa" action 3.0 syslog msg "Cleared crypto SAs". Router R2 (spoke) shows: DMVPN tunnel is up, but IPsec SAs are renegotiating frequently. What is the root cause?

A.The EEM applet clears all crypto SAs whenever a DMVPN tunnel comes up, disrupting existing SAs.
B.The DMVPN tunnel is misconfigured with mismatched IPsec profiles.
C.The spoke router has an incorrect NHRP mapping.
D.The hub router has a routing protocol issue preventing spoke-to-spoke routes.
AnswerA

Clearing all crypto SAs forces renegotiation, causing spoke-to-spoke failures.

Why this answer

The EEM applet triggers on any DMVPN tunnel UP event and clears all crypto security associations (SAs). This forces renegotiation of IPsec SAs for all tunnels, causing temporary loss of spoke-to-spoke connectivity. The correct fix is to clear only specific SAs or avoid clearing them on DMVPN UP events.

Full explanation →
1509
MCQmedium

A network engineer runs the following command to troubleshoot SNMP traps: R1# show snmp host Host: 10.1.1.2 Port: 162 Timeout: 30 Retries: 3 Community: trap-public Version: 2c Filter: none Host: 10.1.1.3 Port: 162 Timeout: 30 Retries: 3 Community: trap-public Version: 2c Filter: none What does this output indicate?

A.SNMP traps are sent to two NMS hosts: 10.1.1.2 and 10.1.1.3 using SNMPv2c.
B.SNMP traps are sent to host 10.1.1.2 only.
C.The router is configured to receive traps from these hosts.
D.SNMPv3 is used for trap communication.
AnswerA

The output shows two hosts configured for trap reception with SNMPv2c.

Why this answer

The output of the 'show snmp host' command lists the configured SNMP trap receivers. Each entry shows a host IP address (10.1.1.2 and 10.1.1.3), port 162 (the standard SNMP trap port), and the SNMP version (2c). This confirms that the router is sending SNMPv2c traps to both NMS hosts, making option A correct.

Exam trap

Cisco often tests the distinction between 'show snmp host' (shows trap destinations) and 'snmp-server host' (configures trap destinations), leading candidates to mistakenly think the output shows incoming traps or only a single host.

How to eliminate wrong answers

Option B is wrong because the output clearly shows two separate host entries (10.1.1.2 and 10.1.1.3), indicating traps are sent to both, not just 10.1.1.2. Option C is wrong because 'show snmp host' displays the destinations to which the router sends traps, not the hosts from which it receives traps; receiving traps would be shown by 'snmp-server trap-source' or similar commands. Option D is wrong because the output explicitly states 'Version: 2c' for both hosts, confirming SNMPv2c is used, not SNMPv3.

Full explanation →
1510
MCQhard

In an MPLS LDP network, routers R1 and R2 are directly connected via GigabitEthernet0/0. R1 shows 'show mpls ldp neighbor' output: 'Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0, TCP connection: 10.0.0.2.646 - 10.0.0.1.646, State: OPERATIONAL' but 'show mpls forwarding-table' for prefix 192.168.1.0/24 shows 'No label'. R2 has the same prefix in its routing table. What is the root cause?

A.R2 does not have MPLS enabled on the interface facing the prefix's origin; LDP only labels routes learned via MPLS-enabled interfaces.
B.R1 has an ACL blocking LDP label advertisement for prefix 192.168.1.0/24.
C.The MTU mismatch between R1 and R2 causes label distribution failure.
D.R1's MPLS forwarding table is full; no room for new labels.
AnswerA

If the prefix is learned via an interface without 'mpls ip', LDP will not assign a label, causing R1 to have no label in forwarding table.

Why this answer

LDP neighbors are operational, but label binding may fail if the IGP (e.g., OSPF) has a route to the prefix but LDP does not advertise a label for it. This can occur if the prefix is a connected route on R2 but R2's LDP is not configured to advertise labels for connected routes (e.g., 'no mpls ldp advertise-labels' or route filtering). Alternatively, R2 may have the prefix via a different interface not running MPLS.

Full explanation →
1511
MCQhard

A network engineer runs the following command to troubleshoot a SPAN issue: R1# show monitor session all Session 1 --------- Type : Local Session Source Ports : Both : Gi0/0 Destination Ports : Gi0/1 Encapsulation : Native Ingress : Disabled Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/2 Destination RSPAN VLAN : 100 What does this output indicate?

A.Both sessions are correctly configured and can operate simultaneously.
B.Session 1 is misconfigured because it cannot coexist with an RSPAN session.
C.Session 2 is misconfigured because the RSPAN VLAN must be used only for RSPAN.
D.Both sessions are misconfigured because they use the same source port.
AnswerA

Multiple SPAN sessions can coexist on the same device.

Why this answer

The output shows two sessions: Session 1 is a local SPAN session, and Session 2 is an RSPAN source session. This is a valid configuration for multiple monitoring sessions.

Full explanation →
1512
MCQhard

An engineer configures PBR with a route-map that sets the next-hop to 10.0.0.2 for traffic matching ACL 100. The route-map is applied inbound on interface GigabitEthernet0/1. Traffic from a host on that interface is forwarded via 10.0.0.2, but the engineer notices that packets with destination IP 10.0.0.2 itself are also being redirected, causing a loop. Why does this happen?

A.The ACL 100 inadvertently matches the router's own IP address as source.
B.PBR is applied outbound, causing packets to the router to be re-routed.
C.The set ip next-hop command does not check if the next-hop is the router itself, so packets destined to the router are forwarded instead of being processed locally.
D.The route-map has a default route that sends all traffic to 10.0.0.2.
AnswerC

PBR overrides local delivery; packets to the router's own IP are forwarded per the policy.

Why this answer

PBR processes all incoming packets, including those destined to the router itself. If the set next-hop points to the router's own IP, packets to that IP are forwarded back out, creating a loop. The route-map should include a match clause to exclude traffic destined to the router.

Full explanation →
1513
MCQhard

A network engineer is troubleshooting an EIGRP adjacency that is not forming. Both routers are configured for EIGRP with BFD. The engineer checks the BFD session and sees it is 'Down'. The interface between the routers is up/up. The EIGRP configuration appears correct. What is the most likely cause?

A.The EIGRP process is configured with 'bfd all-interfaces' but the interface is not configured with 'eigrp bfd'.
B.The BFD timers are configured with 'bfd interval 50 min_rx 50 multiplier 3' on one router and 'bfd interval 100 min_rx 100 multiplier 3' on the other, causing a negotiation failure.
C.The interface is configured with 'ip address 10.0.0.1 255.255.255.252' but the neighbor is using a different subnet.
D.The EIGRP autonomous system number is mismatched between the two routers.
AnswerB

BFD timers must be compatible; if the required interval or multiplier values are not negotiable, the session will fail to come up.

Why this answer

EIGRP BFD requires that the BFD session be established before the EIGRP adjacency can form. If the BFD session is down, the issue is often a mismatch in BFD parameters or a lack of BFD configuration on one side.

Full explanation →
1514
MCQeasy

According to RFC 5424, which syslog severity level corresponds to 'Critical' conditions?

A.Severity 0
B.Severity 1
C.Severity 2
D.Severity 3
AnswerC

Severity 2 is defined as 'Critical' in RFC 5424.

Why this answer

RFC 5424 defines severity level 2 as 'Critical' conditions.

Full explanation →
1515
MCQhard

What is the default metric value assigned to redistributed routes into IS-IS when no metric is specified?

A.0
B.10
C.20
D.63
AnswerA

IS-IS uses a default metric of 0 for redistributed routes, requiring manual configuration to set a meaningful metric.

Why this answer

By default, Cisco IOS assigns a metric of 0 to routes redistributed into IS-IS, which can cause suboptimal routing if not modified.

Full explanation →
1516
MCQhard

Which statement correctly describes the default behavior of the 'flow monitor' in Flexible NetFlow regarding the collection of BGP next-hop information?

A.BGP next-hop is always collected by default in Flexible NetFlow monitors.
B.BGP next-hop is never collected in Flexible NetFlow, only in traditional NetFlow.
C.BGP next-hop is collected only if the flow record includes the 'match routing bgp next-hop' command.
D.BGP next-hop is collected by default only for IPv4 flows.
AnswerC

Correct. The BGP next-hop must be explicitly matched in the flow record.

Why this answer

By default, Flexible NetFlow does not collect BGP next-hop information unless explicitly configured in the flow record.

Full explanation →
1517
MCQmedium

A network engineer runs the following command to verify IPv6 binding table: R1# show ipv6 neighbors binding IPv6 Address Age Link-layer Addr State Interface VLAN Policy 2001:db8::1 10 0011.2233.4455 REACH Fa0/1 10 TRUSTED 2001:db8::2 5 00aa.bbcc.ddee STALE Fa0/0 10 INSPECT 2001:db8::3 0 1111.2222.3333 INCOMP Fa0/0 10 - What does this output indicate?

A.The binding table shows three entries: one reachable on trusted port, one stale on untrusted port, and one incomplete, indicating active ND learning.
B.The binding table is empty, indicating no ND activity.
C.The binding table shows all entries as reachable, indicating stable neighbor relationships.
D.The binding table is only for DHCPv6-learned addresses.
AnswerA

The output correctly shows the state and policy for each entry.

Why this answer

The output of 'show ipv6 neighbors binding' displays the IPv6 binding table used in First Hop Security (FHS) features like IPv6 Snooping. The entry for 2001:db8::1 has a REACH state on interface Fa0/1 with a TRUSTED policy, indicating it is reachable on a trusted port. The entry for 2001:db8::2 is STALE on Fa0/0 with an INSPECT policy, meaning it is on an untrusted port and requires verification.

The entry for 2001:db8::3 is INCOMP (incomplete) on Fa0/0, showing an ongoing Neighbor Discovery (ND) process where the link-layer address has not yet been resolved.

Exam trap

Cisco often tests the misinterpretation of the 'show ipv6 neighbors binding' output by confusing it with 'show ipv6 neighbors' (which shows the ND cache), leading candidates to overlook the FHS-specific policy column and state meanings, especially the significance of INCOMP and STALE states in security contexts.

How to eliminate wrong answers

Option B is wrong because the binding table is not empty; it clearly shows three entries with IPv6 addresses, ages, link-layer addresses, states, and policies. Option C is wrong because not all entries are reachable; one is STALE and one is INCOMP, indicating unstable or unresolved neighbor relationships. Option D is wrong because the binding table is populated by IPv6 Neighbor Discovery (ND) snooping and can include addresses learned via ND, not exclusively DHCPv6; the 'Policy' column (TRUSTED, INSPECT) is specific to FHS features like IPv6 RA Guard and ND inspection.

Full explanation →
1518
MCQhard

A network engineer runs the following command to debug MPLS LDP session establishment: R1# debug mpls ldp session Output: *Mar 1 00:01:23.456: LDP: Session with 10.0.0.2:0 (0x1234) is UP *Mar 1 00:01:24.567: LDP: Session with 10.0.0.2:0 (0x1234) is DOWN *Mar 1 00:01:25.678: LDP: Session with 10.0.0.2:0 (0x1234) is UP *Mar 1 00:01:26.789: LDP: Session with 10.0.0.2:0 (0x1234) is DOWN What does this output indicate?

A.The LDP session with 10.0.0.2 is flapping
B.The LDP session with 10.0.0.2 is stable
C.The LDP session with 10.0.0.2 is using targeted hello
D.The LDP session with 10.0.0.2 is down permanently
AnswerA

The session repeatedly transitions between UP and DOWN states, indicating flapping.

Why this answer

The debug output shows the LDP session with neighbor 10.0.0.2 is flapping (repeatedly going UP and DOWN). This indicates instability in the LDP session.

Full explanation →
1519
MCQhard

An engineer enables uRPF (unicast Reverse Path Forwarding) in strict mode on an interface connected to a DMVPN spoke. The spoke has multiple tunnels and receives traffic from the hub with a source IP that is not the best reverse path. Unexpectedly, the spoke drops all traffic from the hub, even though the hub is reachable via the tunnel. Which is the most likely explanation?

A.uRPF strict mode requires the reverse path to be via the same interface; asymmetric routing causes drops.
B.The hub's IP address is not in the routing table, so uRPF drops the packet.
C.uRPF must be configured with the `allow-default` option to accept packets with default route.
D.uRPF is not supported on tunnel interfaces; it must be applied on the physical interface.
AnswerA

Strict mode fails if the return route uses a different interface, which is common in DMVPN.

Why this answer

uRPF strict mode checks that the source IP of incoming packets has a route back to the source via the same interface. In DMVPN, the hub's source IP may be reachable via a different interface (e.g., physical interface) than the tunnel interface where the packet arrives. This asymmetric routing causes uRPF strict mode to drop the packets.

The solution is to use loose mode or allow-default.

Full explanation →
1520
Multi-Selecthard

Which THREE commands can be used to verify the current syslog configuration and message flow on a Cisco IOS device? (Choose THREE.)

Select 3 answers
A.show logging
B.debug logging
C.terminal monitor
D.show running-config | include logging
E.show log
AnswersA, C, D

Correct. This command displays the current logging configuration, buffer contents, and statistics such as messages logged and dropped.

Why this answer

The 'show logging' command displays the logging configuration, buffer contents, and statistics. The 'debug logging' command is not a verification command; it enables debugging of logging itself. The 'terminal monitor' command allows a user to see syslog messages on their terminal session.

The 'show running-config | include logging' filters the running configuration for logging-related lines. The 'show log' command is not valid in Cisco IOS; the correct command is 'show logging'.

Full explanation →
1521
MCQmedium

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show bgp neighbors 10.1.1.2 advertised-routes BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.2.2.0/24 0.0.0.0 0 32768 i Total number of prefixes 1 What does this output indicate?

A.BGP is not advertising routes due to CoPP dropping update packets.
B.BGP is advertising routes correctly, and CoPP is not affecting outbound updates.
C.BGP is receiving routes but not advertising them due to CoPP.
D.BGP session is down due to CoPP.
AnswerB

The route is advertised with weight 32768, indicating local origin, and no errors are shown.

Why this answer

The output shows that BGP has one prefix (10.2.2.0/24) in the advertised-routes table for neighbor 10.1.1.2, with the next hop set to 0.0.0.0 (indicating a locally originated route). This confirms that BGP is successfully advertising routes outbound, and there is no evidence of CoPP dropping update packets. CoPP would only affect control plane traffic destined to the router itself, not outbound BGP updates, which are forwarded in the data plane.

Exam trap

The trap here is that candidates assume CoPP can affect outbound BGP updates, but CoPP only polices inbound control plane traffic, so a successful advertised-routes output proves CoPP is not the cause of any advertisement failure.

How to eliminate wrong answers

Option A is wrong because the advertised-routes output shows a prefix being advertised, so CoPP is not dropping outbound update packets; CoPP polices inbound control plane traffic, not outbound updates. Option C is wrong because the command shows routes being advertised (not just received), and CoPP does not prevent BGP from advertising routes; it only filters traffic destined to the control plane. Option D is wrong because the BGP session is clearly up (as evidenced by the ability to run the show command and see advertised routes), and CoPP would not bring down a BGP session unless it dropped keepalives or updates inbound, which is not indicated here.

Full explanation →
1522
MCQhard

A network engineer applies a CoPP (Control Plane Policing) policy to a router running VRF-Lite. The policy includes a class that matches SSH traffic and polices it to 1 Mbps. After applying the policy, the engineer cannot SSH into the router from any VRF. Which is the most likely explanation?

A.The CoPP policy has an explicit 'deny' in the class-default, which drops all traffic not matched by other classes.
B.The SSH traffic is being policed to 1 Mbps, but the traffic rate is below that, so it should be allowed.
C.The CoPP policy is applied to the control plane of the VRF, not the global control plane, so it does not affect SSH traffic.
D.The SSH traffic is being matched by a different class that has a 'drop' action, such as a class for ICMP.
AnswerA

If class-default has a 'police' or 'drop' action, all unmatched traffic (including SSH) is dropped. The engineer should have added a 'class class-default' with 'police' or 'permit'.

Why this answer

CoPP policies are applied to the control plane and affect all traffic destined to the router, regardless of VRF. However, CoPP uses the global routing table for classification. If the SSH traffic is sourced from a VRF, the CoPP policy may not match it correctly because the class-map might be using 'match protocol' or 'match access-group' that is evaluated in the global context.

Additionally, the default class (class-default) often has a police action that drops traffic if not explicitly allowed. A common edge case is that the engineer forgot to include a 'class-default' action to permit traffic, causing all unmatched traffic to be dropped.

Full explanation →
1523
Multi-Selectmedium

Which TWO commands can be used to verify the MPLS L3VPN label forwarding table on a PE router? (Choose TWO.)

Select 2 answers
A.show mpls forwarding-table
B.show ip bgp vpnv4 vrf CUSTOMER_A labels
C.show mpls ldp bindings
D.show ip route vrf CUSTOMER_A
E.show mpls ldp neighbor
AnswersA, B

Displays the LFIB including VPN labels for all prefixes.

Why this answer

The 'show mpls forwarding-table' displays the LFIB with labels and next hops for all VPNv4 prefixes. The 'show ip bgp vpnv4 vrf <vrf-name> labels' shows the label assigned by the local PE for prefixes in a specific VRF. 'show mpls ldp bindings' shows LDP label bindings, not VPN labels. 'show ip route vrf <vrf-name>' shows the routing table, not labels. 'show bgp vpnv4 unicast all labels' is a valid alternative but not listed; 'show ip bgp vpnv4 vrf' with labels is correct.

Full explanation →
1524
MCQeasy

What is the default BFD multiplier (detection time multiplier) on Cisco IOS-XE?

A.1
B.2
C.3
D.4
AnswerC

The default multiplier is 3, as per Cisco IOS-XE defaults.

Why this answer

The default BFD multiplier is 3, meaning the detection time is 3 times the negotiated hello interval.

Full explanation →
1525
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 snooping policy Interface Policy Role State Gi0/0/0 GUARD_POLICY device-guard ACTIVE Gi0/0/1 GUARD_POLICY device-guard ACTIVE Gi0/0/2 (default) host ACTIVE Based on this output, which statement is correct?

A.Interface Gi0/0/2 is protected by the GUARD_POLICY policy.
B.Interface Gi0/0/2 is not protected by the custom guard policy and may be vulnerable to spoofing attacks.
C.All interfaces are equally protected by the same policy.
D.The role 'host' means Gi0/0/2 is acting as a device-guard.
AnswerB

The default policy provides minimal protection; the custom GUARD_POLICY is not applied to Gi0/0/2.

Why this answer

The output shows that Gi0/0/2 is using the default policy with a role of 'host', meaning it is not protected by the custom GUARD_POLICY. The device-guard feature, part of IPv6 First Hop Security, applies only to interfaces with a custom policy; a default policy does not enforce spoofing protection, leaving the interface vulnerable to attacks like rogue RA or ND spoofing.

Exam trap

Cisco often tests the misconception that all interfaces are equally protected by a guard policy, when in fact the (default) policy indicates no custom protection, leaving the interface vulnerable to spoofing attacks.

How to eliminate wrong answers

Option A is wrong because Gi0/0/2 is using the (default) policy, not GUARD_POLICY, so it is not protected by the custom guard policy. Option C is wrong because Gi0/0/0 and Gi0/0/1 are protected by GUARD_POLICY, while Gi0/0/2 uses the default policy, resulting in unequal protection. Option D is wrong because the role 'host' indicates the interface is treated as a host (not a device-guard), and the device-guard role is specifically assigned to interfaces with a custom policy like GUARD_POLICY.

Full explanation →
1526
Drag & Dropmedium

Drag and drop the steps to configure a DHCP pool and relay agent on a Cisco router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, you must define the DHCP pool with a name and network. Then, you set the default router and DNS server. Next, you exclude any addresses from the pool.

Finally, you enable the DHCP relay agent on the interface facing clients to forward requests to the DHCP server.

Full explanation →
1527
MCQhard

A network engineer runs the following command on switch SW6: SW6# show monitor session 8 Session 8 --------- Type : Remote Source Session Source Ports : Both : Gi0/13 Source VLANs : TX Only : 200 Destination Ports : Gi0/14 Encapsulation : Dot1q Ingress : Disabled Based on this output, which statement is correct?

A.The RSPAN source session sends mirrored traffic to Gi0/14 with a Dot1q tag.
B.The RSPAN source session sends mirrored traffic to Gi0/14 without any VLAN tag.
C.The session is an ERSPAN source session because it uses Dot1q encapsulation.
D.The session is misconfigured because source VLANs cannot be TX only.
AnswerA

The encapsulation type 'Dot1q' means the traffic is tagged with the RSPAN VLAN.

Why this answer

This is an RSPAN source session. It monitors source port Gi0/13 and source VLAN 200 (TX only), and sends the mirrored traffic to destination port Gi0/14 with Dot1q encapsulation. The Dot1q encapsulation indicates that the destination port is a trunk port carrying the RSPAN VLAN.

The session is correctly configured.

Full explanation →
1528
MCQhard

What is the default maximum number of labels that can be imposed in the MPLS label stack on a Cisco IOS-XE router?

A.6 labels
B.3 labels
C.10 labels
D.Unlimited
AnswerA

The default maximum label stack depth is 6 labels.

Why this answer

The default maximum label stack depth is 6 labels on Cisco IOS-XE routers, though this can be increased with the 'mpls label range' command.

Full explanation →
1529
MCQmedium

What is the default frequency (in seconds) for an IP SLA operation when no frequency is explicitly configured?

A.10 seconds
B.30 seconds
C.60 seconds
D.120 seconds
AnswerC

Correct. The default frequency for IP SLA operations is 60 seconds.

Why this answer

The default frequency for an IP SLA operation is 60 seconds. This means the probe is sent every 60 seconds unless a different frequency is configured under the IP SLA configuration.

Full explanation →
1530
MCQhard

A network engineer configures SNMPv3 with authentication and privacy on a router. The NMS polls the router via the management interface. The engineer then adds a loopback interface and configures the router to send SNMP traps sourced from the loopback IP. The NMS stops receiving traps. Which is the most likely explanation?

A.The NMS is configured to accept traps only from the management interface IP address, not the loopback IP.
B.The loopback interface does not support SNMP trap generation.
C.The SNMP engine ID changed when the loopback interface was added.
D.The 'snmp-server trap-source' command requires a specific interface type.
AnswerA

NMS trap receivers often filter or authenticate based on source IP; if the source IP changes, traps may be dropped.

Why this answer

The NMS is likely configured with an ACL or trap receiver filter that only accepts SNMP traps from the management interface IP address. When the engineer configures 'snmp-server trap-source loopback0', the router changes the source IP of all outgoing traps to the loopback IP. If the NMS is not expecting traps from that IP, it will drop them, even though SNMPv3 authentication and privacy are correctly configured.

Exam trap

Cisco often tests the misconception that SNMPv3 security (auth/priv) is the cause of trap delivery failure, when in fact the issue is a source IP mismatch due to the 'snmp-server trap-source' command overriding the default source address.

How to eliminate wrong answers

Option B is wrong because loopback interfaces fully support SNMP trap generation; they are logical interfaces and can be used as the source for any IP traffic, including SNMP traps. Option C is wrong because adding a loopback interface does not change the SNMP engine ID; the engine ID is derived from the router's MAC address or configured manually, and it remains stable unless explicitly modified. Option D is wrong because the 'snmp-server trap-source' command accepts any interface type (e.g., GigabitEthernet, Loopback, VLAN), and there is no restriction on interface type for trap sourcing.

Full explanation →
1531
MCQhard

Router R9 is configured with SNMP and NetFlow. The NMS uses SNMP to poll NetFlow statistics. The configuration includes: snmp-server community public RO, snmp-server enable traps netflow. However, the NMS cannot poll NetFlow MIB objects. The router's show snmp mib shows that the NetFlow MIB is not loaded. What is the root cause?

A.The NetFlow MIB is not loaded because NetFlow data export is not configured; the 'ip flow-export' command is missing.
B.The SNMP community string does not have read access to the NetFlow MIB.
C.The router's SNMP agent is not compatible with the NetFlow MIB.
D.The NMS is using an incorrect OID for NetFlow statistics.
AnswerA

The NetFlow MIB is only loaded when NetFlow is configured with 'ip flow-export' commands. Without it, the MIB is not available for SNMP polling.

Why this answer

The NetFlow MIB is only loaded into the router's SNMP agent when NetFlow data export is actively configured. Without the 'ip flow-export' command, the router does not instantiate the NetFlow MIB objects, so 'show snmp mib' reports the MIB as not loaded. The NMS cannot poll statistics that do not exist in the SNMP agent's MIB tree.

Exam trap

Cisco often tests the misconception that SNMP traps and MIB polling are independent of the underlying feature configuration; the trap here is assuming that enabling SNMP traps for NetFlow automatically loads the NetFlow MIB, when in fact the MIB requires the 'ip flow-export' command to be present.

How to eliminate wrong answers

Option B is wrong because the SNMP community string 'public RO' provides read-only access, which is sufficient for polling MIB objects; the issue is that the MIB itself is not loaded, not a permissions problem. Option C is wrong because the router's SNMP agent is fully compatible with the NetFlow MIB when NetFlow export is configured; the MIB is simply not instantiated without the export command. Option D is wrong because the NMS cannot poll using any OID if the MIB is not loaded in the router's agent; the problem is at the agent side, not the NMS's OID selection.

Full explanation →
1532
MCQeasy

In the context of NAT and PAT, what is the purpose of the ip nat translation timeout command?

A.It sets the timeout for static NAT entries.
B.It configures the timeout for all dynamic NAT translations globally.
C.It sets the timeout only for TCP translations.
D.It configures the timeout for translations on a specific interface.
AnswerB

Correct. This command sets the global timeout for dynamic NAT entries.

Why this answer

The `ip nat translation timeout` command sets the global idle timeout for all dynamic NAT translations, including both TCP and UDP. When a dynamic translation is no longer active, this timer determines how long the NAT entry remains in the table before being removed, freeing resources. Static NAT entries are not affected by this command because they are manually configured and persist indefinitely unless explicitly removed.

Exam trap

Cisco often tests the distinction between global and per-interface NAT configuration, leading candidates to incorrectly assume that `ip nat translation timeout` can be applied under a specific interface, when in fact it is always a global command that affects all dynamic translations on the router.

How to eliminate wrong answers

Option A is wrong because static NAT entries are not subject to timeouts; they remain in the translation table until manually deleted. Option C is wrong because the command applies to all dynamic translations, not just TCP; TCP has its own separate configurable timeout via `ip nat translation tcp-timeout`. Option D is wrong because the `ip nat translation timeout` command is a global configuration command; per-interface timeout behavior is not supported—timeouts are always global.

Full explanation →
1533
MCQmedium

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# debug eigrp packets EIGRP: Received HELLO on GigabitEthernet0/0 nbr 10.1.1.2 AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 EIGRP: Sending HELLO on GigabitEthernet0/0 AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 EIGRP: Received UPDATE on GigabitEthernet0/0 nbr 10.1.1.2 AS 100, Flags 0x1, Seq 1/0 idbQ 0/0 iidbQ un/rely 0/0 EIGRP: Sending UPDATE on GigabitEthernet0/0 nbr 10.1.1.2 AS 100, Flags 0x1, Seq 2/1 idbQ 0/0 iidbQ un/rely 0/0 What does this output indicate?

A.EIGRP adjacency is forming and routes are being exchanged successfully.
B.EIGRP adjacency is stuck in INIT state because no hello packets are received.
C.EIGRP is experiencing authentication failures.
D.EIGRP is only sending hellos but not receiving updates.
AnswerA

The debug shows HELLO and UPDATE packets with proper sequence numbers, confirming adjacency and route exchange.

Why this answer

The output shows both incoming and outgoing Hello packets, confirming that the EIGRP adjacency is established and both routers are in the Init state or beyond. The subsequent UPDATE packets with sequence numbers (Seq 1/0 and Seq 2/1) indicate that routes are being exchanged successfully, which is the normal behavior for a forming or stable EIGRP neighbor relationship.

Exam trap

Cisco often tests the misinterpretation of debug output where candidates assume that seeing only Hello packets means no adjacency, but the presence of UPDATE packets with sequence numbers is the key indicator of a fully formed neighbor relationship and route exchange.

How to eliminate wrong answers

Option B is wrong because the debug output clearly shows Hello packets being received (Received HELLO on GigabitEthernet0/0 nbr 10.1.1.2), so the adjacency is not stuck in INIT state due to missing hellos. Option C is wrong because authentication failures would typically generate specific error messages (e.g., 'authentication failed' or 'key mismatch') in the debug output, and the output here shows normal packet exchanges without any authentication-related flags or errors. Option D is wrong because the output includes both sending and receiving UPDATE packets, not just hellos; the 'Received UPDATE' line proves that updates are being received from the neighbor.

Full explanation →
1534
MCQmedium

A network engineer is troubleshooting MPLS L3VPN where traffic from CE1 to CE2 is being dropped. On PE1, show mpls forwarding-table shows that the label for the BGP next-hop is 'Pop tag' (implicit null). The engineer checks the remote PE and sees that it is advertising implicit null for the BGP next-hop. What is the most likely reason for the traffic drop?

A.The remote PE does not have the CE route in its VRF.
B.The penultimate hop is not popping the label correctly.
C.The MTU on the link between P and PE2 is too small.
D.The remote PE is configured with explicit null for the BGP next-hop.
AnswerA

Correct because after label pop, the packet is forwarded as IP; if the remote PE lacks the VRF route, it drops the packet.

Why this answer

Implicit null (pop tag) means the penultimate hop pops the label and forwards the IP packet. If the traffic is dropped, the issue is likely that the remote PE does not have a route to the CE in its VRF, so it drops the IP packet after label pop.

Full explanation →
1535
MCQhard

An engineer configures BFD on an OSPF link between two routers. The BFD session comes up, but OSPF remains stuck in EXSTART state. The engineer verifies that IP connectivity is fine and OSPF hello packets are exchanged. What is the most likely cause?

A.An MTU mismatch between the two routers causes the DBD packets to be dropped, preventing OSPF from progressing past EXSTART.
B.BFD is not configured with the 'bfd all-interfaces' command under OSPF, causing OSPF to ignore BFD state changes.
C.The OSPF network type is set to point-to-multipoint on one side and broadcast on the other, preventing the adjacency from forming.
D.The BFD minimum interval is set too low, causing BFD to flap and reset the OSPF adjacency repeatedly.
AnswerA

Correct. OSPF DBD packets are sized based on the interface MTU. A mismatch causes the larger DBD to be dropped, halting the adjacency while BFD remains up.

Why this answer

BFD can cause OSPF to remain stuck in EXSTART if there is an MTU mismatch on the link. OSPF uses the interface MTU to determine the size of Database Description (DBD) packets. If the MTU is mismatched, the larger DBD packet is silently dropped by the receiving router, preventing the exchange of LSAs.

BFD does not detect this because BFD packets are small and unaffected by MTU issues.

Full explanation →
1536
MCQmedium

A network engineer runs the following command on Router PE1: PE1# show mpls forwarding-table 192.168.1.0 24 Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 16 Pop Label 192.168.1.0/24 0 Gi0/0 10.1.1.2 17 22 192.168.1.0/24 0 Gi0/1 10.2.2.2 Based on this output, which statement is correct?

A.The router is performing load balancing across two LSPs for prefix 192.168.1.0/24.
B.The router has a routing loop for prefix 192.168.1.0/24.
C.Penultimate Hop Popping is disabled on this router.
D.The prefix 192.168.1.0/24 is learned via BGP from two different neighbors.
AnswerA

Two forwarding entries for the same prefix with different outgoing interfaces and labels indicate ECMP load balancing.

Why this answer

The show mpls forwarding-table output shows two entries for the same prefix. The first entry has 'Pop Label' as outgoing label, meaning PHP (Penultimate Hop Popping) is in use for that path. The second entry has label 22, indicating a different LSP.

The presence of two entries for the same prefix suggests load balancing across two equal-cost paths.

Full explanation →
1537
MCQhard

An engineer configures 'ipv6 nd suppress' on a switch port to prevent the switch from sending Router Advertisements. However, after this configuration, hosts on that port cannot obtain IPv6 addresses via SLAAC, even though a router on another port is sending RAs. What is the most likely explanation?

A.The 'ipv6 nd suppress' command blocks all RA traffic on the port, including RAs forwarded from other ports.
B.The router's RAs are being filtered by an ACL on the switch.
C.The hosts must be configured to use DHCPv6 instead of SLAAC.
D.The switch port is in a different VLAN than the router.
AnswerA

Suppress prevents any RA from being sent or forwarded on that port.

Why this answer

The 'ipv6 nd suppress' command on a switch port prevents the switch from sending its own Router Advertisements (RAs) and also blocks all incoming RAs from being forwarded out that port. Since SLAAC relies on hosts receiving RAs to learn the prefix and other parameters, blocking the RAs from the router on another port prevents the hosts from obtaining IPv6 addresses via SLAAC.

Exam trap

Cisco often tests the misconception that 'ipv6 nd suppress' only stops the switch from sending RAs, when in fact it also blocks forwarding of RAs received from other ports, which is the key trap here.

How to eliminate wrong answers

Option B is wrong because the question does not mention any ACL configuration, and the 'ipv6 nd suppress' command operates independently of ACLs; it directly suppresses RA forwarding at the switch level. Option C is wrong because SLAAC is a valid method for IPv6 address assignment that does not require DHCPv6; the issue is the lack of RAs, not the method of address assignment. Option D is wrong because if the switch port were in a different VLAN, the hosts would not be on the same Layer 2 domain as the router, but the question implies the router is on another port of the same switch, so VLAN mismatch is not indicated as the cause.

Full explanation →
1538
MCQhard

A network engineer is troubleshooting a route redistribution issue between two OSPF processes. Router R1 runs OSPF process 1 and OSPF process 2, and redistributes routes between them. The engineer notices that routes from OSPF process 1 are not appearing in the OSPF database of process 2, even though the redistribute command is configured. The show ip ospf database command on R1 for process 2 shows no external routes. What is the most likely cause?

A.The redistribute ospf 1 command under OSPF process 2 is missing the subnets keyword.
B.OSPF process 1 has a higher administrative distance than OSPF process 2.
C.The redistribute ospf 1 command under OSPF process 2 is missing the match internal keyword.
D.OSPF process 2 has a route map applied that is filtering all routes.
AnswerA

Correct: Without subnets, only classful networks are redistributed, causing many missing routes.

Why this answer

When redistributing between OSPF processes, the redistribute command must include the subnets keyword to redistribute classless subnets. Without it, only classful networks are redistributed, which may cause many routes to be missing.

Full explanation →
1539
MCQmedium

A network engineer runs the following command to verify redistribution with route-maps: R1# show ip route 10.10.10.0 255.255.255.0 Routing entry for 10.10.10.0/24 Known via "eigrp 100", distance 170, metric 2560002816 Tag 100, type internal Last update from 10.1.1.2 on GigabitEthernet0/0, 00:00:45 ago Routing Descriptor Blocks: * 10.1.1.2, from 10.1.1.2, 00:00:45 ago, via GigabitEthernet0/0 Route metric is 2560002816, traffic share count is 1 Total delay is 2000 microseconds, minimum bandwidth is 100000 Kbit Reliability 255/255, minimum MTU 1500 bytes Loading 1/255, Hops 1 What does the 'Tag 100' indicate?

A.The route was originated by EIGRP autonomous system 100.
B.The route has a tag of 100, likely set by a route-map during redistribution.
C.The route is internal to EIGRP and has a metric of 100.
D.The route is from a BGP AS 100.
AnswerB

The 'Tag 100' is a route tag, commonly set by a route-map to mark routes for filtering or administrative purposes.

Why this answer

The 'Tag 100' indicates that a route-map applied during redistribution set the tag to 100. Route tags are often used for filtering or administrative purposes during redistribution.

Full explanation →
1540
MCQhard

An engineer configures EIGRP named mode with an offset-list applied to the EIGRP topology table. The offset-list increases the metric of a route learned from a neighbor. However, the route is still used as the successor even though the offset-list increased its metric above the feasible distance (FD) of another route. Which is the most likely explanation?

A.The offset-list is applied to the wrong interface; it must be applied to the outgoing interface.
B.The offset-list only affects the advertised distance (AD), not the feasible distance (FD).
C.The offset-list is applied in classic mode, but the router is running named mode.
D.The offset-list value is too small to change the successor; a larger value is needed.
AnswerB

Offset-list modifies the metric of the route but does not update the FD, which is the metric of the best path at the time of learning.

Why this answer

In EIGRP named mode, the offset-list is applied to the route's metric in the topology table, but it does not affect the feasible distance (FD) calculation. The FD is computed from the original metric before the offset. The successor is chosen based on the FD, not the offset metric, so the route remains the successor.

Full explanation →
1541
MCQmedium

Which of the following best describes the behavior of BGP when an 'aggregate-address' command is used without the 'summary-only' keyword?

A.The aggregate route is advertised, and all more specific routes are also advertised.
B.Only the aggregate route is advertised.
C.The aggregate route is not advertised unless a network command exists for it.
D.The more specific routes are withdrawn from the BGP table.
AnswerA

Correct. Without summary-only, both aggregate and specifics are advertised.

Why this answer

Without the summary-only keyword, BGP advertises both the aggregate route and the more specific routes that are in the BGP table.

Full explanation →
1542
Multi-Selecthard

Which TWO actions will prevent an ISATAP tunnel from forming correctly? (Choose TWO.)

Select 2 answers
A.Configuring the tunnel destination with the IPv4 address of the ISATAP client itself.
B.Using a private IPv4 address as the tunnel source on the ISATAP router.
C.Configuring the ISATAP interface ID as ::5EFE:xxxx.
D.Setting the tunnel mode to ipv6ip.
E.Adding a static IPv6 route pointing to the ISATAP tunnel interface.
AnswersA, B

Correct. The tunnel destination should be the ISATAP router's IPv4 address, not the client's own address.

Why this answer

In an ISATAP tunnel, the tunnel destination must be the IPv4 address of the ISATAP client (which is dynamically derived from the ISATAP interface ID). Configuring the tunnel destination with the client's own IPv4 address creates a loopback tunnel that cannot forward traffic, preventing the tunnel from forming correctly. The ISATAP router automatically derives the destination from the IPv4 address embedded in the ISATAP interface ID; manually setting it to the client's address breaks the automatic mapping.

Exam trap

Cisco often tests the misconception that the tunnel destination must be explicitly configured, when in fact ISATAP automatically derives it from the interface ID, and manually setting it to the client's own address breaks the tunnel.

Full explanation →
1543
MCQhard

R1 and R2 are eBGP peers. R1 advertises a prefix 192.168.1.0/24 with MED 50. R2 also receives the same prefix from another eBGP peer R3 with MED 100. R2's BGP best path selection chooses the path via R1 because of lower MED. However, R2's routing table shows the next-hop for 192.168.1.0/24 as 10.1.1.1 (R1), but R2 cannot ping 192.168.1.1. R2 has: interface GigabitEthernet0/0, ip address 10.1.1.2 255.255.255.0, and no ip route to 192.168.1.0/24 other than BGP. R1's interface to R2 has ip address 10.1.1.1 255.255.255.0. R1's BGP table shows the prefix with next-hop 10.1.1.1 (self). What is the root cause?

A.R1 does not have the prefix 192.168.1.0/24 in its routing table because the next-hop for that prefix in R1's BGP table is unreachable.
B.R2's MED comparison is incorrect; lower MED should be preferred, but R2 should have chosen R3.
C.R2 is missing a static route to 192.168.1.0/24.
D.R1 should use next-hop-self when advertising to R2.
AnswerA

R1's BGP table may have the prefix, but if the next-hop is not reachable (e.g., due to missing route), R1 will not install it in the routing table, causing forwarding failure.

Why this answer

The issue is that R1 is advertising the prefix with next-hop 10.1.1.1, which is the interface IP of R1 towards R2. R2 installs the route with that next-hop, and since it is directly connected, R2 can reach it. However, R1 may not have a route to 192.168.1.0/24 in its routing table (e.g., it learned it via iBGP but did not install it due to next-hop unreachable or other issue).

R1's BGP table shows the prefix, but if the next-hop is not reachable in R1's routing table, R1 will not install it in the routing table, and thus cannot forward packets. The root cause is that R1 does not have a valid route to the next-hop of the prefix it is advertising, so it cannot forward traffic.

Full explanation →
1544
MCQhard

An engineer configures SPAN on a Cisco switch to monitor traffic from a source VLAN. Unexpectedly, BPDU guard shuts down the monitoring port when a switch is connected to it. Which is the most likely explanation?

A.The SPAN destination port is configured with spanning-tree bpduguard enable, and a BPDU from the connected switch triggers errdisable.
B.The SPAN source VLAN includes the native VLAN, causing BPDUs to be forwarded to the destination port.
C.The SPAN destination port is in the same VLAN as the source, causing a loop that triggers BPDU guard.
D.The switch has PortFast enabled on the SPAN destination port, which automatically enables BPDU guard.
AnswerA

BPDU guard on a SPAN destination port causes errdisable upon BPDU reception, despite SPAN disabling STP on that port.

Why this answer

SPAN destination ports do not participate in spanning tree, but BPDU guard still operates on them if configured globally or per interface. When a BPDU is received on a SPAN destination port, BPDU guard errdisables the port, even though the port is not forwarding traffic.

Full explanation →
1545
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 203.0.113.5 203.0.113.5 --- 192.0.2.11 10.0.0.11 203.0.113.5 203.0.113.5 R1# show ip nat statistics Total active translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 20 Misses: 0 CEF Translated packets: 20, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 2 map-id 1 [Id] ip nat inside source list ACL1 pool POOL1 refcount 2 Based on this output, which statement is correct?

A.NAT is configured without PAT; each inside host uses a unique global address.
B.PAT is enabled, but only two translations are active.
C.The pool is exhausted because two addresses are used.
D.Static NAT is configured for both hosts.
AnswerA

The statistics show 0 extended translations, and the mapping lacks 'overload'. The translations show different inside global addresses for each inside local.

Why this answer

The output shows two dynamic NAT translations, each with a unique inside global address (192.0.2.10 and 192.0.2.11) mapped to different inside local addresses (10.0.0.10 and 10.0.0.11). The absence of any port numbers in the 'Pro' column indicates that Port Address Translation (PAT) is not used; instead, each inside host receives a one-to-one mapping to a unique public IP from the pool. This confirms standard dynamic NAT without PAT.

Exam trap

Cisco often tests the distinction between NAT and PAT by hiding port numbers in the 'Pro' column; candidates mistakenly assume PAT is active when they see multiple translations, but the absence of port numbers and the presence of unique global addresses clearly indicate standard dynamic NAT.

How to eliminate wrong answers

Option B is wrong because PAT would show port numbers in the 'Pro' column and typically multiple inside hosts share a single global address, but here each host has a unique global address with no port information. Option C is wrong because the pool (192.0.2.10–192.0.2.20) has 16 addresses, and only two are used, so it is far from exhausted. Option D is wrong because the 'show ip nat statistics' explicitly states '0 static' and '2 dynamic', and the configuration references an ACL and pool, confirming dynamic NAT, not static NAT.

Full explanation →
1546
MCQhard

VRF route leaking between two VRFs is causing unexpected reachability to a sensitive subnet. Router R1 has the following relevant configuration: vrf definition BLUE rd 100:1 ! address-family ipv4 route-target export 100:1 route-target import 100:2 vrf definition RED rd 100:2 ! address-family ipv4 route-target export 100:2 route-target import 100:1 interface GigabitEthernet0/0 vrf forwarding BLUE ip address 10.1.1.1 255.255.255.0 interface GigabitEthernet0/1 vrf forwarding RED ip address 10.2.2.1 255.255.255.0 router ospf 1 vrf BLUE network 10.1.1.0 0.0.0.255 area 0 router ospf 2 vrf RED network 10.2.2.0 0.0.0.255 area 0 A ping from a host in BLUE VRF to 10.2.2.2 (RED VRF) succeeds, but it should not. What is the root cause?

A.Route-target import/export is symmetric, causing full route exchange; use route-map to filter.
B.The OSPF process IDs are different; they should be the same for route leaking.
C.The network commands are missing the vrf keyword; add vrf BLUE/RED.
D.The interfaces are in the wrong VRF; move GigabitEthernet0/1 to BLUE.
AnswerA

Both VRFs import each other's routes, so all routes are leaked. Route-maps can restrict which prefixes are imported.

Why this answer

The route-target import/export configuration is bidirectional, causing full route leaking between VRFs. This allows hosts in BLUE to reach RED subnets. The correct fix is to use import/export only for specific prefixes or use route-maps to control leaking.

Full explanation →
1547
MCQhard

A large enterprise network is experiencing intermittent reachability to a subnet 10.1.1.0/24 from the rest of the network. Router R1 has the following relevant configuration: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 ! router ospf 1 redistribute eigrp 100 subnets summary-address 10.0.0.0 255.255.0.0 ! interface GigabitEthernet0/0 ip summary-address eigrp 100 10.0.0.0 255.255.0.0 5 Router R2 shows: R2# show ip route 10.1.1.0 Routing entry for 10.0.0.0/16, supernet Known via "eigrp 100", distance 90, metric 128256 Redistributing via eigrp 100 Last update from 10.10.10.1 on GigabitEthernet0/1 What is the root cause?

A.The OSPF summary-address command on R1 is blocking the redistribution of the specific /24 route.
B.The EIGRP metric values are too high, causing the route to be unreachable.
C.The redistribute ospf command under EIGRP is missing the subnets keyword.
D.The route is being filtered by a distribute-list on R2.
AnswerA

The OSPF summary-address creates an aggregate route, and combined with the EIGRP interface summary, the specific /24 is suppressed.

Why this answer

The issue is that R1 has both an OSPF summary-address and an EIGRP interface summary-address, causing the more specific /24 route to be suppressed by the /16 summary. The EIGRP summary-address command on the interface creates a null0 summary route, and the OSPF redistribution of the EIGRP summary further aggregates, losing the specific prefix. The fix is to remove the interface summary-address or adjust the summary to include the specific subnet.

Full explanation →
1548
MCQeasy

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue: R1# show access-lists 120 Extended IP access list 120 10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 20 permit tcp 192.168.2.0 0.0.0.255 any eq 443 30 deny ip any any log What does this output indicate?

A.The ACL permits HTTP traffic from 192.168.1.0/24 and HTTPS traffic from 192.168.2.0/24, and denies all other traffic with logging.
B.The ACL permits all traffic from 192.168.1.0/24 and 192.168.2.0/24.
C.The ACL denies all traffic from 192.168.1.0/24 and 192.168.2.0/24.
D.The ACL is applied inbound on an interface and is blocking all traffic.
AnswerA

The ACL entries match this description.

Why this answer

The output shows an extended ACL with two permit statements: the first permits TCP traffic from 192.168.1.0/24 to any destination on port 80 (HTTP), and the second permits TCP traffic from 192.168.2.0/24 to any destination on port 443 (HTTPS). The final deny ip any any log statement explicitly denies all other IP traffic and logs matches, which is standard practice for ACL troubleshooting. Therefore, option A correctly describes the ACL's behavior.

Exam trap

Cisco often tests the ability to read ACL output precisely, and the trap here is that candidates may overlook the specific port restrictions (eq 80 and eq 443) and assume the ACL permits all traffic from the source networks, or misinterpret the 'log' keyword as affecting the permit/deny action.

How to eliminate wrong answers

Option B is wrong because the ACL does not permit all traffic from the specified subnets; it only permits HTTP from 192.168.1.0/24 and HTTPS from 192.168.2.0/24, and denies everything else. Option C is wrong because the ACL does not deny traffic from those subnets; it explicitly permits specific traffic from them. Option D is wrong because the output does not indicate where the ACL is applied (inbound or outbound) or that it is blocking all traffic; it only shows the ACL's configured entries, and the implicit deny at the end is standard, not a sign of blocking all traffic.

Full explanation →
1549
MCQhard

A large enterprise uses IP SLA to track a route to a remote site via an MPLS L3VPN. Router R1 (PE) has: ip sla 8 icmp-echo 10.10.10.10 source-ip 192.168.1.1 frequency 10 ip sla schedule 8 life forever start-time now track 8 ip sla 8 reachability ip route vrf CUSTOMER 10.10.10.0 255.255.255.0 192.168.1.2 track 8 The MPLS network is operational, but the route is intermittently removed. Show output on R1: show ip route vrf CUSTOMER 10.10.10.0 Routing entry for 10.10.10.0/24 Known via "static", distance 1, metric 0 Last update from 192.168.1.2 on GigabitEthernet0/0 * 192.168.1.2, via GigabitEthernet0/0 But the track is down: show track 8 Track 8 IP SLA 8 reachability Reachability is Down 3 changes, last change 00:00:15 What is the root cause?

A.The IP SLA is not configured with the vrf CUSTOMER keyword, so the probe is sent in the global table and cannot reach the target in the VRF.
B.The MPLS label distribution is failing, causing the IP SLA probe to be dropped.
C.The source IP 192.168.1.1 is not in the VRF CUSTOMER, so the probe cannot be sourced correctly.
D.The track 8 is not supported for VRF routes.
AnswerA

The IP SLA must be VRF-aware to send probes within the VRF; otherwise, the probe fails and the track goes down, but the route might still be installed due to other factors.

Why this answer

The IP SLA probe is sent to 10.10.10.10, but the source IP is 192.168.1.1. In an MPLS L3VPN, the VRF CUSTOMER might have a different routing table. The probe is sent in the global table unless configured with vrf.

The correct answer is that the IP SLA is not VRF-aware, so the probe fails, but the static route is still installed because the track is down but the route is not removed immediately due to the delay or because the route is still in the table from a previous state.

Full explanation →
1550
MCQmedium

A network engineer runs the following command to troubleshoot OSPF neighbor states: R1# show ip ospf neighbor detail Neighbor 2.2.2.2, interface address 10.1.1.2 In the area 0 via interface GigabitEthernet0/0 Neighbor priority is 1, State is FULL, 6 state changes DR is 10.1.1.2, BDR is 10.1.1.1 Options is 0x42 (LLS, DC) LLS Options is 0x1 (LR) Dead timer due in 00:00:36 Neighbor is up for 00:12:34 Index 1/1/1 Retransmission queue length 0, number of retransmission 1 First 0x0(0)/0x0(0)/0x0(0) Next 0x0(0)/0x0(0)/0x0(0) Last retransmission scan length is 1, maximum is 1 Last retransmission scan time is 0 msec, maximum is 0 msec What does this output indicate?

A.The neighbor is in the 2WAY state and not fully adjacent.
B.The neighbor is the DR and the adjacency is fully established.
C.There is a retransmission queue issue causing packet loss.
D.The neighbor is not participating in DR/BDR election.
AnswerB

The DR is 10.1.1.2 (neighbor's address) and state is FULL.

Why this answer

The output shows detailed OSPF neighbor information, including state, DR/BDR roles, and timers.

Full explanation →
1551
MCQhard

A network engineer is troubleshooting IPv6 connectivity issues on a multi-access segment where Router R1 and Router R2 are both acting as default routers. Hosts on the segment are not using R1 as a preferred router, even though R1 has a higher router preference. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ipv6 address 2001:DB8:1::1/64 ipv6 nd router-preference high ! Router R2 shows: debug ipv6 nd output indicates that R2 is sending RAs with default preference (medium). What is the root cause?

A.Router R1's RA interval is set too high, causing hosts to prefer R2's more frequent RAs.
B.An IPv6 ACL applied to the interface is blocking Router Advertisements from R1.
C.Router R2 is configured with 'ipv6 nd router-preference high' as well, overriding R1's preference.
D.Hosts are configured to ignore router preference due to a security policy.
AnswerB

An ACL with an implicit deny can block RAs, even if the router is configured to send them with high preference.

Why this answer

An IPv6 ACL applied to the interface can filter Router Advertisement (RA) messages. If R1's RAs are blocked, hosts will never receive the high-preference indication and will instead use R2's default-preference RAs, causing R1 not to be preferred. The debug output confirms R2 is sending RAs with medium preference, and R1's configuration explicitly sets preference high, so the only explanation for hosts ignoring R1's preference is that its RAs are not reaching them.

Exam trap

Cisco often tests the misconception that router preference alone guarantees selection, but the trap here is that an ACL or other filter can silently drop RAs, making the preference irrelevant because hosts never receive the RA.

How to eliminate wrong answers

Option A is wrong because the RA interval does not affect preference; hosts use the router preference field in the RA, not the frequency, to choose a default router. Option C is wrong because the debug output explicitly states R2 is sending RAs with default (medium) preference, not high, so there is no override. Option D is wrong because there is no evidence or configuration shown that hosts have a security policy to ignore router preference; such a policy would need to be explicitly configured on the hosts, which is not indicated in the question.

Full explanation →
1552
MCQmedium

A network engineer is troubleshooting an MPLS L3VPN where CE1 cannot reach CE2. The PE routers are running OSPF as the IGP and LDP for label distribution. On PE1, the engineer sees that the VRF route for CE2's subnet is present, but the corresponding MPLS label is missing in the LFIB. The show mpls ldp neighbor command shows LDP neighbors are up. What is the most likely cause of the missing label?

A.LDP is not enabled on the interface facing the next-hop router.
B.The VRF route is not redistributed into BGP on the remote PE.
C.MTU mismatch on the link between PE1 and P causes label imposition failure.
D.The mpls label protocol ldp command is missing under the VRF.
AnswerA

Correct because LDP must be enabled on the interface that connects to the next-hop router to assign a label for the IGP route, which is used to resolve the BGP next-hop in MPLS VPN.

Why this answer

The missing label in the LFIB despite the VRF route being present indicates that LDP is not binding a label to the BGP next-hop of the VPN route. Since the IGP route to the BGP next-hop is present but LDP has not assigned a label for it, the issue is likely that LDP is not enabled on the interface facing the next-hop router.

Full explanation →
1553
MCQmedium

Examine this partial configuration on router R3: flow record RECORD-2 match ipv4 source address match ipv4 destination address match ipv4 protocol match transport source-port match transport destination-port collect counter bytes collect counter packets ! flow monitor MONITOR-3 record RECORD-2 cache timeout active 60 cache timeout inactive 15 ! interface GigabitEthernet0/3 ip flow monitor MONITOR-3 input ip flow monitor MONITOR-3 output ! Which statement is true about this configuration?

A.The router will create separate flow records for traffic entering and leaving GigabitEthernet0/3, doubling the cache entries.
B.The router will aggregate input and output flows into a single cache entry for each unique flow.
C.The inactive timeout of 15 seconds will cause flows to be exported only after 15 seconds of inactivity, overriding the active timeout.
D.The configuration is invalid because a flow monitor cannot be applied to both input and output on the same interface.
AnswerA

Applying the same flow monitor in both input and output directions creates separate flow entries for each direction, effectively doubling the cache usage.

Why this answer

This question tests understanding of bidirectional flow monitoring and cache timeout interaction.

Full explanation →
1554
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip vrf interfaces Interface VRF IP Address Protocol GigabitEthernet0/0 BLUE 10.1.1.1 up GigabitEthernet0/1 BLUE 10.1.2.1 up GigabitEthernet0/2 RED 192.168.1.1 up Loopback0 BLUE 10.0.0.1 up Loopback1 RED 192.168.0.1 up Based on this output, which statement is correct?

A.All interfaces are in the global routing table.
B.GigabitEthernet0/2 is in VRF RED with IP address 192.168.1.1.
C.Loopback0 is in VRF RED.
D.GigabitEthernet0/1 has IP address 10.1.2.2.
AnswerB

The output shows GigabitEthernet0/2 is in VRF RED with IP 192.168.1.1 and protocol up.

Why this answer

The 'show ip vrf interfaces' command displays all interfaces assigned to VRFs and their IP addresses. The output shows that GigabitEthernet0/0, GigabitEthernet0/1, and Loopback0 are in VRF BLUE, while GigabitEthernet0/2 and Loopback1 are in VRF RED. There are no interfaces in the global routing table shown here, but that is normal for VRF-Lite.

Full explanation →
1555
Drag & Drophard

Drag and drop the steps to troubleshoot a BFD adjacency or connectivity failure into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking basic IP connectivity to isolate layer 3 issues, then verify BFD parameters match on both sides, inspect BFD session state, check for interface or routing protocol mismatches, and finally enable debug to capture BFD packet exchange.

Full explanation →
1556
MCQmedium

In IPv6 First Hop Security, what is the purpose of the 'device-role' command in a DHCP guard policy?

A.It specifies whether the interface is a server, client, or relay for DHCP filtering.
B.It sets the trust level for ND inspection.
C.It defines the VLAN membership for the interface.
D.It enables IPv6 routing on the interface.
AnswerA

The role dictates the expected DHCP message types on that interface.

Why this answer

The 'device-role' command in a DHCP guard policy specifies the role of the interface as either a DHCP server, client, or relay. This allows the switch to filter DHCP messages based on the expected role, blocking unauthorized DHCP server messages on interfaces that should only have clients or relays. It is a key component of IPv6 First Hop Security to prevent rogue DHCPv6 servers.

Exam trap

Cisco often tests the distinction between DHCP guard and other First Hop Security features like RA guard or ND inspection, so candidates may confuse the 'device-role' command with trust settings for ND or RA messages.

How to eliminate wrong answers

Option B is wrong because the 'device-role' command is specific to DHCP guard, not ND inspection; ND inspection uses the 'nd inspection' command and trust settings. Option C is wrong because VLAN membership is configured with the 'switchport access vlan' or 'vlan' commands, not with a DHCP guard policy. Option D is wrong because IPv6 routing is enabled globally with 'ipv6 unicast-routing' or on an interface with 'ipv6 enable', not through a DHCP guard policy.

Full explanation →
1557
Drag & Drophard

Drag and drop the steps to troubleshoot EIGRP adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking the EIGRP neighbor table to confirm adjacency state, then verify interface status and MTU mismatch, review K-value mismatches, inspect ACLs that might block EIGRP packets, and finally check for authentication mismatches.

Full explanation →
1558
MCQhard

A network engineer runs the following command to troubleshoot an EEM issue: R1# show event manager environment all No. Variable Name Value 1 _exit_status 1 2 _event_type syslog 3 _syslog_msg %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.2 on GigabitEthernet0/0 from LOADING to FULL, Loading Done 4 _syslog_severity 5 5 _syslog_facility OSPF 6 _syslog_mnemonic ADJCHG What does this output indicate?

A.The environment variables show that a syslog event with mnemonic ADJCHG triggered, and the applet can use these variables in actions.
B.The environment variables are configured manually by the engineer to define the applet behavior.
C.The output shows the current state of all EEM applets and their variables.
D.The _exit_status variable indicates the applet failed to execute.
AnswerA

Correct. The variables show the event details, and applets can reference them using $_syslog_msg, etc.

Why this answer

The output shows the EEM environment variables that are set when an event triggers an applet. These variables contain information about the event, such as the event type, syslog message details, and exit status. This is useful for debugging applets that use these variables in their actions.

Full explanation →
1559
MCQmedium

Which EIGRP packet type is used to confirm receipt of a route update during reliable transport?

A.Hello
B.Update
C.ACK
D.Query
AnswerC

ACK packets are Hello packets with no data, used to acknowledge received updates.

Why this answer

EIGRP uses ACK packets (which are Hello packets with no data) to acknowledge reliable updates.

Full explanation →
1560
Multi-Selecthard

Which TWO statements correctly describe the use of IKEv2 for IPsec site-to-site VPNs? (Choose TWO.)

Select 2 answers
A.IKEv2 uses UDP port 500 and 4500 for NAT traversal.
B.IKEv2 supports only pre-shared keys for authentication.
C.IKEv2 uses aggressive mode to establish the IKE SA.
D.IKEv2 can authenticate using EAP (Extensible Authentication Protocol).
E.The default IKEv2 SA lifetime is 3600 seconds.
AnswersA, D

Correct. IKEv2 uses UDP 500 for initial exchanges and UDP 4500 when NAT is detected.

Why this answer

IKEv2 uses UDP port 500 for initial IKE SA establishment and port 4500 for NAT traversal (encapsulating IPsec packets in UDP to pass through NAT devices). This is a standard behavior defined in RFC 7296, ensuring compatibility with NAT environments.

Exam trap

Cisco often tests the misconception that IKEv2 uses aggressive mode (like IKEv1) or that its default SA lifetime is 3600 seconds, when in fact IKEv2 uses a simpler exchange and a 24-hour default lifetime.

Full explanation →
1561
MCQeasy

In OSPF, what is the default metric for a Type 3 summary LSA generated by an ABR using the 'area range' command?

A.The lowest metric among the summarized routes.
B.The highest metric among the summarized routes.
C.The sum of all metrics.
D.The metric is set to 1 by default.
AnswerA

Correct. OSPF uses the best (lowest) metric from the component routes for the summary LSA.

Why this answer

The default metric for a Type 3 summary LSA is the lowest metric among the component routes being summarized.

Full explanation →
1562
MCQeasy

A network engineer runs the following command to debug NAT with access lists: R1# debug ip nat access-list 100 NAT: access list 100 matched ip 10.1.1.1 -> 192.168.1.1 NAT: access list 100 matched ip 10.1.1.2 -> 192.168.1.1 NAT: access list 100 matched ip 10.1.1.3 -> 192.168.1.1 NAT: access list 100 matched ip 10.1.1.4 -> 192.168.1.1 What does this output indicate?

A.The access list is correctly matching traffic for NAT.
B.NAT is failing because translations are not being created.
C.The access list is misconfigured and blocking traffic.
D.The inside interface is not configured.
AnswerA

The debug confirms the access list is being hit by traffic.

Why this answer

The debug output shows that access list 100 is matching traffic from inside local addresses (10.1.1.1-4) to the inside global address (192.168.1.1). This indicates the ACL is correctly identifying traffic for NAT translation, which is the first step in the NAT process. The 'matched' messages confirm that the ACL is permitting the traffic, not blocking it, so NAT can proceed to create translations.

Exam trap

Cisco often tests the misconception that 'matched' in NAT debug output means the ACL is blocking traffic, when in fact 'matched' indicates the ACL permitted the traffic for translation.

How to eliminate wrong answers

Option B is wrong because the debug output shows 'matched' messages, which indicate the ACL is permitting traffic and NAT is processing it; translations would be created unless there is another issue (e.g., no ip nat inside/outside commands). Option C is wrong because the ACL is matching traffic, not blocking it; a misconfigured ACL would show 'denied' or no match messages. Option D is wrong because the debug output does not indicate interface configuration issues; the NAT process is actively matching traffic, implying the inside interface is likely configured with 'ip nat inside'.

Full explanation →
1563
MCQhard

An engineer configures DHCPv6 prefix delegation on a Cisco router acting as a requesting client. The router receives a valid IA_PD prefix from the server, but no route for the delegated prefix appears in the routing table. Which is the most likely explanation?

A.DHCPv6 prefix delegation automatically installs a connected route; the issue is a missing 'ipv6 route' command to point the prefix to the DHCP-learned next-hop.
B.The router's 'ipv6 dhcp client pd' command does not install a route; the engineer must manually configure a static route for the delegated prefix.
C.The DHCPv6 server must also send a route option; the requesting client cannot install a route without it.
D.The router's 'ipv6 unicast-routing' is disabled, preventing route installation.
AnswerB

Correct: DHCPv6 PD only assigns the prefix to an interface; no route is created. A static route or dynamic routing is needed.

Why this answer

The `ipv6 dhcp client pd` command on a Cisco router acting as a DHCPv6 prefix delegation client does not automatically install a route for the delegated prefix into the routing table. The command only assigns the prefix to an interface for use (e.g., with `ipv6 address` commands), but the engineer must manually configure a static route pointing to the DHCP-learned next-hop address to populate the routing table.

Exam trap

Cisco often tests the misconception that DHCPv6 prefix delegation automatically installs a route, similar to how DHCPv4 might install a default route, but the `ipv6 dhcp client pd` command only provides prefix assignment, not route installation.

How to eliminate wrong answers

Option A is wrong because DHCPv6 prefix delegation does not automatically install a connected route; the delegated prefix is not a directly connected network, so no connected route is generated. Option C is wrong because the DHCPv6 server is not required to send a route option (option 23) for the requesting client to install a route; the client can install a static route based on the delegated prefix and server-provided next-hop. Option D is wrong because if `ipv6 unicast-routing` were disabled, the router would not process IPv6 routing at all, and the DHCPv6 client would likely fail to obtain a prefix or the interface would not come up; the question states a valid IA_PD prefix was received, indicating unicast routing is enabled.

Full explanation →
1564
Multi-Selectmedium

Which TWO commands can be used to troubleshoot an Embedded Event Manager (EEM) applet that is not triggering as expected? (Choose TWO.)

Select 2 answers
A.debug event manager action all
B.show event manager detector all
C.show event manager policy registered
D.show event manager environment all
E.debug event manager all
AnswersA, B

This enables debugging for all EEM actions, showing detailed output when actions run, which helps identify if the applet is executing and what actions are performed.

Why this answer

The 'debug event manager action all' command provides detailed logs of EEM actions, while 'show event manager detector all' shows the status of all EEM detectors (including whether they are registered). The other options are either not valid or not useful for troubleshooting trigger issues.

Full explanation →
1565
MCQhard

A network engineer is troubleshooting IPv6 MPLS LDP neighbor discovery on a link between Router R1 and Router R2. The LDP session is not forming. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ipv6 address 2001:DB8:1::1/64 mpls ip mpls ldp discovery transport-address interface ! Router R2 shows: debug mpls ldp discovery output indicates that R2 is receiving Hello packets from R1, but the LDP session remains in INIT state. What is the root cause?

A.The 'mpls ldp discovery transport-address interface' command on R1 causes the transport address to be the link-local address, which is not routable.
B.The MPLS LDP label distribution is disabled on the interface, preventing session establishment.
C.The LDP hello interval is mismatched between R1 and R2, causing the session to fail.
D.Router R2 has a firewall blocking TCP port 646, preventing the LDP session.
AnswerA

Link-local addresses are not routable, so R2 cannot establish a TCP session to R1's transport address.

Why this answer

The command 'mpls ldp discovery transport-address interface' on Router R1 forces the LDP transport address to be the interface's IPv6 link-local address. Since link-local addresses are not routable, Router R2 cannot reach this transport address to establish the TCP connection (port 646) required for the LDP session. The session stalls in INIT state because the TCP handshake fails, even though Hello packets (UDP) are exchanged successfully.

Exam trap

Cisco often tests the subtle difference between LDP Hello (UDP) and LDP session (TCP) establishment, tricking candidates into thinking that receiving Hellos means the session should form, when in fact the transport address must be routable for the TCP handshake to succeed.

How to eliminate wrong answers

Option B is wrong because 'mpls ip' on the interface enables MPLS forwarding and implicitly enables LDP label distribution; there is no separate disable command. Option C is wrong because LDP hello intervals can be mismatched without preventing session formation; the session would still transition to INIT and then fail only if the hold timer expires, but here the session is stuck in INIT, not dropping. Option D is wrong because the debug output shows R2 is receiving Hello packets from R1, indicating UDP port 646 is open; a firewall blocking TCP port 646 would prevent the TCP connection, but the symptom would be the same as the correct answer, yet the root cause is specifically the non-routable transport address, not a firewall.

Full explanation →
1566
Multi-Selecthard

Which TWO statements correctly describe the behavior of NAT with route maps and ACLs when using the 'ip nat inside source route-map' feature? (Choose TWO.)

Select 2 answers
A.The route map can use 'match ip address' to select traffic for translation based on source IP.
B.The route map can use 'match interface' to translate only when traffic exits a specific interface.
C.The route map can use 'match ip next-hop' to control translation based on the next-hop IP.
D.The route map is evaluated once per session at the creation of the translation entry.
E.The route map can use 'set ip next-hop' to change the destination of translated packets.
AnswersA, B

Correct. 'match ip address' references an ACL that selects source IPs for NAT.

Why this answer

The 'match ip address' command in a route map references an ACL that selects traffic based on source IP address. When used with 'ip nat inside source route-map', only packets matching the ACL are considered for NAT translation, allowing granular control over which inside hosts are translated.

Exam trap

Cisco often tests the misconception that route-map match clauses like 'match ip next-hop' or 'set ip next-hop' are valid for NAT, when in fact they belong to PBR and have no effect on NAT translation decisions.

Full explanation →
1567
MCQmedium

A network engineer runs the following command to troubleshoot OSPF route filtering: R1# show ip ospf database router 2.2.2.2 OSPF Router with ID (1.1.1.1) (Process ID 1) Router Link States (Area 0) LS age: 300 Options: (No TOS-capability, DC) LS Type: Router Links Link State ID: 2.2.2.2 Advertising Router: 2.2.2.2 LS Seq Number: 80000004 Checksum: 0x1234 Length: 48 Number of Links: 2 Link connected to: a Stub Network (Link ID) Network/subnet number: 10.1.1.0 (Link Data) Network Mask: 255.255.255.0 Number of TOS metrics: 0 TOS 0 Metrics: 10 Link connected to: a Transit Network (Link ID) Designated Router address: 10.1.1.2 (Link Data) Router Interface address: 10.1.1.1 Number of TOS metrics: 0 TOS 0 Metrics: 10 What does this output indicate?

A.Router 2.2.2.2 is advertising two links, one of which is a stub network 10.1.1.0/24.
B.Router 2.2.2.2 is filtering routes from area 0.
C.Router 2.2.2.2 is a DR for the transit network.
D.Router 2.2.2.2 has a mismatched area ID.
AnswerA

The LSA shows two links: a stub network and a transit network. The stub network is 10.1.1.0/24.

Why this answer

The output shows the OSPF router LSA from router 2.2.2.2. It lists two links: one stub network (10.1.1.0/24) and one transit network (via DR 10.1.1.2). This is normal OSPF operation.

Full explanation →
1568
MCQmedium

A network engineer runs the following command to troubleshoot SNMP access control: R1# show snmp view v1default - includes all objects up to OID 1.3.6.1.2.1.1 v1system - includes system MIB only (1.3.6.1.2.1.1) What does this output indicate?

A.Two SNMP views are configured: 'v1default' with broader access and 'v1system' limited to the system MIB.
B.The router uses SNMPv3 views exclusively.
C.The 'v1default' view includes all MIB objects.
D.No views are configured, so SNMP access is denied.
AnswerA

The output shows two views with different scopes.

Why this answer

The output from 'show snmp view' lists two views: 'v1default' includes objects up to OID 1.3.6.1.2.1.1 (system MIB), and 'v1system' is explicitly limited to the system MIB. This indicates that 'v1default' has broader access than 'v1system', but neither includes all MIB objects. Option A correctly describes this configuration.

Exam trap

Cisco often tests the misconception that a view named 'default' includes all MIB objects, but in reality, 'v1default' is a default view that typically includes only the system MIB (1.3.6.1.2.1.1) unless explicitly modified.

How to eliminate wrong answers

Option B is wrong because the output shows views named 'v1default' and 'v1system', which are typically associated with SNMPv1/v2c community-based views, not exclusive to SNMPv3; SNMPv3 uses view-based access control models (VACM) but can also use these views. Option C is wrong because 'v1default' includes only objects up to OID 1.3.6.1.2.1.1 (system MIB), not all MIB objects; a view including all objects would be specified as 'included' with a subtree of '1' or 'iso'. Option D is wrong because the output clearly shows two views are configured, so SNMP access is not denied by default; views exist and can be applied to communities or groups.

Full explanation →
1569
MCQhard

An engineer configures IP SLA to track a route to a server that is reachable via a GRE tunnel. Router R1 has: ip sla 9 icmp-echo 172.16.0.1 source-ip 10.0.0.1 frequency 10 ip sla schedule 9 life forever start-time now track 9 ip sla 9 reachability ip route 192.168.2.0 255.255.255.0 Tunnel0 track 9 The GRE tunnel is up, but the route is flapping. Show output on R1: show interface Tunnel0 Tunnel0 is up, line protocol is up show track 9 Track 9 IP SLA 9 reachability Reachability is Up 10 changes, last change 00:00:05 What is the root cause?

A.The GRE tunnel has a path MTU issue that causes ICMP packets to be fragmented or dropped, leading to intermittent probe failures.
B.The IP SLA frequency is too high, causing the router to overload.
C.The source IP 10.0.0.1 is not reachable from the tunnel destination.
D.The track 9 is not correctly associated with the route.
AnswerA

GRE adds overhead, and if the path MTU is not adjusted, ICMP packets may be dropped due to fragmentation, causing the track to flap.

Why this answer

The IP SLA probe is successful, but the track is flapping. This could be due to the IP SLA probe itself being intermittent, perhaps because the GRE tunnel is using a path that has high latency or packet loss. The correct answer is that the IP SLA probe is being affected by the GRE tunnel's path MTU or fragmentation issues, causing some probes to be dropped.

Full explanation →
1570
MCQhard

Router R10 is configured with SNMP and EEM. An EEM applet is configured to send an SNMP trap when a specific syslog message is generated. The applet uses the 'action snmp-trap' command. However, the NMS receives no trap. The syslog message is generated and logged. The router's show snmp statistics shows TrapsSent: 0. What is the root cause?

A.The EEM applet is configured to send a trap, but the 'snmp-server host' command is missing, so the router has no destination for the trap.
B.The syslog message is not matching the EEM trigger pattern correctly.
C.The EEM applet is not registered due to a syntax error.
D.The SNMP community string is not configured with RW privileges.
AnswerA

Without 'snmp-server host', the router does not know where to send the trap. The EEM action will fail silently.

Why this answer

The EEM applet uses the 'action snmp-trap' command to generate a trap, but without the 'snmp-server host' command, the router has no configured destination to send the trap to. The 'show snmp statistics' output showing TrapsSent: 0 confirms that the trap was generated internally but never transmitted, which is the classic symptom of a missing trap destination. The syslog message being logged and the applet triggering correctly rules out pattern-matching or registration issues.

Exam trap

Cisco often tests the misconception that 'action snmp-trap' alone is sufficient to send a trap, when in fact the 'snmp-server host' command is mandatory to define the trap receiver.

How to eliminate wrong answers

Option B is wrong because the syslog message is generated and logged, indicating the EEM trigger pattern matched correctly; if it didn't match, the applet would not execute at all. Option C is wrong because if the applet had a syntax error, it would not register, and the syslog message would not trigger any action; the fact that the syslog is logged and the applet is expected to run shows registration succeeded. Option D is wrong because SNMP traps are sent using the community string configured under 'snmp-server host', which requires read-only (RO) or read-write (RW) privileges only for SNMP writes to the router, not for trap generation; traps are sent with the community string specified in the 'snmp-server host' command, and RW is irrelevant here.

Full explanation →
1572
Drag & Dropmedium

Drag and drop the steps to verify and validate the Administrative Distance operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by showing the IP routing table to see which routes are installed, then display the specific route with its AD, next check the routing protocol database for the prefix, then verify the protocol-specific AD configuration, and finally compare the AD with other protocols to ensure correct preference.

Full explanation →
1573
MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast summary BGP router identifier 192.168.0.1, local AS number 65001 BGP table version is 10, main routing table version 10 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 1002 1000 10 0 0 00:15:30 5 192.168.2.2 4 65003 1005 1003 10 0 0 00:14:20 3 10.10.10.2 4 65004 0 0 0 0 0 00:00:05 Idle Based on this output, what is the problem with neighbor 10.10.10.2?

A.The neighbor is administratively shut down.
B.The BGP session is not established; possible misconfiguration or reachability issue.
C.The neighbor is in the process of establishing the session.
D.The neighbor has sent all its prefixes and is waiting for updates.
AnswerB

Idle state with no messages indicates the session is down.

Why this answer

The output shows that neighbor 10.10.10.2 is in the Idle state with zero messages sent or received, indicating the BGP session has never been established. This typically results from a misconfiguration (e.g., wrong neighbor IP, incorrect AS number, missing update-source) or a Layer 3 reachability issue preventing the TCP connection on port 179.

Exam trap

Cisco often tests the distinction between Idle (no session attempt) and Active (session attempt in progress), tricking candidates into thinking Idle means 'waiting' rather than 'not started'.

How to eliminate wrong answers

Option A is wrong because an administratively shut down BGP neighbor would show the state as 'Idle (admin)' or similar, not just 'Idle'. Option C is wrong because a session in the process of establishing would show a state like 'Active' or 'Connect', not 'Idle'. Option D is wrong because the neighbor has sent zero prefixes (PfxRcd is blank) and is in Idle, meaning no prefixes have been exchanged; waiting for updates would occur in the Established state.

Full explanation →
1574
MCQmedium

A network engineer is troubleshooting a BGP route filtering issue. Router R1 is advertising a prefix 10.1.1.0/24 to its eBGP neighbor R2, but R2 is not receiving it. The engineer checks R1's BGP configuration and sees a route-map named FILTER-OUT applied outbound to the neighbor. The route-map references an ACL that permits 10.1.1.0/24, but the prefix is still not being sent. What is the most likely cause?

A.The route-map is missing a 'permit' statement; the default action is deny.
B.The ACL is using the wrong wildcard mask; it should be 0.0.0.255 instead of 0.0.0.0.
C.The neighbor is configured with 'soft-reconfiguration inbound' which blocks outbound updates.
D.The route-map is applied inbound instead of outbound on R1.
AnswerA

Correct because route-maps without an explicit permit will implicitly deny all prefixes.

Why this answer

The route-map must have an explicit permit statement; if the route-map is missing the permit clause, or if the sequence number is incorrect, the implicit deny at the end of the route-map will filter all routes. The ACL permitting the prefix is necessary but not sufficient if the route-map itself does not have a permit action.

Full explanation →
1575
MCQhard

An engineer configures iBGP between two routers in the same AS. The BGP table shows the prefix, but it is not installed in the routing table. The IGP does not carry the prefix. Which is the most likely explanation?

A.The BGP synchronization rule is enabled, and the prefix is not in the IGP, so BGP does not install the route.
B.The next-hop is unreachable because of a missing static route.
C.The BGP route is filtered by an inbound route-map.
D.The maximum-paths limit is exceeded.
AnswerA

Synchronization requires that the prefix be reachable via IGP before BGP installs it; if not, the route remains in the BGP table but not the routing table.

Why this answer

When BGP synchronization is enabled (default in older IOS versions), BGP will not install a route learned via iBGP into the routing table unless the same prefix is also present in the IGP. Since the IGP does not carry the prefix, BGP considers the route unsynchronized and does not install it, even though it appears in the BGP table.

Exam trap

Cisco often tests the BGP synchronization rule as a legacy behavior that candidates overlook, assuming that a prefix in the BGP table always implies installation in the routing table, but synchronization can block installation even when the next-hop is reachable.

How to eliminate wrong answers

Option B is wrong because an unreachable next-hop due to a missing static route would cause the BGP route to be marked as invalid or not installed, but the question states the BGP table shows the prefix, implying the next-hop is reachable via the IGP or a connected route. Option C is wrong because an inbound route-map filtering the route would prevent the prefix from appearing in the BGP table entirely, not just from being installed in the routing table. Option D is wrong because exceeding the maximum-paths limit affects load balancing among multiple equal-cost paths, not the installation of a single prefix; a single route would still be installed.

Full explanation →
Page 20

Page 21 of 27

Page 22

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →