Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1801–1875

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 24

Page 25 of 27

Page 26
1801
MCQhard

A network administrator configures 'ipv6 nd raguard' on a switch port connected to a router. The router is sending Router Advertisements with a non-zero Router Lifetime. The switch logs indicate that RAs are being dropped, and the port goes into err-disable state. The engineer checks the RA Guard policy and sees that the default policy is applied. What is the most likely reason for the drops?

A.The RA has a hop-limit less than 255, which RA Guard treats as invalid and drops.
B.The RA Guard policy is configured to block all RAs regardless of source.
C.The router is using a multicast MAC address that is not allowed by RA Guard.
D.The switch port is in access mode, and RA Guard only works on trunk ports.
AnswerA

RA Guard expects hop-limit of 255 for locally generated RAs.

Why this answer

The default RA Guard policy on Cisco switches blocks Router Advertisements (RAs) that do not have a hop limit of 255. This is because legitimate routers always send RAs with a hop limit of 255, as specified in RFC 4861. When the router sends an RA with a hop limit less than 255, RA Guard treats it as invalid and drops it, which can also trigger err-disable state on the port.

Exam trap

Cisco often tests the specific hop-limit validation in the default RA Guard policy, where candidates mistakenly think the issue is with port mode or MAC addressing rather than the hop-limit field.

How to eliminate wrong answers

Option B is wrong because the default RA Guard policy does not block all RAs; it uses a device-role-based approach that validates specific fields like hop limit and source address. Option C is wrong because RA Guard does not filter based on multicast MAC addresses; it validates the IPv6 source address and hop limit, not the MAC layer. Option D is wrong because RA Guard works on both access and trunk ports; the port mode does not affect RA Guard functionality.

Full explanation →
1802
MCQmedium

In IPv6 FHS, which protocol is used to secure Neighbor Discovery messages with cryptographic authentication?

A.IPsec
B.SEND
C.SSL/TLS
D.MACsec
AnswerB

Correct. SEND (Secure Neighbor Discovery) uses CGAs and RSA signatures to authenticate ND messages.

Why this answer

B is correct because SEND (Secure Neighbor Discovery, RFC 3971) uses Cryptographically Generated Addresses (CGAs) and RSA signatures to authenticate Neighbor Discovery (ND) messages, protecting against threats like Neighbor Advertisement spoofing and Duplicate Address Detection (DAD) attacks. Unlike IPsec, SEND does not require a pre-established security infrastructure or key management, making it practical for securing ND in IPv6 first-hop segments.

Exam trap

Cisco often tests the misconception that IPsec is the universal security solution for IPv6, but the trap here is that SEND is the specific protocol designed to authenticate Neighbor Discovery messages, while IPsec is used for general IPv6 traffic protection and requires a different trust model.

How to eliminate wrong answers

Option A is wrong because IPsec can encrypt and authenticate IPv6 traffic but requires a pre-shared key or PKI infrastructure and is not designed specifically for securing Neighbor Discovery messages; SEND is the dedicated protocol for ND message authentication. Option C is wrong because SSL/TLS operates at the transport layer (TCP) and is used for securing application-layer communications (e.g., HTTPS), not for authenticating link-layer Neighbor Discovery messages in IPv6. Option D is wrong because MACsec (IEEE 802.1AE) provides hop-by-hop encryption and authentication at Layer 2 (Ethernet) but does not authenticate IPv6 ND messages; it secures the physical link, not the ND protocol itself.

Full explanation →
1803
MCQmedium

Given the following partial configuration on router R1: ``` interface GigabitEthernet0/0 ip vrf forwarding CUSTOMER_A ip address 192.168.1.1 255.255.255.0 ``` What is the effect of this configuration?

A.The interface is placed into VRF CUSTOMER_A, and the IP address is assigned correctly.
B.The interface is placed into VRF CUSTOMER_A, but the IP address is ignored because it must be configured before the VRF command.
C.The VRF name is misspelled; it should be 'vrf forwarding CUSTOMER_A' under the interface.
D.The configuration will fail because VRF CUSTOMER_A must be created globally first.
AnswerA

This is correct. The VRF association is applied before the IP address, so the IP address is associated with the VRF.

Why this answer

The 'ip vrf forwarding' command associates the interface with a VRF. It removes the IP address if one was previously configured, requiring it to be re-applied. This ensures traffic on this interface is forwarded using the VRF's routing table.

Full explanation →
1804
MCQhard

What is the default MTU size for ERSPAN encapsulated packets on Cisco IOS-XE?

A.1500 bytes
B.1492 bytes
C.The ERSPAN packet inherits the interface MTU, with no separate default.
D.The default ERSPAN MTU is 1518 bytes.
AnswerC

ERSPAN does not have a configurable MTU; it uses the interface MTU, and the encapsulation adds 8 bytes (Type II) overhead.

Why this answer

ERSPAN adds a GRE header (4 bytes) and an ERSPAN header (4 bytes for Type II) to the original packet. The default system MTU is 1500 bytes, but the ERSPAN packet may exceed this; however, the default MTU for the ERSPAN session itself is not explicitly set—it inherits the interface MTU. There is no separate default ERSPAN MTU; the question tests understanding that ERSPAN adds 8 bytes overhead.

Full explanation →
1805
MCQmedium

Examine the following configuration: ``` interface GigabitEthernet0/3 ip access-group WEB_ONLY out ! ip access-list extended WEB_ONLY permit tcp any any eq 80 permit tcp any any eq 443 ``` What is the effect of this ACL when applied outbound on GigabitEthernet0/3?

A.It permits all web traffic entering the interface.
B.It permits only HTTP and HTTPS traffic to leave the interface; all other traffic is denied.
C.It permits all TCP traffic to any destination.
D.It has no effect because the ACL is missing a deny statement.
AnswerB

Correct. The ACL permits web traffic and implicitly denies everything else.

Why this answer

The ACL named WEB_ONLY explicitly permits TCP traffic destined for ports 80 (HTTP) and 443 (HTTPS). When applied outbound on GigabitEthernet0/3, it filters traffic leaving the interface. Since every ACL has an implicit deny any at the end, only HTTP and HTTPS traffic is permitted outbound; all other traffic is denied.

Exam trap

Cisco often tests the implicit deny any concept and the distinction between inbound and outbound ACL application, causing candidates to overlook that an ACL without an explicit deny still denies all non-permitted traffic.

How to eliminate wrong answers

Option A is wrong because the ACL is applied outbound, not inbound, so it filters traffic leaving the interface, not entering. Option C is wrong because the ACL only permits TCP traffic to ports 80 and 443, not all TCP traffic to any destination. Option D is wrong because an explicit deny statement is not required; every ACL has an implicit deny any at the end, so the ACL does have an effect by denying all other traffic.

Full explanation →
1806
MCQmedium

What is the default behavior of EIGRP auto-summary in IOS-XE 15.x and later?

A.Auto-summary is enabled by default
B.Auto-summary is disabled by default
C.Auto-summary is enabled only for connected routes
D.Auto-summary is disabled only for point-to-point links
AnswerB

Correct. IOS-XE 15.x and later disable auto-summary by default to avoid suboptimal routing.

Why this answer

In IOS-XE 15.x and later, EIGRP auto-summary is disabled by default. This change was introduced to align with modern network designs that require classless routing and to prevent unintended route summarization at classful boundaries, which can cause routing loops or suboptimal path selection in discontiguous networks.

Exam trap

Cisco often tests the misconception that auto-summary remains enabled by default in newer IOS versions, as it was in older releases, leading candidates to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because auto-summary was enabled by default in older IOS versions (pre-15.x), but Cisco changed the default to disabled starting with IOS-XE 15.x and IOS 15.0(1)M. Option C is wrong because auto-summary, when enabled, applies to all EIGRP-learned routes, not just connected routes; connected routes are automatically advertised without summarization unless explicitly configured. Option D is wrong because auto-summary behavior is not interface-type specific; it is a global EIGRP process setting that applies to all routes regardless of link type (point-to-point or multipoint).

Full explanation →
1807
Multi-Selecthard

Which THREE commands would a network engineer use to troubleshoot an MPLS L3VPN issue where a CE router cannot reach a remote CE? (Choose THREE.)

Select 3 answers
A.show ip route vrf CUSTOMER_A
B.show ip bgp vpnv4 vrf CUSTOMER_A
C.show mpls forwarding-table vrf CUSTOMER_A
D.ping vrf CUSTOMER_A <remote-ce-ip>
E.show mpls ldp neighbor
AnswersA, B, C

Checks if the remote CE prefix is in the VRF routing table.

Why this answer

Troubleshooting end-to-end connectivity involves checking the VRF routing table, the BGP VPNv4 table, and the MPLS forwarding table. 'show ip route vrf <vrf>' verifies that the remote prefix is present. 'show ip bgp vpnv4 vrf <vrf>' confirms BGP has the route. 'show mpls forwarding-table vrf <vrf>' checks for label entries. 'ping vrf' tests connectivity from the PE. 'show mpls ldp neighbor' checks LDP status, which is important for the underlay but not directly for VPN route presence.

Full explanation →
1808
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip policy Interface Route-map GigabitEthernet0/0 PBR-VOICE R1# show route-map PBR-VOICE route-map PBR-VOICE, permit, sequence 10 Match clauses: ip address (access-lists): 130 Set clauses: ip next-hop 192.168.10.1 Policy routing matches: 0 packets, 0 bytes R1# show access-lists 130 Extended IP access list 130 10 permit udp any any range 16384 32767 R1# show interfaces GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Internet address is 10.1.1.1/24 R1# show ip route 192.168.10.1 % Network not in routing table Based on this output, what is the most likely problem?

A.The access list 130 is not matching any traffic.
B.The next-hop 192.168.10.1 is not reachable.
C.The interface GigabitEthernet0/0 is down.
D.The route map is missing a permit statement.
AnswerB

The show ip route output indicates the network is not in the routing table, so the next-hop is unreachable, causing PBR to fail to apply the set clause.

Why this answer

The next-hop 192.168.10.1 is not in the routing table. For PBR to forward packets to a next-hop, that next-hop must be reachable (in the routing table). If it is not, packets that match the route map are forwarded using the normal routing table instead.

The zero matches could be because no traffic matching ACL 130 has arrived, or because the next-hop is missing, but the missing route is a clear issue.

Full explanation →
1809
MCQmedium

Consider the following BGP configuration on router R5: router bgp 65005 bgp router-id 5.5.5.5 neighbor 10.5.5.6 remote-as 65006 neighbor 10.5.5.6 route-map SET-LP in ! route-map SET-LP permit 10 set local-preference 150 ! What is the result of this configuration?

A.All routes from 10.5.5.6 have their local preference set to 150, making them more preferred.
B.Only routes that match a prefix-list are affected; otherwise, default local preference is used.
C.Local preference is set to 150 for routes sent to 10.5.5.6.
D.The route-map is ignored because local-preference can only be set outbound.
AnswerA

The route-map matches all routes (no match condition) and sets local-preference to 150.

Why this answer

The route-map SET-LP is applied inbound. It sets the local preference to 150 for all routes received from 10.5.5.6. This makes those routes more preferred within the local AS compared to routes with default local preference (100).

Full explanation →
1810
Multi-Selecthard

An engineer is redistributing OSPF routes into EIGRP. Which TWO commands can be used to verify that the redistribution is working correctly? (Choose TWO.)

Select 2 answers
A.show ip route eigrp
B.show ip eigrp topology
C.show ip ospf database
D.show ip protocols
E.show ip route ospf
AnswersA, B

Correct. This command displays EIGRP routes in the routing table. If OSPF routes are successfully redistributed into EIGRP, they will appear as EIGRP routes (usually marked with 'D EX' for external).

Why this answer

To verify redistribution, you can check the routing table of the receiving protocol (EIGRP) to see if the redistributed routes appear. Additionally, 'show ip eigrp topology' shows the EIGRP topology table, which includes redistributed routes. 'show ip ospf database' is for OSPF LSDB and does not show redistributed routes into EIGRP. 'show ip protocols' shows redistribution configuration but not active routes. 'show ip route eigrp' shows only EIGRP routes, but if redistribution is working, those routes should appear there.

Full explanation →
1811
Multi-Selectmedium

Which THREE symptoms indicate that Policy-Based Routing (PBR) is not working as expected? (Choose THREE.)

Select 3 answers
A.Traffic that should be policy-routed follows the routing table instead.
B.High CPU usage on the router when processing PBR traffic.
C.The 'show ip policy' command shows the route-map applied to the interface.
D.Packets are dropped when the 'set interface' specifies a down interface.
E.The routing table is updated with new routes from PBR.
AnswersA, B, D

This indicates PBR is not matching the traffic or not applied correctly.

Why this answer

If traffic that should be policy-routed follows the routing table instead, PBR may not be applied or the route-map may not match. High CPU usage can occur if PBR is process-switched and ACLs are large. If the 'set interface' specifies a down interface, packets are dropped.

The 'show ip policy' command shows PBR application, not a symptom of failure. PBR does not affect routing table updates. A mismatch in ACLs can cause unintended forwarding.

Full explanation →
1812
Multi-Selecthard

Which TWO statements about PBR and the 'set ip next-hop recursive' command are true? (Choose TWO.)

Select 2 answers
A.The 'set ip next-hop recursive' command can specify a next-hop address that is not directly connected, and the router will perform a recursive lookup to determine the outgoing interface.
B.The 'set ip next-hop recursive' command is the default behavior for 'set ip next-hop' when the next hop is not directly connected.
C.Using 'set ip next-hop recursive' can cause the router to perform additional routing table lookups, potentially increasing CPU utilization.
D.The 'set ip next-hop recursive' command is only supported on Cisco IOS-XE platforms, not on classic IOS.
E.When using 'set ip next-hop recursive', the router will drop the packet if the recursive lookup fails to find a route to the next hop.
AnswersA, C

Correct. This command is designed for non-directly connected next hops; the router uses the routing table to resolve the next hop recursively.

Why this answer

The 'set ip next-hop recursive' command allows PBR to use a next-hop address that is not directly connected; the router performs recursive lookup to find the outgoing interface. This is different from 'set ip next-hop' which requires a directly connected next hop. The recursive option is useful when the next hop is multiple hops away.

However, it can impact performance due to the recursive lookup.

Full explanation →
1813
MCQhard

A network engineer runs the following command to debug Flexible NetFlow cache events: R1# debug flow monitor FLOW-MONITOR-1 Flow Monitor FLOW-MONITOR-1 debugging is on R1# *Mar 1 00:10:15.123: FLOW MONITOR: Cache entry created for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) *Mar 1 00:10:15.124: FLOW MONITOR: Cache entry updated for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) - bytes: 1460, packets: 1 *Mar 1 00:10:15.125: FLOW MONITOR: Cache entry updated for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) - bytes: 2920, packets: 2 *Mar 1 00:10:45.123: FLOW MONITOR: Cache entry aged for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) - reason: inactive timeout What does this output indicate?

A.The flow was aged due to active timeout after 1800 seconds.
B.The flow was created, updated twice, and then aged due to inactive timeout, indicating a normal flow lifecycle.
C.The flow was dropped because the cache was full.
D.The flow is still active in the cache.
AnswerB

The debug shows creation, two updates as packets arrive, and eventual aging due to inactivity, which is expected.

Why this answer

The debug output shows the lifecycle of a flow in the Flexible NetFlow cache. A flow is created, then updated as packets are received, and eventually aged out due to inactive timeout after 30 seconds of inactivity (the default is 15 seconds, but this may be configured differently). This is normal behavior for a TCP connection that has ended.

Full explanation →
1814
MCQmedium

Which BGP attribute is used as the first tie-breaker in the route selection process when comparing routes from different peers?

A.Local preference
B.Weight
C.AS path length
D.MED
AnswerB

Correct. Weight is the first attribute checked; it is Cisco proprietary.

Why this answer

The BGP best-path selection algorithm first prefers the path with the highest weight (Cisco proprietary), then highest local preference, then locally originated routes.

Full explanation →
1815
MCQmedium

A network engineer is troubleshooting an IPv6 over IPv4 tunnel that is used to connect two remote sites. The tunnel is configured with a tunnel source that is a loopback interface. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address. The engineer checks the routing table and sees a route to the remote loopback's IPv4 address via a default route. What is the most likely cause?

A.The remote router does not have a route to the loopback network used as the tunnel source; it only has a default route that may not cover that prefix.
B.The tunnel destination is configured with the loopback address of the remote router, but the remote router's tunnel source is a different interface.
C.The tunnel interface is missing the 'tunnel mode ipv6ip' command.
D.The IPv6 address on the tunnel interface is not in the same subnet as the remote tunnel IPv6 address.
AnswerA

Correct because the tunnel source loopback address must be reachable from the remote router. If the default route does not include that specific prefix (e.g., due to routing policy or subnet mismatch), the tunnel cannot encapsulate packets.

Why this answer

The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address because the remote router lacks a route back to the loopback network used as the tunnel source. The remote router only has a default route, which may not cover the specific prefix of the local loopback, causing return traffic to be dropped. For IPv6 over IPv4 tunnels, the tunnel source and destination must be reachable via unicast routing; a missing or insufficient route (like a default that doesn't match) breaks bidirectional communication.

Exam trap

Cisco often tests the misconception that a tunnel being up guarantees end-to-end reachability, but the real issue is asymmetric routing caused by missing return routes for the tunnel source IPv4 address.

How to eliminate wrong answers

Option B is wrong because the tunnel destination is correctly configured with the remote router's loopback address; the issue is not about mismatched tunnel sources, but about the remote router lacking a route back to the local loopback network. Option C is wrong because if the tunnel is up, the 'tunnel mode ipv6ip' command is already applied; without it, the tunnel would not come up at all. Option D is wrong because IPv6 addresses on tunnel interfaces do not need to be in the same subnet for ping to work; they only need to be routable, and the tunnel itself provides the logical link.

Full explanation →
1816
MCQhard

A dual-stack network uses BGP for IPv6 between two ISPs. R1 (AS 100) receives a full BGP table from R2 (AS 200). R1 has an IPv6 ACL applied inbound on the interface to R2 that permits only BGP (TCP 179) and denies all other traffic. R1 also has uRPF configured in strict mode on the same interface. R1's BGP table has a route to 2001:db8:1::/48 with next-hop 2001:db8:2::2. R1's routing table shows the route, but traffic from R1 to 2001:db8:1::1 fails. R1 shows 'show ipv6 cef 2001:db8:1::/48' points to 2001:db8:2::2 via the interface to R2. What is the root cause?

A.The ACL on R1 blocks the return traffic from the destination, which is not BGP, causing the ping to fail.
B.uRPF strict mode drops the outgoing traffic because the source address is not reachable via the interface.
C.The next-hop 2001:db8:2::2 is not reachable due to a missing ND entry.
D.BGP next-hop resolution fails because the next-hop is not in the FIB.
AnswerA

The ACL permits only BGP. Return traffic (ICMPv6 echo reply) is blocked, so the ping fails.

Why this answer

The IPv6 ACL on R1 permits only BGP (TCP port 179) inbound from R2. When R1 sends a ping to 2001:db8:1::1, the return ICMPv6 echo-reply traffic from the destination (via R2) is not BGP and is therefore denied by the inbound ACL, causing the ping to fail. The BGP table and routing table are correct, but the ACL blocks the non-BGP return traffic.

Exam trap

Cisco often tests the directional nature of ACLs—candidates assume an inbound ACL only affects traffic initiated from the remote side, forgetting that return traffic for locally initiated sessions is also subject to the inbound ACL.

How to eliminate wrong answers

Option B is wrong because uRPF strict mode checks the source address of incoming packets against the FIB to ensure it is reachable via the receiving interface; it does not drop outgoing traffic. Option C is wrong because if the next-hop 2001:db8:2::2 were unreachable due to a missing ND entry, the route would not appear in the routing table or CEF, but the question states both tables show the route. Option D is wrong because BGP next-hop resolution has already succeeded—the route is in the FIB and CEF points to the correct next-hop and interface.

Full explanation →
1817
MCQhard

A network engineer is troubleshooting a redistribution issue between OSPF and EIGRP. Router R3 is redistributing OSPF routes into EIGRP, but some OSPF external routes are not appearing in the EIGRP topology table. The engineer checks the redistribute command under EIGRP and sees a route-map named RM-OSPF that uses a prefix-list to match specific prefixes. The missing routes are permitted by the prefix-list. What is the most likely cause?

A.The route-map is missing a 'set metric' command; EIGRP requires a metric for redistributed routes.
B.The prefix-list is using the wrong sequence number and is being overridden by a later deny statement.
C.The OSPF routes are type-5 LSAs, which cannot be redistributed into EIGRP.
D.The route-map is applied to the OSPF process instead of the EIGRP process.
AnswerA

Correct because EIGRP will not accept redistributed routes without an explicit metric.

Why this answer

The route-map may have a 'set metric' command that is misconfigured, or the route-map may be missing the 'set metric' command entirely, causing EIGRP to reject the route because it requires a metric for redistributed routes. Alternatively, the route-map might have a 'match route-type' that excludes external type-2 routes.

Full explanation →
1818
MCQhard

In a VRF-Lite environment, EIGRP is configured between two routers. The engineer notices that the EIGRP neighbor relationship is flapping intermittently. Debug output shows 'dually' messages and the route is occasionally marked as 'stuck-in-active' (SIA). The link is Ethernet with no errors. Which is the most likely explanation?

A.The EIGRP K-values are mismatched between the two routers, causing the neighbor to reset.
B.A unidirectional link issue is present, where EIGRP packets are successfully sent but not received, causing the query process to time out.
C.The EIGRP stub routing feature is enabled on one router, preventing query propagation and causing the active process to hang.
D.The 'eigrp log-neighbor-changes' command is causing excessive logging, which delays EIGRP processing.
AnswerB

Unidirectional link causes queries to be sent but replies not received, leading to SIA and neighbor flapping.

Why this answer

EIGRP uses the Reliable Transport Protocol (RTP) for updates, queries, and replies. If there is a unidirectional link issue (e.g., one direction has high latency or packet loss), the query process may not receive replies in time, causing the route to become SIA. This is a classic edge case where the link appears operational but is unidirectional for EIGRP packets.

Full explanation →
1819
MCQmedium

According to RFC 2663, what is the term for the process of translating both the source and destination IP addresses in a packet?

A.Static NAT
B.Twice NAT
C.PAT
D.Double NAT
AnswerB

Twice NAT translates both source and destination addresses.

Why this answer

RFC 2663 defines 'Twice NAT' as the process of translating both the source and destination IP addresses within a single packet. This is necessary when the private and public address spaces overlap, requiring simultaneous translation of both the source and destination fields to ensure proper routing and reachability.

Exam trap

The trap here is confusing 'Twice NAT' with 'Double NAT' — Cisco often tests this distinction, where Double NAT implies two separate NAT devices in series, while Twice NAT is a single device performing bidirectional translation as defined in RFC 2663.

How to eliminate wrong answers

Option A is wrong because Static NAT only translates the source IP address (or destination IP address in reverse) on a one-to-one basis, not both addresses in the same packet. Option C is wrong because PAT (Port Address Translation) translates only the source IP address and port, leaving the destination IP address unchanged. Option D is wrong because Double NAT refers to two separate NAT devices performing translations sequentially (e.g., ISP and customer CPE), not a single device translating both source and destination addresses in one packet.

Full explanation →
1820
MCQhard

An engineer configures a Cisco router with 'aaa authentication login default local' and 'aaa authorization exec default local'. The engineer then attempts to log in via the console and is prompted for a username and password. The username 'admin' with password 'cisco' is configured locally. The login fails. What is the most likely cause?

A.The console line is not configured with 'login authentication default'.
B.The username 'admin' is not in the local database.
C.The password 'cisco' is incorrect.
D.The 'aaa new-model' command is missing.
AnswerA

Correct because the default AAA login method list must be applied to the console line using the 'login authentication' command.

Why this answer

By default, the console line does not inherit the AAA authentication methods defined under 'aaa authentication login default local'. The 'login authentication default' command must be explicitly applied to the console line under line configuration to use the global AAA authentication method. Without it, the console line falls back to its default behavior, which does not use AAA, causing the login to fail despite the local user being configured.

Exam trap

Cisco often tests the distinction between defining a default AAA method list and applying it to a specific line, trapping candidates who assume that 'aaa authentication login default local' automatically applies to the console without the 'login authentication default' command.

How to eliminate wrong answers

Option B is wrong because the username 'admin' is explicitly stated as configured locally, so it is in the local database. Option C is wrong because the password 'cisco' is also stated as configured correctly, and the failure is not due to a password mismatch but due to the AAA method not being applied to the console line. Option D is wrong because the presence of 'aaa authentication login default local' and 'aaa authorization exec default local' implies that 'aaa new-model' has already been enabled; without it, these AAA commands would be rejected by the router.

Full explanation →
1821
Multi-Selecthard

An engineer is troubleshooting an EIGRP network where some routers are not learning all routes, and suspects a route filtering issue. Which TWO statements about EIGRP route filtering are true? (Choose TWO.)

Select 2 answers
A.A distribute-list configured under the EIGRP process using an ACL will filter routes based on the source IP address of the EIGRP update, not the route prefix.
B.A prefix-list applied in a distribute-list under EIGRP can filter routes based on both the prefix and the prefix length, using ge and le operators.
C.An outbound distribute-list on an EIGRP router will prevent the router from installing filtered routes in its own routing table.
D.If a distribute-list is applied both at the EIGRP process level and on a specific interface, the process-level distribute-list takes precedence for that interface.
E.The 'distance' command configured under EIGRP can be used to filter routes by setting the administrative distance to 255, which prevents the route from being installed.
AnswersA, B

When using an ACL in a distribute-list under EIGRP, the ACL matches the source IP address of the router sending the update, not the route prefix itself. This is a common misconception.

Why this answer

A is correct because a distribute-list using an ACL matches the source IP of the EIGRP update, not the route prefix. B is correct because a prefix-list can use ge and le operators to match both prefix and prefix length. C is false because an outbound distribute-list filters routes before sending to neighbors, not local installation.

D is false because an interface-specific distribute-list takes precedence over a process-level one. E is false because the distance command sets administrative distance; while a value of 255 prevents route installation, it is not considered a route filtering method in the context of EIGRP distribute-lists. Thus, only A and B are true.

Full explanation →
1822
Drag & Dropmedium

Drag and drop the steps to configure uRPF in strict mode on an edge router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order begins with entering global configuration mode, then configuring the interface, enabling IPv6 on the interface, applying uRPF strict mode, and finally verifying the configuration with a show command.

Full explanation →
1823
MCQmedium

Examine this CoPP configuration: ip access-list extended PROTECT-ACL permit tcp any any eq 22 permit tcp any any eq 23 permit tcp any any eq 179 ! class-map match-all PROTECT-CLASS match access-group name PROTECT-ACL ! policy-map PROTECT-POLICY class PROTECT-CLASS police 16000 conform-action transmit exceed-action drop class class-default police 64000 conform-action transmit exceed-action drop ! control-plane service-policy input PROTECT-POLICY What will happen to SSH traffic that exceeds 16000 bps?

A.SSH traffic exceeding 16000 bps is dropped.
B.SSH traffic exceeding 16000 bps is still accepted because SSH is critical.
C.SSH traffic is not affected because the ACL uses 'permit' and the class-map uses 'match-all'.
D.SSH traffic exceeding 16000 bps is sent with a lower priority.
AnswerA

Correct. The exceed-action is drop, so any SSH traffic above the conform rate is dropped.

Why this answer

The CoPP policy applies a police rate of 16000 bps to the PROTECT-CLASS class, which matches SSH traffic via the ACL. When SSH traffic exceeds this rate, the exceed-action is configured to drop, so any SSH packets beyond 16000 bps are discarded. This is standard CoPP behavior: the policer enforces the rate limit regardless of the protocol's importance.

Exam trap

Cisco often tests the misconception that CoPP can prioritize or remark traffic instead of simply dropping it, leading candidates to choose 'lower priority' or 'still accepted' options, but the exceed-action explicitly defines the fate of excess traffic.

How to eliminate wrong answers

Option B is wrong because CoPP does not prioritize traffic based on criticality; the policer enforces the configured rate limit, and exceeding traffic is dropped per the exceed-action. Option C is wrong because the ACL's 'permit' entries and the class-map's 'match-all' logic correctly classify SSH traffic into the PROTECT-CLASS, so the policer applies to it; there is no bypass due to ACL or class-map syntax. Option D is wrong because CoPP policers only support conform-action and exceed-action (transmit or drop), not lowering priority; there is no 'lower priority' action in a CoPP policer.

Full explanation →
1824
Multi-Selecthard

Which TWO statements correctly describe the behavior of VRF-Lite when using OSPF as the IGP? (Choose TWO.)

Select 2 answers
A.The OSPF process must be configured with the 'vrf <name>' keyword to associate it with a specific VRF.
B.OSPF in VRF-Lite requires an MP-BGP session to exchange routes between VRFs.
C.By default, OSPF automatically redistributes all connected routes in the VRF into OSPF.
D.The 'network' command under the OSPF process can be used to enable OSPF on interfaces belonging to the VRF.
E.OSPF in VRF-Lite uses different LSA types compared to global OSPF.
AnswersA, D

Correct. The command 'router ospf <pid> vrf <name>' creates a VRF-aware OSPF instance.

Why this answer

In VRF-Lite, OSPF can be configured per VRF, and the OSPF process uses the VRF's routing table. The 'router ospf <process-id> vrf <name>' command creates a VRF-aware OSPF process. By default, OSPF uses the VRF's route table, not the global table.

The 'network' statement under the OSPF process is still used to enable OSPF on interfaces, but the interface must be in the same VRF. Option A is correct because the OSPF process is VRF-specific. Option D is correct because the 'network' command is still valid.

Option B is incorrect because OSPF does not require BGP; it can run directly. Option C is incorrect because OSPF does not automatically redistribute connected routes; a redistribution command is needed. Option E is incorrect because OSPF LSA types are the same in VRF-Lite.

Full explanation →
1825
MCQhard

An engineer is troubleshooting why SNMPv3 informs are not being received by the NMS from router R6. The configuration includes 'snmp-server group ADMIN v3 priv', 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456', and 'snmp-server host 10.1.1.100 informs version 3 priv admin'. The NMS can receive SNMPv3 traps from other routers. What is the most likely cause?

A.The NMS is not configured to respond to SNMP informs, so the router does not receive acknowledgment.
B.The 'snmp-server host' command should use 'traps' instead of 'informs' for SNMPv3.
C.The router needs the 'snmp-server enable informs' command globally.
D.The SNMPv3 user must have the 'auth' privilege instead of 'priv' to send informs.
AnswerA

Correct because informs require an acknowledgment; if the NMS does not support it, informs fail.

Why this answer

SNMPv3 informs require the NMS to send an acknowledgment back to the router. If the NMS is not configured to respond to informs, the router never receives the acknowledgment and will not send the inform. The configuration shown is correct for sending informs, so the issue is likely on the NMS side, especially since the NMS can receive traps from other routers.

Exam trap

Cisco often tests the distinction between traps (unconfirmed) and informs (confirmed), leading candidates to incorrectly assume that a missing global command or wrong privilege level is the cause, rather than the NMS's inability to acknowledge the inform.

How to eliminate wrong answers

Option B is wrong because SNMPv3 supports both traps and informs; the 'informs' keyword is valid and does not need to be replaced with 'traps'. Option C is wrong because the 'snmp-server enable informs' command is not a valid global command in Cisco IOS; informs are enabled per host using the 'informs' keyword in the 'snmp-server host' command. Option D is wrong because the 'priv' privilege level is required for sending informs with privacy (encryption), and 'auth' would only provide authentication without encryption, which is not the issue here.

Full explanation →
1826
MCQeasy

What is the default administrative distance for internal EIGRP routes?

A.90
B.110
C.120
D.170
AnswerA

Internal EIGRP routes have a default AD of 90.

Why this answer

The default administrative distance for internal Enhanced Interior Gateway Routing Protocol (EIGRP) routes is 90. This value is used by Cisco routers to select the best path when multiple routing protocols provide route information for the same destination network, with a lower administrative distance being preferred over a higher one.

Exam trap

Cisco often tests the distinction between internal and external EIGRP administrative distances, so the trap here is that candidates may confuse the default AD of 170 for external EIGRP routes with the AD of 90 for internal EIGRP routes.

How to eliminate wrong answers

Option B is wrong because 110 is the default administrative distance for Open Shortest Path First (OSPF) routes, not for EIGRP. Option C is wrong because 120 is the default administrative distance for Routing Information Protocol (RIP) routes. Option D is wrong because 170 is the default administrative distance for external EIGRP routes (routes redistributed into EIGRP from another protocol), not for internal EIGRP routes.

Full explanation →
1827
MCQmedium

A network engineer runs the following command on Router R1: R1# show dmvpn Interface: Tunnel0, IPv4 NHRP Details Type:Hub, NHRP Peers:2, # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- ----------------- --------------- ----- -------- ----- 1 10.0.0.2 10.1.1.2 UP 00:10:00 D 2 10.0.0.3 10.1.1.3 UP 00:05:00 D Based on this output, what is the role of Router R1 in the DMVPN network?

A.Router R1 is the hub router with two active spoke connections.
B.Router R1 is a spoke router with two hub connections.
C.Router R1 is a spoke router with two other spoke connections.
D.Router R1 is not participating in DMVPN because the tunnel is down.
AnswerA

The 'Type:Hub' and two UP peers indicate it is a hub.

Why this answer

The output shows that Router R1 has a Tunnel0 interface configured as a DMVPN hub (Type:Hub) with two NHRP peers (10.1.1.2 and 10.1.1.3) in the UP state. The 'D' attribute in the Attrb column indicates these peers are directly connected spokes, confirming R1 is the hub router with two active spoke connections.

Exam trap

Cisco often tests the distinction between the 'Type:Hub' and 'Type:Spoke' fields in the show dmvpn output, and candidates may misinterpret the 'D' attribute as meaning the router is a spoke or that the tunnel is down, when it actually indicates a dynamic peer relationship on the hub.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows Type:Hub, not a spoke, and a spoke router would have a single hub connection, not two hub connections. Option C is wrong because a spoke router does not have two other spoke connections in a typical DMVPN phase 2/3; spokes only connect to the hub, and the output shows the hub role. Option D is wrong because the tunnel state is UP (as indicated by the 'UP' status for both peers), meaning R1 is actively participating in DMVPN.

Full explanation →
1828
MCQmedium

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Session_Reset R1# show event manager history events Event History: No. Time Type Name 1 00:02:00 UTC Mar 1 syslog BGP_Session_Reset 2 00:02:05 UTC Mar 1 syslog BGP_Session_Reset 3 00:02:10 UTC Mar 1 syslog BGP_Session_Reset Based on this output, which statement is correct?

A.The BGP session reset event has occurred three times.
B.The EEM policy is not triggering any events.
C.The BGP session is stable.
D.The EEM policy is disabled.
AnswerA

The event history shows three entries for BGP_Session_Reset, each at different times.

Why this answer

The output shows one registered EEM applet policy named BGP_Session_Reset, and three triggered syslog events for that policy. The correct answer is that the BGP session reset event has occurred multiple times, indicating a persistent issue.

Full explanation →
1829
MCQeasy

A network engineer runs the following command on Router R4: R4# show ip route 10.10.10.0 Routing entry for 10.10.10.0/24 Known via "connected", distance 0, metric 0 (connected) Redistributing via eigrp 100 Last update from 10.10.10.1 on GigabitEthernet0/0, 00:00:00 ago Routing Descriptor Blocks: * 10.10.10.1, via GigabitEthernet0/0 Route metric is 0, traffic share count is 1 Based on this output, which statement is true?

A.The route is a static route with distance 0.
B.The route is a connected route, as indicated by distance 0.
C.The route is redistributed from EIGRP into connected.
D.The administrative distance of 0 indicates a floating static route.
AnswerB

Connected routes have an administrative distance of 0, confirming this is a directly connected network.

Why this answer

The route is directly connected, as indicated by 'known via connected' and distance 0. The administrative distance of 0 is the default for connected routes.

Full explanation →
1830
MCQhard

A network engineer is troubleshooting a DHCPv4 issue where a router configured as a DHCP server is not assigning addresses from a pool to clients on a specific VLAN. The pool is configured with 'network 10.1.1.0 255.255.255.0' and 'default-router 10.1.1.1'. The router's interface Gi0/0.10 (subinterface) has encapsulation dot1Q 10 and IP 10.1.1.1/24. Clients send DISCOVER messages, but the router does not respond. The engineer notices that the router has multiple DHCP pools configured. What is the most likely cause?

A.The DHCP pool is configured under a VRF, but the interface is not in that VRF.
B.The subinterface is missing the 'ip helper-address' command.
C.The 'ip dhcp server' command is missing globally.
D.The encapsulation dot1Q 10 is misconfigured, causing the router to not receive broadcasts.
AnswerA

Correct because if the pool is defined with 'vrf <name>', it will only respond to DHCP requests on interfaces belonging to that VRF; the subinterface is not in any VRF, so the pool is ignored.

Why this answer

The router has multiple DHCP pools configured, and the pool for VLAN 10 is likely bound to a VRF. When a DHCP pool is configured under a VRF, the router only responds to DHCP DISCOVER messages received on interfaces that belong to that same VRF. Since the subinterface Gi0/0.10 is not in the VRF, the router ignores the client broadcasts, even though the IP address and subnet match the pool.

Exam trap

Cisco often tests the VRF-aware DHCP concept by presenting a scenario where a DHCP server has multiple pools and clients are not getting addresses, leading candidates to incorrectly suspect missing helper addresses or global DHCP commands, when the real issue is a VRF mismatch between the pool and the interface.

How to eliminate wrong answers

Option B is wrong because the 'ip helper-address' command is used to forward DHCP broadcasts to a remote DHCP server, not to enable a local DHCP server to respond; the router is acting as the DHCP server itself, so this command is unnecessary. Option C is wrong because the global 'ip dhcp server' command does not exist in Cisco IOS; DHCP server functionality is enabled by default when a pool is configured, and the correct global command is 'service dhcp' (which is enabled by default). Option D is wrong because the encapsulation dot1Q 10 is correctly configured for the subinterface to receive VLAN 10 traffic; if it were misconfigured, the router would not receive any frames from that VLAN, but the question states clients send DISCOVER messages, implying the router receives them.

Full explanation →
1831
MCQhard

A network engineer configures OSPF on two routers connected via Ethernet. The adjacency forms but remains stuck in EXSTART state. Both routers have identical OSPF configuration except for MTU. Which is the most likely explanation?

A.The OSPF network type is point-to-point on one side and broadcast on the other.
B.The MTU on the interfaces is mismatched, causing DBD packet rejection.
C.The OSPF router ID is identical on both routers.
D.The 'ip ospf authentication' is configured only on one side.
AnswerB

MTU mismatch is a classic cause of EXSTART state.

Why this answer

OSPF uses the interface MTU in Database Description (DBD) packets. If MTU values differ, the neighbor will reject DBD packets larger than its own MTU, causing the adjacency to stall in EXSTART. The fix is to use 'ip ospf mtu-ignore' or match MTU.

Full explanation →
1832
MCQhard

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue: R1# debug ip policy Policy routing debugging is on R1# *Mar 1 00:15:30.789: IP: s=10.0.0.1 (FastEthernet0/0), d=20.0.0.1, len 100, policy match *Mar 1 00:15:30.789: IP: s=10.0.0.1 (FastEthernet0/0), d=20.0.0.1, len 100, policy rejected *Mar 1 00:15:30.789: IP: s=10.0.0.2 (FastEthernet0/0), d=20.0.0.2, len 100, policy match *Mar 1 00:15:30.789: IP: s=10.0.0.2 (FastEthernet0/0), d=20.0.0.2, len 100, policy routed *Mar 1 00:15:30.789: IP: FastEthernet0/0 to GigabitEthernet0/1 192.168.1.1 What does this output indicate?

A.The route-map has multiple sequences or ACL entries; one source is permitted, the other is denied or fails next-hop check.
B.Both packets should have been rejected due to a misconfiguration.
C.The next-hop 192.168.1.1 is unreachable for the first packet.
D.The ACL is blocking all traffic from 10.0.0.1.
AnswerA

The different treatment indicates different match conditions or set clause outcomes.

Why this answer

The debug shows two packets: the first from 10.0.0.1 was rejected, while the second from 10.0.0.2 was successfully routed to 192.168.1.1. This suggests that the route-map may have multiple sequences or the ACL differentiates between the sources.

Full explanation →
1833
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 tunnel brief Tunnel2: IPv6/IP, intf id 0/0/2, 6to4, mtu 1280 Source: 192.168.1.1 (GigabitEthernet0/0) Destination: 192.168.2.1 Tunnel transport: IPv4 Based on this output, which statement is correct?

A.This is a correctly configured 6to4 tunnel.
B.This tunnel is actually a manually configured IPv6/IP tunnel, not a 6to4 tunnel.
C.The tunnel is an ISATAP tunnel.
D.The tunnel is in an up/up state and passing traffic.
AnswerB

The presence of a specific destination address indicates a manual tunnel; 6to4 tunnels have no configured destination.

Why this answer

The output shows a manually configured IPv6/IP tunnel because it specifies both a source and destination IPv4 address. In a true 6to4 tunnel, the destination is automatically derived from the 6to4 prefix (2002::/16) and the destination IPv4 address, not statically configured. The presence of a static destination address indicates this is a manually configured tunnel, not a 6to4 tunnel.

Exam trap

Cisco often tests the distinction between automatic 6to4 tunnels (where the destination is derived from the IPv6 address) and manually configured tunnels (where both source and destination are explicitly set), leading candidates to assume any tunnel with '6to4' in the output is correctly configured.

How to eliminate wrong answers

Option A is wrong because a correctly configured 6to4 tunnel does not have a statically configured destination IPv4 address; the destination is derived automatically from the 6to4 prefix. Option C is wrong because an ISATAP tunnel uses a different interface identifier format (::0:5EFE:IPv4-address) and typically does not show a static destination address in this manner. Option D is wrong because the output does not show interface status or traffic statistics; 'show ipv6 tunnel brief' only displays configuration parameters, not operational state.

Full explanation →
1834
MCQeasy

What is the maximum number of VRFs that can be configured on a Cisco IOS router?

A.256
B.1024
C.Platform-dependent, typically limited by available memory.
D.Unlimited
AnswerC

This is correct. The number of VRFs is constrained by hardware resources.

Why this answer

The maximum number of VRFs is platform-dependent. There is no fixed IOS-wide limit; it varies based on hardware and software resources.

Full explanation →
1835
MCQhard

An engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers have MP-BGP peering and the VRF is configured with route-target import 100:100. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, but the show ip route vrf CUSTOMER command does not have this route. The show ip bgp vpnv4 all 10.2.2.0/24 command on PE1 shows the route is received but not best. What is the most likely cause?

A.The route-target import on PE1 is missing.
B.The BGP next-hop (PE2 loopback) is not reachable in the global routing table.
C.The VRF on PE1 has a different route-target export.
D.The MP-BGP session is using an incorrect address family.
AnswerB

Correct: BGP requires the next-hop to be reachable for the route to be considered best and installed.

Why this answer

The route is received but not marked as best, so it is not installed in the routing table. Common reasons include the route being suppressed due to a higher AD from another source or the next-hop being unreachable. In this scenario, the most likely cause is that the BGP next-hop is not reachable in the global routing table.

Full explanation →
1836
MCQeasy

Which statement correctly describes the default behavior of EIGRP auto-summary on Cisco IOS-XE?

A.Auto-summary is enabled by default, summarizing classful boundaries.
B.Auto-summary is disabled by default, so subnets are advertised without summarization.
C.Auto-summary is enabled only for EIGRP named mode configurations.
D.Auto-summary is disabled by default, but only for IPv6 EIGRP.
AnswerB

Correct: In IOS-XE, auto-summary is off by default, preventing unwanted classful summarization.

Why this answer

In Cisco IOS-XE, EIGRP auto-summary is disabled by default. This means that EIGRP advertises subnets without summarizing them to their classful boundaries, preserving the original prefix lengths. This behavior changed from older IOS versions where auto-summary was enabled by default, which could cause routing issues in discontiguous networks.

Exam trap

Cisco often tests the change in default behavior between older IOS and IOS-XE, where candidates may incorrectly assume auto-summary is still enabled by default based on legacy knowledge.

How to eliminate wrong answers

Option A is wrong because auto-summary is not enabled by default on Cisco IOS-XE; it was enabled by default in older IOS versions but is now disabled. Option C is wrong because auto-summary behavior is consistent across both classic and named mode EIGRP configurations; named mode does not enable auto-summary by default. Option D is wrong because auto-summary is disabled by default for both IPv4 and IPv6 EIGRP, not only for IPv6; additionally, auto-summary does not apply to IPv6 EIGRP as it is classless by design.

Full explanation →
1837
Multi-Selectmedium

Which TWO commands can be used to verify the NHRP shortcut route creation in a DMVPN Phase 3 network? (Choose TWO.)

Select 2 answers
A.show ip nhrp
B.show ip route
C.show dmvpn
D.show crypto ipsec sa
E.show ip eigrp topology
AnswersA, B

This command shows NHRP cache entries, including shortcut routes with the 'shortcut' flag.

Why this answer

In DMVPN Phase 3, shortcut routes are created by NHRP. The 'show ip nhrp' command displays the NHRP cache, which includes shortcut entries. The 'show ip route' command shows the routing table, where shortcut routes appear as NHRP-learned routes.

The other commands do not show shortcut route information.

Full explanation →
1838
MCQhard

A network engineer notices that after redistributing EIGRP into OSPF, a routing loop occurs between two routers. Router R1 config: router ospf 1 redistribute eigrp 100 subnets ! router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 R1# show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "eigrp 100", distance 90, metric 128256 Redistributing via eigrp 100 Last update from 10.1.1.2 on GigabitEthernet0/0 R2# show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20 Redistributing via ospf 1 Last update from 10.1.1.1 on GigabitEthernet0/0 What is the root cause?

A.The redistribute commands are missing route-map filters, causing mutual redistribution and a loop.
B.The EIGRP metric is too low, causing OSPF to prefer the redistributed route.
C.The OSPF administrative distance is higher than EIGRP, causing suboptimal path selection.
D.The subnets keyword under OSPF redistribution is causing classful behavior.
AnswerA

Without filtering, routes learned from one protocol are redistributed back, creating a loop.

Why this answer

Mutual redistribution between EIGRP and OSPF without route filtering causes a routing loop. R1 learns the route via EIGRP and redistributes into OSPF; R2 learns via OSPF and redistributes back into EIGRP, creating a loop. The fix is to use route-maps to filter redistributed routes or set administrative distance to prefer one source.

Full explanation →
1839
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 traffic | include tunnel 0 tunnel packets received 0 tunnel packets sent 0 tunnel packets dropped Based on this output, what can be concluded?

A.The tunnel is passing traffic normally.
B.The tunnel is not carrying any IPv6 traffic.
C.The tunnel is dropping all packets.
D.The tunnel is using IPsec encryption.
AnswerB

All counters are zero, meaning no traffic.

Why this answer

The 'show ipv6 traffic | include tunnel' command filters the output to show only lines containing 'tunnel'. The counters for packets received, sent, and dropped are all zero, which indicates that no IPv6 packets have been encapsulated or decapsulated by any tunnel interface. This means the tunnel is not carrying any IPv6 traffic, making option B correct.

Exam trap

Cisco often tests the misinterpretation of zero counters as 'no issues' (option A) or as 'dropping all packets' (option C), when in fact zero counters simply indicate no activity on the tunnel.

How to eliminate wrong answers

Option A is wrong because zero packets received and sent indicates no traffic is passing, not normal operation. Option C is wrong because zero packets dropped means no packets have been discarded; dropping all packets would show non-zero drop counters. Option D is wrong because the output provides no information about IPsec encryption; IPsec status is verified with commands like 'show crypto ipsec sa' or 'show crypto map', not from IPv6 traffic counters.

Full explanation →
1840
Drag & Drophard

Drag and drop the steps to troubleshoot SNMP adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking basic IP connectivity using ping to the SNMP manager. Next, verify that the SNMP agent is enabled and listening on the correct port. Then, review ACLs and firewall rules that might block SNMP traffic.

After that, examine SNMP community strings or security credentials for mismatches. Finally, enable debug snmp packets to capture and analyze packet exchanges.

Full explanation →
1841
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces EIGRP-IPv4 Interfaces for AS(100) Xmit Queue Mean Pacing Time Multicast Pending Interface Peers Un/Reliable SRTT Un/Reliable Flow Timer Routes Gi0/0 1 0/0 12 0/10 50 0 Gi0/1 1 0/0 15 0/10 50 0 Gi0/2 1 0/0 18 0/10 50 0 Gi0/3 1 0/0 20 0/10 50 0 Gi0/4 0 0/0 0 0/10 50 0 Based on this output, which statement is correct?

A.Interface Gi0/4 has no EIGRP neighbor, which may indicate a configuration issue or lack of connectivity.
B.All interfaces have at least one EIGRP neighbor.
C.The mean SRTT on Gi0/2 is 18 ms, which is too high and indicates a problem.
D.The pending routes count of 0 on all interfaces indicates a routing loop.
AnswerA

A peer count of 0 means no EIGRP adjacency exists on that interface.

Why this answer

The output shows that interface Gi0/4 has 0 peers, while all other interfaces have 1 peer. In EIGRP, a peer count of 0 indicates that no neighbor adjacency has been formed on that interface. This could be due to a configuration mismatch (e.g., different AS numbers, passive interface, or authentication) or a Layer 1/2 connectivity issue.

Therefore, option A is correct.

Exam trap

Cisco often tests the misinterpretation of SRTT values as indicators of problems, when in fact normal SRTT values vary by network and are not inherently problematic unless they are excessively high (e.g., >5000 ms) or accompanied by retransmissions.

How to eliminate wrong answers

Option B is wrong because Gi0/4 has 0 peers, so not all interfaces have at least one EIGRP neighbor. Option C is wrong because a mean SRTT of 18 ms on Gi0/2 is well within normal operational range (typically under 100 ms) and does not indicate a problem; SRTT values are used for metric calculation and retransmission timing, not as a direct indicator of faults. Option D is wrong because a pending routes count of 0 is normal and expected when the EIGRP topology table is fully converged; it does not indicate a routing loop—routing loops are detected via other mechanisms like feasible successor checks and hold-down timers.

Full explanation →
1842
MCQmedium

A network engineer runs the following command to troubleshoot DMVPN with NHRP filtering: R1# show ip nhrp detail 10.1.1.2/8 via 10.1.1.2, Tunnel0 created 00:10:00, expire 01:50:00 Type: dynamic, Flags: authoritative unique registered NBMA address: 192.168.1.2 (no-socket) (no-socket) What does this output indicate?

A.The spoke at 10.1.1.2 has registered with the hub and is reachable via NBMA address 192.168.1.2.
B.The spoke is being filtered by an NHRP filter.
C.The NHRP entry is static and configured manually.
D.The spoke is not reachable because the NBMA address is incorrect.
AnswerA

The entry shows a dynamic registration with the NBMA address, indicating successful NHRP registration.

Why this answer

The output shows an NHRP cache entry for a remote spoke (10.1.1.2) with NBMA address 192.168.1.2. The entry is dynamic and registered, indicating that the spoke has successfully registered with the hub.

Full explanation →
1843
MCQmedium

In an extended IPv4 ACL, what is the default action if only a source and destination are specified without a protocol?

A.The ACL matches all IP traffic.
B.The ACL matches only TCP traffic.
C.The command is rejected by the IOS parser.
D.The ACL matches only UDP traffic.
AnswerC

Extended ACL syntax requires a protocol field; omission causes a syntax error.

Why this answer

In an extended IPv4 ACL, the protocol keyword is mandatory. If you omit it, the IOS parser rejects the command because it cannot determine which protocol to filter. The correct syntax requires a protocol (e.g., ip, tcp, udp) after the permit or deny keyword; without it, the parser returns an error.

Exam trap

Cisco often tests the mandatory nature of the protocol field in extended ACLs, trapping candidates who assume a default protocol (like IP, TCP, or UDP) is applied when none is specified.

How to eliminate wrong answers

Option A is wrong because an extended ACL does not default to matching all IP traffic when only source and destination are specified; the protocol field is required, and omitting it causes a parser error, not an implicit 'permit ip any any'. Option B is wrong because there is no default protocol of TCP; the ACL command is invalid without a protocol keyword. Option D is wrong because there is no default protocol of UDP; the command is rejected, not interpreted as UDP traffic.

Full explanation →
1844
MCQmedium

A network engineer runs the following command to troubleshoot OSPF over DMVPN: R1# debug ip ospf adj OSPF: 2 Way Communication to 10.0.0.2 on Tunnel0, state 2WAY OSPF: Send DBD to 10.0.0.2 on Tunnel0 seq 0x1234 opt 0x52 flag 0x7 OSPF: Rcv DBD from 10.0.0.2 on Tunnel0 seq 0x1235 opt 0x52 flag 0x2 OSPF: Exchange Done with 10.0.0.2 on Tunnel0 OSPF: Build router LSA for area 0, router ID 1.1.1.1 What does this output indicate?

A.OSPF adjacency with 10.0.0.2 is stuck in 2WAY state and not progressing.
B.OSPF adjacency with 10.0.0.2 is forming successfully and will reach FULL state.
C.OSPF is not enabled on Tunnel0.
D.There is an OSPF MTU mismatch causing the adjacency to fail.
AnswerB

Correct: The sequence shows normal adjacency formation steps.

Why this answer

The debug shows OSPF adjacency formation: 2-way state, database description exchange, and exchange done, indicating a full adjacency is being established.

Full explanation →
1845
MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# show ip eigrp topology 10.10.10.0/24 all-links P 10.10.10.0/24, 1 successors, FD is 1310720 via 10.1.1.2 (1310720/1310720), GigabitEthernet0/0 via 10.1.2.2 (1310720/1310720), GigabitEthernet0/1 What does this output indicate?

A.There are two equal-cost paths to 10.10.10.0/24, and EIGRP will load balance across them.
B.Only the first path via 10.1.1.2 is installed because the second path has a higher FD.
C.The path via 10.1.2.2 is a feasible successor but is not used because it has a higher RD.
D.The router has no route to 10.10.10.0/24 because the FD is the same as the RD.
AnswerA

Both paths have the same FD and RD, making them equal-cost successors; EIGRP will install both and load balance.

Why this answer

The output shows two EIGRP routes to 10.10.10.0/24 with identical Feasible Distances (FD) of 1310720, indicating equal-cost paths. EIGRP installs up to four equal-cost routes by default and performs per-destination load balancing across them, so both paths are active and used.

Exam trap

Cisco often tests the distinction between equal-cost paths (same FD) and feasible successors (RD < FD), leading candidates to mistakenly label an equal-cost path as a feasible successor or assume only the first path is used.

How to eliminate wrong answers

Option B is wrong because both paths have the same FD (1310720), so the second path is not rejected due to a higher FD; it is an equal-cost path. Option C is wrong because a feasible successor must have a Reported Distance (RD) less than the current successor's FD; here both RDs equal the FD (1310720), so the second path is not a feasible successor—it is an equal-cost successor. Option D is wrong because the router does have a route to 10.10.10.0/24; the FD and RD being the same is normal for directly connected or redistributed routes and does not prevent route installation.

Full explanation →
1846
MCQhard

An engineer configures CoPP on a router with the following policy: class-map match-any PROTECT, match protocol ospf, police 1000 pps; class class-default, police 500 pps. After applying, OSPF neighbors form, but the router's CPU utilization remains high. Which is the most likely explanation?

A.The class-default police rate is too low, causing ARP packets to be dropped, but CPU is high due to the policing overhead.
B.OSPF traffic is being policed to 1000 pps, which is too high, causing CPU overload.
C.CoPP only works on hardware-switched platforms, not software.
D.The class-default should have a higher rate than the OSPF class.
AnswerA

Policing itself consumes CPU, and dropping packets may cause retries, increasing CPU.

Why this answer

The class-default police rate of 500 pps is too low to handle essential control-plane traffic like ARP, which falls into class-default. When ARP packets are dropped, the router must retry ARP resolution, generating additional CPU overhead from policing and retransmissions, keeping CPU utilization high. OSPF neighbors form because OSPF traffic is explicitly protected in the PROTECT class with a 1000 pps policer, but the underlying ARP starvation causes CPU strain.

Exam trap

Cisco often tests the misconception that CoPP only affects the protected class, but the trap here is that the class-default policer can starve essential control-plane traffic (like ARP) that is not explicitly matched, causing CPU issues even when OSPF appears healthy.

How to eliminate wrong answers

Option B is wrong because OSPF traffic being policed to 1000 pps is not too high; it is actually a reasonable rate that allows OSPF hellos and updates to pass, as evidenced by OSPF neighbors forming. Option C is wrong because CoPP (Control Plane Policing) works on both hardware-switched and software-switched platforms; it is applied to the control plane of the router, regardless of forwarding path. Option D is wrong because the class-default rate does not need to be higher than the OSPF class; the issue is that class-default is too low for essential traffic like ARP, not that it must exceed the PROTECT class rate.

Full explanation →
1847
MCQmedium

Examine this BGP configuration on router R6: router bgp 65006 bgp router-id 6.6.6.6 neighbor 10.6.6.7 remote-as 65007 neighbor 10.6.6.7 weight 200 ! What is the effect of the weight command?

A.It sets the weight of all routes learned from 10.6.6.7 to 200, making them preferred over routes with lower weight.
B.It sets the weight of routes sent to 10.6.6.7 to 200.
C.It has no effect because weight is only configurable under route-map.
D.It sets the MED value to 200 for routes from this neighbor.
AnswerA

Weight is locally significant and higher weight wins.

Why this answer

The weight command assigns a weight value to routes from a specific neighbor. Weight is a Cisco-specific attribute that is local to the router. Higher weight is preferred over other routes.

The default weight for eBGP routes is 0, so weight 200 makes routes from this neighbor preferred.

Full explanation →
1848
MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# debug nhrp NHRP: Receive Resolution Request via Tunnel0 10.1.1.2, target 192.168.1.1 NHRP: Send Resolution Reply via Tunnel0 to 10.1.1.2, target 192.168.1.1 What does this output indicate?

A.The router is acting as a NHRP server and successfully resolves the NBMA address for the target.
B.The router is a NHRP client and is requesting resolution for target 192.168.1.1.
C.The router is unable to resolve the target address because it does not have a mapping.
D.The NHRP process is failing due to a misconfigured authentication key.
AnswerA

The router receives a request and sends a reply, indicating it has the mapping and is providing resolution.

Why this answer

The debug output shows the router receiving a Resolution Request and immediately sending a Resolution Reply, which is the behavior of a Next Hop Resolution Protocol (NHRP) server (or hub) that has a mapping for the target 192.168.1.1. The router successfully resolves the Non-Broadcast Multiple Access (NBMA) address (10.1.1.2) for the target, indicating it is acting as a server in a DMVPN or similar overlay network.

Exam trap

Cisco often tests the distinction between NHRP client (spoke) and server (hub) roles by showing debug output; the trap here is that candidates may confuse sending a Resolution Reply with sending a Resolution Request, incorrectly assuming the router is a client.

How to eliminate wrong answers

Option B is wrong because the router is sending a Resolution Reply, not a Resolution Request, so it is not acting as a client requesting resolution. Option C is wrong because the router successfully sends a reply, meaning it does have a mapping for the target address. Option D is wrong because the debug output shows successful NHRP message exchange with no authentication errors; a misconfigured key would generate NHRP authentication failure messages, not a successful reply.

Full explanation →
1849
MCQhard

An engineer configured IP SLA 80 to monitor a remote server (192.168.100.100) using ICMP echo. The IP SLA is used in a track object for a static route. The engineer notices that the IP SLA state is 'Active', but the track object shows 'Down'. What is the most likely cause?

A.The track object is configured with a 'delay up' timer that has not yet expired.
B.The IP SLA probe is using a different source IP than expected.
C.The track object is referencing the wrong IP SLA number.
D.The router's routing table is full, preventing the track object from updating.
AnswerA

A 'delay up' timer forces the track to wait before transitioning to 'Up' after the IP SLA becomes 'Active'. This is a common cause of mismatch.

Why this answer

The track object can be configured with a threshold (e.g., 'threshold' or 'delay') that causes it to remain 'Down' even if the IP SLA is 'Active'. For example, if the track object has a 'delay up' timer, it will not transition to 'Up' immediately.

Full explanation →
1850
MCQmedium

Which of the following is a mandatory condition for a route to be considered a feasible successor in EIGRP?

A.The reported distance must be less than the feasible distance.
B.The metric must be equal to the successor's metric.
C.The next-hop router must be directly connected.
D.The route must be learned from the same AS.
AnswerA

This is the feasibility condition defined by EIGRP.

Why this answer

In EIGRP, a feasible successor is a backup route that can be used immediately if the successor fails. The mandatory condition for a route to be considered a feasible successor is that its reported distance (RD) must be less than the feasible distance (FD) of the current successor. This ensures the backup route is loop-free, as per the Diffusing Update Algorithm (DUAL).

Exam trap

Cisco often tests the misconception that a feasible successor must have a metric equal to or better than the successor, but the actual condition is that the reported distance must be strictly less than the feasible distance.

How to eliminate wrong answers

Option B is wrong because the metric does not need to be equal to the successor's metric; feasible successors can have a higher metric as long as the RD < FD condition is met. Option C is wrong because the next-hop router does not have to be directly connected; EIGRP can learn routes through multiple hops, and feasibility is based on distance, not adjacency. Option D is wrong because all EIGRP routes are learned from the same autonomous system by default; this is not a distinguishing condition for feasible successors.

Full explanation →
1851
MCQhard

What is the default ERSPAN ID range on Cisco IOS-XE devices?

A.1 to 256
B.1 to 1023
C.1 to 4096
D.1 to 65535
AnswerB

The ERSPAN ID range is 1 to 1023 on most Cisco IOS-XE platforms.

Why this answer

ERSPAN sessions use an ID from 1 to 1023 (or 1 to 256 on some platforms) to identify the session. The default is 1 if not specified.

Full explanation →
1852
MCQhard

An engineer configures OSPF on a link with an MTU of 1500 on one side and 1400 on the other. The OSPF neighbor state is stuck in EXSTART. What is the most likely explanation?

A.The router with the smaller MTU (1400) rejects DBD packets from the neighbor with MTU 1500 because they exceed the interface MTU, causing the EXSTART state.
B.The router with the larger MTU (1500) cannot process the smaller DBD packets from the neighbor.
C.The OSPF network type is point-to-point, which ignores MTU mismatches.
D.The 'ip ospf mtu-ignore' command is needed on both sides to bypass the MTU check.
AnswerA

OSPF DBD packets are sized based on MTU; a mismatch prevents the exchange from completing.

Why this answer

OSPF uses the MTU of the interface to determine the maximum size of Database Description (DBD) packets. If the MTU mismatches, the router with the smaller MTU will reject DBD packets that exceed its MTU, causing the neighbor to remain in EXSTART.

Full explanation →
1853
Multi-Selecthard

Which TWO configuration steps are required to enable an Embedded Event Manager (EEM) applet that sends an SNMP trap when a specific OID is polled? (Choose TWO.)

Select 2 answers
A.Configure 'event snmp oid 1.3.6.1.4.1.9.9.117.1.1.2.1.1 get-type exact' within the applet.
B.Ensure the 'snmp-server enable traps' command is configured globally.
C.Configure 'event syslog pattern "SNMP"' to capture the SNMP poll.
D.Configure an SNMP community string with read-write access inside the applet using 'action snmp-community'.
E.Configure 'event cli command "snmpwalk" sync yes' to trigger on SNMP walks.
AnswersA, B

This defines the SNMP event trigger, specifying the OID to monitor and the type of access (exact match) that will fire the applet.

Why this answer

To trigger an EEM applet on an SNMP OID poll, you must configure the 'event snmp oid' command and ensure SNMP is enabled globally. The other options are either unnecessary (like configuring a community for the applet itself) or incorrect (like using 'event syslog' or 'event cli').

Full explanation →
1854
MCQeasy

A network engineer runs the following command on Router R5: R5# show logging | include %LINEPROTO-5-UPDOWN *Mar 1 00:00:10.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up *Mar 1 00:00:20.456: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down *Mar 1 00:00:30.789: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up *Mar 1 00:00:40.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down *Mar 1 00:00:50.345: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up *Mar 1 00:01:00.678: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down Based on this output, what is the most likely problem?

A.The interface is administratively down.
B.There is a physical layer issue causing the interface to flap.
C.The interface is configured with a high bandwidth delay product.
D.The router is experiencing a high CPU load due to routing updates.
AnswerB

Repeated line protocol up/down messages indicate a flapping interface, typically due to physical or Layer 2 issues.

Why this answer

The output shows the line protocol on GigabitEthernet0/0 flapping every 10 seconds. This is a classic symptom of a flapping interface, often due to a physical issue (bad cable, faulty transceiver) or a Layer 2 problem (e.g., spanning tree topology changes, keepalive mismatch).

Full explanation →
1855
Multi-Selecthard

Which THREE symptoms indicate that a Cisco IOS router is experiencing issues with device access control due to misconfigured AAA local authentication? (Choose THREE.)

Select 3 answers
A.Users with correct credentials are repeatedly denied access, and the 'show aaa local user lockout' command shows no locked accounts.
B.The 'debug aaa authentication' output shows 'FAIL' for local authentication attempts even though the username and password are correctly configured.
C.Users are locked out after three failed attempts despite 'login block-for' not being configured.
D.The 'show aaa servers' output shows the RADIUS server status as 'DEAD'.
E.The 'show line' command shows that the line is in 'ready' state but login prompts are not displayed.
AnswersA, B, C

This suggests the authentication method list may not reference 'local' or the local database is not properly configured, causing failures without lockouts.

Why this answer

When AAA local authentication is misconfigured, users with valid credentials can be repeatedly denied access without any lockout entries. The 'show aaa local user lockout' command would show locked accounts only if the 'aaa local authentication attempts max-fail' feature is enabled, but the absence of lockouts indicates the issue is not due to failed attempts but rather a misconfiguration in the local username/password database or AAA method list.

Exam trap

Cisco often tests the distinction between local authentication lockout (controlled by 'aaa local authentication attempts max-fail') and login blocking (controlled by 'login block-for'), causing candidates to incorrectly associate lockout behavior with the 'login block-for' feature rather than AAA local authentication parameters.

Full explanation →
1856
MCQmedium

Examine the following IPv6 ACL applied to an interface: ipv6 access-list FILTER permit ipv6 any any fragments deny ipv6 any any interface GigabitEthernet0/1 ipv6 traffic-filter FILTER in What is the effect of this configuration?

A.All IPv6 traffic is permitted because the permit statement matches any packet.
B.Only fragmented IPv6 packets are permitted; all other IPv6 traffic is denied.
C.The ACL is invalid because 'fragments' cannot be used with 'any any'.
D.The interface command is missing the 'ipv6 enable' prerequisite.
AnswerB

The first ACE permits only fragments; the second denies everything else, so only fragments pass.

Why this answer

The ACL explicitly permits only fragmented IPv6 packets via the 'permit ipv6 any any fragments' statement, while the subsequent 'deny ipv6 any any' statement denies all other IPv6 traffic. Since ACLs are processed sequentially, the permit for fragments is evaluated first, allowing only fragmented packets; all non-fragmented packets are then denied by the second entry.

Exam trap

Cisco often tests the misconception that 'permit ipv6 any any' without the 'fragments' keyword matches all packets, but here the 'fragments' keyword narrows the match, causing candidates to overlook the sequential processing of ACL entries and incorrectly assume all traffic is permitted.

How to eliminate wrong answers

Option A is wrong because the permit statement includes the 'fragments' keyword, which restricts the match to only fragmented IPv6 packets, not all IPv6 traffic; thus, non-fragmented packets are denied by the subsequent deny statement. Option C is wrong because the 'fragments' keyword is fully valid with 'any any' in an IPv6 ACL; it simply limits the match to fragmented packets, and the ACL is syntactically correct. Option D is wrong because the 'ipv6 traffic-filter' command does not require the 'ipv6 enable' interface command as a prerequisite; IPv6 traffic filtering works independently as long as IPv6 is configured on the interface.

Full explanation →
1857
MCQmedium

A network engineer runs the following command on Router R7: R7# show ip route 172.16.0.0 Routing entry for 172.16.0.0/16 Known via "bgp 65000", distance 200, metric 0 Redistributing via bgp 65000 Last update from 10.0.0.1 00:00:20 ago Routing Descriptor Blocks: * 10.0.0.1, from 10.0.0.1, 00:00:20 ago Route metric is 0, traffic share count is 1 Based on this output, what type of BGP route is this?

A.This is an eBGP route because the distance is 200.
B.This is an iBGP route because the distance is 200.
C.This is a redistributed route from OSPF into BGP.
D.The distance of 200 is non-default and manually configured.
AnswerB

iBGP routes have a default administrative distance of 200, matching this output.

Why this answer

The administrative distance of 200 is the default for iBGP routes. eBGP routes have a default distance of 20. Therefore, this is an iBGP route.

Full explanation →
1858
MCQhard

An enterprise uses BGP to exchange routes with a service provider. After redistributing OSPF into BGP, some prefixes are missing. Router R1 config: router bgp 65001 redistribute ospf 1 match internal external 1 external 2 ! router ospf 1 redistribute bgp 65001 subnets R1# show ip bgp 10.10.10.0 % Network not in table R1# show ip ospf database external 10.10.10.0 Type-5 AS External Link States LS age: 360 Options: (No TOS-capability, DC) LS Type: AS External Link Link State ID: 10.10.10.0 (External Network Number) Advertising Router: 192.168.1.2 LS Seq Number: 80000001 Checksum: 0x1234 Length: 36 Network Mask: /24 Metric Type: 2 (Larger than any link state path) Metric: 20 Forward Address: 0.0.0.0 External Route Tag: 0 What is the root cause?

A.The OSPF external route is not installed in the routing table because of a mismatched metric type or LSA filtering.
B.The BGP redistribute command is missing the route-map to set the metric.
C.The OSPF process is not configured with the default-information originate command.
D.The BGP table is full and cannot accept more routes.
AnswerA

The route appears in the database but not in the routing table, so BGP cannot redistribute it.

Why this answer

The OSPF external route 10.10.10.0/24 has a Forward Address of 0.0.0.0, which means it is reachable via the advertising router. However, BGP redistribution of OSPF requires the route to be in the OSPF routing table, not just the database. The route may be missing due to an OSPF LSA filtering or a mismatched area.

The correct fix is to ensure the OSPF route is fully installed and not filtered.

Full explanation →
1859
MCQmedium

Given this IP SLA configuration on router R4: ip sla 40 icmp-echo 10.10.10.1 source-ip 172.16.1.1 frequency 15 ip sla schedule 40 life forever start-time now Which statement is true?

A.The source IP 172.16.1.1 must be configured on an interface of R4.
B.The source IP 172.16.1.1 can be any IP address, even if not local.
C.The operation will fail because frequency 15 is too high.
D.The operation will use TCP instead of ICMP.
AnswerA

The source-ip must belong to a local interface for the probe to be sourced correctly.

Why this answer

The configuration sends ICMP echo probes from 172.16.1.1 to 10.10.10.1 every 15 seconds. The source IP is explicitly set.

Full explanation →
1860
Multi-Selecthard

Which TWO statements about the 'ip domain-lookup' and DNS configuration on a Cisco IOS router are true? (Choose TWO.)

Select 2 answers
A.The 'ip domain-lookup' command is disabled by default on Cisco IOS routers.
B.The 'ip name-server' command can specify up to six DNS servers.
C.The 'ip domain-list' command adds a domain suffix to the search list for DNS queries.
D.The 'ip host' command creates a dynamic DNS entry that can be overwritten by a DNS server.
E.The 'show hosts' command displays only statically configured host entries.
AnswersB, C

Correct. The 'ip name-server' command allows configuring up to six DNS server addresses. The router will query them in order.

Why this answer

The 'ip name-server' command on a Cisco IOS router can specify up to six DNS servers, which the router will query in order when resolving hostnames. This is a standard limitation documented in Cisco IOS configuration guides.

Exam trap

The trap here is that candidates often assume 'ip domain-lookup' is disabled by default (Option A) because they recall it must be explicitly enabled for certain features, but in fact it is enabled by default on most IOS versions.

Full explanation →
1861
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 interface gigabitethernet 0/0 GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 1000 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. IPv6 uRPF: strict mode (drop invalid packets) Based on this output, what is the operational state of uRPF on this interface?

A.uRPF is disabled
B.uRPF is enabled in strict mode
C.uRPF is enabled in loose mode
D.uRPF is enabled but only for multicast
AnswerB

The output confirms strict mode uRPF is active.

Why this answer

The output explicitly states 'IPv6 uRPF: strict mode (drop invalid packets)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled on the interface and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB pointing back to the same interface; if not, the packet is dropped. This is a direct read of the operational state from the show command.

Exam trap

Cisco often tests the ability to read the exact operational state from the 'show ipv6 interface' output, where candidates may overlook the explicit 'strict mode' line and instead assume uRPF is disabled or confuse it with loose mode based on incomplete knowledge of the command syntax.

How to eliminate wrong answers

Option A is wrong because the output clearly shows 'IPv6 uRPF: strict mode', indicating uRPF is enabled, not disabled. Option C is wrong because the output specifies 'strict mode', not 'loose mode'; loose mode would only require a matching route in the FIB regardless of the incoming interface. Option D is wrong because uRPF operates on unicast traffic, not multicast; the output makes no mention of multicast filtering, and uRPF is not designed for multicast.

Full explanation →
1862
MCQeasy

An engineer is troubleshooting why the NMS is not receiving SNMP traps from router R8 after a recent configuration change. The engineer added 'snmp-server host 10.1.1.100 version 2c public' and 'snmp-server enable traps' but forgot to remove the old 'snmp-server host 10.1.1.200 version 2c public' command. The NMS at 10.1.1.100 can receive traps from other devices. What is the most likely cause?

A.The engineer did not configure the SNMP community string 'public' on the router.
B.The old 'snmp-server host' command for 10.1.1.200 is causing a conflict, preventing traps to the new host.
C.The engineer needs to remove the old host command before adding the new one.
D.The router requires a reload after adding a new 'snmp-server host' command.
AnswerA

Correct because the 'snmp-server host' command references a community string that must be defined; without it, traps are not sent.

Why this answer

The router's SNMP agent will not send traps to any host unless the community string referenced in the 'snmp-server host' command is first defined with an 'snmp-server community' command. Without 'snmp-server community public ro' (or rw), the router has no valid community string to include in the trap PDU, so the NMS at 10.1.1.100 will never receive traps from R8, even though the host and enable commands are present.

Exam trap

Cisco often tests the misconception that adding 'snmp-server host' alone is sufficient to send traps, when in fact the community string must be explicitly configured with 'snmp-server community' for the trap to be generated and transmitted.

How to eliminate wrong answers

Option B is wrong because multiple 'snmp-server host' commands can coexist; each defines a separate trap destination, and there is no conflict that would block traps to the new host. Option C is wrong because there is no requirement to remove an old host command before adding a new one; the router supports multiple trap receivers simultaneously. Option D is wrong because SNMP configuration changes, including 'snmp-server host', take effect immediately without requiring a router reload.

Full explanation →
1863
MCQhard

A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: ! R1 control-plane service-policy input CoPP ! access-list 100 permit tcp any any eq bgp class-map match-all BGP-CLASS match access-group 100 ! policy-map CoPP class BGP-CLASS police 8000 conform-action transmit exceed-action drop class class-default police 1000000 conform-action transmit exceed-action drop ! R2 shows: R2#show ip bgp summary BGP router identifier 2.2.2.2, local AS number 65002 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 1.1.1.1 4 65001 12345 12345 0 0 0 00:02:34 0 What is the root cause?

A.The BGP session is flapping because the CoPP policy drops BGP keepalive packets when the police rate is exceeded.
B.The access-list 100 is misconfigured; it should match TCP port 179 specifically.
C.The class-default police rate is too low, causing all traffic to be dropped, including BGP.
D.The CoPP policy should be applied to the control-plane input direction, but the service-policy is missing the 'control-plane' keyword.
AnswerA

BGP keepalives are small, but if the overall BGP traffic (including updates) exceeds 8000 bps, the policer drops packets, causing keepalive loss and hold timer expiry.

Why this answer

The BGP session resets because the CoPP policy applies a police rate of 8000 bps to BGP packets matched by access-list 100. When BGP keepalive or other packets exceed this rate, they are dropped, causing the hold timer to expire and the session to reset. The short uptime of 2 minutes 34 seconds on R2 confirms the session is flapping due to packet loss.

Exam trap

Cisco often tests the misconception that CoPP misconfiguration is always due to ACL or direction errors, but here the trap is that a seemingly reasonable police rate (8000 bps) is actually too low for BGP control-plane traffic, causing intermittent drops that mimic a flapping session.

How to eliminate wrong answers

Option B is wrong because access-list 100 already matches TCP any any eq bgp, which correctly identifies BGP traffic (TCP port 179); the issue is not the ACL but the policing rate. Option C is wrong because the class-default police rate of 1,000,000 bps is high enough to pass most traffic, and BGP packets are classified into the BGP-CLASS, not class-default, so the class-default rate is irrelevant to the BGP drops. Option D is wrong because the service-policy input CoPP is correctly applied under the control-plane configuration; the 'control-plane' keyword is not missing—it is the parent context for the service-policy command.

Full explanation →
1864
MCQmedium

A network engineer runs the following command to troubleshoot an OSPF adjacency issue: R1# debug ip ospf adj OSPF: Interface GigabitEthernet0/0 going Up OSPF: Send with youngest orig age 0 OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state INIT OSPF: First DBD and we are not SLAVE OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state EXSTART OSPF: Nbr 2.2.2.2 has larger interface MTU What does this output indicate?

A.OSPF adjacency is forming correctly, moving to FULL state.
B.OSPF adjacency is stuck due to MTU mismatch; the neighbor has a larger MTU.
C.OSPF adjacency is stuck because the router is not the DR/BDR.
D.OSPF adjacency is stuck due to authentication mismatch.
AnswerB

The debug explicitly states 'Nbr has larger interface MTU', which blocks adjacency.

Why this answer

The debug output shows that R1 receives a Database Description (DBD) packet from neighbor 2.2.2.2 with the INIT and EXSTART states, and then explicitly states 'Nbr 2.2.2.2 has larger interface MTU'. This indicates an MTU mismatch where the neighbor's interface MTU (1500) is larger than R1's interface MTU, preventing the OSPF adjacency from progressing beyond the EXSTART state. Option B is correct because the adjacency is stuck due to the MTU mismatch, as OSPF requires matching MTU values on both sides for DBD exchange to complete.

Exam trap

Cisco often tests the MTU mismatch trap by showing debug output with 'Nbr has larger interface MTU' and candidates mistakenly think the adjacency is progressing normally (Option A) or confuse it with DR/BDR election issues (Option C), but the key is that OSPF adjacency will not form until MTU values match.

How to eliminate wrong answers

Option A is wrong because the adjacency is not forming correctly; it is stuck in EXSTART due to the MTU mismatch, not moving to FULL state. Option C is wrong because the DR/BDR election occurs after the adjacency reaches the 2-WAY state, and this issue is in EXSTART, which is before that election; the debug output shows no DR/BDR-related problem. Option D is wrong because authentication mismatches would generate different debug messages (e.g., 'auth type mismatch' or 'auth key mismatch') and would typically cause the adjacency to be stuck in INIT or EXSTART with authentication errors, not an MTU size message.

Full explanation →
1865
MCQhard

Consider the following configuration on Router R4: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 router ospf 1 redistribute eigrp 100 metric 20 metric-type 1 subnets What is a potential issue with this configuration?

A.The configuration is correct and will work without issues.
B.The 'metric-type 1' in OSPF redistribution may cause EIGRP routes to be preferred over OSPF routes.
C.Mutual redistribution without route filtering can cause routing loops or suboptimal routing.
D.The EIGRP metric values are invalid because load must be between 1 and 255.
AnswerC

Without filtering, routes can be redistributed back and forth, causing loops.

Why this answer

Mutual redistribution without route filtering or administrative distance adjustments can cause routing loops or suboptimal routing. The configuration does not include any route-maps or distribute-lists to control which routes are redistributed, which is a common pitfall.

Full explanation →
1866
MCQmedium

Examine the following partial configuration: username admin privilege 15 secret 5 $1$abcdefg$hashedvalue username operator privilege 1 password cisco ! line console 0 login local ! line vty 0 4 login local transport input ssh What is a potential security issue with this configuration?

A.The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.
B.The 'admin' user has privilege 15, which is too high for administrative access.
C.The console line is missing the 'transport input' command.
D.The VTY lines should use 'login' without 'local' to allow remote authentication.
AnswerA

The 'password' keyword stores the password in a reversible format (type 7 or clear), whereas 'secret' uses MD5 hashing.

Why this answer

The 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.

Exam trap

Cisco often tests the distinction between 'password' and 'secret' in username configurations, and the trap here is that candidates may overlook the security implications of using 'password' instead of 'secret' for non-privileged users, assuming it only matters for enable passwords.

How to eliminate wrong answers

Option B is wrong because privilege 15 is the standard highest privilege level for full administrative access, and it is appropriate for an 'admin' user; there is no security issue with using privilege 15 for administrative accounts. Option C is wrong because the console line does not require a 'transport input' command by default, as console access is out-of-band and typically uses a direct serial connection; the absence of 'transport input' does not create a security vulnerability. Option D is wrong because 'login local' on VTY lines is the correct method to enforce local username/password authentication; using 'login' without 'local' would allow any password (including no password) if no other authentication method is configured, which is less secure.

Full explanation →
1867
MCQmedium

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

A.The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.
B.The ACL is applied outbound on R1 and blocks the echo request.
C.IPv6 unicast-routing is not enabled on R1.
D.The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.
AnswerA

Correct because ICMPv6 echo replies are sourced from the destination address (R2) and must be permitted inbound on R1 for the ping to succeed.

Why this answer

The inbound ACL on R1 is blocking the ICMPv6 echo reply from R2, because the ACL only permits echo requests from a specific source, not replies. For a successful ping, both the echo request and echo reply must be permitted. The reply is sourced from R2's address, which is not matched by the permit statement.

Full explanation →
1868
MCQhard

An enterprise is redistributing EIGRP into OSPF on router R1. R1 has the following configuration: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 route-map RMAP-OSPF. Router R2 (OSPF-only) shows: 'show ip route 10.1.1.0' as an O E2 route with metric 20, but 'show ip ospf database external 10.1.1.0' shows the forwarding address is 0.0.0.0. Router R3 (also OSPF) cannot reach 10.1.1.0. What is the root cause?

A.The redistributed route's next-hop is not reachable via OSPF, causing the forwarding address to be 0.0.0.0, but R1's router ID is not reachable from R3 due to a missing OSPF network statement.
B.The route-map RMAP-OSPF is setting the metric to 20, which is too high and causes the route to be suppressed.
C.The EIGRP process on R1 has a distribute-list blocking the route.
D.The OSPF process on R1 has a route-map applied inbound that filters the route.
AnswerA

If the next-hop is not in OSPF, the forwarding address is set to 0.0.0.0, meaning the packet should be sent to the advertising router (R1). If R1's router ID is not reachable (e.g., R1's OSPF interfaces are not advertised correctly), R3 cannot reach the route.

Why this answer

When redistributing into OSPF, if the redistributed route's next-hop is not reachable via OSPF (e.g., it is an EIGRP-learned route with a next-hop that is not in the OSPF domain), the forwarding address is set to 0.0.0.0. This causes other OSPF routers to try to reach the originating router (R1) as the next-hop. However, if R1's OSPF router ID is not reachable or if there is a filtering issue, the route may be installed but unreachable.

In this scenario, the route-map RMAP-OSPF may be filtering the route or setting incorrect metrics, but the forwarding address issue suggests that the next-hop is not being advertised correctly. The root cause is likely that the redistributed route's next-hop is not in the OSPF domain, so R1 should use a route-map to set the forwarding address to itself (e.g., set forwarding-address 0.0.0.0 is default, but if the next-hop is reachable, it should be set to the router's own interface IP).

Full explanation →
1869
MCQhard

A network engineer configured IP SLA 50 to monitor a remote router's loopback (5.5.5.5) using ICMP echo. The IP SLA is linked to a track object that is used in a PBR (policy-based routing) route-map. The engineer notices that the PBR is not applying the alternate path when the IP SLA goes down. The track object shows 'Down'. What is the most likely misconfiguration?

A.The route-map is missing the 'set ip next-hop verify-availability' command with the track object.
B.The IP SLA probe is using the wrong source interface.
C.The track object is configured with a delay that prevents immediate reaction.
D.The PBR is applied to the wrong interface.
AnswerA

Without 'verify-availability', PBR does not check the track state and will continue using the primary next-hop even if the track is down.

Why this answer

PBR with set ip next-hop verify-availability requires the track object to be referenced correctly in the route-map. If the route-map uses 'set ip next-hop verify-availability' but does not include the track keyword, PBR will not react to the IP SLA state.

Full explanation →
1870
MCQhard

A network engineer is troubleshooting a connectivity issue where a host on VLAN 10 cannot reach a server on VLAN 20. Both VLANs are on the same switch, which is running IPv6. The engineer checks the switch and finds that uRPF (unicast Reverse Path Forwarding) is enabled in strict mode on the VLAN 20 interface. The host's IPv6 address is 2001:db8:10::100/64, and the server's address is 2001:db8:20::200/64. The switch has a default route pointing to a next-hop router. The host sends traffic to the server, but the switch drops the packets. What is the most likely cause?

A.The uRPF strict mode check fails because the switch does not have a specific route to the host's subnet pointing back to the VLAN 10 interface.
B.The uRPF mode should be loose mode to allow traffic from any source as long as there is a route in the FIB.
C.The host's IPv6 address is not in the switch's neighbor cache.
D.The switch has an ACL that blocks traffic between VLANs.
AnswerA

Correct because uRPF strict mode requires a matching route in the FIB that points to the same interface on which the packet was received; a default route does not satisfy this requirement.

Why this answer

With uRPF strict mode enabled on the VLAN 20 interface, the switch checks that the source IP address of incoming packets (2001:db8:10::100) is reachable via the same interface on which the packet arrived. Since the switch only has a default route pointing to a next-hop router and no specific route for the 2001:db8:10::/64 subnet pointing back to the VLAN 10 interface, the FIB lookup for the source address fails the strict uRPF check, causing the switch to drop the packet.

Exam trap

Cisco often tests the distinction between strict and loose uRPF modes, and the trap here is that candidates assume a default route is sufficient for strict mode, not realizing that strict mode requires a specific route pointing back to the source's ingress interface.

How to eliminate wrong answers

Option B is wrong because loose mode only requires that a route exists in the FIB for the source address, not that it points back to the incoming interface; while that would allow the traffic, it is not the most likely cause given that strict mode is already enabled and failing. Option C is wrong because the neighbor cache is used for Layer 2 address resolution (NDP), not for uRPF validation; uRPF checks the FIB for a matching route, not the neighbor cache. Option D is wrong because the question states that uRPF is enabled and the symptom matches a uRPF failure; an ACL would produce a different drop reason (e.g., 'denied by ACL') and is not indicated as the cause.

Full explanation →
1871
Multi-Selecthard

Which TWO statements about MPLS Traffic Engineering (MPLS-TE) are true? (Choose TWO.)

Select 2 answers
A.MPLS-TE uses RSVP-TE to signal label-switched paths (LSPs) and reserve bandwidth.
B.The command 'show mpls traffic-eng tunnels' displays the status of MPLS-TE tunnels.
C.MPLS-TE uses LDP to distribute labels for the TE tunnels.
D.MPLS-TE requires BGP to carry the TE attributes across the network.
E.MPLS-TE requires a full mesh of IBGP sessions between all routers.
AnswersA, B

Correct. RSVP-TE is the standard signaling protocol for MPLS-TE.

Why this answer

MPLS-TE allows explicit path selection using RSVP-TE to reserve bandwidth and set up LSPs. The 'show mpls traffic-eng tunnels' command displays tunnel status. Option A is correct: RSVP-TE is the signaling protocol used for MPLS-TE.

Option B is correct: 'show mpls traffic-eng tunnels' is a valid verification command. Option C is false: MPLS-TE does not use LDP; it uses RSVP-TE. Option D is false: MPLS-TE uses the Resource Reservation Protocol (RSVP) for signaling, not BGP.

Option E is false: MPLS-TE does not require a full mesh of IBGP sessions; it uses IGP with TE extensions.

Full explanation →
1872
MCQmedium

In MPLS, what is the purpose of the TTL propagation feature?

A.It propagates the MPLS label stack to all routers in the domain.
B.It copies the IP TTL into the MPLS TTL at the ingress LER, allowing traceroute to see each hop in the MPLS path.
C.It prevents TTL from being decremented in the MPLS core for security purposes.
D.It ensures that the MPLS TTL is always equal to the IP TTL at the egress LER.
AnswerB

When enabled, the IP TTL is decremented and copied to the MPLS label, so each LSR decrements the TTL, making traceroute visible.

Why this answer

The TTL propagation feature controls how the IP TTL is handled when packets enter an MPLS domain. By default, the IP TTL is copied to the MPLS TTL (propagation), allowing traceroute to work across the MPLS network. When disabled, the MPLS TTL is set to 255, hiding the core from traceroute.

Full explanation →
1873
MCQhard

A network uses PBR to route traffic from a specific host (10.1.1.1) through a VPN tunnel (next-hop 10.10.10.2). After a VPN tunnel failure, traffic from this host is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2', but 'show ip route 10.10.10.2' shows a route via a different interface. What is the root cause?

A.The next-hop 10.10.10.2 is not directly connected; it is reachable via a route. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.
B.The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.
C.The routing table on R1 has a better route to the destination via the VPN tunnel, overriding PBR.
D.The VPN tunnel is down, causing the next-hop to be unreachable.
AnswerA

Policy-Based Routing (PBR) mandates that the specified next-hop IP address must be directly connected to the router. The `debug ip policy` output, showing "no route to next-hop 10.10.10.2", indicates this constraint is not met. Even though `show ip route` displays a route to 10.10.10.2 via a different interface, PBR's lookup mechanism specifically requires a directly connected entry for the next-hop. When the VPN tunnel fails, the directly connected path to 10.10.10.2 is lost, causing PBR to fail and traffic to be dropped.

Why this answer

PBR requires the next-hop to be directly reachable (i.e., on a directly connected subnet). If the next-hop is reachable via a route (e.g., through another router), PBR will not use it because it expects a direct connection. In this case, 10.10.10.2 is reachable via a route, not directly connected, so PBR drops the traffic.

The solution is to ensure the next-hop is directly connected or use a different next-hop that is directly connected.

Full explanation →
1874
Drag & Dropmedium

Drag and drop the steps to set up a PE-CE BGP session in an MPLS L3VPN into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with defining the VRF and its RD/RT on the PE, then assigning the VRF to the CE-facing interface. After that, the PE interface is configured with an IP address and BGP is enabled in the VRF address-family. Finally, the BGP neighbor is activated under the VRF address-family to establish the PE-CE session.

Full explanation →
1875
MCQhard

An engineer configures route redistribution from EIGRP into OSPF. The redistributed routes appear in the OSPF database but are not installed in the routing table of other OSPF routers. Which is the most likely explanation?

A.The OSPF process on the redistributing router does not have a router-id configured.
B.The redistributed routes have a metric of 0, which OSPF treats as unreachable.
C.The administrative distance of OSPF external routes (110) is higher than EIGRP (90), so the EIGRP routes are preferred.
D.The redistribute command is missing the subnets keyword, causing only classful routes to be redistributed.
AnswerB

OSPF requires a non-zero metric for external routes; a metric of 0 (default for type 1) can cause the route to be ignored.

Why this answer

When redistributing into OSPF, a seed metric must be specified. If not, OSPF defaults to a metric of 20 for external type 2 routes, but if the metric-type is set to 1, the default metric is 0, which may cause the route to be considered unreachable or not installed.

Full explanation →
Page 24

Page 25 of 27

Page 26

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →