Knowledge + Practice

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1876–1950

1966 questions total · 27pages · All types, answers revealed

Take a mock exam Exam hub

Page 26 of 27

1876

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip route 10.1.1.0 Routing entry for 10.1.1.0/24 Known via "eigrp 100", distance 170, metric 2560000 Redistributing via eigrp 100 Advertised by eigrp 100 (self originated) Last update from 10.2.2.2 on GigabitEthernet0/1, 00:00:10 ago Routing Descriptor Blocks: * 10.2.2.2, from 10.2.2.2, 00:00:10 ago, via GigabitEthernet0/1 Route metric is 2560000, traffic share count is 1 Total delay is 100 microseconds, minimum bandwidth is 100000 Kbit Reliability 255/255, minimum MTU 1500 Loading 1/255, Hops 1 Based on this output, what is the problem?

A.The route 10.1.1.0/24 is an internal EIGRP route because the administrative distance is 90.

B.The route is redistributed into EIGRP from another protocol, as indicated by the distance of 170 and the 'self originated' message.

C.The route is learned from a neighbor with a metric of 2560000, which is the default for redistributed routes.

D.The route is not being advertised to any EIGRP neighbors because it is marked as 'self originated'.

AnswerB

The distance of 170 and the 'self originated' flag indicate redistribution into EIGRP.

Why this answer

The output shows a route learned via EIGRP with an administrative distance of 170, which is the default for external EIGRP routes. The route is marked as 'Redistributing via eigrp 100' and 'Advertised by eigrp 100 (self originated)', indicating that this route was redistributed into EIGRP from another protocol. The problem is that the route is both learned and redistributed by the same router, which could cause a routing loop if not filtered.

Full explanation →

1877

MCQhard

An engineer configures Control Plane Policing (CoPP) on a router to protect the management plane. After applying the policy, the router becomes unreachable via SSH, but the console is still accessible. The engineer checks the CoPP policy and sees that SSH traffic is permitted. Which is the most likely explanation?

A.The class-map for SSH uses 'match protocol ssh' but the SSH server is configured on a non-default port, so the traffic is not matched and is dropped by the default class.

B.The CoPP policy is applied in the input direction, but SSH traffic is generated by the router itself, so it is not affected by input policing.

C.The CoPP policy uses 'rate-limit' in bps instead of pps, causing all traffic to be dropped due to a misconfiguration.

D.The CoPP policy has an explicit deny statement before the permit statement for SSH, so SSH traffic is denied.

AnswerA

CoPP class-maps that match by protocol may not match non-standard ports. If the default class has a drop action, SSH traffic will be dropped.

Why this answer

CoPP policies have an implicit deny at the end. If the class-map for SSH does not match the traffic correctly (e.g., using the wrong protocol or port), SSH packets will fall through to the default class, which may have a deny action. Additionally, the default class behavior is to permit traffic if not explicitly configured, but if the default class is configured with a drop action, all unmatched traffic is dropped.

A common edge case is when the class-map uses 'match protocol ssh' but the router uses a different port for SSH (e.g., port 2222), so the traffic is not matched and is dropped by the default class.

Full explanation →

1878

MCQhard

A network engineer runs the following command to troubleshoot PAT exhaustion: R1# show ip nat statistics Total active translations: 1024 (0 static, 1024 dynamic; 1024 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 50000 Misses: 10 CEF Translated packets: 45000, CEF Punted packets: 5000 Expired translations: 2000 Dynamic mappings: -- Inside Source [Id: 1] access-list NAT permit ip 10.0.0.0 0.255.255.255 any refcount 1024, pool MyPool pool MyPool: netmask 255.255.255.240 start 203.0.113.1 end 203.0.113.14 type generic, total addresses 14, allocated 14 (100%), misses 0 What is the most likely issue?

A.The pool is exhausted; PAT is using all addresses, but port exhaustion may occur.

B.The access list is misconfigured, blocking traffic.

C.The outside interface is down.

D.Static translations are missing.

AnswerA

All 14 addresses are allocated, meaning PAT is using them, but with 1024 translations, ports may be running out.

Why this answer

The output shows that the NAT pool 'MyPool' has 14 addresses, all of which are allocated (100% usage), and there are 1024 active translations. With only 14 public IPs, PAT can theoretically support up to 14 * 65535 = 917,490 ports, but the pool exhaustion indicates that all addresses are in use, and the high number of translations suggests that port exhaustion is imminent or occurring, as each address can only handle a finite number of simultaneous sessions before ports are exhausted.

Exam trap

Cisco often tests the misconception that PAT exhaustion only occurs when the pool has a single address, but here the trap is that even with multiple addresses, all can be fully allocated, leading to port exhaustion per address.

How to eliminate wrong answers

Option B is wrong because the access list 'NAT permit ip 10.0.0.0 0.255.255.255 any' is correctly configured to match the inside network, and the refcount of 1024 shows it is actively matching traffic. Option C is wrong because the outside interface GigabitEthernet0/1 is listed in the output, and the presence of hits (50000) and misses (10) indicates that the interface is operational and processing traffic. Option D is wrong because static translations are not required for PAT; the issue is dynamic pool exhaustion, not a lack of static entries.

Full explanation →

1879

Multi-Selecthard

Which TWO actions will prevent unauthorized access to a Cisco IOS-XE device's console port? (Choose TWO.)

Select 2 answers

A.Configure 'login authentication default' under the console line to require AAA authentication.

B.Configure 'exec-timeout 0 0' under the console line to prevent idle sessions from timing out.

C.Configure 'transport input none' under the console line to block all inbound connections.

D.Configure 'no exec' under the console line to disable EXEC sessions on the console port.

E.Configure 'password cisco' and 'login' under the console line to require a local password.

AnswersA, E

This command applies the default AAA authentication method list to the console line, requiring users to authenticate before gaining access.

Why this answer

Configuring 'login authentication default' under the console line forces the device to use AAA (Authentication, Authorization, and Accounting) services for console login. This prevents unauthorized access by requiring valid credentials verified by a centralized AAA server (e.g., RADIUS or TACACS+), rather than relying on a local password that could be compromised or shared.

Exam trap

Cisco often tests the distinction between commands that actually prevent unauthorized access versus those that modify session behavior or apply to different line types, so the trap here is assuming that disabling idle timeout (exec-timeout 0 0) or blocking transport input enhances security, when in fact they either weaken it or are irrelevant to console port access.

Full explanation →

1880

Multi-Selecthard

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Select 2 answers

A.The noAuthNoPriv security level provides no authentication and no encryption.

B.The authPriv security level requires both authentication and encryption.

C.The authNoPriv security level uses encryption but no authentication.

D.SNMPv3 always requires encryption for all security levels.

E.The 'priv' keyword in the snmp-server group command disables authentication.

AnswersA, B

This is the least secure level, often used for read-only access.

Why this answer

SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Exam trap

Cisco often tests the misconception that authNoPriv includes encryption or that the 'priv' keyword disables authentication, leading candidates to confuse the purpose of the 'auth' and 'priv' keywords in the snmp-server group command.

Full explanation →

1881

MCQeasy

What is the default severity level for syslog messages sent to the console on a Cisco IOS device?

A.Debugging (level 7)

B.Informational (level 6)

C.Warnings (level 4)

D.Notifications (level 5)

AnswerA

The default console logging level is debugging, which includes all severities.

Why this answer

By default, the console logging level is 'debugging' (severity 7), meaning all messages from 0 to 7 are displayed on the console. This is a common fact for ENARSI.

Full explanation →

1882

Drag & Dropmedium

Drag and drop the steps to verify and validate DHCP (IPv4 and IPv6) operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Start by checking the DHCP pool utilization and bindings. Then, verify that clients have received addresses from the correct pool. Next, confirm that the DHCP relay agent is forwarding packets.

After that, validate DHCPv6 prefix delegation if used. Finally, ensure that the DHCP server is not running out of addresses.

Full explanation →

1883

MCQmedium

Which OSPF LSA type is flooded only within the originating area and is used for loop prevention by describing the topology of the area?

A.Type 1 LSA (Router LSA)

B.Type 2 LSA (Network LSA)

C.Type 3 LSA (Summary LSA)

D.Type 4 LSA (ASBR Summary LSA)

AnswerA

Correct. Router LSAs are area-scoped and describe the router's interfaces and neighbors.

Why this answer

Type 1 Router LSAs describe the router's links and are flooded only within the area. They provide topology information for loop prevention within the area.

Full explanation →

1884

MCQhard

An MPLS network with EIGRP as the IGP is experiencing label distribution failures. Router R1 shows: 'show mpls ldp neighbor' does not list R2. R1's configuration: mpls ip on interfaces, but no router-id configured. R2's configuration: mpls ldp router-id Loopback0 force. R1 and R2 are directly connected. What is the root cause?

A.R1's LDP router-id is not configured, so it uses the IP of the interface facing R2, which may not be reachable from R2's loopback.

B.R2 has a loopback interface that is not advertised via EIGRP, so R1 cannot reach it.

C.R1 has an ACL that blocks LDP UDP packets (port 646).

D.R2's 'force' keyword causes it to use the loopback even if it is not reachable.

AnswerA

LDP requires a reachable router-id. Without explicit configuration, R1 uses the interface IP, which may not be in R2's routing table.

Why this answer

R1 has no explicit LDP router-id configured, so it defaults to the highest IP address on a loopback interface or, if none exists, the highest IP on a physical interface. Since R1 has no loopback, it uses the IP of the interface facing R2. R2's LDP router-id is forced to its Loopback0 address via the 'force' keyword.

For LDP sessions to establish, each router must be able to reach the other's LDP router-id. R2's loopback may not be reachable from R1's interface IP, or R1's interface IP may not be reachable from R2's loopback, breaking the TCP transport required for LDP.

Exam trap

Cisco often tests the nuance that LDP router-id reachability is required for session establishment, and candidates mistakenly focus on the 'force' keyword or ACLs instead of the fundamental TCP reachability requirement.

How to eliminate wrong answers

Option B is wrong because the question does not indicate that R2's loopback is not advertised via EIGRP; the issue is about LDP router-id reachability, not route advertisement. Option C is wrong because there is no mention of an ACL on R1, and the symptom 'show mpls ldp neighbor' not listing R2 points to a failure in LDP session establishment, which is more likely due to router-id reachability than a blocked UDP port (LDP uses UDP for discovery but TCP for session establishment). Option D is wrong because the 'force' keyword on R2 causes it to use the loopback address as its LDP router-id regardless of reachability, but the problem is that R1 cannot reach that loopback address, not that R2's configuration is incorrect.

Full explanation →

1885

MCQeasy

What is the default route distinguisher (RD) format when using the 'ip vrf' command without specifying an RD?

A.The RD defaults to 0:0.

B.The RD is automatically derived from the router ID.

C.The VRF will not be created until an RD is configured.

D.The RD defaults to the ASN:1 format.

AnswerC

This is correct. The RD is required to create a VRF.

Why this answer

The RD is mandatory when creating a VRF. If not specified, the VRF will not be created. There is no default RD.

Full explanation →

1886

MCQmedium

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show bgp neighbors 10.1.1.2 received-routes BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.3.3.0/24 10.1.1.2 0 100 0 i Total number of prefixes 1 What does this output indicate?

A.BGP is not receiving any routes due to CoPP dropping updates.

B.BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.

C.BGP is receiving routes but not installing them in the routing table due to CoPP.

D.BGP session is flapping due to CoPP.

AnswerB

The route is received from neighbor 10.1.1.2 with valid attributes.

Why this answer

The output shows a single BGP prefix (10.3.3.0/24) received from neighbor 10.1.1.2, with the route marked as valid (*) and best (>). This confirms that BGP is successfully receiving and processing the update, and the route is eligible for installation in the routing table. Since the route appears in the received-routes output, CoPP is not dropping the inbound BGP update packets, as CoPP would prevent the packets from reaching the BGP process entirely.

Exam trap

Cisco often tests the distinction between CoPP dropping packets before they reach the BGP process (which would show no received routes) versus BGP receiving routes but not installing them due to other reasons like RIB-failure or policy, leading candidates to incorrectly assume CoPP affects route installation.

How to eliminate wrong answers

Option A is wrong because the output clearly shows one route received, so BGP is receiving updates; CoPP dropping updates would result in zero received routes. Option C is wrong because the route is marked as valid and best, meaning BGP has installed it in the BGP table and will attempt to install it in the routing table; CoPP does not affect route installation after the update is processed. Option D is wrong because the BGP session is stable (the neighbor is reachable and updates are received); a flapping session would show no routes or intermittent connectivity, not a single stable prefix.

Full explanation →

1887

MCQhard

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

A.The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.

B.The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.

C.The NHRP network-id is different on R2 and R3, preventing communication.

D.The tunnel source interface is not reachable between spokes.

AnswerA

Without NHS configuration, spokes do not register with the hub, so NHRP cannot provide the mapping for spoke-to-spoke tunnels.

Why this answer

In a DMVPN network, spokes must use the 'ip nhrp nhs' command to register their real (physical) IP addresses with the hub (NHS). Without this command, the hub never learns the spokes' addresses, so it cannot provide NHRP resolution replies to other spokes attempting to form spoke-to-spoke tunnels. The absence of dynamic sessions on R2 and no NHRP entries for R2 on R3 directly indicate that R2 never registered with the hub.

Exam trap

Cisco often tests the misconception that 'ip nhrp map multicast dynamic' alone is sufficient for spoke registration, but in reality, the 'ip nhrp nhs' command is mandatory for spokes to register their addresses with the hub.

How to eliminate wrong answers

Option B is wrong because the question states the network is configured with mGRE, and while spoke-to-spoke tunnels fail, there is no evidence that spokes use point-to-point GRE; even if they did, that would not prevent NHRP registration with the hub. Option C is wrong because if the NHRP network-id were different on R2 and R3, they would not be able to communicate with the hub either, but the hub (R1) is configured with network-id 1, and the spokes would need matching IDs to register; the issue is specifically the missing 'ip nhrp nhs' command, not a mismatch. Option D is wrong because the tunnel source interface reachability between spokes is irrelevant for initial registration; spokes first register with the hub, and the hub facilitates spoke-to-spoke resolution; if the hub is reachable, registration should occur, but it does not due to the missing NHS configuration.

Full explanation →

1888

MCQeasy

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue: R1# show ip interface GigabitEthernet0/0 | include access list Outgoing access list is 102 Inbound access list is not set Then the engineer checks: R1# show ip access-lists 102 Extended IP access list 102 10 deny tcp any any eq 23 20 permit ip any any What does this output indicate?

A.ACL 102 is applied outbound on GigabitEthernet0/0, denying Telnet traffic and permitting all other traffic.

B.ACL 102 is applied inbound on GigabitEthernet0/0, blocking Telnet.

C.ACL 102 is not applied to any interface.

D.ACL 102 is applied inbound and outbound on GigabitEthernet0/0.

AnswerA

The output shows the ACL is outbound and its entries.

Why this answer

The output of 'show ip interface GigabitEthernet0/0 | include access list' shows 'Outgoing access list is 102', which means ACL 102 is applied in the outbound direction on that interface. The ACL itself contains a deny statement for TCP traffic destined to port 23 (Telnet) followed by a permit ip any any, so it denies Telnet traffic while permitting all other IP traffic. Option A correctly summarizes this behavior.

Exam trap

Cisco often tests the distinction between the ACL being 'applied' to an interface versus the ACL's content, and the trap here is that candidates see the ACL content and assume it is applied inbound without checking the interface output for direction.

How to eliminate wrong answers

Option B is wrong because the interface output explicitly states 'Inbound access list is not set', so ACL 102 is not applied inbound. Option C is wrong because the interface output confirms ACL 102 is applied outbound on GigabitEthernet0/0. Option D is wrong because the interface output shows only an outbound ACL; the inbound access list is not set, so it is not applied in both directions.

Full explanation →

1889

MCQhard

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

A.The hub router does not have a route to the remote spoke's LAN subnet.

B.The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.

C.The spoke's routing table has a static route to the remote spoke's LAN via the hub.

D.The hub's tunnel interface has 'no ip nhrp redirect' configured.

AnswerA

Correct because the hub must have a route to the destination subnet to send an NHRP redirect.

Why this answer

In DMVPN phase 3, for spoke-to-spoke shortcuts to be installed, the spoke must receive an NHRP redirect from the hub. If the hub does not send a redirect, the spoke will not create a shortcut. The hub sends a redirect only if it has a route to the destination subnet.

If the hub does not have a route to the remote spoke's LAN, it will not send a redirect.

Full explanation →

1890

MCQmedium

An engineer is troubleshooting an IPv6 deployment where hosts on a subnet are not receiving IPv6 addresses via SLAAC. The router is configured with 'ipv6 unicast-routing' and the interface has 'ipv6 address 2001:db8:1::1/64' and 'ipv6 nd other-config-flag'. The hosts are sending Router Solicitations but receive no Router Advertisements. What is the root cause?

A.The interface is missing the 'ipv6 enable' command.

B.The 'ipv6 nd ra suppress' command is configured on the interface.

C.The 'ipv6 nd prefix' command is missing for the subnet.

D.The hosts are using DHCPv6 instead of SLAAC.

AnswerB

Correct because this command suppresses Router Advertisements, preventing hosts from receiving RAs even though the interface has an IPv6 address.

Why this answer

For SLAAC to work, the router must send Router Advertisements (RAs). The 'ipv6 nd other-config-flag' only sets the 'O' flag for additional information (like DNS), but does not enable RA generation. The interface must have an 'ipv6 enable' command or a configured unicast address to automatically enable RA generation, but here the address is configured, so RA generation should be on by default.

However, the 'ipv6 nd prefix' command may be missing or the interface may be administratively down. The most common cause is that the interface is not 'no shutdown' or the RA interval is set to 0. Given the symptom, the likely cause is that the interface is in a state where RAs are suppressed, such as when 'ipv6 nd ra suppress' is configured.

Full explanation →

1891

MCQmedium

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# debug ip sla trace IP SLAs trace debugging is on *Mar 1 12:34:56.789: IP SLAs: Starting operation 10 *Mar 1 12:34:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1 *Mar 1 12:34:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1 *Mar 1 12:34:56.790: IP SLAs: RTT = 12 ms *Mar 1 12:34:56.790: IP SLAs: Operation 10 completed successfully *Mar 1 12:35:56.789: IP SLAs: Starting operation 10 *Mar 1 12:35:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1 *Mar 1 12:35:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1 *Mar 1 12:35:56.790: IP SLAs: RTT = 14 ms *Mar 1 12:35:56.790: IP SLAs: Operation 10 completed successfully What does this output indicate?

A.The IP SLA operation is failing because the RTT values are too high.

B.The IP SLA operation is successfully completing each probe cycle.

C.The IP SLA operation is not configured because no configuration is shown.

D.The IP SLA operation is timing out because no reply is received.

AnswerB

Each cycle shows 'completed successfully'.

Why this answer

This debug output shows the IP SLA trace for operation 10 (newer command). It confirms successful ICMP echo probes with RTT values, indicating the operation is functioning correctly.

Full explanation →

1892

MCQmedium

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# debug crypto ipsec *Mar 1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, *Mar 1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0 *Mar 1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match! *Mar 1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI What does this output indicate?

A.The IPsec SA is established successfully with ESP 3DES and SHA.

B.The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.

C.The ACL for the crypto map is misconfigured, causing the traffic to not match.

D.The IKE phase 1 SA is not established before IPsec negotiation.

AnswerB

The debug explicitly states the proposal is not supported, meaning a mismatch in transform set.

Why this answer

The debug output shows that the IPsec SA request is generated, but the transform proposal (esp-3des esp-sha-hmac) is rejected with 'not supported for proxy'. This indicates that the remote peer does not support or is configured with a different transform set, causing the proposal to fail validation. The SA is created with placeholder SPIs (0x1234, 0x5678) but no actual inbound/outbound SPI, confirming negotiation failure due to transform set mismatch.

Exam trap

Cisco often tests the distinction between IKE phase 1 and phase 2 failures; the trap here is that candidates might assume the SA creation message with SPIs indicates success, but the 'no inbound or outbound SPI' line reveals the SA is incomplete, pointing to a transform set mismatch rather than ACL or IKE phase 1 issues.

How to eliminate wrong answers

Option A is wrong because the debug clearly shows 'proposal doesn't match' and 'no inbound or outbound SPI', meaning the SA is not established successfully. Option C is wrong because the debug output shows the correct proxy identities (src=192.168.1.0/24, dst=192.168.2.0/24), indicating the ACL is matching traffic; the failure is at the transform proposal validation stage, not ACL misconfiguration. Option D is wrong because the debug output shows an IPsec SA request is being processed, which implies IKE phase 1 (ISAKMP SA) has already been established; if IKE phase 1 were not up, the debug would not reach the IPsec SA negotiation stage.

Full explanation →

1893

MCQhard

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

A.Configure 'no logging trap debugging' globally.

B.Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.

C.Use 'undebug all' to stop all debug output.

D.Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.

AnswerB

Correct because this command sets the severity level for that specific host only, allowing local logging to remain at debugging.

Why this answer

To stop sending debug messages to the remote server without affecting local logging, the engineer should change the remote logging severity to a higher level (e.g., 'logging host 10.1.1.100 trap notifications' to set severity 5). This will exclude debug (severity 7) messages from being sent to that specific host. The local buffer can remain at debugging level.

Full explanation →

1894

Drag & Drophard

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table.

Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Full explanation →

1895

MCQhard

In a VRF-Lite setup, Router R1 and R2 are running OSPF in VRF-A. R1 has interface Gig0/0 in VRF-A with ip ospf network point-to-point. R2 has interface Gig0/1 in VRF-A with default network type (broadcast). The link between them is a direct Ethernet connection. OSPF neighbors are not forming. What is the root cause?

A.The OSPF network types are mismatched: one side is point-to-point, the other is broadcast, causing neighbor adjacency failure.

B.The VRF names must match for OSPF to form neighbors.

C.The OSPF process ID must be the same on both routers.

D.The interface must be configured with the same IP subnet mask.

AnswerA

Correct: OSPF requires matching network types on the same link; mismatch leads to no neighbor formation.

Why this answer

OSPF network type mismatch prevents neighbor formation. On a broadcast network, OSPF expects DR/BDR elections, while point-to-point expects no election. The mismatch causes hello packets to be ignored because the OSPF interface parameters (like hello interval, dead interval, and network type) differ.

Specifically, on a point-to-point link, the neighbor state machine expects a different packet format and does not process broadcast hellos.

Full explanation →

1896

Multi-Selecthard

An engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)

Select 2 answers

A.Configure 'event cli pattern "write memory" sync no' under the applet.

B.Use 'action cli command "copy running-config tftp://10.1.1.1/backup-config"' to perform the backup.

C.Define the applet using the 'event manager policy' command instead of 'event manager applet'.

D.Add an 'event syslog pattern "WRITE"' to detect the write memory operation.

E.Include an 'action cli command "enable"' before the copy command to ensure privileged access.

AnswersA, B

Correct. This event triggers on the 'write memory' command without synchronizing, allowing the backup to proceed asynchronously.

Why this answer

The 'event cli' with 'sync no' is needed to avoid blocking the CLI. The 'action cli command' must use the 'copy running-config tftp:' command. The 'event manager applet' is correct, not 'event manager policy'.

The 'event syslog' with pattern 'WRITE' is not precise enough. The 'action cli command' should not use 'enable' as a separate action because the applet runs in the same privilege level as the triggering user.

Full explanation →

1897

MCQmedium

What is the default timeout value (in milliseconds) for an IP SLA operation?

A.1000 ms

B.5000 ms

C.10000 ms

D.60000 ms

AnswerB

Correct. The default timeout is 5000 ms (5 seconds).

Why this answer

The default timeout for an IP SLA operation is 5000 milliseconds (5 seconds). If a response is not received within this time, the probe is considered failed.

Full explanation →

1898

MCQeasy

Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?

A.event syslog

B.event snmp

C.event cli

D.event timer

AnswerC

Correct. 'event cli' is used to trigger on CLI commands.

Why this answer

EEM provides the 'event cli' event type to match on CLI commands. The syntax is 'event cli pattern <string>' where the pattern can be a regular expression to match the command. Other event types like 'event syslog' match syslog messages, not CLI commands.

Full explanation →

1899

MCQhard

DMVPN spoke-to-spoke tunnel is not forming between two spokes. Hub router R1 has the following relevant configuration: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 ip nhrp map multicast dynamic ip ospf 1 area 0 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint Spoke R2 shows: show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, NHRP Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.168.1.1 10.0.0.1 UP 00:10:00 D Spoke R3 shows similar, but no spoke-to-spoke tunnel. What is the root cause?

A.Missing ip nhrp redirect on hub and ip nhrp shortcut on spokes.

B.OSPF network type is broadcast; change to point-to-multipoint.

C.IPsec is not configured; DMVPN requires encryption.

D.The tunnel key is mismatched; configure tunnel key on all routers.

AnswerA

NHRP redirect triggers shortcut creation; without it, spokes always use hub.

Why this answer

Spoke-to-spoke tunnel requires NHRP redirect and shortcut route. Without ip nhrp redirect on hub and ip nhrp shortcut on spokes, traffic between spokes goes through hub. OSPF over DMVPN may also need mtu or ipsec issues.

The correct fix is to enable NHRP redirect on hub and shortcut on spokes.

Full explanation →

1900

MCQmedium

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

A.The routers have the same OSPF router ID.

B.The OSPF hello interval is mismatched between the two routers.

C.The subinterfaces are in different VLANs, preventing Layer 2 communication.

D.The OSPF network type is set to point-to-point on one side and broadcast on the other.

AnswerA

When a router receives a hello packet with its own router ID, it ignores it, causing the adjacency to stay in INIT.

Why this answer

The INIT state indicates that the router has received a hello packet from the neighbor but the neighbor has not seen its own router ID in the hello packet. This is often due to a mismatch in the OSPF network type or a unicast communication issue. In a VLAN trunk scenario, if the subinterfaces are not in the same VLAN, the routers may not be able to communicate at Layer 2.

However, the most common cause is that the routers are using the same router ID, which causes the hello packet to be ignored because the router sees its own router ID in the neighbor list.

Full explanation →

1901

Multi-Selecthard

Which TWO statements about the 'time-range' feature in IPv4 ACLs are correct? (Choose TWO.)

Select 2 answers

A.A time-range can include both absolute and periodic statements simultaneously.

B.The time-range is applied to the entire ACL, not individual ACEs.

C.If the router's clock is not set, the time-range will be considered active at all times.

D.The time-range feature can only be used with extended named ACLs, not standard ACLs.

E.The time-range must be configured before it is referenced in an ACE.

AnswersA, E

Correct. A time-range can have one absolute statement and multiple periodic statements; the ACE is active if any of the conditions are met.

Why this answer

The 'time-range' feature in Cisco IOS allows both absolute (specific start/end dates) and periodic (recurring days/times) statements to be combined within a single time-range definition. This enables flexible scheduling, such as allowing traffic only during business hours on weekdays while also specifying an absolute end date for the policy.

Exam trap

Cisco often tests the misconception that a time-range applies to the entire ACL rather than individual ACEs, leading candidates to incorrectly select option B.

Full explanation →

1902

MCQhard

What is the maximum hop count for an EIGRP route?

A.15

B.255

C.224

D.Unlimited

AnswerC

Correct. EIGRP limits hop count to 224 by default.

Why this answer

EIGRP uses a maximum hop count of 224, not 255 like RIPv2 or other distance-vector protocols. This limit is hard-coded in the EIGRP protocol to prevent routing loops and excessive path lengths, and it is enforced by the EIGRP update process. Routes with a hop count exceeding 224 are considered unreachable and are not installed in the routing table.

Exam trap

Cisco often tests the specific EIGRP hop count of 224 to trap candidates who confuse it with the more common RIP hop count of 15 or the RIPv2/EIGRP default of 255, or who assume EIGRP has no hop count limit due to its advanced metric system.

How to eliminate wrong answers

Option A is wrong because 15 is the maximum hop count for RIP (Routing Information Protocol), not EIGRP. Option B is wrong because 255 is the maximum hop count for RIPv2 and some other distance-vector protocols, but EIGRP specifically uses 224. Option D is wrong because EIGRP does have a finite hop count limit (224), so routes are not unlimited; this misconception might arise from EIGRP's use of composite metrics rather than hop count as the primary metric.

Full explanation →

1903

MCQmedium

Consider the following partial configuration on a Cisco IOS-XE router: interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat outside ! ip nat inside source list 1 interface GigabitEthernet0/1 overload access-list 1 permit 192.168.1.0 0.0.0.255 What is the effect of this configuration?

A.All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.

B.Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

C.Traffic is translated using static NAT to 203.0.113.1.

D.The configuration is incomplete; a NAT pool is required for dynamic translation.

AnswerA

The 'overload' keyword enables PAT, and the ACL matches the inside network.

Why this answer

The configuration uses an ACL (access-list 1) to match traffic from the 192.168.1.0/24 subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command translates all matching source IP addresses to the single IP address 203.0.113.1 (the outside interface IP) using Port Address Translation (PAT). This is a classic dynamic NAT overload configuration, where multiple internal hosts share one public IP by multiplexing on source ports.

Exam trap

Cisco often tests the distinction between 'ip nat inside source list <acl> interface <interface> overload' (dynamic PAT using the interface IP) and configurations that require a NAT pool or static mapping, leading candidates to mistakenly think a pool is mandatory for any dynamic translation.

How to eliminate wrong answers

Option B is wrong because the ACL permits the entire 192.168.1.0/24 subnet, not just the router's own interface IP 192.168.1.1; all hosts in that subnet are eligible for translation. Option C is wrong because static NAT requires the 'ip nat inside source static' command, not the 'overload' keyword, and the configuration here uses dynamic translation with PAT. Option D is wrong because when using 'interface' with 'overload', no NAT pool is required; the outside interface IP itself serves as the single translated address, and PAT handles port multiplexing.

Full explanation →

1904

MCQhard

A network engineer notices that routes redistributed from EIGRP into OSPF are causing routing loops. Router R1 has the following relevant configuration: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 router ospf 1 redistribute eigrp 100 subnets metric-type 1 Router R2 shows: show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20, type E1 Last update from 10.1.1.1, 00:01:30 ago Also, R2 has a default route via R1. What is the root cause?

A.Mutual redistribution without filtering causes a routing loop; apply distribute-list or route-map with tags.

B.The metric-type 1 should be type 2 to avoid loops.

C.The EIGRP metric values are incorrect; they should match OSPF cost.

D.The subnets keyword is missing in the redistribute command for OSPF.

AnswerA

Without filtering, routes are redistributed back and forth, creating loops. Tags and filters break the cycle.

Why this answer

The mutual redistribution between EIGRP and OSPF without route filtering can cause a routing loop. R1 redistributes OSPF into EIGRP, and EIGRP back into OSPF, creating a feedback loop. The E1 metric of 20 suggests the route was redistributed twice.

The correct fix is to implement route tagging and filtering to prevent loop.

Full explanation →

1905

MCQmedium

What is the default EIGRP composite metric formula used for route calculation?

A.metric = bandwidth + delay + load + reliability

B.metric = (K1 * bandwidth) + (K3 * delay)

C.metric = bandwidth + delay + MTU

D.metric = (K1 * bandwidth) + (K2 * load) + (K3 * delay) + (K5 / (K4 + reliability))

AnswerB

Correct: With default K values (K1=1, K3=1, others=0), the formula simplifies to bandwidth + delay.

Why this answer

The default EIGRP composite metric uses only K1 and K3, which correspond to bandwidth and delay, with K1=1 and K3=1 by default. This yields the formula metric = bandwidth + delay, where bandwidth is calculated as (10^7 / minimum path bandwidth in kbps) * 256 and delay is the sum of interface delays in tens of microseconds multiplied by 256. Option B correctly represents this default behavior.

Exam trap

Cisco often tests the misconception that the full five-term formula (Option D) is the default, but the trap is that K2, K4, and K5 default to zero, so only K1 and K3 are used, making Option B the correct default formula.

How to eliminate wrong answers

Option A is wrong because it omits the K-value scaling and treats load and reliability as additive components, but EIGRP does not include load or reliability in the default metric calculation. Option C is wrong because MTU is not part of the EIGRP composite metric; it is only used for path MTU discovery and does not influence route selection. Option D is wrong because it includes K2 (load), K4, and K5 (reliability) terms, which are set to zero by default, making the formula non-functional for default operation; the full formula is only used when non-default K-values are configured.

Full explanation →

1906

MCQhard

What is the default keepalive interval for a GRE tunnel interface on Cisco IOS-XE?

A.5 seconds

B.10 seconds

C.15 seconds

D.20 seconds

AnswerB

The default keepalive interval is 10 seconds.

Why this answer

The default keepalive interval for a GRE tunnel interface on Cisco IOS-XE is 10 seconds. This is defined by the default behavior of the `keepalive` command on tunnel interfaces, which sends periodic keepalive packets to verify the reachability of the tunnel destination. If no keepalive reply is received within three consecutive intervals (30 seconds by default), the tunnel interface is marked as down.

Exam trap

Cisco often tests the default keepalive interval for GRE tunnels, and the trap here is that candidates confuse it with the default keepalive interval for other interface types (e.g., serial interfaces default to 10 seconds as well, but some assume 5 or 15 seconds based on unrelated protocols like EIGRP hello timers).

How to eliminate wrong answers

Option A is wrong because 5 seconds is not the default; it is a common misconfiguration or a value used for faster failure detection but not the Cisco IOS-XE default. Option C is wrong because 15 seconds is not the default; it might be confused with the default keepalive interval for other interface types like serial interfaces (which default to 10 seconds as well, but not 15). Option D is wrong because 20 seconds is not the default; it could be mistaken for the default dead interval (three keepalive intervals) which is 30 seconds, not 20.

Full explanation →

1907

MCQeasy

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

A.RA Guard

B.DHCPv6 Guard

C.Device Tracking

D.PACL

AnswerC

Correct. Device Tracking maintains a database of IPv6 addresses and their reachability.

Why this answer

Device Tracking is the correct answer because it is the IPv6 First Hop Security (FHS) feature that maintains a 'device tracking' database to monitor and store reachability information for hosts. This database tracks the IPv6 address, MAC address, and binding state of each host, enabling features like ND Inspection and DHCPv6 Guard to verify host reachability before forwarding traffic.

Exam trap

Cisco often tests the distinction between features that maintain the database (Device Tracking) versus features that use the database (e.g., DHCPv6 Guard, RA Guard), so the trap here is assuming that any FHS feature that interacts with host information must be the one that maintains the tracking database.

How to eliminate wrong answers

Option A is wrong because RA Guard is an IPv6 FHS feature that filters Router Advertisement messages to prevent rogue router attacks, but it does not maintain a device tracking database for host reachability. Option B is wrong because DHCPv6 Guard is an IPv6 FHS feature that filters DHCPv6 messages to block unauthorized DHCP servers, but it relies on the device tracking database rather than maintaining it. Option D is wrong because PACL (Port Access Control List) is a security feature used to filter traffic based on Layer 2 or Layer 3 criteria, but it is not an IPv6 FHS feature and does not maintain a device tracking database.

Full explanation →

1908

MCQeasy

Which DHCP message type is used by a client to renew its lease before it expires?

A.DHCPREQUEST

B.DHCPDISCOVER

C.DHCPACK

D.DHCPRELEASE

AnswerA

The client uses DHCPREQUEST to renew its lease, sent unicast to the DHCP server.

Why this answer

When a DHCP client wants to renew its existing lease before it expires, it sends a unicast DHCPREQUEST message directly to the DHCP server that originally granted the lease. This is part of the renewal process defined in RFC 2131, where the client transitions from the BOUND state to the RENEWING state and uses the server's IP address to request an extension of the lease time.

Exam trap

Cisco often tests the distinction between the unicast DHCPREQUEST used for lease renewal and the broadcast DHCPREQUEST used during the initial DORA process, leading candidates to mistakenly think DHCPDISCOVER is involved in renewal.

How to eliminate wrong answers

Option B (DHCPDISCOVER) is wrong because it is used by a client to locate available DHCP servers when it has no current lease or is starting from the INIT state, not for renewing an existing lease. Option C (DHCPACK) is wrong because it is a server-to-client response that acknowledges and grants the lease or renewal, not a message sent by the client. Option D (DHCPRELEASE) is wrong because it is used by a client to voluntarily relinquish its IP address lease to the server, not to renew it.

Full explanation →

1909

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 120 10 permit tcp 10.0.0.0 0.255.255.255 any eq www (1000 matches) 20 permit udp any any eq dns (500 matches) 30 deny ip any any (200 matches) Based on this output, what is the problem?

A.The ACL is correctly permitting web and DNS traffic.

B.The ACL is blocking all traffic except web and DNS, which may be too restrictive.

C.The ACL has no effect because it is not applied.

D.The ACL allows all traffic because of the permit statements.

AnswerB

The deny ip any any with matches shows that other traffic is being denied, which could be a problem.

Why this answer

The ACL explicitly permits only TCP port 80 (www) and UDP port 53 (dns) traffic, while the final deny ip any any statement blocks all other traffic. With only 1000 matches for web and 500 for DNS, the ACL is likely too restrictive for a production network, as it would drop essential traffic such as routing protocols, management traffic (e.g., SSH, SNMP), or other application flows. The output shows the ACL is present and has hit counts, but its restrictive nature is the problem.

Exam trap

Cisco often tests the misconception that an ACL with permit statements is automatically 'correct' or 'permissive,' when in fact the explicit deny at the end makes it highly restrictive, and candidates may overlook the need to evaluate whether the ACL matches the intended security policy.

How to eliminate wrong answers

Option A is wrong because the ACL does not 'correctly permit' all necessary traffic; it only permits web and DNS, while blocking everything else, which is typically too restrictive for a functioning network. Option C is wrong because the ACL is defined and has match counts (1000, 500, 200), indicating it is applied to an interface; an unapplied ACL would show zero matches. Option D is wrong because the permit statements do not allow all traffic; the explicit deny ip any any at line 30 blocks all traffic not matching the earlier permit entries.

Full explanation →

1910

MCQhard

An engineer configures RSPAN VLAN 100 on two switches to monitor traffic across the network. The remote switch shows the RSPAN source as active, but the destination switch receives no mirrored traffic. What is the most likely cause?

A.The RSPAN VLAN is not allowed on a trunk link between the source and destination switches.

B.The RSPAN VLAN is configured as a native VLAN on the trunk, causing VLAN tagging issues.

C.The destination switch has a different RSPAN VLAN ID configured for the session.

D.The source switch has not enabled RSPAN globally with the 'monitor session' command.

AnswerA

RSPAN traffic traverses the network in the RSPAN VLAN; if that VLAN is not permitted on an intermediate trunk, the traffic is dropped.

Why this answer

RSPAN requires that the RSPAN VLAN be created and allowed on all intermediate switches (trunks) between source and destination. If the RSPAN VLAN is pruned or not allowed on a trunk, the mirrored traffic never reaches the destination. Additionally, the RSPAN VLAN must not be used for user data.

Full explanation →

1911

Drag & Dropmedium

Drag and drop the steps to verify and validate DMVPN operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Validating DMVPN starts with checking the tunnel interface status, then verifying NHRP mappings and IPsec security associations. Next, confirm routing protocol adjacencies over the tunnel. Finally, test end-to-end reachability to ensure the DMVPN network is fully operational.

Full explanation →

1912

Multi-Selectmedium

Which TWO commands would a network engineer use to verify the MPLS label forwarding table on a Cisco IOS-XE router? (Choose TWO.)

Select 2 answers

A.show mpls forwarding-table

B.show mpls ldp neighbor

C.show mpls label table

D.show ip route

E.show mpls interfaces

AnswersA, C

This command displays the MPLS forwarding table, including incoming labels, outgoing labels, and next-hop information.

Why this answer

The MPLS label forwarding table is verified using 'show mpls forwarding-table' and 'show mpls label table'. The former displays outgoing labels for prefixes, while the latter shows local label bindings. Other commands either show LDP neighbors or are invalid.

Full explanation →

1913

Multi-Selectmedium

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Select 2 answers

A.It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.

B.It can be configured to rate-limit ND packets on a per-interface basis.

C.It prevents rogue DHCPv6 servers from assigning malicious addresses.

D.It uses a prefix list to determine which source addresses are allowed.

E.It is enabled globally and cannot be applied on a per-interface basis.

AnswersA, B

ND Inspection checks NS and NA messages against the binding table to prevent spoofing attacks.

Why this answer

IPv6 ND Inspection validates Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages against the IPv6 snooping binding table. This table is built by gleaning information from DHCPv6 messages or by using the IPv6 Neighbor Discovery protocol itself, ensuring that only legitimate ND messages from trusted sources are forwarded, preventing attacks like Neighbor Cache exhaustion or address spoofing.

Exam trap

Cisco often tests the distinction between IPv6 First Hop Security features, and the trap here is confusing ND Inspection (which validates ND messages) with DHCPv6 Guard (which blocks rogue DHCPv6 servers) or RA Guard (which uses prefix lists).

Full explanation →

1914

MCQmedium

Examine this OSPF configuration snippet on router R3: router ospf 1 network 10.1.1.0 0.0.0.255 area 0 default-information originate always What is the effect of the default-information originate always command?

A.R3 will advertise a default route into OSPF only if it has a default route in its routing table.

B.R3 will unconditionally advertise a default route into OSPF as an external LSA type 5.

C.R3 will advertise a default route only if it is an ASBR.

D.The command is invalid because default-information originate requires a route-map.

AnswerB

Correct. The 'always' keyword forces advertisement regardless of the presence of a default route.

Why this answer

The command injects a default route (0.0.0.0/0) into the OSPF domain as an external LSA type 5, regardless of whether the router has a default route in its routing table. The 'always' keyword forces advertisement even without a default route.

Full explanation →

1915

MCQhard

An engineer configures CoPP on a router running EIGRP. The policy includes a class-map matching EIGRP traffic with a police rate of 1000 pps. After applying the policy, EIGRP neighbors form but occasionally go active and become stuck-in-active (SIA). Which is the most likely explanation?

A.EIGRP uses multicast, and CoPP cannot police multicast traffic.

B.The police rate in pps is too low, causing EIGRP reliable packets (queries/replies) to be dropped, leading to SIA.

C.CoPP only affects incoming traffic, but EIGRP SIA is caused by outgoing packet drops.

D.EIGRP uses TCP, and CoPP only polices UDP.

AnswerB

EIGRP's reliable transport requires all packets to be acknowledged; drops cause retransmissions and potential SIA.

Why this answer

EIGRP uses RTP (Reliable Transport Protocol) for certain packets like queries and replies. These reliable packets require acknowledgment; if the CoPP police rate of 1000 pps is too low, EIGRP queries or replies may be dropped. Missing acknowledgments cause the neighbor to be declared active, and if the query process is not completed within the active timer, the route becomes stuck-in-active (SIA).

Exam trap

The trap here is that candidates may assume CoPP only affects incoming traffic or that EIGRP uses TCP, but the key is understanding that EIGRP's reliable packets (queries/replies) are sensitive to drops, and a low pps police rate can cause SIA.

How to eliminate wrong answers

Option A is wrong because CoPP can police multicast traffic; EIGRP uses multicast address 224.0.0.10, and CoPP class-maps can match this traffic using access-lists or protocol matching. Option C is wrong because CoPP can police both incoming and outgoing control plane traffic; EIGRP SIA is typically caused by dropped incoming reliable packets (queries/replies) or missing acknowledgments, not solely by outgoing drops. Option D is wrong because EIGRP does not use TCP; it uses its own Reliable Transport Protocol (RTP) over IP protocol 88, and CoPP can police any IP protocol, not just UDP.

Full explanation →

1916

MCQmedium

A network engineer is troubleshooting MPLS traffic where packets are being dropped at a P router. The engineer runs show mpls forwarding-table and sees that the outgoing label for a specific FEC is 'Untagged' instead of a valid label. The IGP is running correctly, and LDP neighbors are established. What is the most likely cause?

A.LDP is not enabled on the outgoing interface.

B.The IGP metric is too high, causing LDP to prefer a different path.

C.The mpls label range is exhausted.

D.The router is configured with mpls ldp advertise-labels for host routes only.

AnswerA

Correct because LDP must be enabled on each interface to assign a label for the FEC; without it, the label remains 'Untagged' and packets are dropped.

Why this answer

The 'Untagged' label in the LFIB indicates that LDP has not assigned a label for that FEC on the outgoing interface. This typically happens when LDP is not enabled on the outgoing interface, either because the interface is not configured with mpls ip or because the interface is passive under LDP.

Full explanation →

1917

MCQhard

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue: R1# show bgp vpnv4 vrf CUSTOMER-A 10.1.1.0/24 Output: BGP routing table entry for 10.1.1.0/24, version 10 Paths: (1 available, best #1, table CUSTOMER-A) Advertised to update-groups: 1 Refresh Epoch 1 Local 0.0.0.0 from 0.0.0.0 (10.0.0.1) Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best Extended Community: RT:100:100 mpls labels in/out nolabel/nolabel What does this output indicate?

A.The route is locally originated and has no MPLS label

B.The route is learned from a BGP peer

C.The route has an MPLS label of 100

D.The route is not best

AnswerA

The route is sourced locally (0.0.0.0 from 0.0.0.0) and the mpls labels are nolabel/nolabel.

Why this answer

This shows a VPNv4 route for prefix 10.1.1.0/24 in VRF CUSTOMER-A. The path is local (sourced from this router), with next hop 0.0.0.0, and the route is valid and best. The extended community is RT:100:100.

The mpls labels show nolabel/nolabel, meaning no MPLS label is assigned for this prefix, which could indicate a problem if labels are expected.

Full explanation →

1918

MCQeasy

Which of the following is NOT a valid match criterion for a class-map used in Control Plane Policing?

A.match access-group

B.match ip dscp

C.match protocol

D.match ip precedence

AnswerC

Correct. match protocol is not supported in CoPP; only ACLs, DSCP, or IP precedence are allowed.

Why this answer

In Control Plane Policing (CoPP), class-maps are used to classify traffic destined to the control plane. The valid match criteria include match access-group, match ip dscp, and match ip precedence. However, match protocol is not a valid match criterion for a class-map under CoPP; it is used in other contexts like QoS policy-maps for application-level classification, but not for CoPP class-maps.

Exam trap

Cisco often tests the distinction between match criteria available in CoPP class-maps versus those in general QoS class-maps, and the trap here is that candidates assume match protocol is universally valid across all class-map types, when it is specifically excluded from CoPP.

How to eliminate wrong answers

Option A is wrong because match access-group is a valid match criterion in CoPP class-maps, allowing classification based on an IPv4 or IPv6 ACL. Option B is wrong because match ip dscp is a valid match criterion, enabling classification based on DSCP values in the IP header. Option D is wrong because match ip precedence is a valid match criterion, allowing classification based on IP precedence bits.

The only invalid option is C, as match protocol is not supported in CoPP class-maps.

Full explanation →

1919

MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show mpls ldp bindings 10.0.0.0/16 tib entry: 10.0.0.0/16, rev 1 local binding: label: 16 remote binding: lsr: 2.2.2.2:0, label: 17 What does this output indicate?

A.The summary route 10.0.0.0/16 has both a local and remote label binding, indicating MPLS LDP is operational for this prefix.

B.The summary route is not label-switched because no local binding exists.

C.The remote binding indicates that the route is not being summarized.

D.The label bindings are for the more specific /24 routes, not the summary.

AnswerA

The presence of both local and remote bindings confirms LDP is working for the summary route.

Why this answer

This output shows MPLS LDP label bindings for the prefix 10.0.0.0/16. There is a local label (16) and a remote label (17) from LSR 2.2.2.2. This indicates that the summary route is label-switched, and LDP has successfully assigned labels for it.

Full explanation →

1920

Multi-Selectmedium

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Select 2 answers

A.IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.

B.IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

C.The implicit deny at the end of an IPv6 ACL also blocks ICMPv6 neighbor discovery messages.

D.IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

E.IPv6 ACLs support the remark keyword for documentation.

AnswersA, C

Correct: The command is 'ipv6 traffic-filter' in interface configuration mode.

Why this answer

The `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Exam trap

The trap here is that candidates often assume IPv6 ACLs behave like IPv4 ACLs in supporting wildcard masks and remarks, or that they automatically permit essential control-plane traffic like ICMPv6 neighbor discovery, leading to incorrect selections of options B, D, or E.

Full explanation →

1921

MCQmedium

Examine this IP SLA configuration on router R5: ip sla 50 icmp-echo 10.20.20.1 source-ip 192.168.10.1 frequency 10 ip sla schedule 50 life forever start-time now What is the effect of this configuration?

A.It will continuously monitor reachability to 10.20.20.1 from source 192.168.10.1.

B.It will stop after 10 successful replies.

C.It will measure jitter between the two IPs.

D.It will only work if 10.20.20.1 is directly connected.

AnswerA

This is the standard behavior of icmp-echo IP SLA.

Why this answer

The configuration creates an IP SLA operation that sends ICMP echo probes to 10.20.20.1 every 10 seconds, using source IP 192.168.10.1. It starts immediately and runs forever.

Full explanation →

1922

MCQhard

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

A.The local enable password is not configured.

B.The RADIUS server is not configured to provide the enable password.

C.The 'aaa authentication enable default' command is missing the 'local' keyword.

D.The router's enable secret is set to a different password.

AnswerA

Correct because the enable authentication method list includes 'enable' as a fallback; if no local enable password is set, the fallback fails.

Why this answer

The 'aaa authentication enable default group radius enable' command tells the router to first contact the RADIUS server for enable authentication, and if that fails, fall back to the 'enable' method (which uses the local enable password). Since the RADIUS server is reachable, the router will attempt RADIUS authentication first. If the RADIUS server does not return a successful authentication (e.g., because it is not configured to provide the enable password), the router falls back to the 'enable' method, which requires a locally configured enable password.

If no local enable password is set (via 'enable password' or 'enable secret'), the fallback fails, and the user is denied access. Therefore, the most likely cause is that the local enable password is not configured.

Exam trap

Cisco often tests the distinction between the 'local' method (which uses the local username/password database) and the 'enable' method (which uses the enable password/secret), leading candidates to incorrectly assume that 'local' is needed as a fallback for enable authentication.

How to eliminate wrong answers

Option B is wrong because the RADIUS server being reachable does not guarantee it is configured to provide the enable password; however, the command explicitly includes 'group radius' as the primary method, so if the RADIUS server does not respond with success, the router falls back to the 'enable' method, not to local authentication. Option C is wrong because the 'enable' method in 'aaa authentication enable default' already implies using the local enable password (or enable secret), so adding 'local' is not valid syntax; the correct fallback method is 'enable', not 'local'. Option D is wrong because the 'enable secret' and 'enable password' are both local enable passwords; if either is set, the 'enable' method would use it, so the issue is that neither is configured, not that they are different.

Full explanation →

1923

MCQmedium

A network engineer is troubleshooting an MPLS L3VPN where CE1 (192.168.1.0/24) cannot reach CE2 (192.168.2.0/24). The PE routers are running OSPF with the CEs. On PE1, the VRF configuration includes route-target import and export 100:100. The show ip vrf detail command on PE1 shows the VRF is active, but the CE1 loopback is not present in the VRF routing table. The show ip route vrf CUSTOMER command on PE1 shows only directly connected interfaces. What is the most likely cause?

A.The route-target import on PE1 is misconfigured.

B.The OSPF process on PE1 is not configured under the VRF.

C.The CE1 interface is not in the VRF.

D.The MP-BGP session between PE1 and PE2 is down.

AnswerB

Correct: OSPF must be configured with 'router ospf <pid> vrf CUSTOMER' to populate the VRF routing table.

Why this answer

The CE routes are not being learned via OSPF into the VRF because OSPF process is not associated with the VRF. Without the 'router ospf <pid> vrf <name>' command, OSPF runs in the global routing table and does not populate the VRF.

Full explanation →

1924

MCQhard

An engineer configures iBGP between two routers in the same AS. The engineer notices that routes learned from one iBGP neighbor are not being advertised to another iBGP neighbor, even though the next-hop is reachable. The engineer verifies that the BGP session is established and that the routes are present in the BGP table. Which is the most likely explanation?

A.iBGP split-horizon rule prevents advertising iBGP-learned routes to other iBGP neighbors

B.The next-hop-self command is required for iBGP

C.The BGP synchronization rule is enabled

D.The routes are not valid because the next-hop is not reachable

AnswerA

Correct. iBGP does not advertise routes learned from one iBGP neighbor to another iBGP neighbor by default.

Why this answer

By default, iBGP routers do not advertise routes learned from one iBGP neighbor to another iBGP neighbor because of the split-horizon rule. This is a fundamental behavior to prevent routing loops, but it often catches engineers who expect iBGP to behave like eBGP. To overcome this, a route reflector or confederation must be used.

Full explanation →

1925

MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 dhcp binding Client: FE80::1 DUID: 0003000100AABBCCDDEE Username: unknown IA NA: IA ID 0x00010001, T1 302400, T2 483840 Address: 2001:DB8:1::100/128 Preferred lifetime 604800, valid lifetime 2592000 Expires at Sep 15 2024 12:00 PM (2592000 seconds) Based on this output, which statement is correct?

A.The client has been assigned an IPv6 address via DHCPv6.

B.The client is using SLAAC instead of DHCPv6.

C.The client's lease has expired.

D.The client is not authorized.

AnswerA

The binding shows an IA NA with an assigned address.

Why this answer

The output shows a DHCPv6 binding entry with an IA NA (Identity Association for Non-temporary Addresses) containing an assigned IPv6 address (2001:DB8:1::100/128) along with preferred and valid lifetimes. This confirms that the client with DUID 0003000100AABBCCDDEE successfully obtained an IPv6 address via stateful DHCPv6, not through SLAAC or any other method.

Exam trap

Cisco often tests the distinction between stateful DHCPv6 and SLAAC by showing a DHCPv6 binding output, leading candidates to mistakenly think SLAAC is in use when the presence of an IA NA and assigned address clearly indicates DHCPv6.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows a DHCPv6 binding with an IA NA and assigned address, which is not present in SLAAC (Stateless Address Autoconfiguration) where addresses are derived from router advertisements and no DHCPv6 binding exists. Option C is wrong because the lease has not expired; the output shows a valid lifetime of 2592000 seconds with an expiration date of Sep 15 2024, indicating the lease is still active. Option D is wrong because the binding entry exists with an assigned address, meaning the client is authorized; an unauthorized client would not have a binding entry or would show a different status.

Full explanation →

1926

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla statistics 1 Round Trip Time (RTT) for Index 1 Latest RTT: 200 ms Latest RTT (milliseconds): 200 Latest RTT (microseconds): 200000 Number of successes: 50 Number of failures: 10 Operation time to live: Forever Output: Over threshold Based on this output, which statement is correct?

A.The IP SLA operation has failed due to a timeout.

B.The latest RTT has exceeded the configured threshold value.

C.The IP SLA operation is not reachable and has been disabled.

D.The IP SLA responder is not configured on the target device.

AnswerB

'Output: Over threshold' directly means the measured RTT was above the threshold set in the IP SLA configuration.

Why this answer

The 'Output: Over threshold' line indicates that the latest RTT exceeded the configured threshold. The number of failures (10) suggests some probes failed, but the key clue is the threshold violation. This does not necessarily mean the operation is down; it means a threshold event occurred.

Full explanation →

1927

MCQmedium

A network engineer runs the following command to verify NetFlow export destination: R1# show ip flow export Flow export v9 is enabled for main cache Export source and destination details : VRF ID : Default Destination(1) 192.168.1.100 (2055) Source IP 10.0.0.1 Origin AS 65000 Peer AS 65001 Mask for source 255.255.255.255 Mask for destination 255.255.255.255 Version 9 flow records 1234 flows exported in 567 udp datagrams 0 flows failed due to lack of export packet 0 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues 0 export packets were dropped due to fragmentation failures 0 export packets were dropped due to encapsulation fixup failures What does this output indicate?

A.NetFlow export is failing due to adjacency issues.

B.NetFlow export is successful with 1234 flows exported and no errors.

C.NetFlow is using version 5 export.

D.The export destination is not configured.

AnswerB

All drop counters are zero, and 1234 flows have been successfully exported.

Why this answer

The output shows that NetFlow export is working correctly. It is exporting version 9 flows to destination 192.168.1.100 on port 2055, using source IP 10.0.0.1. There are no failures or drops, indicating successful export.

Full explanation →

1928

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- R1# show ip nat statistics Total active translations: 1 (0 static, 1 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 0 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 1 map-id 1 [Id] ip nat inside source list ACL1 pool POOL1 refcount 1 Based on this output, what is the problem?

A.The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.

B.The NAT pool is exhausted.

C.PAT is misconfigured.

D.The inside and outside interfaces are reversed.

AnswerA

The translation is present but no packets have been processed. This could be a stale entry or lack of traffic.

Why this answer

The output shows a single dynamic NAT translation with zero hits and zero misses, meaning no traffic has attempted to traverse the NAT process. This indicates the translation entry exists (likely from a previous or idle session) but no packets have matched the access list or triggered translation since the counters were cleared. The problem is that the NAT configuration is in place but not actively translating any traffic.

Exam trap

Cisco often tests the misconception that a static translation entry in the NAT table implies active traffic flow, but the 'Hits: 0' counter reveals no packets have been translated, indicating the translation is idle or the ACL is not matching traffic.

How to eliminate wrong answers

Option B is wrong because the NAT pool (192.0.2.10–192.0.2.20) has 15 usable addresses, and only one translation is active (refcount 1), so the pool is far from exhausted. Option C is wrong because PAT (Port Address Translation) is not misconfigured; the output shows no extended translations (0 extended), and the pool uses standard dynamic NAT without overload, so PAT is not even configured here. Option D is wrong because the interfaces are correctly assigned: GigabitEthernet0/1 is the outside interface and GigabitEthernet0/0 is the inside interface, as shown in the statistics output, and the translation mapping (inside local 10.0.0.10 to inside global 192.0.2.10) is consistent with that orientation.

Full explanation →

1929

MCQhard

A network engineer is troubleshooting IPv6 DMVPN phase 2 spoke-to-spoke tunnel failures. Spoke routers are able to communicate with the hub, but direct spoke-to-spoke traffic is not working. Router R1 (spoke) has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ipv6 nhrp network-id 1 ipv6 nhrp nhs 2001:DB8:1::2 ipv6 nhrp map multicast dynamic ! Router R2 (hub) shows: show ipv6 nhrp brief output indicates that both spokes are registered. What is the root cause?

A.The tunnel mode is multipoint, but the spokes need to be configured with 'tunnel mode gre ip' for direct communication.

B.The hub is missing the 'ipv6 nhrp redirect' command, and the spokes are missing 'ipv6 nhrp shortcut'.

C.The spokes have different NHRP network IDs, preventing registration.

D.The IPv6 addresses on the tunnel interfaces are in different subnets.

AnswerB

Without redirect and shortcut, spokes do not learn each other's NHRP mappings and send traffic through the hub.

Why this answer

In DMVPN Phase 2, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to use NHRP shortcuts. Without 'ipv6 nhrp redirect' on the hub and 'ipv6 nhrp shortcut' on the spokes, the spokes will forward all inter-spoke traffic through the hub instead of establishing a direct tunnel. The hub's NHRP brief shows both spokes are registered, confirming NHRP registration works, but the missing redirect/shortcut mechanism prevents direct spoke-to-spoke communication.

Exam trap

Cisco often tests the distinction between DMVPN phases, and the trap here is that candidates assume NHRP registration alone enables spoke-to-spoke communication, overlooking the mandatory redirect/shortcut commands for Phase 2.

How to eliminate wrong answers

Option A is wrong because 'tunnel mode gre multipoint' is correct for DMVPN Phase 2 spokes; changing to 'tunnel mode gre ip' would disable multipoint and prevent dynamic spoke-to-spoke tunnels. Option B is correct as explained. Option C is wrong because the spokes are registered with the hub, which requires matching NHRP network IDs; different network IDs would prevent registration entirely.

Option D is wrong because the tunnel interfaces share the same /64 subnet (2001:DB8:1::/64), and IPv6 addressing is not the issue since spoke-to-hub communication works.

Full explanation →

1930

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 100 Redistributing via ospf 1 Last update from 10.1.1.2 on GigabitEthernet0/1, 00:00:05 ago Routing Descriptor Blocks: * 10.1.1.2, from 10.1.1.2, 00:00:05 ago, via GigabitEthernet0/1 Route metric is 20, traffic share count is 1 Based on this output, what is the problem?

A.The route is an external OSPF route with metric 20, which is the default for Type 2 external routes.

B.The route is being redistributed back into OSPF, which could cause a routing loop if not filtered.

C.The forward metric is 100, which is the metric to the ASBR.

D.The route is learned from neighbor 10.1.1.2, which is the next hop.

AnswerB

Redistributing a route learned from OSPF back into OSPF without filtering can cause loops.

Why this answer

The output shows a route learned via OSPF with type extern 2 and metric 20. The route is also 'Redistributing via ospf 1', meaning this router is redistributing this route back into OSPF. This could cause a routing loop if the route is redistributed back into the same OSPF process from which it was learned.

The problem is that the route is being redistributed without filtering, potentially causing loops.

Full explanation →

1931

MCQmedium

Examine this IP SLA configuration on router R2: ip sla 20 udp-jitter 203.0.113.10 16384 source-ip 198.51.100.1 source-port 16384 frequency 30 ip sla schedule 20 life forever start-time now Which statement is true?

A.It measures one-way delay and jitter using UDP packets.

B.It measures only packet loss, not delay or jitter.

C.It uses TCP to measure round-trip time.

D.It sends ICMP echo requests to test connectivity.

AnswerA

UDP jitter operation measures delay, jitter, and packet loss.

Why this answer

The configuration measures UDP jitter by sending UDP packets to destination 203.0.113.10 on port 16384, sourced from 198.51.100.1 with source port 16384, every 30 seconds.

Full explanation →

1932

MCQhard

What is the default CoPP aggregate policer rate for control plane traffic on a Cisco IOS-XE device?

A.32000 bps

B.75000 bps

C.No default rate; CoPP is disabled by default

D.128000 bps

AnswerC

CoPP is not enabled by default on Cisco IOS-XE; the administrator must configure a policy-map and apply it to the control plane.

Why this answer

Cisco IOS-XE does not enable Control Plane Policing (CoPP) by default; it must be explicitly configured using the 'control-plane' command followed by 'service-policy' to attach a policy map. The absence of a default aggregate policer rate means that without CoPP configuration, the control plane is unprotected from traffic storms or DoS attacks. Options A, B, and D are incorrect because they suggest predefined rates that do not exist as defaults in Cisco IOS-XE.

Exam trap

Cisco often tests the misconception that CoPP has a built-in default policer rate, leading candidates to confuse it with the default hardware rate limits for control plane queues (e.g., on Catalyst switches) or with default values from other QoS features.

How to eliminate wrong answers

Option A is wrong because 32000 bps is not a default CoPP aggregate policer rate; CoPP has no default rate, and this value might be confused with a typical low-rate policer used in custom configurations. Option B is wrong because 75000 bps is not a default CoPP aggregate policer rate; this value is often associated with the default CoPP rate on some Cisco IOS (non-XE) platforms, but not on IOS-XE. Option D is wrong because 128000 bps is not a default CoPP aggregate policer rate; this value might be mistaken for the default hardware rate limit for certain control plane queues on some Catalyst switches, but it is not a CoPP default.

Full explanation →

1933

MCQmedium

A network engineer runs the following command on router R2: R2# show monitor session 4 Session 4 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports : Both : Gi0/0 Destination IP : 192.168.1.10 Origin IP : 10.0.0.2 ERSPAN ID : 100 Based on this output, which statement is correct?

A.The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.

B.The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.

C.The ERSPAN session is using RSPAN encapsulation.

D.The ERSPAN session is disabled because the status is 'Admin Enabled'.

AnswerA

The output clearly shows source port Gi0/0, destination IP 192.168.1.10, and ERSPAN ID 100.

Why this answer

This is an ERSPAN source session. It mirrors traffic from source port Gi0/0 and encapsulates it with an ERSPAN header, sending it to destination IP 192.168.1.10 with origin IP 10.0.0.2 and ERSPAN ID 100. The session is administratively enabled.

Full explanation →

1934

MCQmedium

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show policy-map control-plane input class class-default Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any police: cir 1000000 bps, bc 31250 bytes, be 31250 bytes conformed 0 packets, 0 bytes; actions: transmit violated 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps, violated 0 bps What does this output indicate?

A.The CoPP policy is dropping all traffic due to a misconfigured CIR.

B.The CoPP policy is not matching any traffic, indicating a possible ACL or class-map misconfiguration.

C.The CoPP policy is working correctly and policing traffic at 1 Mbps.

D.The CoPP policy is only applied to the output direction.

AnswerB

The class-default matches all traffic, but zero packets have been seen, suggesting the policy may not be applied correctly or the interface is idle.

Why this answer

The output shows zero packets matched in class-default, meaning no traffic is being classified by the CoPP policy. This indicates a possible misconfiguration in the ACL or class-map that defines the traffic to be policed, causing the policy to be effectively inactive. A correctly configured CoPP policy would show non-zero packet counts for matched traffic.

Exam trap

Cisco often tests the misconception that zero packet counts in a CoPP policy indicate the policy is working correctly (e.g., no traffic is being dropped), when in fact it indicates a classification failure, such as a missing ACL or incorrect class-map configuration.

How to eliminate wrong answers

Option A is wrong because the CIR is configured at 1 Mbps and the policy is not dropping any traffic (violated 0 packets), so there is no evidence of a misconfigured CIR causing drops. Option C is wrong because the policy is not policing any traffic at all (0 packets matched), so it is not working correctly. Option D is wrong because the command 'show policy-map control-plane input' explicitly shows the input direction, and the output does not indicate any application to the output direction.

Full explanation →

1935

MCQhard

An enterprise uses EIGRP for IPv6 with route redistribution from a static route. R1 has a static route 2001:db8:0::/32 via Null0 redistributed into EIGRP. R2 receives this route and has a more specific route 2001:db8:1::/32 via a different interface. R2 has an IPv6 ACL applied inbound on the interface facing R1 that permits only EIGRP and denies all other traffic. R2's uRPF is configured in loose mode. Traffic from R2 to 2001:db8:2::1 fails. R2 shows 'show ipv6 route' has both routes, but 'show ipv6 cef' shows the summary route for 2001:db8:2::1 pointing to R1. What is the root cause?

A.The summary route 2001:db8:0::/32 on R1 points to Null0, causing traffic to be dropped at R1.

B.The ACL on R2 blocks the return traffic from R1, causing asymmetric routing.

C.uRPF loose mode drops the packet because the source address is not in the FIB.

D.EIGRP redistribution of the static route creates a routing loop between R1 and R2.

AnswerA

R2 forwards traffic to R1 based on the summary route, but R1's static route to Null0 drops it. The ACL is irrelevant to this failure.

Why this answer

R1's static route 2001:db8:0::/32 via Null0 is redistributed into EIGRP, and R2 learns this summary route. When R2 sends traffic to 2001:db8:2::1, the CEF table (show ipv6 cef) shows the longest prefix match for 2001:db8:2::1 is the summary 2001:db8:0::/32 pointing to R1, not the more specific 2001:db8:1::/32. R1 then forwards the packet to Null0 (a virtual interface that drops traffic), causing the failure.

The more specific route 2001:db8:1::/32 on R2 is not used because 2001:db8:2::1 does not fall within that prefix.

Exam trap

Cisco often tests the distinction between the routing table (RIB) and CEF (FIB), where candidates assume that a more specific route in the RIB will be used for forwarding, but CEF may use a different prefix if the destination does not match the more specific prefix exactly.

How to eliminate wrong answers

Option B is wrong because the ACL on R2 permits only EIGRP inbound from R1, but return traffic from R1 to R2 would be outbound from R1's perspective and inbound on R2's interface facing R1; however, the ACL is applied inbound on R2's interface facing R1, so it would filter traffic arriving from R1, but the issue is not about blocking return traffic—it's about CEF forwarding the packet to R1 due to the summary route. Option C is wrong because uRPF loose mode checks that the source address of the incoming packet is reachable in the FIB (i.e., has a route back to the source), but it does not drop packets if the source address is not in the FIB; loose mode only requires that the source address exists in the routing table, not that it uses the same interface. Option D is wrong because EIGRP redistribution of a static route to Null0 does not inherently create a routing loop; a loop would require R2 to re-advertise the route back to R1, but the summary route 2001:db8:0::/32 is not more specific than R1's own route, and R1's Null0 route prevents forwarding loops.

Full explanation →

1936

MCQmedium

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

A.The flow exporter is configured with the wrong destination IP address.

B.The flow monitor is not associated with any flow exporter.

C.The flow exporter is missing the 'source' interface command.

D.The flow cache is full, preventing new exports.

AnswerB

The monitor must be linked to an exporter using the 'exporter' command under the flow monitor configuration. Without it, no export occurs.

Why this answer

A flow exporter must be associated with the flow monitor. If the monitor does not reference the exporter, no data is exported even if flows are cached.

Full explanation →

1937

MCQeasy

A network engineer runs the following command on Router R1: R1# show bgp neighbors 10.1.12.2 received-routes BGP table version is 15, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.2.2.0/24 10.1.12.2 0 0 65002 i Total number of prefixes 1 Based on this output, what can be inferred about the BGP session?

A.The BGP session is not established.

B.The BGP session is established and the neighbor is advertising one prefix.

C.The BGP session is in Active state.

D.The BGP session is in Idle state.

AnswerB

The presence of a received route indicates the session is up and the neighbor is sending prefixes.

Why this answer

The output shows that R1 has received one prefix (10.2.2.0/24) from neighbor 10.1.12.2. The prefix is valid and best. This indicates the BGP session is established and exchanging routes.

Full explanation →

1938

MCQhard

CoPP rate-limit is impacting legitimate traffic due to route summarization. Router R1 has: access-list 100 permit ip 10.0.0.0 0.0.3.255 any ! class-map match-all COPP-CLASS match access-group 100 ! policy-map COPP-POLICY class COPP-CLASS police 10000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY ! router eigrp 100 network 10.0.0.0 ! interface GigabitEthernet0/0 ip summary-address eigrp 100 10.0.0.0 255.255.252.0 ! R2 (10.0.1.1) sends EIGRP packets to R1, but they are being dropped. What is the root cause?

A.The CoPP policy matches EIGRP traffic from the summarized range and polices it, causing EIGRP packets to be dropped.

B.The summary route causes EIGRP to send packets to the control plane at a high rate, exceeding the policer.

C.EIGRP is not enabled on the interface, so packets are dropped.

D.The control-plane policy is applied in the wrong direction.

AnswerA

EIGRP packets are within the ACL range and are rate-limited.

Why this answer

The CoPP policy matches traffic from 10.0.0.0/22 and polices it to 10 kbps. EIGRP packets from R2 (10.0.1.1) are within this range and are subject to policing. If the EIGRP traffic rate exceeds 10 kbps, packets are dropped, causing neighbor flapping.

The summary route itself does not cause the drop, but the CoPP policy inadvertently includes EIGRP traffic. The fix is to create a separate class for EIGRP or adjust the ACL.

Full explanation →

1939

MCQmedium

Router R6 has the following configuration: ``` interface GigabitEthernet0/7 ip address 10.6.6.6 255.255.255.0 ! route-map PBR-MISS permit 10 match ip address 104 set ip next-hop 192.168.4.1 ! access-list 104 permit ip 10.6.6.0 0.0.0.255 192.168.0.0 0.0.255.255 ``` What is missing in this configuration?

A.The interface is missing the 'ip policy route-map PBR-MISS' command.

B.The route-map is missing a 'set interface' command.

C.The ACL is missing a 'deny any any' statement.

D.The route-map sequence number must be 1.

AnswerA

The interface already has the 'ip policy route-map PBR-MISS' command, so this is not missing.

Why this answer

The configuration is missing the 'ip policy route-map PBR-MISS' command on interface GigabitEthernet0/7. Without this command, the route map is not applied, and policy-based routing will not take effect. Therefore, option A correctly identifies the missing element.

Full explanation →

1940

MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 interface gigabitethernet 0/0 | include uRPF IPv6 uRPF: strict mode Based on this output, which statement is true?

A.uRPF is disabled

B.uRPF is enabled in strict mode

C.uRPF is enabled in loose mode

D.uRPF is enabled but only for multicast

AnswerB

The output confirms strict mode uRPF.

Why this answer

The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Exam trap

Cisco often tests the distinction between strict and loose uRPF modes, and the trap here is that candidates might confuse the 'strict mode' output with 'loose mode' or assume uRPF is disabled when the output line is present.

How to eliminate wrong answers

Option A is wrong because the output clearly states 'strict mode', which indicates uRPF is enabled, not disabled. Option C is wrong because the output specifies 'strict mode', not 'loose mode'; loose mode only checks that a route exists for the source address, regardless of the incoming interface. Option D is wrong because uRPF applies to unicast traffic, not multicast; multicast uses Reverse Path Forwarding (RPF) as part of protocols like PIM, but uRPF is specifically for unicast source address verification.

Full explanation →

1941

MCQeasy

In IPsec site-to-site VPN, what is the default IPsec SA lifetime in Cisco IOS?

A.86400 seconds and 256000 kilobytes

B.3600 seconds and 4608000 kilobytes

C.28800 seconds and 1000000 kilobytes

D.1800 seconds and 256000 kilobytes

AnswerB

This is the standard Cisco default for IPsec SA lifetime.

Why this answer

The default IPsec Security Association (SA) lifetime in Cisco IOS for site-to-site VPNs is 3600 seconds (1 hour) and 4,608,000 kilobytes (4.5 GB). These values are defined in the IPsec transform set configuration and control when the SA expires, triggering a rekey via IKEv1 or IKEv2 to maintain secure communication.

Exam trap

Cisco often tests the distinction between the default IKE SA lifetime (86400 seconds) and the default IPsec SA lifetime (3600 seconds), causing candidates to confuse the two and select option A.

How to eliminate wrong answers

Option A is wrong because 86400 seconds (24 hours) is the default IKE (ISAKMP) SA lifetime, not the IPsec SA lifetime; the 256,000 kilobyte value is also incorrect for the default IPsec SA lifetime. Option C is wrong because 28800 seconds (8 hours) and 1,000,000 kilobytes are not default values; these might be seen in custom configurations or other vendors. Option D is wrong because 1800 seconds (30 minutes) is too short for the default IPsec SA lifetime, and 256,000 kilobytes is not the default traffic-based lifetime.

Full explanation →

1942

Multi-Selecthard

Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)

Select 3 answers

A.IPv6 uRPF uses the Forwarding Information Base (FIB) to verify source address reachability.

B.IPv6 uRPF can be configured in strict mode or loose mode.

C.IPv6 uRPF is configured on a per-interface basis.

D.IPv6 uRPF checks the destination address of incoming packets.

E.IPv6 uRPF is used to filter multicast traffic.

AnswersA, B, C

Correct: uRPF checks the FIB to see if the source address is reachable via the incoming interface.

Why this answer

IPv6 unicast RPF (uRPF) leverages the Forwarding Information Base (FIB) to verify that the source address of an incoming packet is reachable via the interface on which the packet was received. The FIB contains the best routes from the routing table, and uRPF performs a reverse path lookup against it to ensure the source address is topologically correct. This prevents spoofed traffic from entering the network.

Exam trap

Cisco often tests the distinction between source and destination address checking, leading candidates to incorrectly select that uRPF checks the destination address, when in fact it always validates the source address against the FIB.

Full explanation →

1943

MCQmedium

A network engineer runs the following command to troubleshoot an OSPF adjacency issue: R1# debug ip ospf adj *Mar 1 00:12:34.567: OSPF-1 ADJ RtrA: Interface GigabitEthernet0/0 going Up *Mar 1 00:12:34.568: OSPF-1 ADJ RtrA: 2 Way Communication to 10.1.1.2 on GigabitEthernet0/0, state 2WAY *Mar 1 00:12:34.570: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Our router ID 1.1.1.1, his router ID 2.2.2.2 *Mar 1 00:12:34.571: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Neighbor is not DR, state 2WAY *Mar 1 00:12:34.572: OSPF-1 ADJ RtrA: NBR 10.1.1.2: DR is 10.1.1.2, BDR is 10.1.1.1 *Mar 1 00:12:34.573: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Build the Start DBD *Mar 1 00:12:34.574: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Master/Slave negotiation done *Mar 1 00:12:34.576: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Exchange done, loading started *Mar 1 00:12:34.578: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Loading done *Mar 1 00:12:34.580: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Full What does this output indicate?

A.The adjacency failed due to a mismatch in the DR election.

B.The adjacency formed successfully, and the neighbor is in Full state.

C.The adjacency is stuck in Exstart state due to MTU mismatch.

D.The neighbor is not the DR, so the adjacency will not form.

AnswerB

The sequence of messages shows all OSPF adjacency steps completing, ending with 'Full'.

Why this answer

The debug output shows the complete OSPF adjacency formation process from Down to Full state, indicating a successful adjacency.

Full explanation →

1944

MCQmedium

A network engineer notices that the syslog server at 10.1.1.100 is not receiving any log messages from a Cisco router running IOS-XE 16.9. The engineer has configured 'logging host 10.1.1.100' and 'logging trap debugging'. The router can ping the syslog server successfully. What is the most likely cause of the missing syslog messages?

A.The 'logging on' command is not configured globally.

B.The syslog server is using UDP port 514, but the router is sending over TCP.

C.The 'logging source-interface' is set to a loopback that is not advertised in the routing table.

D.The 'logging buffered' command is overriding the remote logging configuration.

AnswerA

Correct because 'logging on' must be enabled to allow any syslog messages to be sent to a remote server. Without it, all syslog output is suppressed.

Why this answer

The 'logging on' command is required globally to enable syslog message generation on Cisco IOS-XE devices. Without it, the router will not send any log messages to any destination, including the configured syslog server at 10.1.1.100, even though the 'logging host' and 'logging trap debugging' commands are present. The successful ping confirms IP connectivity, so the issue is that logging is disabled at the global level.

Exam trap

Cisco often tests the 'logging on' command as a hidden prerequisite that candidates overlook, assuming that configuring 'logging host' alone is sufficient to start sending syslog messages.

How to eliminate wrong answers

Option B is wrong because by default Cisco routers send syslog messages over UDP port 514, and the 'logging host' command uses UDP unless 'logging host transport tcp' is explicitly configured; the scenario does not mention TCP configuration, so a port/protocol mismatch is unlikely. Option C is wrong because if the 'logging source-interface' were set to a loopback not advertised, the router would still attempt to send syslog packets using the best available source IP (usually the egress interface IP), and the ping to 10.1.1.100 succeeds, indicating routing is functional; a missing source-interface would not block all syslog messages. Option D is wrong because 'logging buffered' stores messages locally in a buffer and does not override or disable remote logging; both local and remote logging can coexist independently.

Full explanation →

1945

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf interface GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Internet Address 192.168.12.1/24, Area 0 Process ID 1, Router ID 10.1.1.1, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State BDR, Priority 1 Designated Router (ID) 10.1.1.2, Interface address 192.168.12.2 Backup Designated router (ID) 10.1.1.1, Interface address 192.168.12.1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:03 Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 10.1.1.2 (Designated Router) Suppress hello for 0 neighbor(s) Based on this output, which statement is correct?

A.Router R1 is the Designated Router on this segment.

B.Router R1 has a priority of 0, preventing it from becoming DR.

C.The dead timer is set to 40 seconds and is functioning correctly.

D.Router R1 is not receiving hello packets from the DR.

AnswerC

The dead interval is 40 seconds, and the hello timer is 10 seconds, which is standard. The adjacency is up, so timers are working.

Why this answer

The interface is in state BDR, meaning Router R1 is the backup designated router. The DR is 10.1.1.2. The output shows one neighbor, which is the DR, and the adjacency is full.

Full explanation →

1946

MCQmedium

Given the following configuration on a router: ``` router ospf 1 distance 150 ``` What is the effect of this configuration?

A.It sets the administrative distance for OSPF routes to 150, but only for intra-area routes.

B.It sets the administrative distance for OSPF routes to 150, overriding the default of 110.

C.It sets the administrative distance for OSPF external routes to 150.

D.It sets the administrative distance for OSPF routes to 150, but only for routes learned from a specific neighbor.

AnswerB

The default AD for OSPF is 110; this command changes it to 150.

Why this answer

This command sets the administrative distance for all OSPF routes to 150, overriding the default of 110.

Full explanation →

1947

MCQeasy

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla monitor statistics 10 Round Trip Time (RTT) for Index 10 Latest RTT: 12 ms Latest RTT (milliseconds): 12 Latest RTT (microseconds): 12000 Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Last operation return code: OK Number of successes: 100 Number of failures: 0 Operation time to live: Forever What does this output indicate?

A.The IP SLA monitor operation has failed because the return code is 'OK'.

B.The IP SLA monitor operation is functioning correctly with no failures.

C.The IP SLA monitor operation is not configured for index 10.

D.The IP SLA monitor operation has a timeout of 12 ms.

AnswerB

Zero failures and 'OK' return code confirm success.

Why this answer

This output is from the older 'ip sla monitor' command, which is equivalent to 'ip sla'. It shows the same statistics: 100 successes, 0 failures, and a return code of OK, indicating the probe is working.

Full explanation →

1948

MCQhard

A large enterprise network is experiencing intermittent reachability to a critical server (10.10.10.10). Router R1 has the following relevant configuration: ip sla 1 icmp-echo 10.10.10.10 source-ip 192.168.1.1 frequency 10 ip sla schedule 1 life forever start-time now track 1 ip sla 1 reachability delay down 5 up 5 ip route 0.0.0.0 0.0.0.0 192.168.1.2 track 1 Router R2 (the next-hop) shows: show ip route | include 10.10.10.10 S 10.10.10.0/24 [1/0] via 10.0.0.1 What is the root cause?

A.The IP SLA probe uses a source IP that is not reachable from the server, causing the probe to fail and the tracked route to be removed unnecessarily.

B.The frequency of the IP SLA is too high, causing the router to overload and drop the tracked route.

C.The delay down 5 up 5 is too short, causing flapping of the tracked route.

D.The server 10.10.10.10 is not responding to ICMP echo requests due to a firewall.

AnswerA

The source IP 192.168.1.1 may not be in the routing table of the server or intermediate routers, so echo replies never return, causing the track to go down.

Why this answer

The IP SLA probes are sourced from 192.168.1.1, but the server 10.10.10.10 is in a different subnet. The return path from the server might not reach 192.168.1.1 due to route summarization or asymmetric routing. However, the key issue is that the tracked default route is removed when the probe fails, but the probe failure could be due to the server's response not being routed back correctly, not because the next-hop is unreachable.

The correct answer is that the source IP of the probe is not routable from the server's perspective, causing false negatives.

Full explanation →

1949

MCQhard

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show ip interface brief | include Gi0/0 GigabitEthernet0/0 10.1.1.1 YES NVRAM up up R1# show monitor session 7 detail Session 7 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/1 Destination IP : 10.1.1.2 ERSPAN ID : 300 What does this output indicate?

A.The ERSPAN session is correctly configured and the destination IP is reachable.

B.The ERSPAN session is misconfigured because the source port must have an IP address.

C.The ERSPAN session is misconfigured because the destination IP must be on the same subnet as the source.

D.The ERSPAN session is misconfigured because the ERSPAN ID must be unique across all sessions.

AnswerA

The interface is up and the destination IP is likely reachable.

Why this answer

The output shows that interface Gi0/0 has IP address 10.1.1.1 and is up/up, and ERSPAN session 7 has destination IP 10.1.1.2. This indicates that the ERSPAN source session is configured to send traffic to 10.1.1.2, which is reachable via Gi0/0.

Full explanation →

1950

MCQmedium

Which LSA type is used by OSPF to advertise prefixes from other routing protocols (redistribution) and has a default metric of 20?

A.Type 1 LSA (Router LSA)

B.Type 3 LSA (Summary LSA)

C.Type 4 LSA (ASBR Summary LSA)

D.Type 5 LSA (AS-external LSA)

AnswerD

Correct. Type 5 LSAs carry external routes with a default metric of 20.

Why this answer

Type 5 AS-external LSAs are used to advertise external routes redistributed into OSPF. The default metric for these LSAs is 20, as defined by Cisco IOS.

Full explanation →

Page 26 of 27

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 Technologies VPN Technologies Infrastructure Security Infrastructure Services

See all domains with question counts →