Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1726–1800

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 23

Page 24 of 27

Page 25
1726
Multi-Selecthard

An engineer must enable BFD for an OSPF single-hop session between two directly connected routers. Which TWO configuration changes are required on each router? (Choose TWO.)

Select 2 answers
A.Configure the bfd interval command under the interface.
B.Configure the ip ospf bfd command under the interface.
C.Configure the bfd neighbor command under global configuration.
D.Configure the router ospf command and then use the bfd all-interfaces command.
E.Configure the bfd slow-timers command under the interface.
AnswersA, B

Correct. The bfd interval command enables BFD on the interface and sets the timers.

Why this answer

To enable BFD for OSPF, you must first enable BFD on the interface (bfd interval) and then enable BFD support under the OSPF routing process or interface (ip ospf bfd). The bfd neighbor command is for static BFD sessions, not OSPF. The router ospf command alone does not enable BFD.

The bfd all-interfaces command enables BFD on all OSPF interfaces but still requires interface-level BFD configuration.

Full explanation →
1727
Drag & Dropmedium

Drag and drop the steps to perform mutual redistribution between OSPF and EIGRP into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order ensures that route filtering is applied before redistribution to prevent routing loops, and that redistribution is configured on both protocols symmetrically. First, identify the routing domains and interfaces. Second, configure route filtering using distribute-lists or route-maps to control which routes are exchanged.

Third, configure redistribution of EIGRP into OSPF. Fourth, configure redistribution of OSPF into EIGRP. Finally, verify the redistribution using show commands to confirm routes are exchanged correctly.

Full explanation →
1728
Multi-Selectmedium

Which TWO commands would a network engineer use to verify NetFlow data export and flow monitor statistics on a Cisco IOS-XE router? (Choose TWO.)

Select 2 answers
A.show flow monitor name FLOW-MON cache
B.show ip cache flow
C.show ip flow export
D.debug ip flow export
E.show snmp mib ifmib ifindex
AnswersA, B

Displays the flow cache entries for a specific Flexible NetFlow monitor, including key fields and counters.

Why this answer

The 'show flow monitor name <name> cache' command displays detailed flow cache entries for a specific Flexible NetFlow monitor, including packet/byte counts and timestamps. The 'show ip cache flow' command is the traditional way to verify NetFlow statistics and export status. Option C ('show ip flow export') is plausible but shows only export parameters, not cache data.

Option D is a debug command not used for verification. Option E is for SNMP, not NetFlow.

Full explanation →
1729
MCQmedium

Consider the following partial configuration on a Cisco router: ip access-list extended BLOCK_TELNET deny tcp any any eq 23 permit ip any any ! interface Serial0/0/0 ip access-group BLOCK_TELNET out ! line vty 0 4 transport input telnet password cisco login What is the effect of this configuration?

A.Telnet traffic from the router to remote devices via Serial0/0/0 is blocked; Telnet to the router itself is still allowed.
B.All Telnet traffic to and from the router is blocked.
C.The ACL has no effect because it is applied outbound and Telnet is a TCP protocol.
D.The configuration is invalid because the ACL name contains an underscore.
AnswerA

The outbound ACL blocks Telnet leaving the interface, but does not filter traffic destined to the router. VTY lines still accept Telnet.

Why this answer

The ACL BLOCK_TELNET is applied outbound on Serial0/0/0, so it filters traffic leaving that interface. Telnet traffic (TCP port 23) sourced from the router itself (e.g., a user initiating a Telnet session from the router's CLI) is subject to this outbound ACL and is denied. However, Telnet traffic destined to the router (i.e., incoming management sessions to the VTY lines) is not affected because the ACL is not applied inbound on any interface, and the VTY lines have their own authentication and transport input settings.

Exam trap

Cisco often tests the misconception that an outbound ACL on a router's interface will block Telnet sessions to the router itself, when in fact it only affects traffic exiting that interface, not traffic destined to the router's own IP addresses.

How to eliminate wrong answers

Option B is wrong because the ACL is applied outbound only on Serial0/0/0, so it does not block Telnet traffic entering the router (e.g., a remote user Telnetting into the router's VTY lines). Option C is wrong because an outbound ACL can filter Telnet traffic; the protocol (TCP) does not prevent outbound filtering—the ACL's direction determines which traffic is inspected. Option D is wrong because underscores are permitted in ACL names; the configuration is syntactically valid.

Full explanation →
1730
MCQmedium

A network engineer is troubleshooting a sudden drop in NetFlow data on a Cisco router running IOS-XE 17.x. The engineer verifies that 'ip flow-export destination 10.1.1.100 2055' is configured, and the collector is reachable. However, 'show ip flow export' shows zero packets exported. What is the most likely cause?

A.The collector IP address is incorrect.
B.No flow monitor is applied to any interface.
C.The export version is set to 9 but the collector expects version 5.
D.The router is in a VRF that is not configured for NetFlow export.
AnswerB

NetFlow data is only generated when a monitor or flow is enabled on an interface; without it, no flows are exported.

Why this answer

The issue is that NetFlow generation requires at least one monitor or flow record to be applied to an interface. Without a 'ip flow monitor' or 'ip route-cache flow' command on an interface, no flows are created and thus nothing is exported.

Full explanation →
1731
MCQhard

An engineer configures BFD on an OSPF link and also applies a distribute-list outbound under the OSPF process. The BFD session is up, but OSPF routes are not being advertised to the neighbor. The engineer verifies that the distribute-list is correctly configured. What is the most likely cause?

A.The distribute-list is applied outbound, but OSPF distribute-lists only filter routes in the routing table, not LSAs, so the routes are still advertised.
B.The BFD session is flapping due to a mismatch in the 'bfd interval' command, causing OSPF to withdraw routes.
C.The distribute-list references an ACL that denies the network, but OSPF uses type 3 LSAs that are not affected by ACLs.
D.The 'area range' command is configured on the ABR, summarizing the route, and the distribute-list is filtering the summary.
AnswerD

This is correct. When an ABR has an 'area range' command summarizing a network, it creates a type 3 LSA for that summary. If a distribute-list outbound is applied that denies that summary network, the ABR will not advertise the type 3 LSA to neighbors in other areas. This explains why routes are not being advertised despite the BFD session being up.

Why this answer

OSPF distribute-list outbound only filters routes that are being redistributed into OSPF, not intra-area or inter-area LSAs. On an ABR, the 'area range' command generates a summary LSA (type 3), which can be filtered by a distribute-list outbound if it references that specific summary route. In this scenario, the distribute-list is correctly configured to deny the network, and the ABR summarizes that network via 'area range', causing the summary LSA to be filtered and not advertised to the neighbor.

BFD does not affect this behavior.

Exam trap

The trap is that distribute-list outbound under OSPF does not filter intra-area or inter-area LSAs—only redistributed routes. However, on an ABR with 'area range', the summary LSA can be filtered.

Full explanation →
1732
Multi-Selecthard

Which TWO statements correctly describe the behavior of OSPFv3 when troubleshooting neighbor adjacency issues on a Cisco IOS-XE router? (Choose TWO.)

Select 2 answers
A.OSPFv3 neighbor adjacencies are formed using the link-local IPv6 address of the neighbor.
B.The OSPFv3 router ID is a 128-bit value derived from the highest loopback IPv6 address.
C.The 'ipv6 router ospf' command is used to enable OSPFv3 on an interface.
D.The 'show ipv6 ospf neighbor' command displays the link-local address of each neighbor.
E.OSPFv3 uses the network type configured under the OSPFv3 process globally, not per interface.
AnswersA, D

Correct. OSPFv3 uses IPv6 link-local addresses for neighbor discovery and adjacency formation, not global unicast addresses.

Why this answer

OSPFv3 uses link-local addresses for neighbor adjacency formation and relies on IPv6 link-local addresses for next-hop resolution. The router ID is still a 32-bit value, and the network type must be configured under the interface. The 'ipv6 ospf' command is used to enable OSPFv3 on an interface, not 'ipv6 router ospf'.

Full explanation →
1733
MCQhard

A network engineer runs the following command to debug IPv6 uRPF with detailed information: R1# debug ipv6 verify detail IPv6 verify debugging is on (detail) *Mar 1 00:03:45.678: IPv6 verify: source 2001:DB8:5::1 on GigabitEthernet0/0 *Mar 1 00:03:45.678: route to source via GigabitEthernet0/1, not same as input interface What does this output indicate?

A.The packet will be dropped because strict uRPF requires the return path to be through the same interface.
B.The packet will be forwarded because a route exists.
C.The packet will be forwarded because uRPF is loose.
D.The router will change the route to use GigabitEthernet0/0.
AnswerA

Correct. Strict uRPF checks that the best route to the source uses the same interface as the packet arrived on.

Why this answer

The debug output shows that the source address 2001:DB8:5::1 is reachable via GigabitEthernet0/1, but the packet arrived on GigabitEthernet0/0. With strict unicast Reverse Path Forwarding (uRPF), the router verifies that the best return route to the source uses the same interface on which the packet was received. Since the interfaces do not match, the router drops the packet to prevent spoofing.

Exam trap

Cisco often tests the distinction between strict and loose uRPF modes, and the trap here is that candidates assume any valid route means the packet is forwarded, ignoring the critical interface match requirement for strict mode.

How to eliminate wrong answers

Option B is wrong because the existence of a route alone does not satisfy strict uRPF; the return path must exit via the same interface as the ingress interface. Option C is wrong because the debug output does not indicate loose mode; loose uRPF only requires any route to the source, regardless of interface, and would not generate the 'not same as input interface' message. Option D is wrong because uRPF does not modify routing tables; it only performs a forwarding decision based on existing routes.

Full explanation →
1734
MCQhard

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.4.4.0/24 BGP routing table entry for 10.4.4.0/24, version 8 Paths: (1 available, best #1, table default) Not advertised to any peer Refresh Epoch 1 65006 10.1.16.6 from 10.1.16.6 (10.6.6.6) Origin IGP, metric 0, localpref 100, valid, external, best rx pathid: 0, tx pathid: 0x0 Based on this output, what is the most likely reason the route is not advertised to any peer?

A.The route has a local preference of 100, which is too low.
B.There is an outbound route-map or prefix-list filtering the route.
C.The BGP session to the neighbor is down.
D.The route is not in the routing table.
AnswerB

The most common reason for a valid best route not being advertised is outbound filtering applied to the neighbor.

Why this answer

The route is valid and best, but not advertised. This could be due to outbound filtering (route-map, prefix-list) applied to the BGP neighbor, or the neighbor might not be configured to receive this prefix. Another possibility is that the route is suppressed by a policy.

Full explanation →
1735
MCQmedium

A network engineer is troubleshooting an OSPFv2 adjacency issue between two directly connected routers, R1 and R2, both running IOS-XE. The link is a point-to-point Ethernet link. The engineer issues 'show ip ospf neighbor' on R1 and sees no neighbors. 'show ip ospf interface GigabitEthernet0/0' on R1 shows 'Network Type BROADCAST', but the link is actually a point-to-point link. Both routers have 'ip ospf 1 area 0' configured on the interface. What is the most likely cause of the adjacency not forming?

A.The OSPF network type mismatch between the two routers (one is BROADCAST, the other is POINT-TO-POINT).
B.The routers have duplicate OSPF router IDs.
C.The interface is configured with 'ip ospf passive-interface'.
D.The OSPF process is not enabled globally; 'router ospf 1' is missing.
AnswerB

Duplicate router IDs prevent OSPF adjacency from forming; each router must have a unique router ID.

Why this answer

The default OSPF network type on Ethernet interfaces is BROADCAST, which requires a DR/BDR election and uses multicast 224.0.0.5 and 224.0.0.6. On a point-to-point link, if both routers do not agree on the network type, they may not form an adjacency because the hello packets are sent differently. However, since both are BROADCAST, they should form an adjacency.

The real issue is likely a mismatch in OSPF network type if one side is manually set to POINT-TO-POINT, but here both are BROADCAST. A more common cause is that the interface is administratively down or there is a Layer 1 issue, but the stem indicates the interface is up. Another common cause is that the router IDs are not configured, leading to OSPF not starting.

The most likely cause in this scenario is that the routers have duplicate router IDs, which prevents adjacency formation. The stem does not mention router IDs, so the best answer is that the engineer should check for duplicate router IDs.

Full explanation →
1736
MCQmedium

A network engineer runs the following command to verify IPv6 traffic filtering with logging: R1# show logging | include FILTER *Mar 1 00:04:56.789: %IPV6_ACL-6-ACCESSLOGDP: list FILTER denied tcp 2001:DB8:2::1(12345) -> 2001:DB8:3::1(80), 1 packet What does this output indicate?

A.A TCP packet from 2001:DB8:2::1 to destination 2001:DB8:3::1 port 80 was denied by the access list.
B.A TCP packet was permitted by the access list.
C.The access list is not applied to any interface.
D.The packet was dropped due to uRPF.
AnswerA

Correct. The log clearly indicates the denied packet details.

Why this answer

The log message shows an IPv6 ACL (named FILTER) logging a denied TCP packet from source 2001:DB8:2::1 port 12345 to destination 2001:DB8:3::1 port 80. The keyword 'denied' in the log entry confirms the packet was blocked by the access list, making option A correct.

Exam trap

Cisco often tests the ability to distinguish between ACL deny/permit actions in log messages, where the trap is that candidates misread 'denied' as 'permitted' or confuse ACL logging with other features like uRPF or interface statistics.

How to eliminate wrong answers

Option B is wrong because the log explicitly states 'denied', not 'permitted', so the packet was not allowed through. Option C is wrong because the log entry shows the ACL is actively logging and filtering traffic, which only occurs when the ACL is applied to an interface; an unapplied ACL would generate no such log. Option D is wrong because uRPF (unicast Reverse Path Forwarding) drops packets based on source address reachability checks, not ACL filtering, and the log message specifically references the IPv6 ACL (IPV6_ACL-6-ACCESSLOGDP), not uRPF.

Full explanation →
1737
MCQhard

An engineer configures IPv6 uRPF strict mode on an interface that is used for both IPv6 traffic and OSPFv3 routing. The router is an ABR with multiple areas. OSPFv3 adjacencies form correctly, but some IPv6 data traffic is dropped. The show ipv6 interface command shows uRPF is enabled. Which is the most likely explanation?

A.The router has a default route pointing to a different interface, and uRPF strict mode without 'allow-default' drops packets whose source address is reachable via the default route.
B.OSPFv3 adjacencies use link-local addresses, which are not checked by uRPF, but data traffic uses global addresses that are incorrectly filtered by the OSPFv3 process.
C.The router has 'ipv6 uRPF allow-default' configured, but the default route is not installed, causing all traffic to be dropped.
D.The interface has an IPv6 ACL that denies traffic from certain prefixes, overriding uRPF.
AnswerA

Correct. uRPF strict mode checks the specific route, not the default. If the source address is only matched by a default route via another interface, the packet is dropped.

Why this answer

URPF strict mode on an interface checks that the source address of incoming packets is reachable via the same interface. If the router has a default route pointing to a different interface, packets sourced from addresses that are only reachable via that default route will fail the RPF check and be dropped. The 'allow-default' keyword is required to exempt packets whose source is reachable via a default route from this check.

Exam trap

Cisco often tests the nuance that uRPF strict mode drops traffic when a default route points out a different interface, and candidates forget that the 'allow-default' keyword is necessary to permit such traffic.

How to eliminate wrong answers

Option B is wrong because OSPFv3 adjacencies use link-local addresses, which are not subject to uRPF checks, but data traffic using global addresses is filtered by uRPF, not by the OSPFv3 process. Option C is wrong because if 'ipv6 uRPF allow-default' is configured but the default route is not installed, uRPF would still operate normally for non-default routes; the 'allow-default' keyword only affects behavior when a default route exists. Option D is wrong because an IPv6 ACL overriding uRPF is not a standard behavior; uRPF and ACLs operate independently, and the question states uRPF is enabled and dropping traffic, not an ACL.

Full explanation →
1738
MCQhard

A network engineer runs the following command on Router R1: R1# show route-map REDISTRIBUTE route-map REDISTRIBUTE, permit, sequence 10 Match clauses: ip address prefix-list EIGRP_ROUTES Set clauses: metric 100 metric-type type-1 tag 200 Policy routing matches: 0 packets, 0 bytes route-map REDISTRIBUTE, deny, sequence 20 Match clauses: ip address prefix-list DENY_ALL Set clauses: Policy routing matches: 0 packets, 0 bytes Based on this output, what is the problem?

A.The route-map will redistribute all routes that match prefix-list EIGRP_ROUTES with metric 100 and type-1.
B.The route-map has a deny sequence that may block all routes if prefix-list DENY_ALL is configured to permit all.
C.The route-map will only redistribute routes with tag 200.
D.The route-map is not applied to any redistribution command, so it has no effect.
AnswerB

If DENY_ALL is a catch-all prefix-list (e.g., permit 0.0.0.0/0 le 32), then sequence 20 will deny all routes, overriding sequence 10.

Why this answer

The route-map has a deny sequence 20 that matches prefix-list DENY_ALL. If DENY_ALL is configured to permit all (e.g., permit 0.0.0.0/0 le 32), then all routes will be denied after sequence 10, effectively blocking redistribution. The problem is that the deny sequence may unintentionally block routes that should be redistributed.

Full explanation →
1739
MCQmedium

Which statement correctly describes the behavior of the 'set metric' command in a route-map when applied to redistributed routes into OSPF?

A.It sets the OSPF metric to a value between 1 and 65535, with a default of 10.
B.It sets the OSPF metric to a value between 1 and 65535, with a default of 20.
C.It sets the OSPF metric to a value between 1 and 16777215, with a default of 20.
D.It sets the OSPF metric to a value between 1 and 255, with a default of 1.
AnswerB

Correct. The default metric for redistributed OSPF routes is 20.

Why this answer

When redistributing into OSPF, the 'set metric' command sets the metric type and value. The default metric type is E2 (external type 2), and the default metric value is 20.

Full explanation →
1740
MCQeasy

A network engineer runs the following command on Router R1: R1# show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete N: NATed, L: Local, X: No Socket # Ent -> Number of NHRP entries with same NBMA peer NHS Status: E => Expecting Replies, R => Responding, W => Waiting UpDn Time -> Up or Down Time for a Tunnel ========================================================================== Interface: Tunnel0, IPv4 NHRP Details Type:Hub, NHRP Peers:2, # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 192.168.1.2 10.0.0.2 UP 00:15:30 D 1 192.168.1.3 10.0.0.3 UP 00:10:20 D Based on this output, what is the role of Router R1?

A.Router R1 is a DMVPN spoke.
B.Router R1 is a DMVPN hub.
C.Router R1 is a DMVPN server.
D.Router R1 is a DMVPN client.
AnswerB

The output explicitly states 'Type:Hub'.

Why this answer

The output shows 'Type:Hub', indicating that Router R1 is configured as a DMVPN hub. It has two dynamic peers (spokes) connected.

Full explanation →
1741
MCQhard

An engineer configures an IPsec site-to-site VPN between two routers. The tunnel comes up, but traffic is not encrypted. Which is the most likely explanation?

A.The crypto ACL does not match the traffic that is being sent.
B.The transform set uses ESP with null encryption.
C.The ISAKMP policy has the wrong authentication method.
D.The pre-shared key is incorrect.
AnswerA

Correct. Interesting traffic must match the ACL for encryption.

Why this answer

The most likely reason traffic is not encrypted despite the tunnel being up is that the crypto ACL (access-list) applied to the IPsec configuration does not match the actual traffic being sent. The crypto ACL defines which traffic should be protected by IPsec; if the ACL does not permit the specific source/destination or protocol/port of the traffic, the router will not attempt to encrypt it, even though the IKE and IPsec security associations (SAs) are established.

Exam trap

Cisco often tests the misconception that a tunnel being up guarantees traffic encryption, but the crypto ACL is the gatekeeper for which traffic gets encrypted, and candidates may overlook this distinction.

How to eliminate wrong answers

Option B is wrong because ESP with null encryption would still encrypt the packet (ESP provides encryption by default; null encryption is rarely used and would be a deliberate configuration, not a common cause of no encryption). Option C is wrong because the ISAKMP policy authentication method (e.g., pre-shared key, RSA signatures) affects Phase 1 authentication, not the encryption of data traffic; if the tunnel is up, Phase 1 has succeeded. Option D is wrong because an incorrect pre-shared key would prevent the tunnel from coming up at all (IKE Phase 1 would fail), so the tunnel being up rules out this cause.

Full explanation →
1742
Multi-Selectmedium

Which TWO configuration steps are required to set up an ERSPAN session on a Cisco IOS-XE device? (Choose TWO.)

Select 2 answers
A.monitor session 1 type erspan-source
B.destination erspan-id 1 ip address 192.168.1.100
C.shutdown
D.no monitor session 1
E.ip route 192.168.1.0 255.255.255.0 GigabitEthernet0/1
AnswersA, B

Creates an ERSPAN source session on the device.

Why this answer

ERSPAN encapsulates monitored traffic in GRE and sends it to an IP destination. The 'monitor session 1 type erspan-source' command defines the session as an ERSPAN source. The 'destination' command under that session specifies the IP address of the destination. 'source' is also needed but is not listed as an option here; 'shutdown' disables the session, 'no monitor session' removes it, and 'ip route' is for routing, not ERSPAN configuration.

Full explanation →
1743
MCQhard

BGP attribute manipulation causes unexpected path selection. Router R1 and R2 are eBGP peers. R1 receives prefix 172.16.0.0/16 from R2 with MED 50 and from another peer R3 with MED 100. R1 has configuration: 'route-map SET-MED permit 10 set metric 200' applied to neighbor R2 inbound. R1 shows 'show ip bgp 172.16.0.0' output: 'BGP routing table entry for 172.16.0.0/16, version 2, Paths: (2 available, best #2) Path #1: from R2 with MED 200, Path #2: from R3 with MED 100'. The best path is via R3, but the network expects R2 to be preferred. What is the root cause?

A.The 'bgp always-compare-med' command is missing, causing MED to be ignored for paths from different ASes.
B.The route-map SET-MED should be applied outbound on R2, not inbound.
C.R2's next-hop is unreachable via IGP, causing R1 to ignore R2's path.
D.R1 has 'bgp bestpath med missing-as-worst' configured, causing missing MED to be treated as worst.
AnswerA

Without this command, MED is only compared within same AS, so R2's lower MED (200 vs 100) is not considered, and R3's path is chosen.

Why this answer

BGP best path selection uses MED only if paths are from the same AS (if 'bgp always-compare-med' is not configured). Since R2 and R3 are different ASes, MED is not compared; instead, the next tie-breaker (e.g., IGP metric to next-hop) selects R3. The route-map sets MED on R2's routes, but it does not affect the comparison because of AS path difference.

Full explanation →
1744
MCQhard

An engineer configures IPsec between two routers using transform-set esp-aes 256 esp-sha-hmac. The tunnel fails to establish. Debug shows 'transform set proposal mismatch'. Which is the most likely explanation?

A.The other router uses 'esp-aes' without specifying the key length, defaulting to 128-bit, causing a mismatch.
B.The transform-set uses SHA-1, which is not supported by the other router.
C.The IPsec proposal includes both esp-aes and esp-3des, causing confusion.
D.The transform-set is missing the authentication header.
AnswerA

If one side specifies 256-bit and the other defaults to 128-bit, the transform sets do not match.

Why this answer

The debug output 'transform set proposal mismatch' indicates that the IPsec transform sets on the two peers do not match. When 'esp-aes 256' is configured on one router, the other router must explicitly specify 'esp-aes 256' as well; if it only uses 'esp-aes' without specifying a key length, Cisco IOS defaults to AES-128. This mismatch in encryption algorithm strength (256-bit vs. 128-bit) causes the IKE phase 2 negotiation to fail.

Exam trap

Cisco often tests the default behavior of 'esp-aes' (which defaults to 128-bit) versus explicit 'esp-aes 256', trapping candidates who assume that 'esp-aes' implies 256-bit or that the key length is negotiated automatically.

How to eliminate wrong answers

Option B is wrong because SHA-1 (esp-sha-hmac) is widely supported on Cisco routers and is not the cause of a transform set mismatch; the issue is the encryption algorithm, not the hash. Option C is wrong because the transform-set in the question contains only 'esp-aes 256' and 'esp-sha-hmac', not both esp-aes and esp-3des; a transform set can only contain one encryption algorithm, so this option describes an invalid configuration that would not be accepted by the CLI. Option D is wrong because the transform-set already includes an authentication header via 'esp-sha-hmac', which provides integrity; the absence of AH is irrelevant since ESP provides both encryption and authentication in this setup.

Full explanation →
1745
MCQhard

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

A.The ACL denies ICMPv6 types 133-137, which are required for Neighbor Discovery, causing the router to fail to resolve neighbors.
B.The ACL must be applied outbound, not inbound, to allow ND packets to be sent.
C.The router needs to have 'ipv6 nd suppress' configured to bypass ACL filtering for ND packets.
D.The ACL should use 'permit ipv6 any any' before the deny statements to allow ND, but the engineer placed it after.
AnswerA

Correct. ND uses ICMPv6 types 133-137; denying them breaks IPv6 connectivity.

Why this answer

The ACL denies ICMPv6 types 133-137, which are essential for Neighbor Discovery (ND) processes such as Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136), and Redirect (137). Without permitting these types, the router cannot resolve IPv6 neighbors or maintain IPv6 connectivity, as ND is fundamental to IPv6 operation.

Exam trap

Cisco often tests the candidate's awareness that IPv6 Neighbor Discovery uses specific ICMPv6 types (133-137) which must be explicitly permitted in ACLs, as they are not automatically allowed like in IPv4 ARP.

How to eliminate wrong answers

Option B is wrong because applying the ACL outbound would not fix the issue; ND packets must be received inbound to process neighbor discovery, and the ACL is applied inbound to filter incoming traffic. Option C is wrong because 'ipv6 nd suppress' is used to suppress ND on an interface, not to bypass ACL filtering; it would actually worsen the problem by disabling ND. Option D is wrong because using 'permit ipv6 any any' before deny statements would permit all IPv6 traffic, including unwanted types, defeating the ACL's purpose; the correct approach is to permit specific ICMPv6 types (including ND types) before denying others.

Full explanation →
1746
MCQmedium

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show ip ospf interface detail FastEthernet0/0 is up, line protocol is up Internet Address 10.1.1.1/24, Area 0.0.0.0, Attached via Network Statement Process ID 1, Router ID 10.1.1.1, Network Type BROADCAST, Cost: 1 Topology-MTID Cost Disabled Shutdown Topology Name 0 1 no no Base Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 10.1.1.1, Interface address 10.1.1.1 Backup Designated router (ID) 10.1.1.2, Interface address 10.1.1.2 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:03 Supports Link-local Signaling (LLS) Index 1/1, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 25 Last flood scan time is 0 msec, maximum is 4 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 10.1.1.2 (Backup Designated Router) Suppress hello for 0 neighbor(s) What does this output indicate?

A.OSPF is not forming adjacencies due to CoPP dropping Hello packets.
B.OSPF is operating normally with one neighbor, suggesting CoPP is not impacting OSPF.
C.OSPF is experiencing DR/BDR election issues due to CoPP.
D.OSPF is not receiving Hello packets due to CoPP.
AnswerB

The interface is up, timers are normal, and an adjacency exists.

Why this answer

The output shows that OSPF has formed a full adjacency with neighbor 10.1.1.2, which is the Backup Designated Router. The neighbor count is 1 and the adjacent neighbor count is 1, indicating that OSPF is operating normally on this interface. Therefore, CoPP is not impacting OSPF Hello or adjacency formation.

Exam trap

Cisco often tests the misconception that any CoPP configuration automatically disrupts OSPF, but the trap here is that the 'show ip ospf interface detail' output explicitly shows a working adjacency, proving CoPP is not the issue.

How to eliminate wrong answers

Option A is wrong because the output clearly shows an OSPF adjacency has been formed (neighbor count 1, adjacent neighbor count 1), so CoPP is not dropping Hello packets. Option C is wrong because the DR/BDR election is complete: R1 is the DR (State DR) and 10.1.1.2 is the BDR, with no election issues indicated. Option D is wrong because the adjacency exists, meaning Hello packets are being received and processed; CoPP is not blocking them.

Full explanation →
1747
MCQhard

An engineer configures a Cisco router for SSH access. The router has an IP address on interface GigabitEthernet0/0, and the engineer generates RSA keys using the command 'crypto key generate rsa modulus 2048'. However, SSH connections fail with 'Connection refused'. What is the most likely cause?

A.The hostname and domain name are not configured.
B.The VTY lines are not configured with 'transport input ssh'.
C.The RSA key modulus is too small.
D.The IP address on GigabitEthernet0/0 is not in the same subnet as the client.
AnswerA

Correct because SSH uses the hostname and domain name to generate the RSA key pair; without them, the SSH server may not function.

Why this answer

SSH requires a fully qualified domain name (FQDN) to generate RSA keys. Without a configured hostname and domain name, the 'crypto key generate rsa' command may appear to succeed but actually generates default keys that are not bound to the router's identity, causing SSH to refuse connections. The 'ip domain-name' and 'hostname' commands are prerequisites for proper RSA key generation and SSH operation.

Exam trap

Cisco often tests the prerequisite order for SSH configuration, trapping candidates who focus on VTY transport settings or key modulus size instead of the fundamental requirement of a domain name for RSA key generation.

How to eliminate wrong answers

Option B is wrong because while 'transport input ssh' is required on VTY lines for SSH access, the immediate failure with 'Connection refused' typically occurs before VTY negotiation, and the question states SSH connections fail entirely, not that they are rejected after transport negotiation. Option C is wrong because a 2048-bit modulus is considered secure and is the recommended minimum for SSH; the issue is not key size but missing domain configuration. Option D is wrong because subnet mismatch would cause a timeout or unreachable error, not 'Connection refused', which indicates the router is actively rejecting the TCP connection to port 22.

Full explanation →
1748
MCQhard

A network engineer configures Flexible NetFlow on a router that also runs CoPP (Control Plane Policing). After applying the flow monitor to the ingress interface, the router's CPU spikes and management traffic (SSH, SNMP) becomes intermittent. Router R1 shows: show policy-map control-plane | include (class|police) class CoPP-MGMT police rate 10000 pps. show flow monitor FLOW-MONITOR statistics | include (Packets|Dropped) Packets dropped: 5000. What is the root cause?

A.The flow monitor's cache size is too small, causing packet drops and CPU spikes due to cache overflow.
B.CoPP is rate-limiting NetFlow export packets because they are classified as management traffic, causing export failures and cache buildup.
C.The flow exporter is configured with a wrong destination IP, causing all export packets to be dropped by the router.
D.The flow monitor is applied in the output direction, causing a loop.
AnswerB

NetFlow export packets are sent from the control plane and are subject to CoPP. If the CoPP policy rate-limits management traffic, export packets will be dropped, leading to cache overflow and CPU spikes.

Why this answer

Flexible NetFlow can generate a large number of packets for export, especially if the flow monitor is configured to export all flows. These export packets are sent from the router's control plane, and if CoPP is policing management traffic, the export packets might be classified as management traffic and dropped. However, the show output indicates that the flow monitor itself is dropping packets, which suggests that the flow monitor's cache is full or that the export process is overwhelmed.

The correct answer is that the flow monitor's cache is too small, causing packets to be dropped before they can be exported, and the CPU spike is due to the export process consuming resources. But the CoPP is also rate-limiting the export packets, causing further drops. The root cause is that CoPP is rate-limiting the NetFlow export traffic, which is classified as management traffic, causing the export to fail and the cache to fill up.

Full explanation →
1749
MCQmedium

What is the default administrative distance for a static route pointing to an interface (e.g., 'ip route 10.0.0.0 255.0.0.0 GigabitEthernet0/1')?

A.0
B.1
C.5
D.110
AnswerA

When a static route uses only an exit interface, it is considered directly connected and gets AD 0.

Why this answer

A static route configured with an exit interface (not a next-hop IP) has a default AD of 0, because it is treated as a directly connected route. However, if a next-hop IP is specified, the default AD is 1.

Full explanation →
1750
MCQmedium

Examine this configuration on Router R4: ``` interface Tunnel0 ip address 10.0.0.1 255.255.255.252 ipv6 address 2001:DB8:6::1/64 tunnel source GigabitEthernet0/0 tunnel destination 172.16.1.2 tunnel mode gre ip ``` What will be the effect?

A.The tunnel will only carry IPv4 traffic because the mode is 'gre ip'.
B.The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.
C.The tunnel will fail because the tunnel source is an interface, not an IP address.
D.The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.
AnswerB

GRE allows multiprotocol payload; the IPv4 and IPv6 addresses on the tunnel interface are valid.

Why this answer

The 'tunnel mode gre ip' command creates a generic routing encapsulation (GRE) tunnel over IPv4. GRE is protocol-agnostic and can encapsulate any Layer 3 protocol, including IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and sent to the tunnel destination.

Therefore, the tunnel will successfully carry both IPv4 and IPv6 payloads.

Exam trap

Cisco often tests the misconception that 'tunnel mode gre ip' only supports IPv4 traffic, when in fact GRE is protocol-agnostic and can carry IPv6, IPX, or other Layer 3 protocols as payload.

How to eliminate wrong answers

Option A is wrong because 'gre ip' mode does not restrict the tunnel to only IPv4 payloads; GRE can encapsulate multiple protocols, including IPv6. Option C is wrong because the tunnel source can be specified as an interface (e.g., GigabitEthernet0/0), and the router will use that interface's primary IP address as the source; this is a valid configuration. Option D is wrong because 'ipv6ip' mode is a specific tunnel type for IPv6-in-IPv4 encapsulation without GRE overhead, but GRE is fully capable of carrying IPv6 traffic and is often preferred for its flexibility and support for additional features like multipoint or encryption.

Full explanation →
1751
MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After a few minutes, the router's CPU spikes and routing loops occur. Which is the most likely explanation?

A.The seed metric for EIGRP was not configured, causing the route to be redistributed with an infinite metric.
B.The administrative distance of the redistributed routes is lower than the original, causing them to be preferred.
C.Routes redistributed from OSPF into EIGRP are then redistributed back into OSPF, creating a feedback loop.
D.The OSPF process ID must match on all routers; otherwise, redistribution fails.
AnswerC

Without filtering or tagging, redistributed routes can be re-injected into the original protocol, causing instability.

Why this answer

Mutual redistribution without route tagging or filtering can cause a routing loop. A route redistributed from OSPF into EIGRP can be redistributed back into OSPF, creating a feedback loop. This is a classic redistribution loop.

Full explanation →
1752
Multi-Selecthard

Which TWO statements correctly describe the behavior of EIGRP stub routing and its impact on troubleshooting? (Choose TWO.)

Select 2 answers
A.A stub router configured with the 'leak-map' option can advertise specific routes learned from other EIGRP neighbors beyond the stub restrictions.
B.When a router is configured as an EIGRP stub with the 'connected' keyword, it automatically advertises all connected interfaces, including passive interfaces, to its neighbors.
C.If a stub router receives a query from its neighbor, it will reply with an 'infinite metric' (unreachable) for all routes that are not in its routing table, including those learned via redistribution.
D.The command 'show ip eigrp topology all-links' on a stub router displays only the routes that are in the routing table, as stub routers do not store feasible successors.
E.An EIGRP stub router configured with the 'static' keyword will automatically redistribute all static routes into EIGRP, even if the 'redistribute static' command is not present.
AnswersA, C

The leak-map feature allows a stub router to selectively advertise routes that would otherwise be blocked by the stub restriction, enabling controlled transit of certain routes.

Why this answer

EIGRP stub routing restricts the types of queries sent to a stub router and prevents it from acting as a transit router. Leak-map allows selective leaking of routes. The stub router does not send queries to its neighbors, but it can still receive queries from them. 'show ip eigrp topology' shows all routes, not just stub-learned ones.

The 'connected' keyword only advertises connected routes, not summary or static unless specified.

Full explanation →
1753
MCQeasy

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp interfaces detail Interface GigabitEthernet0/0 EIGRP interface state: Enabled, Up Hello interval: 5 sec, Hold time: 15 sec Split horizon: Enabled Next multicast: 0.0.0.0, Next update: 0.0.0.0 Bandwidth: 10000 Kbit, Delay: 100 us Reliability: 255/255, Load: 1/255, MTU: 1500 Packets sent: 100, received: 95 Authentication: MD5, key chain: EIGRP-KEY Passive interface: No What does this output indicate?

A.EIGRP is using MD5 authentication with key chain EIGRP-KEY, and the interface is actively sending and receiving EIGRP packets.
B.EIGRP is configured as a passive interface, so no hellos are sent.
C.Split horizon is disabled, allowing route advertisement back to the source.
D.The interface is using plain-text authentication.
AnswerA

The output confirms authentication and active interface state.

Why this answer

The output shows the interface is enabled and up, with MD5 authentication configured using key chain EIGRP-KEY. The 'Packets sent: 100, received: 95' indicates active packet exchange, and 'Passive interface: No' confirms hellos are being sent. This means EIGRP is actively sending and receiving packets with MD5 authentication.

Exam trap

Cisco often tests the distinction between 'Passive interface: No' (meaning hellos are sent) and the passive-interface command (which suppresses hellos), leading candidates to incorrectly assume a passive interface when it is not explicitly stated.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Passive interface: No', meaning the interface is not passive and hellos are being sent. Option C is wrong because the output shows 'Split horizon: Enabled', not disabled, so route advertisement back to the source is prevented. Option D is wrong because the output shows 'Authentication: MD5', not plain-text authentication.

Full explanation →
1754
MCQhard

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal hosts can access the internet, but traffic to a specific external server at 203.0.113.100 is being translated to a different source IP than expected. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global --- 10.1.1.1 192.168.1.1 203.0.113.100 203.0.113.100. The server logs show connections from 10.1.1.1 instead of 203.0.113.1. What is the root cause?

A.The interface GigabitEthernet0/1 has a private IP address; configure a public IP or use a NAT pool.
B.The access-list 100 is incorrectly matching traffic.
C.The server is responding to the wrong IP due to asymmetric routing.
D.The NAT configuration is missing the 'overload' keyword.
AnswerA

If the interface IP is private, NAT will use that private IP, causing the issue.

Why this answer

The NAT configuration uses `ip nat inside source list 100 interface GigabitEthernet0/1 overload`, which translates inside local addresses to the IP address of the GigabitEthernet0/1 interface. If that interface has a private IP address (e.g., 10.1.1.1), then all translated traffic will appear to come from that private address, not a public one. The server logs confirm this by showing connections from 10.1.1.1 instead of a public IP like 203.0.113.1, indicating the interface lacks a public IP or a NAT pool with a routable address.

Exam trap

Cisco often tests the misconception that the `interface` keyword in `ip nat inside source list` automatically uses a public IP, but the trap is that it simply uses whatever IP is configured on that interface, which could be private if misconfigured.

How to eliminate wrong answers

Option B is wrong because access-list 100 is used to match the inside local traffic (e.g., 192.168.1.0/24) for translation; if it were incorrectly matching, internal hosts would not be able to access the internet at all, but the issue is specifically about the translated source IP being private. Option C is wrong because asymmetric routing would cause the server to see a different source IP than expected due to path divergence, but here the translation itself is producing a private IP (10.1.1.1), not a mismatch between forward and return paths. Option D is wrong because the configuration already includes the `overload` keyword (PAT), which is necessary for many-to-one translation; missing it would cause NAT to fail for multiple hosts or require a pool, but the issue is the interface IP being private, not the absence of overload.

Full explanation →
1755
MCQmedium

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show monitor session 5 detail Session 5 --------- Type : ERSPAN Destination Session Source IP : 10.1.1.2 ERSPAN ID : 100 Destination Ports : Gi0/3 Encapsulation : Native Ingress : Disabled What does this output indicate?

A.The session is correctly configured as an ERSPAN destination session.
B.The session is misconfigured because the source must be a VLAN, not an IP.
C.The session is misconfigured because the destination port must have ingress enabled.
D.The session is misconfigured because the ERSPAN ID must be different from the source session.
AnswerA

The output confirms an ERSPAN destination session with a source IP and ERSPAN ID.

Why this answer

The output shows an ERSPAN destination session with source IP 10.1.1.2, ERSPAN ID 100, and destination port Gi0/3. This is the destination side of an ERSPAN configuration.

Full explanation →
1756
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After configuration, legitimate traffic from a directly connected network is being dropped. Which is the most likely explanation?

A.Asymmetric routing is causing the return path to use a different interface.
B.The 'allow-default' option is not configured, and a default route exists.
C.The interface is configured with an IP address that is not in the routing table.
D.The routing table has a more specific route for the source network via a different interface.
AnswerA

Strict uRPF requires the source IP to be reachable via the same interface it arrived on. Asymmetric routing violates this, causing drops.

Why this answer

Strict uRPF checks that the source IP address of incoming packets has a route in the routing table that points back to the same interface. If there is asymmetric routing where the return path uses a different interface, strict uRPF will drop the traffic. This is a common edge case in networks with multiple paths.

Full explanation →
1757
MCQeasy

In MPLS L3VPN, what is the default behavior when a PE router receives a VPNv4 route with a Route Target that does not match any import RT on any VRF?

A.The route is stored in the BGP table but not installed in any VRF routing table.
B.The route is discarded and not stored in the BGP table.
C.The route is installed in the global routing table.
D.The route is advertised to all other PEs.
AnswerA

BGP keeps all received routes in its table; the VRF import filter determines which routes are actually used in the VRF.

Why this answer

The PE will still store the route in its BGP table (since BGP accepts all routes by default), but it will not install it into any VRF routing table because the import filter rejects it.

Full explanation →
1758
MCQmedium

Given this configuration on router R2: ``` ip vrf CUSTOMER_D rd 100:1 ! interface GigabitEthernet0/0 ip vrf forwarding CUSTOMER_D ip address 192.168.2.1 255.255.255.0 ! router ospf 1 vrf CUSTOMER_D network 192.168.2.0 0.0.0.255 area 0 ``` What will happen when this configuration is applied?

A.OSPF will run on GigabitEthernet0/0 and form adjacencies within VRF CUSTOMER_D.
B.OSPF will fail because the OSPF process must be configured globally, not under the VRF.
C.OSPF will run on all interfaces, including those not in VRF CUSTOMER_D.
D.The network command is invalid because it uses a wildcard mask instead of a subnet mask.
AnswerA

This is correct. The OSPF process is VRF-aware and will operate only on interfaces in that VRF.

Why this answer

The OSPF process is tied to VRF CUSTOMER_D, so it only runs on interfaces that belong to that VRF. The network command matches the interface, so OSPF will form adjacencies on that interface within the VRF.

Full explanation →
1759
Drag & Dropmedium

Drag and drop the steps to verify and validate NetFlow and Flexible NetFlow operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Verification starts with checking that the flow monitor is active on the interface, then confirming flow records are being generated, then checking exporter statistics for sent packets, then validating the collector receives the data, and finally comparing flow counts to interface counters for accuracy.

Full explanation →
1760
MCQhard

Which statement correctly describes the default 'match' direction in a Flexible NetFlow flow record?

A.The default match direction is 'output' (egress).
B.The default match direction is 'both' (input and output).
C.The default match direction is 'input' (ingress).
D.There is no default direction; it must always be specified.
AnswerC

Correct. Flexible NetFlow matches on input by default.

Why this answer

The default match direction is 'input' (ingress), meaning flows are matched on incoming traffic only.

Full explanation →
1761
MCQmedium

A network engineer runs the following command to troubleshoot SNMP access: R1# show snmp community Community name: public Community Index: public Storage-Type: nonvolatile Access: read-only View: v1default Community name: private Community Index: private Storage-Type: nonvolatile Access: read-write View: v1default What does this output indicate?

A.The router has two SNMP communities: 'public' for read-only and 'private' for read-write access.
B.The router only allows SNMP writes with the 'public' community.
C.The router is not configured for SNMP because no community strings are shown.
D.The router uses SNMPv3 and these communities are for backward compatibility.
AnswerA

The output clearly shows 'public' with read-only and 'private' with read-write access.

Why this answer

The output shows two SNMP community strings configured on the router: 'public' with read-only access and 'private' with read-write access. This is a standard SNMPv1/v2c configuration where the community string acts as a password for access control, and the 'Access' field explicitly defines the permissions. Therefore, option A correctly interprets the output.

Exam trap

Cisco often tests the distinction between SNMPv1/v2c community strings and SNMPv3 user-based security, so candidates may mistakenly assume that any community output implies SNMPv3 backward compatibility.

How to eliminate wrong answers

Option B is wrong because the 'public' community has 'Access: read-only', so it cannot be used for SNMP writes; only the 'private' community has read-write access. Option C is wrong because the output clearly lists two community strings, indicating SNMP is configured. Option D is wrong because the output shows SNMPv1/v2c communities (with 'v1default' view), not SNMPv3; SNMPv3 uses usernames and authentication/encryption parameters, not community strings.

Full explanation →
1762
MCQmedium

A network engineer is troubleshooting missing BGP routes on R3. R1 (AS 65001) is an eBGP peer of R2 (AS 65002), and R2 is an iBGP peer of R3 (AS 65002). R1 advertises the prefix 172.16.1.0/24 to R2. On R2, 'show ip bgp' shows the prefix with next-hop 10.1.1.1 (R1's interface). R3's BGP table does not contain this prefix. R2 and R3 are not route reflectors, and there are no other iBGP peers. What is the most likely cause?

A.R2 does not have the 'neighbor 10.1.1.3 activate' command under the BGP configuration for the iBGP session.
B.R2 is not advertising the route because the next-hop 10.1.1.1 is not reachable from R3.
C.R2 is not advertising the route because BGP synchronization is enabled and the IGP does not have the route.
D.R2 is not advertising the route because the prefix is being filtered by an inbound route-map on R3.
AnswerA

Correct because without the activate command, BGP will not advertise any prefixes to the neighbor, even if the session is up.

Why this answer

In iBGP, by default, routes learned from an iBGP peer are not advertised to other iBGP peers (split horizon). Since R2 learned the route from eBGP, it should advertise it to R3. However, if R3 learned the route via iBGP from another source, it might not be advertised.

But the scenario implies R2 is not advertising to R3. The most common cause is that R2 has a route-map or filter blocking the advertisement, or the next-hop is unreachable from R3. However, given the information, the likely issue is that R2 does not have the route in its BGP table as best, or the next-hop is not reachable.

But the stem says R2 shows the prefix. The correct answer is that R2 is not advertising because the next-hop (10.1.1.1) is not reachable from R3, but that would affect R3's ability to use the route, not R2's advertisement. Actually, R2 will advertise to iBGP peers regardless of next-hop reachability on the receiver.

So the issue must be that R2 is not advertising due to a missing 'neighbor R3 activate' or a filter. The most plausible is that the network statement or redistribution is missing on R2 for the prefix? No, R2 has it. Let me re-read: R2's BGP table shows the prefix.

The missing route on R3 could be due to R2 not having the 'neighbor 10.1.1.3 activate' under the BGP process, or a route-map blocking. The stem does not mention any filters. The most common cause in such scenarios is that the BGP session between R2 and R3 is not configured to exchange prefixes (missing activate).

Full explanation →
1763
MCQhard

A large enterprise is using a DMVPN Phase 2 hub-and-spoke topology with IPsec protection. Spoke routers R3 and R4 are both behind NAT. The hub R1 has a tunnel interface with IPsec profile and mGRE. Spoke-to-spoke dynamic tunnels do not form. R3 can ping R4's tunnel IP via the hub, but R3's show dmvpn detail shows no NHRP redirect or shortcut. R4's show crypto ipsec sa shows no inbound/outbound SA for the R3-to-R4 traffic. What is the root cause?

A.The hub is missing the 'ip nhrp redirect' command under the tunnel interface.
B.The IPsec profile on the hub does not include perfect forward secrecy (PFS).
C.The spokes are using different ISAKMP policies.
D.The NAT traversal feature is disabled on the hub.
AnswerA

Without NHRP redirect, the hub does not inform spokes of peer public addresses, preventing dynamic spoke-to-spoke tunnel formation.

Why this answer

In a DMVPN Phase 2 topology, spoke-to-spoke dynamic tunnels require the hub to send NHRP redirect messages to inform a spoke that the destination it is trying to reach is behind another spoke. Without the 'ip nhrp redirect' command on the hub's tunnel interface, the hub forwards traffic between spokes but never signals the source spoke to initiate a direct tunnel. This explains why R3 can ping R4's tunnel IP via the hub but no NHRP redirect or shortcut is seen, and no IPsec SA is built between the spokes.

Exam trap

Cisco often tests the distinction between DMVPN Phase 2 and Phase 3, where Phase 3 uses 'ip nhrp redirect' on the hub and 'ip nhrp shortcut' on spokes, and candidates may incorrectly assume that spoke-to-spoke tunnels form automatically without explicit NHRP redirect configuration.

How to eliminate wrong answers

Option B is wrong because PFS (Perfect Forward Secrecy) is not required for DMVPN Phase 2 spoke-to-spoke tunnel establishment; PFS is an optional security enhancement for IPsec key exchange and does not affect NHRP redirect or shortcut creation. Option C is wrong because if the spokes were using different ISAKMP policies, they would not be able to form IPsec SAs with the hub at all, but the problem states that R3 can ping R4's tunnel IP via the hub, indicating that both spokes have working IPsec tunnels to the hub. Option D is wrong because NAT traversal (NAT-T) is automatically enabled in IOS when a NAT device is detected and is not a command that needs to be explicitly enabled on the hub; disabling it would prevent the hub from establishing tunnels with NATed spokes, but the spokes already have connectivity to the hub.

Full explanation →
1764
MCQhard

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

A.The EEM applets are not registered due to a syntax error in the configuration.
B.The EEM server is not listening for syslog events.
C.The router's logging level is set to emergencies only.
D.The EEM applets are configured with 'event none' and need manual triggering.
AnswerA

Correct because a syntax error prevents the applet from being registered, even if the EEM server is running.

Why this answer

Even if the EEM server is running, the applets may not be registered if they have syntax errors or if the 'event manager applet' command is missing. The engineer should use 'show event manager policy available' or 'show event manager policy registered' to verify if the applets are registered.

Full explanation →
1765
MCQeasy

A network engineer is troubleshooting a DHCPv4 issue where clients on a subnet are getting IP addresses from the correct pool, but they cannot reach the default gateway. The router is configured as a DHCP server with pool 'POOL' that includes 'default-router 192.168.1.1'. The router's interface IP is 192.168.1.1/24. Clients receive the address and default gateway, but pings to 192.168.1.1 fail. What is the most likely cause?

A.The DHCP pool has the wrong subnet mask.
B.The router interface Gi0/0 is administratively down.
C.The 'ip helper-address' command is interfering with DHCP.
D.The clients have a static ARP entry for the gateway.
AnswerB

Correct because if the interface is down, the router cannot respond to ARP requests or pings from clients, even though DHCP assignments are still possible (the server process runs independently).

Why this answer

If the router's interface is up and has the correct IP, but clients cannot ping the gateway, the issue is often that the interface is in a different VLAN or the clients are on a different broadcast domain. However, the most common misconfiguration is that the 'default-router' command points to an IP that is not actually configured on the router's interface, or the interface is down. Given that the symptom is specific to the gateway, the likely cause is that the interface is shut down or has a different IP.

Full explanation →
1766
MCQhard

A network engineer is troubleshooting a scenario where two routers running EIGRP are not forming an adjacency. Both routers have BFD configured under the EIGRP process and on the interfaces. The BFD session is up and operational. However, the EIGRP neighbor status shows 'Pending' and never transitions to 'Up'. What is the most likely cause?

A.The BFD timers are set too high, causing EIGRP to time out before BFD can respond.
B.EIGRP is configured with 'no auto-summary' on one router and 'auto-summary' on the other.
C.The EIGRP K-values are mismatched between the two routers.
D.The interface is configured with 'bfd interval 50 min_rx 50 multiplier 3' but the neighbor expects different values.
AnswerC

EIGRP K-values must match for adjacency to form; a mismatch causes the neighbor to stay in Pending state even if BFD is up.

Why this answer

EIGRP requires the BFD session to be fully established before it will bring up the adjacency. If the BFD session is up but EIGRP is stuck in Pending, the issue is often a mismatch in EIGRP K-values or authentication.

Full explanation →
1767
MCQmedium

A network engineer configured IP SLA 70 to monitor a remote site's LAN gateway (172.16.1.1) using ICMP echo. The IP SLA is linked to a track object that is used in a static route for a backup link. The engineer notices that the IP SLA state is 'Active', but the backup static route is installed in the routing table even when the primary route is available. What is the most likely cause?

A.The static route is configured without the 'track' keyword, so it is always installed regardless of the IP SLA state.
B.The IP SLA probe is failing intermittently, causing the track object to flap.
C.The primary route has a higher administrative distance than the static route.
D.The track object is configured with a delay that causes the static route to be installed prematurely.
AnswerA

Without the 'track' keyword, the static route is permanent and will be installed if its AD is lower than the primary route.

Why this answer

If the backup static route is installed while the primary route is available, the static route likely has a lower administrative distance than the primary route, or the track object is not being used correctly (e.g., the static route does not have the 'track' keyword).

Full explanation →
1768
MCQhard

An engineer configures OSPF on two directly connected routers with MTU 1500 on one interface and MTU 1600 on the other. The OSPF adjacency remains stuck in EXSTART/EXCHANGE state. Which is the most likely explanation?

A.The larger MTU interface sends DBD packets that are too big for the smaller MTU interface, preventing the exchange of LSAs.
B.OSPF uses TCP, and the MSS mismatch causes the adjacency to fail.
C.The MTU mismatch causes a routing loop that prevents the exchange of hello packets.
D.The router with the smaller MTU will not send hello packets because it detects the mismatch.
AnswerA

OSPF DBD packets are limited by the outgoing interface MTU; a mismatch causes the smaller MTU router to drop the packets, stalling the adjacency.

Why this answer

OSPF uses IP protocol 89 and directly exchanges Database Description (DBD) packets during the EXSTART/EXCHANGE state. When the MTU on one interface is smaller (1500) than the DBD packet size sent by the neighbor with the larger MTU (1600), the smaller interface drops the oversized packet. This prevents the successful exchange of LSAs, causing the adjacency to remain stuck in EXSTART/EXCHANGE.

Exam trap

Cisco often tests the misconception that OSPF uses TCP or that MTU mismatches affect hello packets, when in fact the problem only surfaces during DBD exchange in the EXSTART/EXCHANGE state.

How to eliminate wrong answers

Option B is wrong because OSPF does not use TCP; it uses IP protocol 89 directly, so MSS (Maximum Segment Size) is irrelevant. Option C is wrong because an MTU mismatch does not cause a routing loop; routing loops are caused by incorrect route redistribution or summarization, not by MTU differences, and hello packets are still exchanged (the adjacency reaches EXSTART). Option D is wrong because the router with the smaller MTU will still send hello packets; OSPF does not detect an MTU mismatch from hello packets alone, and the issue only manifests when DBD packets are exchanged.

Full explanation →
1769
MCQmedium

A network engineer runs the following command on Router R1: R1# show route-map route-map FILTER_OSPF, permit, sequence 10 Match clauses: ip address prefix-list OSPF_ROUTES Set clauses: Policy routing matches: 0 packets, 0 bytes route-map FILTER_OSPF, deny, sequence 20 Match clauses: Set clauses: Policy routing matches: 0 packets, 0 bytes Based on this output, which statement is correct?

A.The route-map will permit all routes that match the prefix-list OSPF_ROUTES and deny all others.
B.The route-map will permit all routes because sequence 20 has no match clause.
C.The route-map is used for policy-based routing and has matched 0 packets.
D.The route-map will deny only routes matching the prefix-list OSPF_ROUTES.
AnswerA

Sequence 10 permits matching routes; sequence 20 denies everything else.

Why this answer

The route-map FILTER_OSPF has two sequences: sequence 10 permits routes matching prefix-list OSPF_ROUTES, and sequence 20 denies all other routes (since no match clause). The match counters show 0 packets/bytes, indicating no traffic has been matched yet, but this is a route-map used for route filtering, not policy routing. The correct answer is that the route-map will deny all routes not matching the prefix-list.

Full explanation →
1770
MCQmedium

A network engineer runs the following command to troubleshoot a VRF-Lite IPsec issue: R1# show crypto ipsec transform-set vrf CUSTOMER_H Output: Transform set combined: { esp-aes 256 esp-sha-hmac } will negotiate = { Tunnel, } What does this output indicate?

A.The transform set uses ESP with AES 256 and SHA-HMAC in transport mode.
B.The transform set uses ESP with AES 256 and SHA-HMAC in tunnel mode.
C.The transform set uses AH with AES 256 and MD5.
D.The transform set does not specify any encryption or authentication.
AnswerB

Correct. The transform set includes esp-aes 256 and esp-sha-hmac, and will negotiate tunnel mode.

Why this answer

The 'show crypto ipsec transform-set vrf' command displays the IPsec transform set for a specific VRF. The output shows a transform set named 'combined' that uses ESP with AES 256-bit encryption and SHA-HMAC authentication. It will negotiate a tunnel mode (as opposed to transport mode).

Full explanation →
1771
MCQhard

What is the default behavior of PBR when a 'set ip next-hop' and a 'set ip default next-hop' are both configured in the same route-map entry?

A.The 'set ip default next-hop' is always used first.
B.Both are used simultaneously, and the router load-balances.
C.The 'set ip next-hop' is used if reachable; otherwise, the 'set ip default next-hop' is used if the routing table has no explicit route.
D.The router ignores both and uses the routing table.
AnswerC

This is the correct order of evaluation.

Why this answer

The 'set ip next-hop' is evaluated first. If it is reachable, it is used. If not, then the 'set ip default next-hop' is used, but only if there is no explicit route in the routing table.

Full explanation →
1772
MCQhard

A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall replacement, traffic from this VLAN is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'show ip policy' shows the policy on the VLAN interface, but 'debug ip packet' shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but the firewall is configured to drop traffic from 10.10.10.0/24. What is the root cause?

A.The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.
B.The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.
C.The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.
D.The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.
AnswerA

PBR successfully forwards traffic to the firewall, but the firewall drops it due to its own security policy. The routing is correct, but the firewall policy is blocking the traffic.

Why this answer

PBR forwards traffic to the firewall, but the firewall is configured to drop traffic from the source subnet (10.10.10.0/24). This is a policy issue on the firewall, not a routing issue. The solution is to update the firewall policy to allow traffic from the source subnet.

Full explanation →
1773
MCQmedium

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue: R1# show mpls ldp neighbor detail Output: Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.646 State: Oper; Msgs sent/rcvd: 100/100; Downstream Up time: 00:10:00 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.0.0.2 Addresses bound to peer LDP Ident: 10.0.0.2 10.1.1.2 10.2.2.2 What does this output indicate?

A.The router has an operational LDP session with neighbor 10.0.0.2, with addresses 10.0.0.2, 10.1.1.2, and 10.2.2.2.
B.The router is experiencing an LDP authentication failure.
C.The router is using UDP for LDP discovery.
D.The router has only one LDP neighbor.
AnswerA

The state is 'Oper' (operational) and addresses are listed.

Why this answer

The output shows detailed LDP neighbor information, including TCP connection details, state, and addresses bound to the peer. This indicates a functioning LDP session.

Full explanation →
1774
MCQmedium

Consider this OSPF configuration on router R4: router ospf 1 network 192.168.1.0 0.0.0.255 area 0 neighbor 10.0.0.2 What is the effect of the neighbor statement?

A.R4 will attempt to form an OSPF adjacency with 10.0.0.2 over any interface that can reach it.
B.The neighbor command is ignored because the network type is broadcast by default on Ethernet interfaces.
C.R4 will send unicast OSPF packets to 10.0.0.2, but only if the interface is in area 0.
D.The configuration is invalid because the neighbor command must include a priority.
AnswerB

Correct. On Ethernet, OSPF uses multicast discovery; the neighbor command is not needed and is ignored.

Why this answer

The neighbor command is used in OSPF for non-broadcast multi-access (NBMA) networks to manually specify neighbors. However, the interface used to reach 10.0.0.2 must be configured with the appropriate network type (e.g., point-to-multipoint or non-broadcast). If the network type is broadcast or point-to-point, the neighbor command is ignored.

Full explanation →
1775
MCQmedium

A network engineer runs the following command on Router R1: R1# show route-map route-map PBR-ROUTE, permit, sequence 10 Match clauses: ip address (access-lists): ACL-PBR Set clauses: ip next-hop 192.168.1.2 Policy routing matches: 0 packets, 0 bytes route-map PBR-ROUTE, permit, sequence 20 Match clauses: Set clauses: ip next-hop 192.168.2.2 Policy routing matches: 0 packets, 0 bytes R1# show ip policy Interface Route-map GigabitEthernet0/0 PBR-ROUTE Based on this output, what is the most likely problem?

A.The route map is not applied to an interface.
B.The access list ACL-PBR does not exist or matches no traffic.
C.The next-hop 192.168.1.2 is unreachable.
D.The route map is missing a permit statement.
AnswerB

Zero matches in sequence 10 suggest ACL-PBR is not matching any packets. Sequence 20 has no match clause and would match all, but its counter is also zero, indicating no traffic is being processed by PBR at all, likely because ACL-PBR is missing or incorrect.

Why this answer

The show route-map output shows zero policy routing matches. The route map is applied to the interface, but the access list ACL-PBR may not match any traffic, or traffic is not arriving on GigabitEthernet0/0. The set clause in sequence 20 is applied unconditionally (no match clause), which would normally match all traffic, but sequence 10 must be evaluated first; if ACL-PBR matches nothing, sequence 20 would match all, yet counters still show zero, indicating no traffic is being policy-routed at all.

Full explanation →
1776
MCQmedium

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# show ip policy Interface Route-map FastEthernet0/0 PBR-MAP Serial0/0 PBR-MAP What does this output indicate?

A.The same route-map is applied to multiple interfaces, which may lead to unintended policy routing.
B.PBR is applied globally.
C.The route-map PBR-MAP is misconfigured.
D.PBR is only active on FastEthernet0/0.
AnswerA

Applying the same route-map to multiple interfaces can cause issues if the set clauses are not interface-agnostic.

Why this answer

The output shows that the same route-map PBR-MAP is applied to both FastEthernet0/0 and Serial0/0. This could cause unexpected behavior if the route-map uses interface-specific conditions.

Full explanation →
1777
Multi-Selecthard

Which TWO statements about the limitations of local SPAN are correct? (Choose TWO.)

Select 2 answers
A.A local SPAN session can only monitor traffic on the same switch where the session is configured.
B.A local SPAN destination port can be a routed port or a switchport in trunk mode.
C.A local SPAN session can monitor both ingress and egress traffic simultaneously on the same source interface.
D.A local SPAN session can include a VLAN as a source, which monitors all traffic in that VLAN except the control plane traffic.
E.A local SPAN session can have multiple destination ports to send the mirrored traffic to multiple analyzers.
AnswersA, C

Correct. Local SPAN is confined to a single switch; it cannot extend across switches.

Why this answer

Local SPAN has several restrictions: it cannot send traffic across Layer 3 boundaries, it can only use interfaces on the same switch, and it has limitations on the number of sessions and the types of traffic that can be mirrored (e.g., control plane traffic is not included).

Full explanation →
1778
MCQhard

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec protection using a transform set that includes ESP encryption and authentication. The tunnel comes up, but OSPFv3 over the tunnel fails to form adjacency. The engineer notices that the tunnel interface has an MTU of 1400. What is the most likely explanation?

A.The IPsec transform set includes both ESP encryption and authentication, which adds 50+ bytes of overhead; the tunnel MTU of 1400 is too high for the actual path MTU after encapsulation.
B.OSPFv3 requires the tunnel interface to be configured with 'ipv6 ospf network point-to-point' to work over GRE.
C.The IPsec configuration is missing the 'crypto map' applied to the tunnel interface.
D.The GRE tunnel mode should be 'tunnel mode gre ipv6' instead of the default.
AnswerA

With ESP encryption and authentication, the total overhead can be 50-60 bytes. The tunnel MTU of 1400 does not account for this, causing OSPFv3 packets to be fragmented or dropped.

Why this answer

When IPsec ESP encryption and authentication are applied to a GRE tunnel, the combined overhead (typically 50–60 bytes for ESP headers, trailers, and authentication data) reduces the effective payload MTU. With a tunnel interface MTU of 1400, the actual packet size after adding GRE (20 bytes) and IPsec overhead can exceed the path MTU, causing fragmentation or drops. OSPFv3 uses large hello packets (often 1500 bytes), and if the encapsulated packet exceeds the path MTU, adjacency cannot form.

Exam trap

Cisco often tests the concept that IPsec overhead must be accounted for when setting tunnel MTU, and candidates mistakenly assume that a tunnel MTU of 1400 is always safe for IPv6 over GRE with IPsec, ignoring the cumulative encapsulation overhead.

How to eliminate wrong answers

Option B is wrong because OSPFv3 over GRE does not require the 'ipv6 ospf network point-to-point' command; GRE tunnels are inherently point-to-point, and OSPFv3 automatically detects the network type as point-to-point over a GRE tunnel. Option C is wrong because the question states that the tunnel comes up, and IPsec protection is configured via a transform set; the crypto map is likely applied to the physical interface or tunnel interface, and the tunnel being up indicates IPsec is functioning. Option D is wrong because 'tunnel mode gre ipv6' is used for IPv6 transport over IPv6, not for IPv6 over IPv4 GRE; the default 'tunnel mode gre ip' is correct for encapsulating IPv6 in IPv4.

Full explanation →
1779
MCQeasy

What is the default dead interval on a Cisco IOS-XE router for OSPF on a broadcast network type?

A.10 seconds
B.30 seconds
C.40 seconds
D.120 seconds
AnswerC

Correct. The dead interval is 4 × hello interval (4 × 10 = 40 seconds) by default on broadcast and point-to-point networks.

Why this answer

On a broadcast network type, OSPF uses a default dead interval of 40 seconds, which is four times the default hello interval of 10 seconds. This relationship is defined in RFC 2328, ensuring that a neighbor is declared down only after missing four consecutive hello packets.

Exam trap

Cisco often tests the default OSPF timers for different network types, and the trap here is confusing the default dead interval for broadcast (40 seconds) with the default hello interval (10 seconds) or with the dead interval for other network types like NBMA (30 seconds).

How to eliminate wrong answers

Option A is wrong because 10 seconds is the default hello interval on broadcast networks, not the dead interval. Option B is wrong because 30 seconds is the default dead interval for OSPF on non-broadcast multi-access (NBMA) networks, not broadcast. Option D is wrong because 120 seconds is the default dead interval for OSPF virtual links or point-to-multipoint networks, not for broadcast network types.

Full explanation →
1780
Drag & Dropmedium

Drag and drop the steps to verify and validate the operational state of an IPsec site-to-site VPN into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Begin by checking the IKE Phase 1 SA to ensure the control plane is established, then verify the IPsec Phase 2 SA for data-plane encryption. Confirm the tunnel interface is up/up, examine the crypto map to ensure it is active, and finally test traffic flow with a ping or extended ping.

Full explanation →
1781
MCQhard

An MPLS network with IPv6 over MPLS (6PE) is experiencing loss of IPv6 routes from a remote provider edge (PE) router. Router PE1 has the following relevant configuration: interface GigabitEthernet0/0 ipv6 address 2001:DB8:1::1/64 mpls ip interface Loopback0 ip address 192.0.2.1 255.255.255.255 router ospf 1 router-id 192.0.2.1 redistribute bgp 65000 subnets. Router PE2 shows: PE2# show bgp ipv6 unicast 2001:DB8:2::/64 % Network not in table. PE2# show mpls forwarding-table 192.0.2.1 Label: 16, Interface: GigabitEthernet0/1. What is the root cause?

A.PE1 is missing the network 2001:DB8:2::/64 command under router bgp for IPv6 unicast address family.
B.The MPLS label distribution between PE1 and PE2 is failing due to LDP mismatch.
C.OSPF is not redistributing the IPv6 prefix correctly.
D.The IPv6 address family is not enabled under router bgp on PE1.
AnswerA

Without this, the IPv6 prefix is not injected into BGP, so PE2 never learns it.

Why this answer

The output shows that PE2 has an MPLS label (16) for PE1's loopback (192.0.2.1) and can forward labeled traffic, but the IPv6 route 2001:DB8:2::/64 is missing from the BGP table. This indicates that PE1 is not advertising the IPv6 prefix into BGP. The missing `network 2001:DB8:2::/64` command under the IPv6 unicast address family on PE1 prevents the prefix from being injected into BGP, even though the interface is configured with the IPv6 address and OSPF redistribution is in place.

Exam trap

Cisco often tests the distinction between interface configuration and BGP advertisement, where candidates assume that having an IPv6 address on an interface automatically makes it reachable via BGP in a 6PE design.

How to eliminate wrong answers

Option B is wrong because the `show mpls forwarding-table` output shows a valid label (16) for PE1's loopback, proving that LDP is functioning correctly and there is no mismatch. Option C is wrong because OSPF redistribution of BGP routes is not required for 6PE; 6PE relies on BGP to carry IPv6 prefixes over the MPLS core, and OSPF is only used for IPv4 IGP reachability of the loopbacks. Option D is wrong because the IPv6 address family is implicitly enabled when the `network` command is used under `router bgp` for IPv6 unicast; the issue is the missing network statement, not the absence of the address family itself.

Full explanation →
1782
MCQmedium

A network engineer runs the following command to troubleshoot an RSPAN issue: R1# show monitor session 2 detail Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/0 Destination RSPAN VLAN : 100 What does this output indicate?

A.The session is correctly configured as an RSPAN source session.
B.The session is misconfigured because the destination must be a port, not a VLAN.
C.The session is misconfigured because the source port must be a VLAN.
D.The session is misconfigured because the RSPAN VLAN must be configured as a remote-span VLAN.
AnswerA

The output confirms an RSPAN source session with a specified RSPAN VLAN.

Why this answer

The output shows an RSPAN source session with source port Gi0/0 and destination RSPAN VLAN 100. This is the source side of an RSPAN configuration.

Full explanation →
1783
MCQmedium

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP class-map: MANAGEMENT (match-all) 5 packets, 500 bytes 5 minute offered rate 0 bps police: cir 8000 bps, bc 1500 bytes conformed 5 packets, 500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps class-map: ATTACK (match-all) 100 packets, 10000 bytes 5 minute offered rate 0 bps police: cir 8000 bps, bc 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 100 packets, 10000 bytes; actions: drop conformed 0 bps, exceed 0 bps Based on this output, what is happening to traffic matching class ATTACK?

A.All traffic in class ATTACK is being transmitted.
B.All traffic in class ATTACK is being dropped.
C.Traffic in class ATTACK is being rate-limited but not dropped.
D.Traffic in class ATTACK is being marked down.
AnswerB

Exceeded 100 packets, all dropped.

Why this answer

The output shows that for class ATTACK, 100 packets were exceeded and dropped. This means the traffic rate exceeded the committed information rate (CIR) of 8000 bps, and all packets were dropped as per the exceed action.

Full explanation →
1784
MCQhard

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.10.10.0/24 should be forwarded to next-hop 192.168.100.2. The route map 'PBR-10' is configured with 'match ip address 130' and 'set ip next-hop 192.168.100.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is dropping packets instead of forwarding them. The engineer checks the ACL 130 and confirms it matches 10.10.10.0/24. What is the most likely cause?

A.The route map has a deny statement that matches the traffic, causing packets to be dropped.
B.The next-hop 192.168.100.2 is unreachable, and PBR drops packets when the next-hop is down.
C.The 'ip policy route-map' command is applied to the wrong interface, and the router is dropping packets due to ACL filtering.
D.The ACL 130 is missing the 'permit' keyword, causing all traffic to be denied.
AnswerA

Correct because a deny statement in the route map will cause the router to drop the packet if no other permit statement matches.

Why this answer

If PBR is dropping packets, it could be because the next-hop is unreachable and the route map has a 'set ip next-hop' command that fails, causing the router to drop the packet if no fallback is configured. However, by default, if the next-hop is unreachable, the router should use the routing table. But if the route map has a 'set ip next-hop' with 'verify-availability' and the next-hop is down, the router may drop the packet.

Another possibility is that the route map has a 'deny' statement that drops traffic. The most likely cause is that the route map has a 'deny' statement that matches the traffic, causing it to be dropped.

Full explanation →
1785
MCQhard

A DMVPN network uses IPv6 with EIGRP as the routing protocol. Spoke routers R2 and R3 are behind NAT and use mGRE tunnels. The hub R1 has an IPv6 ACL applied inbound on the tunnel interface that permits only EIGRP and denies all other IPv6 traffic. Spoke-to-spoke traffic fails even though direct tunnels are established. R2 shows 'ping 2001:db8:3::1 source loopback0' fails, but 'ping 2001:db8:1::1' (hub) succeeds. What is the root cause?

A.R1's inbound ACL on the tunnel interface permits only EIGRP, dropping all other traffic including spoke-to-spoke data packets.
B.NAT traversal is broken for spoke-to-spoke traffic due to IPsec encryption issues.
C.EIGRP is not advertising spoke loopbacks to other spokes, causing no route.
D.The mGRE tunnel on R2 does not have a destination for R3, preventing direct communication.
AnswerA

Spoke-to-spoke traffic is forwarded through the hub if the routing table points to the hub. The ACL on the hub's tunnel interface filters this traffic.

Why this answer

The hub router R1 has an inbound IPv6 ACL on its tunnel interface that permits only EIGRP traffic and denies all other IPv6 traffic. When spoke R2 attempts to send data (e.g., ping) directly to spoke R3, the packets are routed through the hub because the spokes do not have a direct route to each other's loopback addresses. Even though a direct mGRE tunnel exists between spokes, the data packets must first reach the hub, which drops them due to the ACL, causing spoke-to-spoke communication failure.

Exam trap

Cisco often tests the misconception that a direct tunnel between spokes automatically allows direct traffic, but in reality, the hub's ACL or routing policy can still block spoke-to-spoke data if the packets are forwarded through the hub.

How to eliminate wrong answers

Option B is wrong because NAT traversal issues typically affect IPsec tunnel establishment or keepalives, not the filtering of data packets after the tunnel is up; the problem here is ACL-based dropping, not encryption or NAT. Option C is wrong because EIGRP can advertise spoke loopbacks to other spokes via the hub, but the ACL on the hub's tunnel interface blocks the data traffic, not the routing updates; the routes may exist but packets are dropped. Option D is wrong because mGRE tunnels dynamically learn peer destinations (NHRP), so R2 does not need a static destination for R3; the direct tunnel is established, but data packets are still forwarded through the hub due to routing or ACL filtering.

Full explanation →
1786
MCQhard

What is the default OSPF metric for a route redistributed from another routing protocol into OSPF?

A.0
B.1
C.20
D.10
AnswerC

Correct. The default OSPF metric for redistributed routes (except BGP) is 20.

Why this answer

When a route is redistributed from another routing protocol into OSPF, the default metric is 20 for routes that are not BGP. This is defined in RFC 2328 and is the seed metric used when no explicit metric is configured with the redistribute command. The value 20 applies to most external routes (Type 2 by default), while BGP redistributed routes default to 1.

Exam trap

Cisco often tests the distinction between the default OSPF metric for redistributed routes (20) and the default metric for BGP redistributed routes (1), causing candidates to mistakenly choose 1 for all protocols.

How to eliminate wrong answers

Option A is wrong because 0 is not a valid default OSPF metric for redistributed routes; a metric of 0 would imply the route is directly connected, which is not the case for redistributed routes. Option B is wrong because 1 is the default metric for routes redistributed from BGP into OSPF, not for routes from other protocols like EIGRP or RIP. Option D is wrong because 10 is the default cost for a Gigabit Ethernet interface in OSPF, not the default metric for redistributed routes.

Full explanation →
1787
Multi-Selecthard

Which TWO statements about using a route-map with the "set metric" command to influence route selection in EIGRP are true? (Choose TWO.)

Select 2 answers
A.The set metric command in a route-map can set the EIGRP composite metric components such as bandwidth and delay.
B.A route-map applied to a redistribute command under EIGRP can modify the metric of redistributed routes.
C.The route-map must be applied to the EIGRP process using the "route-map" command under router eigrp to affect all updates.
D.The set metric command can also change the administrative distance of the route.
E.The route-map can only be used to set the metric to a single value, not multiple components.
AnswersA, B

Correct. EIGRP metric components can be set using set metric bandwidth delay reliability load mtu.

Why this answer

In EIGRP, the metric is composite (bandwidth, delay, etc.). The set metric command can modify these values. A route-map can be applied to redistribute routes into EIGRP or to filter outbound updates.

The set metric command can set multiple components. However, the route-map must be applied to the redistribution or neighbor statement to affect EIGRP. The set metric command does not affect the administrative distance.

Full explanation →
1788
Multi-Selecthard

Which TWO statements about AAA authentication on Cisco IOS-XE are true? (Choose TWO.)

Select 2 answers
A.If no AAA authentication method list is explicitly configured, the default method list uses the local user database.
B.The 'aaa authentication login default local' command creates a default method list that uses the local user database for login authentication.
C.When a named method list is applied to a line with 'login authentication LISTNAME', the default method list is ignored for that line.
D.The 'aaa authentication login default group radius local' command will first try RADIUS, and if RADIUS fails (not just rejects), it will fall back to local.
E.The 'aaa authentication login default method' command creates a method list with no authentication methods, which denies all login attempts.
AnswersB, C

This command defines the default method list for login authentication, using the local database as the first (and only) method.

Why this answer

The 'aaa authentication login default local' command explicitly configures the default method list to use the local user database for login authentication. This is the standard way to define a fallback or primary local authentication method for all lines that do not have a named method list applied.

Exam trap

Cisco often tests the distinction between a method list 'failure' (which allows fallback) and a 'reject' (which denies access immediately), and the fact that an unconfigured AAA defaults to line password authentication, not local database.

Full explanation →
1789
MCQmedium

A network engineer is troubleshooting a route redistribution issue between two EIGRP processes. Router R1 runs EIGRP AS 100 and EIGRP AS 200, and redistributes routes between them. The engineer notices that routes from EIGRP AS 100 are not appearing in the EIGRP topology table of AS 200 on R1. The redistribute eigrp 100 command is configured under EIGRP AS 200. What is the most likely cause?

A.The redistribute eigrp 100 command under EIGRP AS 200 is missing the metric specification.
B.EIGRP AS 100 has a higher administrative distance than EIGRP AS 200.
C.The redistribute eigrp 100 command under EIGRP AS 200 is missing the subnets keyword.
D.EIGRP AS 200 has a route map that is filtering all routes.
AnswerA

Correct: Without a metric, EIGRP does not accept redistributed routes.

Why this answer

When redistributing between EIGRP processes, the redistribute command must include the metric values (bandwidth, delay, reliability, load, MTU) or a default-metric must be configured. Without a metric, the redistributed routes are not accepted.

Full explanation →
1790
MCQmedium

What is the default administrative distance for routes redistributed into EIGRP from another protocol?

A.90
B.110
C.170
D.200
AnswerC

Cisco IOS assigns a default administrative distance of 170 to all routes redistributed into EIGRP, matching the distance of external EIGRP routes.

Why this answer

By default, EIGRP assigns an administrative distance of 170 to routes learned via redistribution, distinguishing them from internal EIGRP routes (AD 90) and external EIGRP routes (AD 170).

Full explanation →
1791
Multi-Selecthard

An engineer configures PBR on a Cisco router using the following commands: 'route-map PBR permit 10', 'match ip address 100', 'set ip next-hop 10.1.1.1', and applies it inbound on interface GigabitEthernet0/1. Which TWO statements about this configuration are true? (Choose TWO.)

Select 2 answers
A.The command 'ip policy route-map PBR' must be applied under interface GigabitEthernet0/1 in global configuration mode.
B.If the next hop 10.1.1.1 becomes unreachable, packets that match ACL 100 will be dropped by default.
C.Packets that do not match ACL 100 will be forwarded using the normal routing table.
D.The command 'debug ip policy' can be used to verify which packets are being policy-routed and to which next hop.
E.The route map must also include a 'match interface' statement to specify the incoming interface.
AnswersC, D

Correct. Only packets matching the route-map (via ACL 100) are policy-routed; others are forwarded normally.

Why this answer

PBR is applied inbound on an interface. The route map matches packets using ACL 100. If the next hop is unreachable, the packet is forwarded using the routing table (if a default route exists) or dropped.

PBR can be verified using 'show route-map' and 'debug ip policy'. The route map must be applied to the interface using 'ip policy route-map PBR'.

Full explanation →
1792
MCQhard

What is the default SNMP community string on a Cisco IOS device that has not been configured with any SNMP commands?

A.public
B.private
C.cisco
D.No default community string exists; SNMP is disabled.
AnswerD

Cisco IOS does not preconfigure any community; the device must have an snmp-server community command to enable SNMP.

Why this answer

By default, Cisco IOS devices have no SNMP community strings configured because SNMP is disabled until explicitly enabled with the 'snmp-server community' command. Without any SNMP configuration, the device does not respond to SNMP requests, making option D correct. This aligns with Cisco's security best practices to avoid exposing management access unintentionally.

Exam trap

Cisco often tests the misconception that 'public' is a default community string on IOS devices, when in fact SNMP is completely disabled by default and no community string exists until configured.

How to eliminate wrong answers

Option A is wrong because 'public' is a commonly used community string in many third-party devices but is not the default on Cisco IOS; Cisco does not pre-configure any community string. Option B is wrong because 'private' is similarly a common read-write community string in some contexts but is not a default on Cisco IOS. Option C is wrong because 'cisco' is not a default community string; Cisco IOS does not ship with any pre-set community strings, and SNMP must be explicitly configured.

Full explanation →
1793
MCQhard

A network engineer configures BGP synchronization on an iBGP router. The IGP (OSPF) does not carry the BGP routes. Unexpectedly, the router does not advertise these iBGP routes to eBGP neighbors. What is the most likely explanation?

A.The router has 'bgp synchronization' enabled, and the iBGP route is not in the OSPF routing table, so it is not considered valid for advertisement.
B.The router has 'bgp bestpath as-path multipath-relax' configured, which suppresses eBGP advertisements for iBGP routes.
C.The iBGP session is not using 'next-hop-self', so the next hop is unreachable.
D.The router has 'bgp suppress-duplicates' enabled, which drops identical routes.
AnswerA

With synchronization enabled, the router checks the IGP for the prefix. If missing, the route is not advertised to eBGP.

Why this answer

BGP synchronization requires that an iBGP route must be present in the IGP before it can be advertised to eBGP neighbors. If the IGP does not carry the route, the router will not advertise it, even if it is in the BGP table.

Full explanation →
1794
Multi-Selecthard

Which TWO configuration changes will prevent a specific route from being redistributed from OSPF into EIGRP using a route-map? (Choose TWO.)

Select 2 answers
A.Configure a route-map with a deny clause that matches the route, and apply it to the redistribution command.
B.Apply a distribute-list out under the EIGRP process that denies the route.
C.Use a route-map with a permit clause and no match statement, then apply it to the redistribution.
D.Create a prefix-list that denies the route, then use match ip address prefix-list in a route-map permit clause.
E.Add a match ip address prefix-list command that references a prefix-list with a deny entry, inside a route-map deny clause.
AnswersA, E

Correct. A deny clause in the route-map will prevent the route from being redistributed.

Why this answer

To block redistribution, you can either match the route with a deny clause in the route-map, or use a prefix-list that denies the route and reference it in a match clause. A distribute-list under EIGRP is not used for redistribution filtering. A route-map with a permit clause and no match will permit all routes.

A match ip address prefix-list with a permit entry will permit the route.

Full explanation →
1795
MCQhard

An engineer applies a Control Plane Policing (CoPP) policy to a router. After applying, the router becomes unreachable via SSH and SNMP, even though the policy allows management traffic. Which is the most likely explanation?

A.The CoPP policy was applied to the wrong interface; it must be applied to the management interface.
B.The class-map for management traffic does not include all required protocols, and the class-default action is drop.
C.The CoPP policy uses rate-limit in bps instead of pps, causing all traffic to be policed.
D.The CoPP policy was applied before the class-maps were fully configured.
AnswerB

If class-default is not configured with a permit action, the implicit deny drops unmatched traffic, including management traffic not explicitly matched.

Why this answer

CoPP policies have an implicit deny at the end of the class-map. If the class-map for management traffic does not explicitly match all management protocols (e.g., SSH, SNMP, NTP), or if the policy does not have a class-default action to permit, the traffic is dropped.

Full explanation →
1796
MCQhard

Router R1 is running EIGRP in VRF-A with two neighbors: R2 and R3. R2 is a directly connected router, R3 is reachable via R2. The network is experiencing EIGRP stuck-in-active (SIA) routes for prefixes learned from R3. R1 configuration: router eigrp 100, address-family ipv4 vrf VRF-A, network 10.0.0.0. R2 is configured similarly. The link between R1 and R2 is a serial link with low bandwidth. What is the root cause?

A.The low-bandwidth serial link between R1 and R2 causes EIGRP query packets to be delayed, exceeding the active timer and resulting in SIA.
B.The VRF configuration on R2 is missing the network statement for the link to R3.
C.EIGRP is not supported in VRF-Lite.
D.The active timer should be increased to prevent SIA.
AnswerA

Correct: Slow link can delay query/reply packets, leading to SIA.

Why this answer

EIGRP SIA occurs when a query is sent to a neighbor and the reply is not received within the active timer (default 3 minutes). In a VRF-Lite scenario, if the query scope is not limited, the query may propagate to R3 via R2, but if the serial link has low bandwidth or high delay, the query may time out. However, the most common cause in VRF-Lite is that the query is sent to all neighbors, and if one neighbor (R2) does not reply due to a slow link, SIA occurs.

The issue is that the query scope includes R2, but the link is slow, causing the active timer to expire.

Full explanation →
1797
Multi-Selectmedium

Which THREE symptoms indicate a BFD session failure? (Choose THREE.)

Select 3 answers
A.The BFD neighbor state shows 'Down'
B.The OSPF neighbor state changes from Full to Down
C.BFD timer expiry messages appear in logs
D.The interface MTU is set to 1500
E.The BFD discriminator value is zero
AnswersA, B, C

A 'Down' state directly indicates session failure.

Why this answer

A BFD session failure typically results in the neighbor state being 'Down', the routing protocol (like OSPF or EIGRP) neighbor going down due to BFD's fast detection, and BFD timers expiring. The other options are not direct symptoms of a BFD session failure.

Full explanation →
1798
MCQmedium

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue: R1# show bgp ipv4 unicast summary BGP router identifier 1.1.1.1, local AS number 65000 BGP table version is 15, main routing table version 15 2 network entries using 288 bytes of memory 2 path entries using 160 bytes of memory 2/2 BGP path/bestpath attribute entries using 296 bytes of memory 1 BGP AS-PATH entries using 24 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory Bitfield cache entries: current 1 (at peak 1) using 32 bytes of memory BGP using 800 total bytes of memory BGP activity 6/0 prefixes, 6/0 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.1.1.2 4 65001 15 15 15 0 0 00:12:34 2 10.2.2.2 4 65002 10 12 15 0 0 00:08:21 0 What does this output indicate?

A.Both neighbors are fully operational and exchanging routes.
B.Neighbor 10.1.1.2 is not sending any routes.
C.Neighbor 10.2.2.2 is not sending any routes, possibly due to filtering or no routes to advertise.
D.The BGP session with 10.2.2.2 is down.
AnswerC

The PfxRcd column shows 0 for 10.2.2.2, meaning no prefixes are received from that neighbor.

Why this answer

The show bgp summary output shows BGP neighbor states and prefix counts. Neighbor 10.1.1.2 is up and has sent 2 prefixes. Neighbor 10.2.2.2 is up but has sent 0 prefixes, indicating a possible issue with route advertisement or filtering.

Full explanation →
1799
Drag & Dropmedium

Drag and drop the steps to configure SNMPv3 with auth-priv and verify traps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, define the SNMPv3 group with security model and privacy settings. Next, create the user with authentication and privacy passwords. Then, enable SNMP traps globally.

After that, specify the trap receiver host with the correct security parameters. Finally, verify the configuration using show snmp user and show snmp host.

Full explanation →
1800
MCQhard

An engineer configures Control Plane Policing (CoPP) on a router. After configuration, OSPF neighbors are flapping. Which is the most likely explanation?

A.The class-default is configured with a police action that drops OSPF packets exceeding the rate.
B.The CoPP policy is applied to the wrong direction (input vs output).
C.The access-list used to classify OSPF packets is missing the 'permit' statement for OSPF protocol.
D.The CoPP policy uses 'drop' action for OSPF class.
AnswerA

If OSPF packets are not explicitly classified and permitted, they fall into class-default. The police action in class-default will drop packets that exceed the configured rate, causing OSPF hello packets to be dropped and neighbors to flap.

Why this answer

CoPP applies a policy-map to the control plane. If the default class-default is used without an explicit permit for OSPF packets, the implicit deny at the end of the policy-map will drop OSPF packets. The default class-default action is 'drop' if not explicitly configured, but even if a 'police' action is configured, the default behavior is to drop packets that exceed the rate.

Full explanation →
Page 23

Page 24 of 27

Page 25

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →