Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1651–1725

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 22

Page 23 of 27

Page 24
1651
MCQmedium

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue: R1# show mpls ldp neighbor detail Output: Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.17905 State: Oper, Msg sent: 123, Msg rcvd: 456 Up time: 1w2d LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.12.0.2 Addresses bound to peer LDP Ident: 10.0.0.2 10.12.0.2 Peer hold time: 15 sec What does this output indicate?

A.The LDP session is up and stable
B.The LDP session is using UDP
C.The LDP session is down
D.The LDP peer is using a different LDP ID
AnswerA

State is Oper, up time is 1w2d, indicating a stable session.

Why this answer

The output shows LDP neighbor details. The peer is 10.0.0.2, the session is operational (State: Oper) and has been up for 1 week and 2 days. The discovery source is GigabitEthernet0/0 with source IP 10.12.0.2.

The peer's addresses include 10.0.0.2 (loopback) and 10.12.0.2 (interface).

Full explanation →
1652
MCQhard

Two OSPF routers R1 and R2 are connected via a GigabitEthernet link in area 0. R1 has interface GigabitEthernet0/0 ip ospf network point-to-point, while R2 has the default OSPF network type broadcast. R1's show ip ospf neighbor shows R2 in FULL state, but R2's show ip ospf neighbor shows R1 in FULL state. However, routes from R1 are not appearing in R2's routing table. Show ip ospf database on R2 shows the router LSA from R1 but not the network LSA. What is the root cause?

A.The OSPF network type mismatch causes R1 to not generate a network LSA, and R2 cannot install routes that rely on that LSA.
B.The OSPF adjacency is stuck in EXSTART state due to MTU mismatch.
C.R2 has a firewall blocking Type 2 LSAs.
D.R1's router LSA has an incorrect metric, causing R2 to ignore it.
AnswerA

R1's point-to-point network type does not elect a DR or generate Type 2 LSAs, so R2 lacks the necessary topology information for transit.

Why this answer

When R1 has the OSPF network type set to point-to-point on the GigabitEthernet link, it does not elect a DR/BDR and therefore does not generate a Type 2 (Network) LSA. R2, with the default broadcast network type, expects a Network LSA to build complete routing information for the segment. Although the adjacency reaches FULL and R2 receives R1's Type 1 (Router) LSA, the missing Network LSA prevents R2 from installing routes that depend on that LSA, such as those for networks advertised by R1 that are not directly connected to the link.

Exam trap

Cisco often tests the misconception that a FULL adjacency guarantees full route exchange, but the trap here is that OSPF network type mismatch can break route installation even when neighbor state is FULL and Router LSAs are exchanged.

How to eliminate wrong answers

Option B is wrong because the adjacency is already in FULL state, not EXSTART, so an MTU mismatch is not the issue. Option C is wrong because a firewall blocking Type 2 LSAs would not affect the adjacency state or the presence of the Router LSA in the database; the problem is a missing Network LSA due to network type mismatch, not a filter. Option D is wrong because the Router LSA from R1 is present in R2's database, and there is no indication of an incorrect metric; OSPF does not ignore LSAs based solely on metric values.

Full explanation →
1653
MCQhard

An engineer configures PBR on a router to route traffic from VLAN 10 to next-hop 192.168.1.2 using a route-map. The route-map is applied inbound on the VLAN interface. The engineer also configures 'ip policy route-map' on the same interface. However, traffic from VLAN 10 is not being policy-routed; instead, it is forwarded normally. The router is running IOS-XE. What is the most likely cause?

A.The VLAN interface is a Layer 2 switch virtual interface (SVI) and does not support PBR without additional hardware configuration.
B.The route-map is missing a 'match ip address' clause.
C.The next-hop 192.168.1.2 is not reachable via any route.
D.The 'ip policy route-map' command is applied outbound instead of inbound.
AnswerA

PBR on SVIs in IOS-XE may require specific platform support or configuration; otherwise, it is ignored.

Why this answer

On IOS-XE, PBR is not supported on switched virtual interfaces (SVIs) by default; it requires the 'platform hardware throughput mode' or specific hardware support. Alternatively, the interface may be a Layer 2 switch port, not a routed interface. PBR only works on routed interfaces.

Full explanation →
1654
MCQhard

A service provider network is experiencing MPLS label distribution failures between R1 and R2. R1 has: event manager applet LDP-MONITOR event syslog pattern "%LDP-4-ERROR" action 1.0 cli command "enable" action 2.0 cli command "clear mpls ldp neighbor *" action 3.0 syslog msg "Cleared LDP neighbors". Router R2 shows: LDP session is down, and logs show repeated LDP errors. What is the root cause?

A.The EEM applet clears all LDP neighbors upon any LDP error, preventing the session from stabilizing.
B.The LDP router-id is misconfigured on R1.
C.The syslog pattern matches only severity 4, but LDP errors are severity 3.
D.The MPLS label range is exhausted on R1.
AnswerA

Clearing all LDP neighbors disrupts all LDP sessions, causing repeated errors.

Why this answer

The EEM applet triggers on any LDP error and clears all LDP neighbors. This removes the LDP session, causing more errors when the session tries to re-establish, leading to a cycle of failures. The correct fix is to clear only the affected neighbor or address the underlying LDP issue.

Full explanation →
1655
MCQeasy

What is the default BGP keepalive interval and hold time for eBGP peers in Cisco IOS?

A.Keepalive 30 seconds, hold time 90 seconds
B.Keepalive 60 seconds, hold time 180 seconds
C.Keepalive 10 seconds, hold time 30 seconds
D.Keepalive 120 seconds, hold time 360 seconds
AnswerB

This is the standard default for BGP in Cisco IOS.

Why this answer

The default keepalive interval is 60 seconds, and the hold time is 180 seconds (three times the keepalive).

Full explanation →
1656
MCQhard

A network engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using eBGP with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 shows the route is received and best, but the show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 neighbors 192.168.1.2 advertised-routes command on PE2 shows the route is not advertised. What is the most likely cause?

A.The VRF on PE2 does not have the CE2 route in its routing table.
B.The MP-BGP session between PE1 and PE2 is down.
C.The route-target export on PE2 is misconfigured.
D.The VRF on PE1 has the wrong route-target import.
AnswerA

Correct: If the route is not in the VRF routing table on PE2, it cannot be advertised via BGP.

Why this answer

The route is not being advertised from PE2 to PE1. This could be due to a missing network statement or redistribute command under the BGP VRF address family on PE2, or the route is not in the VRF routing table on PE2. The engineer should check PE2's VRF routing table for the CE2 route.

Full explanation →
1657
MCQeasy

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# debug ip ospf adj And sees the following output: *Mar 1 00:20:11.456: OSPF: Rcv pkt from 10.1.1.2, Serial0/0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1 *Mar 1 00:20:11.457: OSPF: Rcv pkt from 10.1.1.2, Serial0/0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1 What does this output indicate?

A.OSPF adjacency is forming successfully with authentication.
B.OSPF authentication is misconfigured; the neighbor is not using authentication while this router is.
C.OSPF is redistributing routes correctly but authentication is failing.
D.The OSPF process is using MD5 authentication and the neighbor is using plaintext.
AnswerB

The router expects authentication type 1, but the neighbor sends type 0, indicating a configuration mismatch.

Why this answer

The debug ip ospf adj output shows authentication type mismatch. The router expects type 1 (plaintext authentication) but the received packet has type 0 (no authentication). This prevents the OSPF adjacency from forming, which would affect route redistribution if OSPF is not learning routes.

Full explanation →
1658
MCQmedium

In VRF-Lite, which routing protocols can be used within a VRF?

A.Only static routing is supported in VRF-Lite.
B.OSPF, EIGRP, RIP, and BGP can all be configured per VRF.
C.Only OSPF and EIGRP are supported in VRF-Lite.
D.BGP cannot be used within a VRF in VRF-Lite.
AnswerB

This is correct. These protocols have VRF-aware capabilities.

Why this answer

Most routing protocols (RIP, EIGRP, OSPF, BGP) support VRF-aware configurations. The protocol must be configured with the 'vrf' keyword to operate within a specific VRF.

Full explanation →
1659
MCQhard

EIGRP stuck-in-active (SIA) is occurring due to route summarization. Router R1 is the hub in a hub-and-spoke topology with R2 and R3 as spokes. R1's configuration: interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip summary-address eigrp 100 10.0.0.0 255.255.252.0 ! router eigrp 100 network 10.0.0.0 ! R2 and R3 are connected via Frame Relay. R2 shows: R2# show ip eigrp topology 10.0.1.0/24 P 10.0.1.0/24, 1 successors, FD is 30720 via 10.0.0.1 (30720/28160), GigabitEthernet0/0 R3 has a similar entry. However, when R1's summary is active, R2 and R3 go into active state for the summary. What is the root cause?

A.The summary route causes EIGRP queries to loop between spokes when one loses connectivity, leading to SIA.
B.The Frame Relay network is not supporting multicast, so EIGRP hello packets are lost.
C.The summary route metric is too high, causing EIGRP to not install it.
D.EIGRP is not enabled on the spoke interfaces.
AnswerA

Spokes query each other for the summary, and if neither has a route, they query the hub again, causing a loop.

Why this answer

The summary route 10.0.0.0/22 is advertised by R1 to both spokes. If one spoke loses connectivity to R1, it queries the other spoke for the summary. The spoke may not have a route to the summary, causing it to query R1 again, leading to a query loop and SIA.

The summary should be configured with a leak-map to allow specific routes, or the query scope should be limited.

Full explanation →
1660
MCQhard

An engineer configures Control Plane Policing (CoPP) on a router that terminates multiple IPsec site-to-site VPN tunnels. After applying the CoPP policy, some IPsec tunnels fail to establish, while others work fine. The engineer verifies that the CoPP policy permits IKE (UDP 500) and ESP (protocol 50) traffic. What is the most likely cause of the failure?

A.The CoPP policy uses the 'class class-default' with a police action that drops traffic exceeding a low rate, and IKE/ESP packets are being classified into class-default because the ACL does not match them correctly.
B.The CoPP policy is applied to the wrong interface; it should be applied to the tunnel interface.
C.The IPsec tunnels use IKEv2, which uses UDP port 4500, and the CoPP policy only permits UDP 500.
D.The CoPP policy rate-limits traffic in bps, but IKE/ESP traffic is bursty, causing drops during the initial exchange.
AnswerA

If the ACL for the IKE/ESP class is misconfigured (e.g., wrong port or protocol), the packets fall into class-default, which may have a police or drop action, causing tunnel establishment to fail.

Why this answer

The most likely cause is that the CoPP ACL does not correctly match IKE (UDP 500) and ESP (protocol 50) packets, causing them to fall into the 'class-default' class. If the 'class-default' has a police action that drops traffic exceeding a low rate, these critical control-plane packets are dropped, preventing IPsec tunnel establishment. This explains why some tunnels work (those that happen to generate less traffic or are not rate-limited) while others fail.

Exam trap

Cisco often tests the concept that CoPP misclassification into class-default with a restrictive police action is a common cause of partial IPsec tunnel failures, leading candidates to overlook ACL matching errors and instead focus on interface application or protocol versions.

How to eliminate wrong answers

Option B is wrong because CoPP is applied to the control plane, not to interfaces; applying it to a tunnel interface would be incorrect and would not affect control-plane policing. Option C is wrong because IKEv2 can use UDP 500 for initial exchange and only switches to UDP 4500 if NAT traversal is detected; the question states the policy permits UDP 500, so this would not cause failure for all tunnels. Option D is wrong because CoPP rate-limits in packets per second (pps) by default, not bps, and while bursty traffic can cause drops, the core issue is misclassification into class-default, not the rate-limiting unit.

Full explanation →
1661
MCQhard

An engineer configures Flexible NetFlow with a flow record that includes 'match ipv4 protocol' and 'collect counter packets'. The flow monitor is applied to an interface. 'show flow monitor name MONITOR cache' shows flows, but the packet counts are much lower than expected based on interface counters. What is the most likely cause?

A.The flow monitor is applied only in the ingress direction, missing egress traffic.
B.The flow record does not include 'match ipv4 source address', causing flows to be aggregated incorrectly.
C.The router is using sampled NetFlow with a default sampling rate of 1:1000.
D.The flow exporter is rate-limiting the export, causing cache entries to be dropped before counting.
AnswerA

If the monitor is applied only ingress, egress packets are not counted. Applying it in both directions or using a sampler with appropriate rate can match interface counters.

Why this answer

Flexible NetFlow uses sampled NetFlow by default unless 'sampler' is explicitly configured. However, the default sampling rate is 1 (no sampling). The issue might be that the monitor is applied only in one direction (ingress or egress) while traffic is bidirectional, so only half the traffic is captured.

Full explanation →
1662
MCQmedium

Which configuration is missing to properly implement IPv6 First Hop Security on an access switch port that should only allow traffic from a single host with a static IPv6 address 2001:db8:1::10?

A.The interface needs 'ipv6 verify source' and a static binding entry 'ipv6 source binding 2001:db8:1::10 interface GigabitEthernet0/6'.
B.The interface needs 'ipv6 nd raguard' to block RAs.
C.The interface needs 'ipv6 dhcp guard' to block DHCP messages.
D.The interface needs 'ipv6 nd inspection' to validate ND messages.
AnswerA

IPv6 Source Guard with a static binding ensures only that source address is allowed.

Why this answer

IPv6 First Hop Security (FHS) on an access switch port requires both the 'ipv6 verify source' command on the interface and a static IPv6 source binding entry to enforce that only traffic from the specified host (2001:db8:1::10) is allowed. The 'ipv6 verify source' command enables source address validation using the binding table, and the static binding entry populates that table with the allowed source address and interface. Without both components, the switch cannot filter traffic based on the static IPv6 address.

Exam trap

Cisco often tests the misconception that a single FHS feature (like RA guard, DHCP guard, or ND inspection) is sufficient for source address filtering, when in fact 'ipv6 verify source' combined with a static binding is required to restrict traffic to a specific static IPv6 address.

How to eliminate wrong answers

Option B is wrong because 'ipv6 nd raguard' is used to block rogue Router Advertisement (RA) messages, not to restrict traffic from a specific host source address. Option C is wrong because 'ipv6 dhcp guard' blocks unauthorized DHCPv6 messages (e.g., rogue DHCP servers), but does not perform source address validation against a static binding. Option D is wrong because 'ipv6 nd inspection' validates Neighbor Discovery (ND) messages (e.g., preventing ND spoofing), but it does not enforce that all traffic from the port must originate from a specific static IPv6 address.

Full explanation →
1663
Drag & Drophard

Drag and drop the steps to troubleshoot BGP adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, check interface IP connectivity with ping; then verify BGP neighbor reachability and TCP port 179; next inspect BGP configuration for AS number mismatches; then examine BGP timers and update-source; finally use debug ip bgp to see session state transitions.

Full explanation →
1664
MCQeasy

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global udp 192.0.2.10:10000 10.0.0.10:10000 203.0.113.5:53 203.0.113.5:53 udp 192.0.2.10:10001 10.0.0.11:10000 203.0.113.5:53 203.0.113.5:53 udp 192.0.2.10:10002 10.0.0.12:10000 203.0.113.5:53 203.0.113.5:53 R1# show ip nat statistics Total active translations: 3 (0 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 150 Misses: 0 CEF Translated packets: 150, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload refcount 3 Based on this output, which statement is correct?

A.PAT is working correctly; multiple inside hosts share the same global address with unique ports.
B.The NAT pool is exhausted because all addresses are used.
C.Static NAT is configured for DNS traffic.
D.The inside and outside interfaces are swapped.
AnswerA

The translations show different source ports for each inside host, and the mapping uses interface overload. Hits indicate successful translation.

Why this answer

The output shows three dynamic NAT translations, all using the same inside global address 192.0.2.10 with unique source ports (10000, 10001, 10002). This is the hallmark of Port Address Translation (PAT) or NAT overload, where multiple inside hosts (10.0.0.10, 10.0.0.11, 10.0.0.12) share a single public IP address by differentiating sessions via layer-4 port numbers. The 'overload' keyword in the dynamic mapping confirms PAT is active and working correctly.

Exam trap

Cisco often tests the distinction between PAT (overload) and basic NAT (pool without overload), and candidates may mistakenly think that multiple translations to the same destination (203.0.113.5:53) indicate a pool exhaustion or static NAT, when in fact the unique source ports confirm PAT is functioning correctly.

How to eliminate wrong answers

Option B is wrong because the NAT pool is not exhausted; PAT allows many inside hosts to share a single global address, and the output shows only 3 active translations with plenty of port space remaining. Option C is wrong because there are no static NAT entries (the count shows 0 static, 3 dynamic), and the translations are for UDP/53 (DNS) but are dynamically created via PAT, not static configuration. Option D is wrong because the interfaces are correctly assigned: GigabitEthernet0/1 is the outside interface (where the global address 192.0.2.10 resides) and GigabitEthernet0/0 is the inside interface; swapping them would prevent NAT from working and the translations would not appear.

Full explanation →
1665
MCQmedium

What is the default administrative distance for OSPF routes in a VRF when OSPF is used as the PE-CE routing protocol in MPLS L3VPN?

A.90
B.110
C.115
D.120
AnswerB

Correct. OSPF administrative distance is 110 by default.

Why this answer

OSPF routes have a default administrative distance of 110, which applies both in the global table and within a VRF.

Full explanation →
1666
MCQeasy

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# show ip policy Interface Route-map FastEthernet0/0 PBR-MAP What does this output indicate?

A.PBR is enabled on FastEthernet0/0 with route-map PBR-MAP.
B.The route-map PBR-MAP is not configured.
C.PBR is applied globally and on the interface.
D.The route-map is applied to all interfaces.
AnswerA

The command shows the interface and associated route-map.

Why this answer

The output shows that PBR is applied on FastEthernet0/0 using route-map PBR-MAP. This confirms the interface-level configuration.

Full explanation →
1667
Multi-Selecthard

Which TWO statements correctly describe the use of SNMP inform requests compared to traps? (Choose TWO.)

Select 2 answers
A.Informs require the NMS to send an acknowledgment back to the router.
B.Traps are more reliable than informs because they use UDP with a higher priority.
C.The default retransmission timeout for informs is 30 seconds.
D.Informs and traps are mutually exclusive; a router can only send one type to a given NMS.
E.Both informs and traps are enabled using the 'snmp-server enable traps' command.
AnswersA, C

Informs require the NMS to send an acknowledgment, making them reliable at the application layer.

Why this answer

SNMP inform requests require the NMS to send an acknowledgment (SNMPv2 InformResponse-PDU), making them reliable at the application layer. Option C is correct because the default retransmission timeout for SNMP informs is 30 seconds on Cisco devices. Option E is incorrect because the 'snmp-server enable traps' command only enables traps, not informs; informs require a separate configuration (e.g., 'snmp-server enable informs').

Exam trap

A common pitfall is assuming that the 'snmp-server enable traps' command also enables informs, but it does not. Informs require an explicit separate configuration.

Full explanation →
1668
MCQmedium

A network engineer runs the following command to troubleshoot an EEM issue: R1# show event manager policy configuration TRACK-INTERFACE Applet TRACK-INTERFACE event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "show ip route" action 2.0 cli command "show ip ospf neighbor" action 3.0 syslog msg "OSPF adjacency change detected" What does this output indicate?

A.The applet 'TRACK-INTERFACE' is configured to trigger on syslog message 'OSPF-5-ADJCHG' and execute three actions in order: show ip route, show ip ospf neighbor, and send a syslog message.
B.The applet 'TRACK-INTERFACE' is currently executing and has run the first two actions.
C.The applet 'TRACK-INTERFACE' has a syntax error because the actions are not numbered correctly.
D.The applet 'TRACK-INTERFACE' will only execute the first action because the others are commented out.
AnswerA

Correct. The output shows the event and three actions with step numbers indicating order.

Why this answer

The output shows the configuration of a specific EEM applet. It displays the event trigger and the actions in order. Each action has a step number (e.g., 1.0) that determines the order of execution.

This is useful for verifying the applet configuration.

Full explanation →
1669
Drag & Dropmedium

Drag and drop the steps to troubleshoot EIGRP neighbor adjacency formation into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order ensures that you first verify the physical and data link layer, then check IP connectivity, confirm EIGRP is enabled on the correct interfaces, verify the autonomous system number matches, and finally check for any passive interface configuration that might block adjacency.

Full explanation →
1670
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface 2001:DB8:1::1 0 aaaa.bbbb.cccc REACH Gi0/0/0 2001:DB8:1::2 10 aaaa.bbbb.cccd STALE Gi0/0/0 2001:DB8:1::3 - aaaa.bbbb.ccce DELAY Gi0/0/1 FE80::1 0 aaaa.bbbb.cccf REACH Gi0/0/0 Based on this output, which statement is correct?

A.All neighbors are in a stable state.
B.The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.
C.The neighbor 2001:DB8:1::2 is unreachable.
D.The link-local address FE80::1 is not valid.
AnswerB

DELAY state means a NS is pending after a delay timer.

Why this answer

The DELAY state in IPv6 Neighbor Discovery (ND) indicates that a neighbor has not been confirmed reachable within the last 5 seconds, and the router will send a Neighbor Solicitation (NS) message after the DELAY timer expires (default 5 seconds) to verify reachability. The entry for 2001:DB8:1::3 shows a hyphen in the Age column, meaning it was just created or refreshed, and it is in DELAY, so an NS will be sent soon.

Exam trap

Cisco often tests the misconception that STALE means unreachable or that DELAY is a failure state, when in fact STALE is a normal aging state and DELAY is a brief waiting period before probing.

How to eliminate wrong answers

Option A is wrong because not all neighbors are in a stable state; the neighbor 2001:DB8:1::3 is in DELAY (transient state) and 2001:DB8:1::2 is in STALE (needs verification), so the table includes unstable entries. Option C is wrong because the STALE state for 2001:DB8:1::2 does not mean unreachable; it means the entry is still valid but reachability has not been confirmed within the last 30 minutes, and the router will not actively probe it until traffic is sent. Option D is wrong because the link-local address FE80::1 is valid and in REACH state, indicating it is reachable and has been confirmed via Neighbor Advertisement; link-local addresses are always valid on the local link.

Full explanation →
1671
MCQhard

In MPLS L3VPN, what is the default behavior of BGP auto-summary on Cisco IOS-XE?

A.Auto-summary is enabled by default for all BGP sessions.
B.Auto-summary is disabled by default.
C.Auto-summary is enabled only for iBGP sessions.
D.Auto-summary is disabled for eBGP but enabled for iBGP.
AnswerB

Correct. Auto-summary is off by default, preventing classful summarization.

Why this answer

BGP auto-summary is disabled by default on Cisco IOS-XE. When enabled, it would summarize subnets to their classful boundary, but this is not default.

Full explanation →
1672
Multi-Selecthard

Which TWO statements correctly describe the behavior of IP SLA with the 'threshold' and 'timeout' configuration? (Choose TWO.)

Select 2 answers
A.The 'threshold' value must be less than the 'timeout' value for the reaction to trigger correctly.
B.The 'timeout' value must be less than the 'frequency' value to prevent overlapping probes.
C.The default timeout for an IP SLA ICMP echo operation is 10000 milliseconds.
D.The 'threshold' value is used to set the maximum number of retries before the operation is considered failed.
E.If the 'timeout' is set to 3000 ms and the 'frequency' is set to 5 seconds, the probe will never overlap.
AnswersA, B

Correct. The threshold is the value that triggers a reaction event; it must be lower than the timeout to allow the reaction to occur before the operation times out.

Why this answer

The 'threshold' command sets the rising threshold for reaction triggering, while 'timeout' specifies how long the probe waits for a response before marking the operation as a failure. The timeout must be less than the frequency interval; otherwise, the probe may overlap. The default timeout is 5000 ms, not 10000 ms.

Full explanation →
1673
MCQmedium

A network engineer is troubleshooting an EIGRP adjacency issue between two directly connected routers, R1 and R2. Both routers are configured with the same autonomous system number, but the adjacency fails to come up. The engineer checks the interfaces and verifies that they are up/up. On R1, the output of 'show ip eigrp neighbors' shows nothing. What is the most likely cause of this problem?

A.The interfaces are configured with IP addresses from different subnets.
B.The EIGRP process is shut down on one of the routers.
C.The passive-interface default command is configured under the EIGRP process.
D.The EIGRP router ID is the same on both routers.
AnswerA

Correct because EIGRP will not form an adjacency if the interfaces are not in the same subnet, as the hello packets will be dropped.

Why this answer

EIGRP requires that directly connected neighbors share a common subnet for their interfaces. If R1 and R2 have IP addresses from different subnets, EIGRP will not form an adjacency because the hello packets sent by one router will be considered invalid by the other due to the subnet mismatch. The 'show ip eigrp neighbors' output is empty because no neighbor has been discovered, which is consistent with this Layer 3 mismatch.

Exam trap

Cisco often tests the requirement that EIGRP neighbors must be on the same subnet, and the trap here is that candidates may overlook this fundamental Layer 3 prerequisite and instead focus on less likely issues like process shutdown or router ID conflicts.

How to eliminate wrong answers

Option B is wrong because if the EIGRP process is shut down on one router, the other router would still see its own neighbors list as empty, but the question states both routers are configured with the same AS number and interfaces are up/up, making a shutdown less likely than a subnet mismatch. Option C is wrong because the 'passive-interface default' command would suppress hello packets on all interfaces, preventing neighbor discovery, but the question does not indicate any such configuration and it would be a less common cause than a subnet mismatch. Option D is wrong because EIGRP routers can have the same router ID without preventing adjacency formation; the router ID is used for routing table stability and loop prevention, not as a requirement for neighbor adjacency.

Full explanation →
1674
MCQhard

A DMVPN Phase 2 network is configured with EIGRP as the routing protocol over the tunnel interface. Spoke routers have `no ip split-horizon eigrp 100` configured on the tunnel interface. Unexpectedly, spoke-to-spoke tunnels are established, but EIGRP routes learned from one spoke are not installed in the routing table of another spoke, even though NHRP resolution works. Which is the most likely explanation?

A.The hub router has `ip next-hop-self eigrp 100` enabled by default, which sets the next-hop to the hub, preventing direct spoke-to-spoke routes.
B.The spoke routers need `ip split-horizon eigrp 100` enabled to advertise routes to other spokes.
C.EIGRP does not support DMVPN Phase 2; OSPF must be used for spoke-to-spoke routing.
D.The NHRP authentication is mismatched, so EIGRP packets are dropped.
AnswerA

Default EIGRP next-hop self on the hub causes spokes to see the hub as next-hop, not the originating spoke.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels require that EIGRP next-hop self behavior is disabled or that the next-hop is changed. By default, EIGRP advertises routes with the next-hop set to the advertising router's tunnel IP. When a spoke learns a route from another spoke via the hub, the next-hop is the hub's tunnel IP, not the originating spoke.

The spoke must have `no ip next-hop-self eigrp 100` on the hub's tunnel interface to preserve the original next-hop, allowing direct spoke-to-spoke communication.

Full explanation →
1675
Multi-Selectmedium

Which THREE statements about administrative distance are true when comparing OSPF and EIGRP? (Choose THREE.)

Select 3 answers
A.By default, EIGRP internal routes are preferred over OSPF routes.
B.By default, OSPF routes are preferred over EIGRP external routes.
C.The administrative distance for OSPF can be changed using the distance ospf command.
D.EIGRP internal routes have a default administrative distance of 170.
E.OSPF external routes have a default administrative distance of 110.
AnswersA, B, C

EIGRP internal AD is 90, OSPF is 110, so EIGRP is preferred.

Why this answer

OSPF has a default AD of 110, EIGRP internal routes have 90, and EIGRP external routes have 170. Therefore, EIGRP internal routes are preferred over OSPF, but OSPF is preferred over EIGRP external routes. Administrative distance can be manually changed for either protocol.

Full explanation →
1676
Multi-Selecthard

An engineer needs to troubleshoot a NetFlow deployment where flow data is not being exported to the collector. Which TWO commands can be used to verify the operational status of NetFlow on a Cisco IOS-XE device? (Choose TWO.)

Select 2 answers
A.show ip flow export
B.show ip cache flow
C.show ip flow interface
D.debug ip flow export
E.show flow exporter
AnswersA, C

Correct. This command displays export statistics, including the number of flows sent, failed exports, and the export destination.

Why this answer

The 'show ip flow export' command displays the export statistics, including the number of flows exported and any export failures. The 'show ip flow interface' command shows which interfaces have NetFlow enabled and the direction of collection. The other options are incorrect: 'show ip cache flow' shows the active flow cache but not export status; 'debug ip flow export' is a debug command, not a show command; 'show flow exporter' is a Flexible NetFlow command but requires the specific exporter name.

Full explanation →
1677
MCQhard

A dual-stack network uses BGP for IPv6 between AS 100 and AS 200. Router R1 (AS 100) has an inbound route-map that sets local preference to 200 for routes from R2 (AS 200). R1 also has an IPv6 ACL applied inbound that permits only BGP (TCP 179) and denies ICMPv6. R2 advertises a prefix 2001:db8:1::/48. R1's BGP table shows the prefix with local preference 200, but 'show ipv6 route' does not install it. R1 has uRPF strict mode on the interface facing R2. What is the root cause?

A.The ACL blocks ICMPv6, which is required for IPv6 neighbor discovery. Without ND, the next-hop address of the BGP route is unresolved, preventing route installation.
B.uRPF strict mode drops the BGP updates because the source address is not in the FIB.
C.The route-map sets local preference incorrectly, causing the route to be suppressed.
D.R1's BGP process has 'soft-reconfiguration inbound' enabled, causing the route to be hidden.
AnswerA

BGP uses TCP, but the next-hop must be reachable via ND. Blocking ICMPv6 prevents ND, so the route is not installed.

Why this answer

The ACL applied inbound on R1 permits only BGP (TCP port 179) and denies all other traffic, including ICMPv6. IPv6 neighbor discovery (ND) relies on ICMPv6 messages such as Neighbor Solicitation (NS) and Neighbor Advertisement (NA) to resolve the link-layer address of the next-hop router. Without ICMPv6, R1 cannot perform ND for the BGP next-hop address (R2's interface), so the next-hop remains unresolved.

BGP routes with an unresolved next-hop are not installed into the IPv6 routing table, even though they appear in the BGP table with the correct local preference.

Exam trap

Cisco often tests the dependency of IPv6 routing on ICMPv6 for neighbor discovery, leading candidates to overlook that denying ICMPv6 breaks next-hop resolution even when BGP sessions are up.

How to eliminate wrong answers

Option B is wrong because uRPF strict mode checks the source address of incoming packets against the FIB; BGP updates are sourced from R2's IP address, which is a directly connected neighbor, so uRPF would not drop them. Option C is wrong because setting local preference to 200 is a valid and common method to prefer routes from AS 200; it does not suppress routes. Option D is wrong because soft-reconfiguration inbound stores received updates before policy application, but it does not hide routes; it actually allows them to be seen even after policy changes.

Full explanation →
1678
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 interface tunnel 0 Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:2::1, subnet is 2001:DB8:2::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds IPv6 uRPF: loose mode (allow default route) Based on this output, what is the uRPF configuration on this interface?

A.uRPF is disabled
B.uRPF is enabled in strict mode
C.uRPF is enabled in loose mode
D.uRPF is enabled but only for IPv4
AnswerC

The output confirms loose mode uRPF.

Why this answer

The output explicitly shows 'IPv6 uRPF: loose mode (allow default route)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled in loose mode. In loose mode, the router checks that the source address of an incoming packet has a matching entry in the routing table, but it does not require the incoming interface to match the best return path. This is distinct from strict mode, which requires both a routing table entry and that the incoming interface is the same as the outgoing interface for the return route.

Exam trap

Cisco often tests the distinction between uRPF strict and loose modes by showing output that includes 'loose mode' or 'allow default route', and the trap here is that candidates may confuse 'loose mode' with 'disabled' or incorrectly assume that uRPF only applies to IPv4, ignoring the IPv6-specific output.

How to eliminate wrong answers

Option A is wrong because the output clearly states 'IPv6 uRPF: loose mode', which means uRPF is enabled, not disabled. Option B is wrong because the output specifies 'loose mode', not 'strict mode'; strict mode would require the incoming interface to match the best return path, which is not indicated here. Option D is wrong because the command 'show ipv6 interface tunnel 0' displays IPv6-specific information, and the output explicitly shows 'IPv6 uRPF: loose mode', confirming that uRPF is configured for IPv6, not only for IPv4.

Full explanation →
1679
Multi-Selecthard

Which TWO statements about Flexible NetFlow flow records are true? (Choose TWO.)

Select 2 answers
A.A flow record defines which fields are matched (key fields) and which fields are collected (non-key fields).
B.Flexible NetFlow flow records can only match on Layer 3 and Layer 4 fields.
C.A flow record must contain at least one key field and cannot contain non-key fields.
D.Flow records can collect fields such as packet count, byte count, and first/last packet timestamps.
E.Flexible NetFlow flow records are only supported for IPv4 traffic.
AnswersA, D

Flow records specify key fields for flow identification and non-key fields for data collection.

Why this answer

Flexible NetFlow allows user-defined flow records that can match on Layer 2, 3, and 4 fields, such as MAC addresses, IP addresses, and TCP/UDP ports. Additionally, flow records can collect non-key fields like packet and byte counts, timestamps, and interface counters. Option B is false because Flexible NetFlow can also match on Layer 2 fields.

Option C is false because flow records can include both key and non-key fields. Option E is false because Flexible NetFlow records are not limited to IPv4; they can also support IPv6 and MPLS.

Full explanation →
1680
MCQmedium

In DHCPv6, what is the purpose of the SOLICIT message?

A.To request a renewal of an existing lease
B.To confirm a previously allocated prefix
C.To discover available DHCPv6 servers
D.To release an IP address
AnswerC

SOLICIT is the initial discovery message in DHCPv6.

Why this answer

In DHCPv6, the SOLICIT message is sent by a client to locate available DHCPv6 servers on the link. This is the first message in the DHCPv6 four-message exchange (Solicit, Advertise, Request, Reply) used for stateful address assignment, as defined in RFC 3315.

Exam trap

Cisco often tests the distinction between the SOLICIT message (server discovery) and the REQUEST message (actual address assignment), leading candidates to confuse the initial discovery phase with the subsequent request phase.

How to eliminate wrong answers

Option A is wrong because lease renewal in DHCPv6 is performed using the RENEW message, not SOLICIT. Option B is wrong because prefix confirmation is handled by the CONFIRM message, which verifies that a previously allocated prefix is still valid. Option D is wrong because releasing an IP address is done via the RELEASE message, not SOLICIT.

Full explanation →
1681
MCQhard

An engineer configures a BGP route reflector in a network. After configuration, some iBGP routes are being dropped, causing routing loops. Which is the most likely explanation?

A.The route reflector is configured with the same cluster ID as another route reflector in the same AS.
B.The next-hop-self command is not configured on the route reflector.
C.The BGP synchronization rule is enabled.
D.The route reflector is not a client of itself.
AnswerA

If two route reflectors share the same cluster ID, a route reflected by one may be dropped by the other because it sees its own cluster ID in the CLUSTER_LIST, preventing proper propagation and potentially causing loops.

Why this answer

BGP route reflectors use the ORIGINATOR_ID and CLUSTER_LIST attributes to prevent loops. If a route reflector receives a route with its own CLUSTER_LIST or ORIGINATOR_ID, it will drop the route. This can happen if there is a misconfiguration where the route reflector's cluster ID is not unique, or if a route reflector reflects a route back to the client that originated it, causing a loop.

Full explanation →
1682
Multi-Selecthard

Which TWO statements about DHCPv4 option 82 are true? (Choose TWO.)

Select 2 answers
A.Option 82 is inserted by the DHCP client to identify itself to the server.
B.The relay agent must be configured with the 'ip dhcp relay information option' command to insert option 82.
C.The DHCP server can use option 82 to select an IP address from a specific pool based on the circuit ID.
D.Option 82 is only supported in DHCPv6.
E.The 'ip dhcp relay information trusted' command must be configured on the relay agent to insert option 82.
AnswersB, C

Correct. This command enables the relay agent to add option 82 to DHCP packets before forwarding them to the server.

Why this answer

The 'ip dhcp relay information option' command must be explicitly configured on a Cisco IOS DHCP relay agent to enable the insertion of DHCP option 82 (Relay Agent Information). Without this command, the relay agent will forward DHCP packets without adding option 82, even if the server expects it. This command is required to allow the relay agent to insert the circuit ID and remote ID sub-options into DHCPv4 packets.

Exam trap

Cisco often tests the distinction between the command that inserts option 82 ('ip dhcp relay information option') and the command that trusts incoming option 82 ('ip dhcp relay information trusted'), leading candidates to confuse the two.

Full explanation →
1683
Multi-Selectmedium

Which TWO configuration steps are required to enable MPLS on a Cisco IOS-XE router using LDP? (Choose TWO.)

Select 2 answers
A.Configure 'mpls ip' on the desired interfaces.
B.Configure 'mpls label protocol ldp' globally.
C.Configure a routing protocol (e.g., OSPF) to provide IGP reachability between LSRs.
D.Configure 'mpls forwarding-table' to allocate labels.
E.Configure 'mpls ldp router-id' to set the LDP router ID.
AnswersA, C

This command enables MPLS label switching and LDP on the interface.

Why this answer

To enable MPLS with LDP, you must configure 'mpls ip' on the interface and also enable a routing protocol (like OSPF or IS-IS) to provide reachability. The 'mpls label protocol ldp' command is optional as LDP is the default, and 'mpls ldp router-id' is optional. 'mpls forwarding-table' is not a configuration command.

Full explanation →
1684
Multi-Selecthard

Which TWO statements about using prefix-lists in conjunction with route-maps for filtering IPv4 routes are true? (Choose TWO.)

Select 2 answers
A.A prefix-list entry with "ge 24" matches any prefix with a subnet mask greater than or equal to 24 bits.
B.A route-map with a match ip address prefix-list command will process the route only if the prefix-list permits the route.
C.A prefix-list can be used directly in a route-map without a match command.
D.The le operator in a prefix-list matches prefixes with a mask length less than the specified value.
E.A prefix-list can only be used with route-maps, not with distribute-lists.
AnswersA, B

Correct. The ge (greater or equal) operator matches prefixes with a mask length >= the specified value.

Why this answer

Prefix-lists can match on prefix length and subnet mask using ge and le operators. A prefix-list entry can be configured to permit or deny. When used in a route-map, the match ip address prefix-list command references the prefix-list.

If the prefix-list denies, the route-map clause is not matched, and the route falls to the next clause. The prefix-list can also be used directly in a distribute-list without a route-map.

Full explanation →
1685
MCQmedium

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp topology 10.1.1.0/24 detail IP-EIGRP (AS 100): Topology entry for 10.1.1.0/24 State: Passive, Query origin flag: 1, 1 Successor(s), FD is 131072 Routing Descriptor Blocks: 10.1.2.2 (GigabitEthernet0/0), from 10.1.2.2, Send flag: 0x0 Composite metric: (131072/130816), Route is Internal Vector metric: Minimum bandwidth is 10000 Kbit Total delay is 100 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 Originating router: 10.1.2.2 External data: Not advertised Protocol: EIGRP Route tag: 0 Extended community: None What does this output indicate?

A.The route is an external EIGRP route redistributed from another protocol.
B.The route is learned from a single neighbor and is in a stable state.
C.The route has multiple successors and is load-balanced.
D.The route is in Active state, meaning a query is in progress.
AnswerB

The route has one successor and is Passive, indicating stability.

Why this answer

The output shows detailed information about the EIGRP topology entry for 10.1.1.0/24. The route is internal, with a single successor via 10.1.2.2. The FD is 131072, and the RD is 130816.

The route is in Passive state.

Full explanation →
1686
Multi-Selecthard

Which THREE are valid syslog severity levels defined in RFC 5424? (Choose THREE.)

Select 3 answers
A.Emergency (0)
B.Fatal (1)
C.Warning (4)
D.Trace (8)
E.Informational (6)
AnswersA, C, E

Level 0 is the highest severity, indicating system is unusable.

Why this answer

RFC 5424 defines eight severity levels from 0 to 7. Levels 0 (Emergency), 1 (Alert), 2 (Critical), 3 (Error), 4 (Warning), 5 (Notice), 6 (Informational), and 7 (Debug). 'Fatal' is not a standard level; it is sometimes used informally. 'Trace' is not a standard level. 'Severe' is not a standard level.

Full explanation →
1687
MCQmedium

What is the default export interval for NetFlow data when using the 'flow exporter' with UDP as the transport protocol?

A.Every 60 seconds
B.Every 30 seconds
C.Exports are triggered by flow aging or cache fullness, not a fixed interval.
D.Every 10 seconds
AnswerC

Correct. NetFlow exports are event-driven based on flow timeout or cache threshold.

Why this answer

The default export interval is based on flow cache timeout; there is no fixed interval—exports occur when flows age out or cache is full.

Full explanation →
1688
MCQmedium

A network engineer runs the following command on Router R1: R1# show mpls l2transport vc 100 detail Local interface: Gi0/0/0 up, line protocol up Destination: 10.0.0.2, VC ID: 100, VC status: down Last error: No remote LDP session Based on this output, what is the most likely cause of the VC being down?

A.The local interface Gi0/0/0 is administratively down.
B.The remote router 10.0.0.2 is not reachable via IP.
C.The LDP session between the routers is not established.
D.The VC ID 100 is mismatched on the remote router.
AnswerC

The last error confirms 'No remote LDP session'.

Why this answer

The output explicitly states 'No remote LDP session' as the last error. This indicates that the LDP session between the two routers (10.0.0.1 and 10.0.0.2) is not established, which is required for the pseudowire to come up.

Full explanation →
1689
MCQmedium

Which BFD packet type is used for initial session establishment and carries the discriminator values?

A.BFD Echo packets
B.BFD Control packets
C.BFD Poll packets
D.BFD Hello packets
AnswerB

Control packets are the primary BFD packets used for session establishment, maintenance, and teardown, and they carry discriminator fields.

Why this answer

BFD Control packets are used for session establishment, carrying local and remote discriminator values, and are sent periodically to maintain the session.

Full explanation →
1690
MCQhard

An engineer redistributes OSPF routes into EIGRP. The OSPF routes have a metric of 20. After redistribution, the EIGRP topology table shows the routes but they are not installed in the routing table. The 'show ip eigrp topology' shows the route in active state. Which is the most likely explanation?

A.The 'default-metric' command was not configured, so the routes are redistributed with an infinite metric.
B.The EIGRP neighbor is stuck-in-active because a query was sent but no reply was received due to a unidirectional link.
C.The OSPF routes are external type 2, which are not redistributed by default.
D.The 'route-map' used for redistribution has a 'match ip address' that does not match the OSPF routes.
AnswerB

Active state indicates a query is outstanding, often due to a unidirectional link.

Why this answer

When redistributing into EIGRP, a seed metric must be specified. If not, the routes are redistributed with an infinite metric (e.g., 4294967295) and are not installed. However, the question says the route is in active state, which indicates a query is pending.

This is an edge case where the route is redistributed with a valid metric but the EIGRP process is stuck-in-active due to a unidirectional link or a neighbor not replying to queries.

Full explanation →
1691
MCQhard

A network engineer runs the following command on Router R1: R1# show ip sla statistics 7 Round Trip Time (RTT) for Index 7 Latest RTT: 500 ms Latest RTT (milliseconds): 500 Latest RTT (microseconds): 500000 Number of successes: 30 Number of failures: 70 Operation time to live: Forever Output: Over threshold R1# show track 5 Track 5 IP SLA 7 reachability Reachability is Up 1 change, last change 00:20:00 Latest operation return code: Over threshold Latest RTT (milliseconds): 500 Tracked by: ip route 0.0.0.0 0.0.0.0 192.168.5.1 track 5 Based on this output, which statement is correct?

A.The track is down because the IP SLA return code is 'Over threshold'.
B.The IP SLA operation has a high failure rate, but the track remains up due to the configured threshold parameters.
C.The static route is removed because of the threshold violation.
D.The IP SLA operation is not responding because of a network issue.
AnswerB

The track is up, meaning the failure rate is within the acceptable range defined in the track configuration.

Why this answer

The track is up despite the 'Over threshold' return code. This can happen if the track is configured to use a different threshold for reachability (e.g., based on number of consecutive successes or a different percentage). The IP SLA has 30 successes and 70 failures, but the track still considers it up, likely because the threshold for down is higher (e.g., 100% failures).

Full explanation →
1692
MCQhard

Which loop prevention mechanism does RIP use to avoid routing loops?

A.TTL expiration in IP header
B.Maximum hop count of 15
C.DUAL algorithm
D.LSA aging
AnswerB

Correct: RIP limits the hop count to 15; 16 means unreachable, preventing loops by discarding routes beyond the limit.

Why this answer

RIP uses a maximum hop count of 15 to prevent routing loops by ensuring that a route cannot be advertised beyond 15 hops, effectively limiting the propagation of routing information and breaking loops. When a router receives a route with a hop count of 16, it marks the route as unreachable (poison reverse), which stops the loop from continuing. This is a fundamental loop prevention mechanism specific to distance-vector protocols like RIP.

Exam trap

Cisco often tests the distinction between loop prevention mechanisms at different layers (e.g., TTL for packet loops vs. hop count for routing loops), and the trap here is that candidates might confuse TTL expiration in the IP header with RIP's hop count limit, thinking both serve the same purpose.

How to eliminate wrong answers

Option A is wrong because TTL expiration in the IP header prevents packets from looping indefinitely in the network layer, but it does not prevent routing loops in the routing protocol itself; RIP uses hop count as a metric, not TTL. Option C is wrong because the DUAL algorithm is used by EIGRP (Enhanced Interior Gateway Routing Protocol) for loop-free path computation, not by RIP, which relies on simple distance-vector mechanisms like split horizon and maximum hop count. Option D is wrong because LSA aging is a mechanism used by OSPF (Open Shortest Path First) to manage link-state advertisements and ensure they are refreshed or removed, not by RIP, which is a distance-vector protocol.

Full explanation →
1693
MCQmedium

Examine the following DHCP configuration on router R1: ip dhcp excluded-address 192.168.1.1 192.168.1.10 ! ip dhcp pool POOL1 network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 8.8.8.8 lease 0 2 30 ! interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip helper-address 192.168.2.2 no shutdown What is the effect of this configuration?

A.Clients on the 192.168.1.0/24 subnet will receive IP addresses from the local DHCP pool, and the ip helper-address will forward DHCP requests to 192.168.2.2, causing duplicate offers.
B.The ip helper-address command will be ignored because the router is the DHCP server for that subnet.
C.The excluded-address range is misconfigured because it includes the router's own interface IP, which will prevent the router from functioning.
D.The DHCP pool will not assign addresses because the network statement does not match the interface subnet exactly.
AnswerA

The local DHCP server will respond to requests, but the helper address will also forward broadcasts to the remote server, leading to duplicate DHCP offers and potential address conflicts.

Why this answer

The router R1 is configured as a DHCP server for the 192.168.1.0/24 subnet via the local pool POOL1, and the ip helper-address 192.168.2.2 on the same interface will forward broadcast DHCP requests from clients to the remote DHCP server at 192.168.2.2. This results in both the local pool and the remote server offering IP addresses, leading to duplicate offers on the subnet.

Exam trap

Cisco often tests the misconception that a router acting as a DHCP server on an interface will automatically suppress the ip helper-address relay function, but in reality, both processes operate independently, leading to duplicate offers.

How to eliminate wrong answers

Option B is wrong because the ip helper-address command is not ignored when the router is also a DHCP server; it still forwards DHCP broadcasts to the specified server, causing potential duplicate offers. Option C is wrong because the excluded-address range includes the router's own interface IP (192.168.1.1), but this is valid and does not prevent the router from functioning; it simply prevents the DHCP pool from assigning that address. Option D is wrong because the network statement 192.168.1.0 255.255.255.0 exactly matches the interface subnet 192.168.1.0/24, so the pool will assign addresses correctly.

Full explanation →
1694
MCQmedium

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show ip access-lists CoPP-ACL Extended IP access list CoPP-ACL 10 permit tcp host 10.1.1.1 any eq bgp (100 matches) 20 permit udp any any eq 67 (50 matches) 30 permit icmp any any echo (200 matches) 40 deny ip any any (500 matches) What does this output indicate?

A.The ACL is blocking all BGP traffic from 10.1.1.1.
B.The ACL is permitting DHCP and ICMP echo traffic, but dropping all other traffic.
C.The ACL is applied to the control plane interface and is dropping all traffic.
D.The ACL has a misconfiguration because the deny statement should be at the top.
AnswerB

Lines 20 and 30 permit DHCP and ICMP echo, while line 40 denies everything else, which is typical for CoPP to protect the control plane.

Why this answer

The ACL shows that lines 10, 20, and 30 have match counts, indicating that BGP from 10.1.1.1, DHCP (UDP port 67), and ICMP echo are being permitted. Line 40 is a deny all with 500 matches, meaning all other traffic is being dropped. This confirms that the ACL is permitting only the specified traffic (DHCP and ICMP echo) while dropping everything else, making option B correct.

Exam trap

Cisco often tests the ability to interpret ACL match counts to determine actual traffic behavior, leading candidates to mistakenly think a deny all at the end means all traffic is dropped, when in fact the permit lines above it are allowing specific traffic.

How to eliminate wrong answers

Option A is wrong because the ACL line 10 shows 100 matches for permit tcp host 10.1.1.1 any eq bgp, meaning BGP traffic from 10.1.1.1 is being permitted, not blocked. Option C is wrong because the ACL is not dropping all traffic; it permits DHCP, ICMP echo, and BGP from 10.1.1.1, as shown by the match counts on permit lines. Option D is wrong because there is no misconfiguration; the deny statement at the bottom is standard for an ACL that permits specific traffic and denies everything else, and the order of entries is correct for CoPP where you want to permit desired control plane traffic first.

Full explanation →
1695
MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP. A route map is used to set the OSPF metric type to type-1 when redistributing EIGRP routes into OSPF. However, the redistributed routes appear as type-2 in the OSPF database. Which is the most likely explanation?

A.The route map sets the metric type but does not set the metric; OSPF requires both to be set for type-1 to work.
B.The redistribute command uses the subnets keyword, which overrides the route map.
C.The route map is applied to the OSPF process, not the redistribute command.
D.The EIGRP routes have a high administrative distance, causing OSPF to ignore the metric type.
AnswerA

OSPF may ignore the metric type if the metric is not explicitly set in the route map.

Why this answer

When redistributing into OSPF, the default metric type is type-2. If the route map sets the metric type but does not also set the metric, OSPF may ignore the metric type setting because the metric is not specified. In some IOS versions, the route map must set both the metric and metric type for the metric type to take effect.

Full explanation →
1696
MCQhard

An ACL implicit deny is blocking management traffic due to route summarization. Router R1 has: access-list 100 permit ip 10.0.0.0 0.0.3.255 any ! interface GigabitEthernet0/0 ip access-group 100 in ! router eigrp 100 network 10.0.0.0 ! R1 also has: interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip summary-address eigrp 100 10.0.0.0 255.255.252.0 ! A management station at 10.0.1.100 cannot SSH to R1's loopback 0 (10.0.0.1). What is the root cause?

A.The summary route changes the return path for traffic to the management station, and the return interface has an ACL with implicit deny blocking the SSH reply.
B.The ACL does not permit SSH traffic (port 22).
C.The summary route is not installed, so traffic is dropped.
D.EIGRP is not advertising the loopback route.
AnswerA

The summary can cause asymmetric routing, and the return path ACL blocks the traffic.

Why this answer

The ACL permits traffic from 10.0.0.0/22 (10.0.0.0-10.0.3.255) to any, but the summary route is also 10.0.0.0/22. However, the ACL is applied inbound on GigabitEthernet0/0. The management station's traffic comes from 10.0.1.100, which is within the permitted range, so the ACL should allow it.

But the summary route may cause the return traffic to be sent via a different interface, and if that interface has an ACL with implicit deny, the SSH session fails. The root cause is that the summary route changes the path, and the return path has an ACL blocking traffic.

Full explanation →
1697
MCQhard

What is the default behavior of Cisco IOS-XE regarding BFD echo mode when BFD is enabled on an interface?

A.Echo mode is disabled by default
B.Echo mode is enabled by default
C.Echo mode is only available for multihop sessions
D.Echo mode requires explicit configuration with the bfd echo command
AnswerB

Echo mode is enabled by default, allowing faster detection using echo packets.

Why this answer

By default, Cisco IOS-XE enables BFD echo mode, which uses echo packets to achieve faster failure detection without involving the remote router's control plane.

Full explanation →
1698
MCQmedium

In a 6to4 tunnel, how is the tunnel destination address determined?

A.It is manually configured.
B.It is derived from the IPv6 destination address using the 2002::/16 prefix.
C.It is obtained via DNS.
D.It is the same as the tunnel source.
AnswerB

The IPv4 address is extracted from the 6to4 prefix.

Why this answer

In a 6to4 tunnel, the tunnel destination address is automatically derived from the IPv6 destination address by extracting the IPv4 address embedded in the 2002::/16 prefix. Specifically, the first 16 bits of the IPv6 destination are 2002, and the next 32 bits represent the IPv4 address of the remote 6to4 router. This allows the tunnel to be dynamically established without manual configuration of each destination.

Exam trap

Cisco often tests the distinction between automatic 6to4 tunnels and manually configured tunnels, where candidates mistakenly think all tunnels require manual destination configuration, but 6to4 uniquely derives it from the IPv6 address.

How to eliminate wrong answers

Option A is wrong because 6to4 is designed as an automatic tunneling mechanism; manually configuring the tunnel destination would defeat its purpose and is characteristic of manually configured tunnels (e.g., IPv6IP tunnels). Option C is wrong because DNS is not used to resolve the tunnel destination; the IPv4 address is directly embedded in the IPv6 prefix 2002::/16, not obtained via name resolution. Option D is wrong because the tunnel destination is not the same as the tunnel source; the source is the local IPv4 address, while the destination is derived from the remote IPv6 address's embedded IPv4 address.

Full explanation →
1699
Multi-Selecthard

An engineer is troubleshooting an MPLS LDP session that fails to establish between two directly connected routers. Which TWO commands can be used to verify LDP operation? (Choose TWO.)

Select 2 answers
A.show mpls ldp neighbor
B.show mpls ldp discovery
C.show mpls ldp bindings
D.show mpls ldp session
E.show ip route
AnswersA, B

Correct. This command displays LDP neighbors and the session state (e.g., OPERATIONAL).

Why this answer

LDP session establishment can be verified using 'show mpls ldp neighbor' to see the state of the session and 'show mpls ldp discovery' to see if LDP hello packets are being exchanged. Option A is correct: 'show mpls ldp neighbor' shows the LDP session state (e.g., OPERATIONAL). Option B is correct: 'show mpls ldp discovery' shows LDP hello adjacency details.

Option C is false: 'show mpls ldp bindings' shows label bindings, not session state. Option D is false: there is no 'show mpls ldp session' command; the correct command is 'show mpls ldp neighbor'. Option E is false: 'show ip route' does not show LDP information.

Full explanation →
1700
MCQhard

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

A.The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.
B.VTP transparent mode prevents RSPAN from working correctly.
C.The source VLAN 50 is not allowed on the trunk ports.
D.The monitor session 2 is missing the 'no shutdown' command.
AnswerA

When the RSPAN VLAN is the native VLAN, frames are sent untagged, but the receiving switch expects tagged frames for the RSPAN VLAN.

Why this answer

RSPAN traffic is flooded across the RSPAN VLAN. If the RSPAN VLAN is used as the native VLAN on trunk ports, the switch may treat the RSPAN frames as untagged. However, RSPAN expects the frames to be tagged with the RSPAN VLAN ID.

When the native VLAN is the same as the RSPAN VLAN, the frames may be sent untagged on the trunk, but the receiving switch may interpret them as belonging to the native VLAN, causing them to be dropped or misdirected. This can lead to intermittent loss because the native VLAN handling may vary. The correct fix is to ensure the RSPAN VLAN is not the native VLAN on any trunk.

Full explanation →
1701
MCQmedium

What is the default BGP update timer (advertisement interval) for eBGP peers in Cisco IOS-XE?

A.0 seconds
B.15 seconds
C.30 seconds
D.60 seconds
AnswerC

Correct. The default eBGP advertisement interval is 30 seconds.

Why this answer

The default eBGP advertisement interval is 30 seconds, meaning that after sending an update to an eBGP peer, the router waits at least 30 seconds before sending another update.

Full explanation →
1702
MCQhard

A network engineer configures Control Plane Policing (CoPP) on a router with a policy-map that applies a rate-limit of 10000 pps to the class-default class. After applying the policy, the router's CPU utilization spikes and OSPF neighbors go down. What is the most likely explanation?

A.OSPF packets are matched by class-default and rate-limited, causing hello packets to be dropped.
B.The rate-limit is in bps, not pps, so it is too low.
C.The policy-map is applied to the wrong interface; it should be applied to the management interface.
D.The router has an ACL that blocks OSPF packets before CoPP processes them.
AnswerA

Without an explicit class for OSPF, it falls into class-default and is subject to the rate-limit, which can drop hellos.

Why this answer

CoPP applies the policy-map to the control plane, and the class-default class matches all traffic not explicitly classified by other classes. By rate-limiting class-default to 10000 pps, OSPF hello packets (which are not explicitly matched in a higher-priority class) are subjected to the rate limit. If the rate limit is too low, OSPF hellos are dropped, causing neighbor adjacencies to fail and triggering CPU spikes due to route recalculation.

Exam trap

Cisco often tests the misconception that class-default is safe to rate-limit aggressively, but the trap here is that critical routing protocol packets (like OSPF hellos) are implicitly matched by class-default unless explicitly classified into a higher-priority class, causing them to be dropped and breaking adjacencies.

How to eliminate wrong answers

Option B is wrong because CoPP rate-limits in pps (packets per second) by default when using the 'police rate 10000 pps' command; specifying bps would require a different syntax (e.g., 'police 10000000'), and the question explicitly states '10000 pps', so the unit is correct. Option C is wrong because CoPP is applied globally to the control plane via 'service-policy input' under 'control-plane' configuration, not to a specific interface; applying it to the management interface would not affect OSPF control-plane traffic. Option D is wrong because CoPP processes packets after ACL-based filtering on interfaces; if an ACL blocked OSPF before CoPP, OSPF neighbors would never form, not just after applying the policy, and the CPU spike would not be directly caused by ACL drops.

Full explanation →
1703
MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast summary BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 10, main routing table version 10 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.0.0.2 4 65002 123 120 10 0 0 02:15:30 5 10.0.0.3 4 65003 50 45 10 0 0 00:00:12 Idle (PfxRcd: 0) Based on this output, what is the problem with neighbor 10.0.0.3?

A.The neighbor 10.0.0.3 is operational and exchanging prefixes.
B.The BGP session to 10.0.0.3 is flapping.
C.The neighbor 10.0.0.3 has sent 5 prefixes.
D.The BGP table version is mismatched.
AnswerB

The state 'Idle' with a short uptime indicates the session is down and trying to re-establish.

Why this answer

The neighbor 10.0.0.3 shows 'Idle' state with no prefixes received (PfxRcd: 0). The 'Idle' state in BGP indicates that the session is not established, often due to a misconfiguration (e.g., wrong AS number, no route to neighbor, or BGP not activated). The brief uptime (00:00:12) suggests it keeps trying but fails.

Full explanation →
1704
MCQhard

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels do not form, even though NHRP registration is successful. Which is the most likely explanation?

A.The spoke routers do not have a route to each other's tunnel IP via the hub, so the NHRP shortcut request fails.
B.The NHRP authentication key is mismatched between spokes.
C.The mGRE interface is configured with tunnel mode gre multipoint on the spokes.
D.The hub is not configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'.
AnswerA

Phase 2 requires that the spoke's routing table points to the hub for the remote spoke's tunnel IP; otherwise, the shortcut cannot be established.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels rely on NHRP shortcut requests. Even though NHRP registration succeeds, the spoke routers must have a route to each other's tunnel IP via the hub (typically a static route pointing to the hub's tunnel IP) for the NHRP shortcut request to be forwarded correctly. Without this route, the spoke cannot reach the destination spoke's tunnel IP through the hub, so the NHRP Resolution Request fails, and the direct tunnel never forms.

Exam trap

Cisco often tests the distinction between DMVPN Phase 2 and Phase 3, and the trap here is that candidates mistakenly think 'ip nhrp redirect' and 'ip nhrp shortcut' are required for spoke-to-spoke tunnels in Phase 2, when in fact they are Phase 3 features and the real issue is the missing route to the remote spoke's tunnel IP via the hub.

How to eliminate wrong answers

Option B is wrong because an NHRP authentication key mismatch would prevent NHRP registration entirely, not just spoke-to-spoke tunnel formation; registration already succeeded in the scenario. Option C is wrong because configuring tunnel mode gre multipoint on spokes is actually required for DMVPN Phase 2 spoke-to-spoke tunnels; using point-to-point GRE on spokes would prevent multipoint NHRP and is not the cause of the issue. Option D is wrong because 'ip nhrp redirect' on the hub and 'ip nhrp shortcut' on spokes are features of DMVPN Phase 3, not Phase 2; in Phase 2, spoke-to-spoke tunnels form via NHRP shortcut requests without needing redirect, so their absence is not the problem.

Full explanation →
1705
MCQmedium

A network engineer runs the following command to verify DHCPv4 server statistics on router R1: R1# show ip dhcp server statistics Output: Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 150 Manual bindings: 5 Expired bindings: 10 Malformed messages: 0 Message Received BOOTREQUEST 0 DHCPDISCOVER 200 DHCPREQUEST 180 DHCPDECLINE 2 DHCPRELEASE 5 DHCPINFORM 10 What does this output indicate?

A.The DHCP server has 150 active automatic bindings and 5 manual bindings.
B.The DHCP server has received 200 DHCPREQUEST messages.
C.The DHCP server has 10 malformed messages, indicating a configuration issue.
D.The DHCP server has 2 database agents configured.
AnswerA

The output shows 'Automatic bindings: 150' and 'Manual bindings: 5', indicating the number of active leases.

Why this answer

The 'Automatic bindings: 150' and 'Manual bindings: 5' fields directly indicate the number of active leases assigned dynamically (via DHCP) and statically (via manual configuration), respectively. These represent the current active bindings on the DHCP server, with no other interpretation needed.

Exam trap

Cisco often tests the ability to distinguish between message types in the 'Received' table, specifically confusing DHCPDISCOVER with DHCPREQUEST counts, as candidates may misread the output under time pressure.

How to eliminate wrong answers

Option B is wrong because the output shows 200 DHCPDISCOVER messages received, not 200 DHCPREQUEST messages; DHCPREQUEST messages are listed as 180. Option C is wrong because the 'Malformed messages: 0' field indicates no malformed messages were received, so there is no indication of a configuration issue from that value. Option D is wrong because the 'Database agents: 0' field explicitly shows that zero database agents are configured, not two.

Full explanation →
1706
Drag & Drophard

Drag and drop the steps to troubleshoot an IPsec site-to-site VPN adjacency failure into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by verifying basic IP connectivity between peers, then check that the crypto isakmp policy and IKE proposals match. Next, confirm tunnel interface configuration and ACLs, then inspect IKE and IPsec SA states. Finally, enable debugs to isolate the specific failure.

Full explanation →
1707
MCQhard

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# show bgp ipv4 unicast 192.168.10.0/24 And sees the following output: BGP routing table entry for 192.168.10.0/24, version 2 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 0.0.0.0 from 0.0.0.0 (1.1.1.1) Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best rx pathid: 0, tx pathid: 0x0 What does this output indicate?

A.The route 192.168.10.0/24 is learned from an EBGP neighbor.
B.The route is injected into BGP via the network command, as shown by origin incomplete.
C.The route is redistributed into BGP from another protocol, as indicated by origin incomplete and weight 32768.
D.The route is a default route injected into BGP.
AnswerC

Origin incomplete and weight 32768 are typical for redistributed routes.

Why this answer

The show bgp ipv4 unicast output shows a route with next hop 0.0.0.0, origin incomplete, and weight 32768. This indicates the route is locally originated, likely via redistribution or network command. Origin incomplete (incomplete) suggests the route was redistributed from another protocol.

Full explanation →
1708
MCQhard

A network engineer is troubleshooting a VRF-Lite deployment where two routers are connected via a trunk link. Each router has two VRFs (VRF_A and VRF_B). The engineer configures subinterfaces on the trunk link, assigning each subinterface to a different VRF. However, traffic between the two routers for VRF_A is not working. The 'show vrf' command shows the VRFs are active. What is the most likely issue?

A.The subinterface on Router1 is configured with 'encapsulation dot1q 10', but the subinterface on Router2 is configured with 'encapsulation dot1q 20'.
B.The 'ip vrf forwarding VRF_A' command is missing on the main interface.
C.The 'no ip routing' command is configured globally.
D.The 'mtu' command is set differently on the two subinterfaces.
AnswerA

Mismatched VLAN IDs prevent the Layer 2 frames from being correctly tagged and forwarded between the VRFs.

Why this answer

In VRF-Lite with trunk links, subinterfaces must be associated with the correct VRF and VLAN. A common mistake is not matching the VLAN IDs on the subinterfaces of both routers, or missing the 'encapsulation dot1q' command.

Full explanation →
1709
MCQhard

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue: R1# show bgp ipv4 unicast 192.168.1.0/24 BGP routing table entry for 192.168.1.0/24, version 12 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch 1 65001 10.1.1.2 from 10.1.1.2 (10.1.1.2) Origin IGP, metric 0, localpref 100, valid, external Refresh Epoch 2 65002 10.2.2.2 from 10.2.2.2 (10.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best What does this output indicate?

A.Both paths are equally preferred, and BGP load-balances traffic.
B.The path from AS 65002 is best because it has a higher local preference.
C.The path from AS 65002 is best due to a tie-breaking rule, such as lower neighbor router ID.
D.The path from AS 65001 is best because it was received first.
AnswerC

When attributes are equal, BGP uses tie-breakers like lower router ID. The best path is from AS 65002.

Why this answer

The output shows two paths with equal local preference and metric. The best path is from AS 65002, likely due to a tie-breaking rule such as lower router ID or older route. The path from AS 65001 is valid but not best.

Full explanation →
1710
MCQhard

A network engineer is troubleshooting MPLS traffic where packets are being forwarded without a label (IP forwarding) instead of being label-switched. The engineer runs show mpls forwarding-table and sees that the FEC for the destination prefix has a valid label. However, show ip cef shows that the outgoing interface is not MPLS-enabled. What is the most likely cause?

A.The outgoing interface is missing the mpls ip command.
B.The CEF is disabled globally.
C.The mpls label protocol ldp command is missing on the interface.
D.The interface is a loopback interface.
AnswerA

Correct because mpls ip on the interface enables MPLS forwarding; without it, CEF will not impose a label and will forward the packet as IP.

Why this answer

The LFIB has a label, but CEF is not imposing it, indicating that the outgoing interface is not configured for MPLS forwarding. Even if LDP assigns a label, the interface must have mpls ip enabled for label imposition to occur.

Full explanation →
1711
MCQmedium

A network engineer runs the following command to verify BFD with MPLS LDP: R1# show mpls ldp neighbor 10.6.6.2 detail Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0 TCP connection: 10.6.6.2.646 - 10.6.6.1.53456 State: Oper; Msgs sent/rcvd: 100/100; Downstream Up time: 00:10:00 LDP discovery sources: GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s Addresses bound to peer LDP ident: 10.6.6.2 10.7.7.2 BFD enabled, BFD state: UP What does this output indicate?

A.BFD is enabled for LDP, allowing faster LDP session failure detection.
B.BFD is disabled for this LDP session.
C.LDP is using BFD only for IPv6.
D.BFD state is DOWN, so LDP uses its own hello timers.
AnswerA

BFD is enabled and UP, enabling sub-second detection for LDP.

Why this answer

The output shows that BFD is enabled for the LDP session and the BFD state is UP, providing fast failure detection for MPLS LDP neighbor.

Full explanation →
1713
Multi-Selecthard

Which TWO configuration steps are required to filter routes using a prefix-list in a route-map applied to a BGP neighbor? (Choose TWO.)

Select 2 answers
A.Configure a prefix-list with permit or deny statements for the desired prefixes.
B.Create a route-map that uses the 'match ip address prefix-list' command to reference the prefix-list.
C.Define an extended access-list to match the prefixes.
D.Apply the route-map to the BGP neighbor using the 'neighbor x.x.x.x route-map' command.
E.Use the 'network' command under BGP to advertise the filtered routes.
AnswersA, B

The prefix-list defines which prefixes to match.

Why this answer

To filter routes, you must define the prefix-list to match the desired prefixes, then create a route-map that uses the prefix-list in a match statement. The route-map is then applied to the BGP neighbor. Defining an access-list is an alternative but not required if using a prefix-list.

The 'network' command under BGP is for originating routes, not filtering. The 'distribute-list' command is a separate method and does not use a route-map.

Full explanation →
1714
MCQmedium

A network engineer is troubleshooting a BGP route-map that is supposed to set a community value on routes from a specific neighbor. The engineer configures a route-map with 'set community 100:100' and applies it inbound to the neighbor. After the configuration, the engineer checks the BGP table on the local router and sees that the routes do not have the community set. What is the most likely cause?

A.The neighbor is missing the 'send-community' command under the BGP neighbor configuration.
B.The route-map is applied outbound instead of inbound.
C.The community value 100:100 is reserved and cannot be used.
D.The route-map has a 'match community' statement that is filtering the routes before the set command.
AnswerA

Correct because communities are not exchanged without this command.

Why this answer

By default, BGP does not send or receive communities unless the 'neighbor send-community' command is configured. Even if the route-map sets the community, the router will not attach it to the routes unless the neighbor is configured to send communities.

Full explanation →
1715
MCQhard

An engineer configures OSPF on two routers connected via a serial link. Both routers show the neighbor state as EXSTART/EXSTART, and no LSAs are exchanged. The engineer verifies that the OSPF process IDs are the same, areas match, and authentication is correct. Which is the most likely explanation?

A.MTU mismatch between the two routers
B.OSPF network type mismatch (e.g., point-to-point vs broadcast)
C.OSPF hello interval mismatch
D.OSPF dead interval mismatch
AnswerA

Correct. An MTU mismatch causes DBD packets to be dropped, preventing the neighbor from advancing past EXSTART.

Why this answer

In OSPF, when neighbors are stuck in EXSTART, it often indicates an MTU mismatch. OSPF uses the interface MTU to determine the size of Database Description (DBD) packets. If the MTU differs, the receiving router will reject DBD packets larger than its own MTU, causing the neighbor to remain in EXSTART.

This is a common edge case because MTU is not always checked during initial troubleshooting.

Full explanation →
1716
Multi-Selectmedium

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.Configure ip nat inside source static <inside-local> <inside-global> in global configuration mode.
B.Apply the ip nat inside command on the interface facing the internal network.
C.Apply the ip nat outside command on the interface facing the internal network.
D.Configure an access list to match the inside local addresses for translation.
E.Enable the ip nat service command globally to activate NAT.
AnswersA, B

This command creates a permanent mapping between a private inside address and a public global address.

Why this answer

The 'ip nat inside source static' command in global configuration mode defines the static one-to-one mapping between an inside local (private) IP address and an inside global (public) IP address. This is the fundamental configuration step for static NAT, as it creates the permanent translation entry in the NAT table without requiring dynamic address pools or access lists.

Exam trap

Cisco often tests the misconception that static NAT requires an access list (like dynamic NAT) or that a global 'ip nat service' command must be enabled, when in fact static NAT only needs the static mapping and the correct interface designations (inside/outside).

Full explanation →
1717
MCQmedium

A network engineer runs the following command to troubleshoot a DMVPN spoke not registering with the hub: R2# debug nhrp NHRP: Send Registration Request via Tunnel0 10.0.0.2, target 10.0.0.1 NHRP: Receive Registration Reply via Tunnel0 10.0.0.1, src 10.0.0.1, dst 10.0.0.2 NHRP: Registration successful for 10.0.0.2/32 via Tunnel0 What does this output indicate?

A.The spoke is unable to reach the hub; the registration request is being sent but no reply is received.
B.The spoke has successfully registered its tunnel IP 10.0.0.2/32 with the hub at 10.0.0.1.
C.The spoke is sending a registration request to 10.0.0.1 but the hub is not responding, causing a timeout.
D.The spoke is attempting to register with the wrong hub IP address.
AnswerB

Correct: The debug shows the registration request and reply, ending with 'Registration successful'.

Why this answer

The debug output shows a successful NHRP registration: the spoke sends a registration request to the hub and receives a reply, confirming that the spoke's tunnel IP is registered with the hub.

Full explanation →
1718
Multi-Selecthard

An engineer is troubleshooting BGP convergence issues. Which THREE commands can be used to verify BGP path selection and best path criteria? (Choose THREE.)

Select 3 answers
A.show ip bgp <prefix>
B.show ip route bgp
C.show ip bgp neighbors <neighbor> routes
D.show ip bgp
E.show ip bgp community <community>
AnswersA, C, D

Correct. This command displays all paths for a prefix, including the best path indicator and path attributes.

Why this answer

BGP path selection can be verified using 'show ip bgp <prefix>' to see the best path and all paths, 'show ip bgp neighbors <neighbor> routes' to see received routes, and 'show ip bgp' to see the BGP table summary. 'show ip route bgp' shows only the RIB, not the BGP decision process. 'show ip bgp community' filters by community but does not show path selection details.

Full explanation →
1719
MCQeasy

Consider the configuration snippet: logging 192.168.1.10 vrf Mgmt-intf logging source-interface Vlan1 logging trap 6 What is the effect of the 'logging trap 6' command?

A.Only messages of severity 6 are sent to the syslog server.
B.Messages of severity 0 through 6 are sent to the syslog server.
C.Messages of severity 6 through 7 are sent to the syslog server.
D.The number 6 is invalid; only named levels are accepted.
AnswerB

Level 6 (informational) includes severities 0-6.

Why this answer

The 'logging trap' command accepts either a severity level name or number. Level 6 corresponds to 'informational'. This means messages with severity 0-6 are sent to the syslog server.

Full explanation →
1720
MCQhard

A network engineer runs the following command on Router R1: R1# show ip ospf database OSPF Router with ID (10.1.1.1) (Process ID 1) Router Link States (Area 0) Link ID ADV Router Age Seq# Checksum Link count 10.1.1.1 10.1.1.1 120 0x80000002 0x00A1B2 3 10.1.1.2 10.1.1.2 200 0x80000001 0x00B2C3 2 10.1.1.3 10.1.1.3 150 0x80000003 0x00C3D4 4 Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 192.168.12.2 10.1.1.2 180 0x80000001 0x00D4E5 Based on this output, what can be concluded?

A.Router R1 is the DR on the segment 192.168.12.0/24.
B.Router 10.1.1.2 is the DR on the segment 192.168.12.0/24.
C.Router 10.1.1.3 has the highest router ID.
D.There is a network LSA for every broadcast segment in area 0.
AnswerB

The net link state with Link ID 192.168.12.2 is advertised by 10.1.1.2, meaning it is the DR on that segment.

Why this answer

The database shows router link states for three routers and one net link state. The net link state is advertised by 10.1.1.2, indicating it is the DR on the segment 192.168.12.0/24. The absence of other net link states suggests only one broadcast segment exists.

Full explanation →
1721
MCQhard

An engineer configures OSPFv3 with a filter-list on an ABR to filter prefixes. After configuration, the routes are still being advertised. Which is the most likely explanation?

A.The filter-list only filters inter-area prefixes, not external routes.
B.The filter-list is applied to the wrong area.
C.The filter-list uses an incorrect prefix-list.
D.The OSPFv3 process needs to be restarted.
AnswerA

Filter-list in OSPFv3 applies to type 3 LSAs only, not type 5 LSAs.

Why this answer

In OSPFv3, prefix filtering is done using the 'prefix-list' or 'filter-list' command under the area. However, the filter-list in OSPFv3 filters type 3 LSAs (inter-area prefixes) but not type 5 LSAs (external routes). If the routes being advertised are external, the filter-list will not affect them.

Full explanation →
1722
Multi-Selecthard

Which TWO statements about DHCP IPv6 (DHCPv6) operation are true? (Choose TWO.)

Select 2 answers
A.DHCPv6 servers listen on UDP port 547.
B.Stateless DHCPv6 is used to provide DNS server information to clients that obtain their IPv6 address via SLAAC.
C.DHCPv6 can only be used in stateless mode.
D.DHCPv6 uses UDP ports 67 and 68, just like DHCPv4.
E.DHCPv6 relies on ARP to discover DHCPv6 servers.
AnswersA, B

DHCPv6 uses UDP port 547 for server communication.

Why this answer

DHCPv6 servers listen on UDP port 547, while DHCPv6 clients use UDP port 546. This is defined in RFC 3315 and is a key distinction from DHCPv4, where servers listen on port 67 and clients on port 68. The server uses port 547 to receive requests from clients, ensuring proper separation of DHCPv6 traffic.

Exam trap

Cisco often tests the misconception that DHCPv6 uses the same UDP ports as DHCPv4 (67/68) or that it can only run in stateless mode, leading candidates to incorrectly select options D or C.

Full explanation →
1723
MCQhard

A DMVPN network with EIGRP as the routing protocol is experiencing spoke-to-spoke tunnel failures. Spoke routers R1 and R2 are both connected to hub R3. R1 shows: 'show ip nhrp' lists R2's NBMA address, but 'show ip eigrp neighbors' does not show R2. R1's configuration: interface Tunnel0 ip nhrp network-id 1 ip nhrp nhs 10.0.0.3. What is the root cause?

A.R1 has no EIGRP configuration on the tunnel interface, so it does not send hellos over the tunnel.
B.R2's NHRP registration is incomplete, so R1 cannot reach R2's NBMA address.
C.The hub R3 is not configured to forward EIGRP packets between spokes.
D.R1's tunnel interface has an ACL that blocks EIGRP packets.
AnswerA

EIGRP must be enabled on the tunnel interface to establish neighbor relationships over it.

Why this answer

R1's 'show ip nhrp' lists R2's NBMA address, confirming NHRP phase 2/3 spoke-to-spoke resolution is working. However, 'show ip eigrp neighbors' does not show R2, indicating EIGRP adjacency is not established. Since R1's tunnel interface lacks EIGRP configuration (no 'ip eigrp <as-number>' under Tunnel0), it does not send EIGRP hellos over the tunnel, preventing neighbor formation even though NHRP can dynamically map spoke addresses.

Exam trap

Cisco often tests the misconception that NHRP and EIGRP are automatically linked; the trap here is that candidates assume a working NHRP mapping implies EIGRP adjacency, but EIGRP requires explicit interface-level configuration to send hellos over the tunnel.

How to eliminate wrong answers

Option B is wrong because R1's NHRP table already shows R2's NBMA address, which means R2's NHRP registration is complete and R1 can reach R2's NBMA address; the issue is not NHRP registration. Option C is wrong because in a DMVPN network with EIGRP, the hub does not need to forward EIGRP packets between spokes; spokes form direct EIGRP adjacencies over the mGRE tunnel using NHRP resolution, and the hub's role is to facilitate NHRP registration and routing updates, not to relay EIGRP hellos. Option D is wrong because the question provides no evidence of an ACL on R1's tunnel interface, and the core symptom (NHRP working but EIGRP neighbor missing) points to missing EIGRP configuration, not a filtering issue.

Full explanation →
1724
MCQhard

Network management traffic from a monitoring server to routers R1, R2, and R3 is being blocked intermittently. The monitoring server uses SNMP and SSH. R1 configuration: access-list 100 permit udp any any eq snmp, access-list 100 permit tcp any any eq 22, access-list 100 deny ip any any, and 'ip access-group 100 in' on the management interface. R2 shows: 'show snmp' indicates SNMP is enabled. R3 shows: 'show ssh' indicates SSH is enabled. The monitoring server can reach R1 but not R2 or R3. What is the root cause?

A.The ACL permits only SNMP and SSH, but blocks other necessary traffic such as ICMP and routing protocol packets, preventing the monitoring server from reaching R2 and R3.
B.The ACL is applied in the wrong direction; it should be applied outbound to allow traffic from the management interface.
C.SNMP and SSH are not enabled on R2 and R3.
D.The monitoring server is not in the same subnet as the management interface, so routing is required but blocked by the ACL.
AnswerA

The implicit deny at the end of the ACL blocks all traffic not explicitly permitted, including ICMP echo requests and routing updates, which are needed for end-to-end connectivity.

Why this answer

The ACL on R1 permits only SNMP (UDP port 161) and SSH (TCP port 22), but denies all other IP traffic. For the monitoring server to reach R2 and R3, ICMP (for ping/traceroute) and routing protocol packets (e.g., OSPF, EIGRP) are necessary to establish and maintain reachability. Since the ACL blocks these, the server cannot communicate with R2 and R3, even though SNMP and SSH are enabled on those routers.

Exam trap

Cisco often tests the misconception that only application-layer protocols (SNMP, SSH) are needed for management, ignoring that ICMP and routing protocols are essential for basic IP reachability and network stability.

How to eliminate wrong answers

Option B is wrong because applying the ACL outbound would still block the same necessary traffic (ICMP, routing protocols) and would not solve the reachability issue; the direction is not the root cause. Option C is wrong because the question explicitly states that SNMP is enabled on R2 and SSH is enabled on R3, so these services are operational. Option D is wrong because the monitoring server can reach R1, indicating that routing is functional; the ACL on R1's management interface is the only filter blocking traffic to R2 and R3, not subnet or routing issues.

Full explanation →
1725
MCQmedium

A network engineer runs the following command on Router R1: R1# show flow interface GigabitEthernet0/0 Interface GigabitEthernet0/0 FNF: enabled Ingress IPV4/IPV6 flow monitoring: enabled Exporter: EXPORTER1 Monitor: MONITOR1 Egress IPV4/IPV6 flow monitoring: disabled Ingress MPLS flow monitoring: disabled Egress MPLS flow monitoring: disabled Based on this output, what is the state of NetFlow on this interface?

A.NetFlow is fully enabled for both ingress and egress traffic.
B.NetFlow is only monitoring incoming traffic on this interface.
C.NetFlow is not configured on this interface.
D.NetFlow is only monitoring MPLS traffic.
AnswerB

Ingress is enabled, egress is disabled.

Why this answer

The output shows that ingress IPv4/IPv6 flow monitoring is enabled with an exporter and monitor configured, while egress IPv4/IPv6 flow monitoring is disabled. This means NetFlow is only monitoring incoming traffic on the interface, not outgoing traffic. The FNF (Flexible NetFlow) status confirms NetFlow is operational, but only for ingress direction.

Exam trap

The trap here is that candidates see 'FNF: enabled' and assume full bidirectional NetFlow, missing the specific ingress/egress status lines that reveal only one direction is active.

How to eliminate wrong answers

Option A is wrong because egress IPv4/IPv6 flow monitoring is explicitly disabled, so NetFlow is not fully enabled for both directions. Option C is wrong because the output clearly shows FNF is enabled and ingress flow monitoring is active, indicating NetFlow is configured. Option D is wrong because both ingress and egress MPLS flow monitoring are disabled, so NetFlow is not monitoring MPLS traffic at all.

Full explanation →
Page 22

Page 23 of 27

Page 24

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →