Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 226–300

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 27

Page 5
226
MCQeasy

What is the default value of the RA lifetime (Router Lifetime) in IPv6 Router Advertisements on Cisco IOS-XE?

A.600 seconds
B.1800 seconds
C.3600 seconds
D.0 seconds
AnswerB

Correct. The default Router Lifetime is 1800 seconds on Cisco IOS-XE.

Why this answer

The default Router Lifetime (RA lifetime) in IPv6 Router Advertisements on Cisco IOS-XE is 1800 seconds (30 minutes). This value is defined in RFC 4861 and indicates how long the router should be considered as a default gateway by hosts. It is three times the default Router Advertisement interval (200 seconds), ensuring hosts have sufficient time to detect a router's absence.

Exam trap

Cisco often tests the distinction between the Router Advertisement interval (default 200 seconds) and the Router Lifetime (default 1800 seconds), leading candidates to confuse the two and incorrectly select 600 seconds (the default MaxRtrAdvInterval) or 200 seconds (the default MinRtrAdvInterval).

How to eliminate wrong answers

Option A (600 seconds) is wrong because it is the default value for the Router Advertisement interval (MinRtrAdvInterval), not the Router Lifetime. Option C (3600 seconds) is wrong because it is not a standard default for Router Lifetime; it might be confused with the default IPv6 Neighbor Solicitation timeout or a common DHCP lease time. Option D (0 seconds) is wrong because a Router Lifetime of 0 seconds would indicate that the router is not a default gateway, which is not the default behavior; it is used only when explicitly configured to suppress the router's default gateway function.

Full explanation →
227
MCQhard

In DMVPN Phase 3, which loop prevention mechanism is used by default to prevent routing loops when using EIGRP?

A.Split horizon
B.Route poisoning
C.Feasibility Condition
D.Hold-down timers
AnswerC

Correct. EIGRP's DUAL algorithm uses the Feasibility Condition to prevent loops.

Why this answer

EIGRP uses the Feasibility Condition (FC) as its loop prevention mechanism. In DMVPN Phase 3, with EIGRP stub routing and summarization, the FC ensures that only feasible successors are used, preventing loops. Additionally, the 'no ip split-horizon' is often required on the hub, but loop prevention relies on EIGRP's DUAL algorithm and the FC.

Full explanation →
228
MCQmedium

A network engineer runs the following command to troubleshoot IPsec on a DMVPN tunnel: R1# debug crypto isakmp ISAKMP: received peer 192.168.1.2, port 500, local 192.168.1.1 ISAKMP: SA created, initiating IKE Main Mode ISAKMP: sent MM_SA proposal to 192.168.1.2 ISAKMP: received MM_SA response from 192.168.1.2 ISAKMP: Main Mode complete, starting Quick Mode ISAKMP: sent QM_SA request to 192.168.1.2 ISAKMP: received QM_SA response from 192.168.1.2 ISAKMP: Quick Mode done, IPsec SA established What does this output indicate?

A.IKE negotiation failed; no IPsec SA was established.
B.IKE negotiation succeeded and an IPsec SA is now active.
C.The peer 192.168.1.2 is not responding to IKE requests.
D.IKE is using Aggressive Mode instead of Main Mode.
AnswerB

Correct: The debug confirms Main Mode and Quick Mode completion, and states 'IPsec SA established'.

Why this answer

The debug shows successful IKE Main Mode and Quick Mode exchanges, resulting in an established IPsec SA between 192.168.1.1 and 192.168.1.2.

Full explanation →
229
MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp neighbors 10.1.12.2 advertised-routes BGP table version is 15, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.1.1.0/24 0.0.0.0 0 32768 i *> 10.2.2.0/24 10.1.12.2 0 0 65002 i Total number of prefixes 2 Based on this output, what can be concluded about the route 10.2.2.0/24?

A.The route 10.2.2.0/24 is being advertised back to the neighbor from which it was learned, which is incorrect.
B.The route 10.2.2.0/24 is locally originated.
C.The route 10.2.2.0/24 has a weight of 0.
D.The route 10.2.2.0/24 is not valid.
AnswerA

The next hop is 10.1.12.2, the same as the neighbor, indicating the route is being sent back to the source, which violates BGP loop prevention unless the AS path is manipulated.

Why this answer

The route 10.2.2.0/24 is being advertised to the neighbor 10.1.12.2 with next hop 10.1.12.2 itself. This indicates that R1 is advertising a route it learned from the same neighbor back to it, which is a classic case of BGP split-horizon or route advertisement causing a potential loop. However, since it is advertised, it may be due to missing AS-path filtering or a misconfiguration.

Full explanation →
230
MCQmedium

Examine the following configuration: interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 bfd interval 50 min_rx 50 multiplier 5 ! router eigrp TEST network 192.168.1.0 bfd interface GigabitEthernet0/0 ! Which statement is true about BFD operation on this interface?

A.BFD will detect a failure in 250 ms (5 x 50 ms).
B.BFD will detect a failure in 50 ms because the interval is set to 50 ms.
C.BFD is enabled but only for EIGRP; it will not affect any other routing protocol.
D.The configuration is missing 'bfd all-interfaces' under EIGRP, so BFD will not work.
AnswerA

Correct. The detection time is multiplier * the negotiated interval, which in this case is 5 * 50 ms = 250 ms.

Why this answer

The 'bfd interface' command under EIGRP enables BFD for that specific interface. The BFD session will negotiate timers; the multiplier of 5 means the session will declare a neighbor down after 5 * max(min_rx, negotiated interval) = 5 * 50 = 250 ms of missed packets.

Full explanation →
231
Drag & Dropmedium

Drag and drop the steps to configure inter-VRF route leaking using static routes in VRF-Lite into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, define both VRFs and assign a route distinguisher (RD). Then assign interfaces to the respective VRFs. After that, configure static routes with the VRF keyword to leak routes between VRFs.

Finally, verify the leaked routes are present in the VRF routing table. Note that import/export route targets are not used in VRF-Lite; they are only required for MPLS VPN scenarios.

Full explanation →
232
MCQhard

An engineer configures an IPsec site-to-site VPN between two routers. The tunnel comes up, but no traffic is encrypted. The engineer verifies that the crypto map is applied to the outgoing interface and that the ACL defining interesting traffic is correct. Which is the most likely explanation?

A.The crypto ACL is not mirrored on both sides, so the SA is not established for the traffic
B.The transform-set is missing encryption or authentication
C.The crypto map is applied to the wrong interface
D.The IKE policy is not configured
AnswerA

Correct. IPsec requires that the crypto ACLs be mirror images of each other for bidirectional traffic to be encrypted.

Why this answer

A common edge case is that the ACL defining interesting traffic is applied in the wrong direction. For IPsec, the ACL should match traffic that will be encrypted, and it must be applied to the crypto map. However, if the ACL is configured with the source and destination reversed (e.g., source is local network and destination is remote network on one router, but on the other router the ACL should also have source as local network), the traffic may not match.

Additionally, if the ACL is not mirrored on both sides, the tunnel may come up but traffic will not be encrypted because the SA is not established for that traffic.

Full explanation →
233
MCQmedium

Which statement about RSPAN source session is correct?

A.The RSPAN source session can send mirrored traffic to multiple RSPAN VLANs simultaneously.
B.The RSPAN source session can monitor both a VLAN and individual ports at the same time.
C.The RSPAN source session must specify a destination RSPAN VLAN.
D.The RSPAN source session can use a physical interface as a destination instead of a VLAN.
AnswerC

The destination for an RSPAN source session is always an RSPAN VLAN, which must be configured with 'remote-span'.

Why this answer

An RSPAN source session mirrors traffic from source ports to an RSPAN VLAN. The source session can monitor a single VLAN or a set of ports, but not both in the same session. The destination is always the RSPAN VLAN.

Full explanation →
234
MCQhard

Router R1 and R2 are iBGP peers in the same AS. R1 learns a route 172.16.1.0/24 from an eBGP peer with AS_PATH 100 200. R2 learns the same prefix from another eBGP peer with AS_PATH 100. Both routers redistribute the route into OSPF with default administrative distance. R3, an OSPF internal router, sees two OSPF external routes for 172.16.1.0/24: one from R1 (type-5, metric 20) and one from R2 (type-5, metric 30). R3's 'show ip route 172.16.1.0' shows the route via R1. What is the root cause of R3 preferring the route via R1?

A.R3 prefers the route with the lower metric (20) over the higher metric (30), which is correct OSPF behavior.
B.R3 has a static route with AD 1 that overrides both OSPF routes.
C.The route from R1 is an OSPF inter-area route (AD 110) while from R2 is external (AD 110), so they are equal; metric decides.
D.R3's OSPF process has 'distance 150' configured, making all OSPF routes AD 150, but the route from R2 is redistributed from BGP with a lower AD.
AnswerA

OSPF external routes are compared by metric first when the same type; lower metric wins.

Why this answer

OSPF prefers external routes based on metric (cost) first for type-5 routes. The route from R1 has metric 20, R2 has metric 30, so R1 is preferred. However, if the administrative distance of OSPF external routes is changed via 'distance ospf external 150', then the route with lower AD is chosen.

The correct answer is that the default AD for OSPF external is 110, so metric decides. The question implies a trick: the route from R2 might have a higher metric but lower AD due to a configuration, but the default is unchanged.

Full explanation →
235
MCQmedium

Which IP SLA operation type is specifically designed to measure one-way delay, jitter, and packet loss using UDP packets with sequence numbers and timestamps?

A.UDP Echo
B.UDP Jitter
C.ICMP Path Echo
D.TCP Connect
AnswerB

Correct. UDP Jitter is designed for one-way delay, jitter, and packet loss measurement.

Why this answer

The UDP Jitter operation (type 3) sends UDP packets with embedded sequence numbers and timestamps to measure one-way delay, jitter, and packet loss between source and destination.

Full explanation →
236
MCQmedium

Examine the following partial MPLS configuration on a Cisco IOS-XE router: interface GigabitEthernet0/0 ip address 10.0.1.1 255.255.255.252 mpls ip mpls label protocol ldp ! router ospf 1 network 10.0.1.0 0.0.0.3 area 0 ! mpls ldp router-id Loopback0 force What is the effect of this configuration?

A.LDP will establish a session with the neighbor on GigabitEthernet0/0, using Loopback0 as the transport address.
B.LDP will use the IP address of GigabitEthernet0/0 as the router ID because 'force' is not valid.
C.LDP sessions will fail because OSPF is not redistributed into LDP.
D.MPLS forwarding will not occur because 'mpls label protocol ldp' is redundant and causes a conflict.
AnswerA

The 'mpls ldp router-id Loopback0 force' command forces LDP to use Loopback0 as the router ID, which becomes the transport address for LDP sessions. The 'mpls ip' on the interface enables label switching and LDP hello messages.

Why this answer

The configuration enables LDP on the interface and globally via 'mpls ip'. The 'mpls label protocol ldp' is default but explicit. The 'mpls ldp router-id Loopback0 force' ensures LDP uses Loopback0 as the router ID, overriding any other interface.

OSPF advertises the /30 link. This is a correct minimal MPLS configuration.

Full explanation →
237
MCQhard

A network engineer runs the following command to debug MPLS LDP errors: R1# debug mpls ldp errors Output: *Mar 1 00:01:23.456: LDP: Received malformed hello from 10.0.0.2 *Mar 1 00:01:23.789: LDP: Received malformed initialization from 10.0.0.2 *Mar 1 00:01:24.012: LDP: Session with 10.0.0.2:0 (0x1234) is DOWN What does this output indicate?

A.The LDP session with 10.0.0.2 failed due to malformed messages from the neighbor
B.The LDP session with 10.0.0.2 is up and stable
C.R1 is sending malformed messages to 10.0.0.2
D.The LDP session is using incorrect transport address
AnswerA

Malformed messages were received, leading to session teardown.

Why this answer

The debug output shows LDP errors. R1 received malformed hello and initialization messages from neighbor 10.0.0.2, causing the LDP session to go down. This indicates a configuration mismatch or software bug on the neighbor.

Full explanation →
238
Drag & Dropmedium

Drag and drop the steps to verify and validate EEM operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Begin by displaying registered EEM policies, then check the status of each policy (active/inactive), review event history and timestamps, examine the policy actions and variables, and finally confirm the policy triggers correctly with a test event.

Full explanation →
239
MCQmedium

A network engineer runs the following command to troubleshoot an MPLS Operations issue: R1# debug mpls ldp transport 10.1.1.1 Output: *Mar 1 00:01:23.456: LDP: Sent hello to 10.1.1.1 (UDP 646) on GigabitEthernet0/0 *Mar 1 00:01:23.789: LDP: Received hello from 10.1.1.1 (UDP 646) on GigabitEthernet0/0 *Mar 1 00:01:24.012: LDP: Opened TCP connection to 10.1.1.1:646 *Mar 1 00:01:24.345: LDP: Initialization msg sent to 10.1.1.1 *Mar 1 00:01:24.678: LDP: Initialization msg received from 10.1.1.1 *Mar 1 00:01:25.001: LDP: Session with 10.1.1.1:0 (0x1234) is UP What does this output indicate?

A.LDP session with neighbor 10.1.1.1 is successfully established
B.LDP discovery via multicast hello failed
C.TCP connection to 10.1.1.1 was refused
D.LDP session is stuck in initialization state
AnswerA

The output shows all steps of LDP session establishment completing successfully, ending with session UP.

Why this answer

The debug output shows the LDP transport session establishment process. The sequence of events indicates a successful LDP session establishment: hello exchange, TCP connection, initialization messages, and session UP.

Full explanation →
240
MCQhard

A network engineer runs the following command on Router R1: R1# show ip route vrf CUSTOMER_A Routing Table: CUSTOMER_A Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks B 10.10.10.0/24 [200/0] via 192.168.1.2, 00:10:00 B 10.20.20.0/24 [200/0] via 192.168.1.2, 00:10:00 R1# show ip bgp vpnv4 vrf CUSTOMER_A BGP table version is 6, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:1 (default for vrf CUSTOMER_A) *> 10.10.10.0/24 192.168.1.2 0 0 65001 i *> 10.20.20.0/24 192.168.1.2 0 0 65001 i *> 10.30.30.0/24 192.168.1.2 0 0 65001 i Based on this output, what is the likely issue?

A.A route-map is filtering the route 10.30.30.0/24 from the VRF routing table.
B.The VRF is not properly configured.
C.The BGP session is down.
D.The route distinguisher is misconfigured.
AnswerA

BGP table has three routes, but routing table only has two, indicating filtering.

Why this answer

The VRF routing table shows only two routes, but the BGP table shows three routes for the VRF. This indicates that a route-map is filtering one of the routes from being installed in the routing table. The correct answer is that a route-map is filtering the route 10.30.30.0/24.

Full explanation →
241
MCQhard

An engineer configures a DHCP server on a Cisco router to assign IP addresses from a pool. Clients receive addresses, but when the engineer checks 'show ip dhcp binding', no bindings are displayed. Which is the most likely explanation?

A.The DHCP pool is configured with 'lease infinite', causing bindings to be stored in a different database.
B.The 'ip dhcp excluded-address' command includes the entire pool range, so no addresses are assigned and no bindings are created.
C.The router's DHCP server is configured in 'database' mode, which stores bindings externally.
D.The clients are using DHCPv6, not DHCPv4.
AnswerB

Correct: If the excluded address range covers the pool, the server will not assign any addresses, and no bindings are created.

Why this answer

The 'show ip dhcp binding' command only displays bindings that are currently active. If the lease time is very short or the clients release addresses, bindings may not appear. However, a more subtle edge case is when the DHCP server is configured with 'ip dhcp excluded-address' that includes the pool range, causing the server to not assign addresses but still respond with NAKs.

Full explanation →
242
MCQhard

An engineer configures uRPF strict mode on an interface that is part of an IPv6 BGP multihoming setup with two upstream providers. The router receives BGP routes from both providers and has equal-cost paths to some destinations. Traffic from the router to those destinations is intermittently dropped. Which is the most likely explanation?

A.ECMP causes asymmetric routing where packets from the same source may arrive on different interfaces, violating uRPF strict mode's single-interface check.
B.BGP routes are not installed in the routing table, so uRPF has no entry to check.
C.The router has 'ipv6 cef' disabled, causing uRPF to fail.
D.The upstream providers are using different AS paths, causing BGP to not install equal-cost paths.
AnswerA

Correct. uRPF strict mode expects symmetric routing; ECMP breaks that assumption.

Why this answer

With uRPF strict mode enabled, the router checks that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the interface used to reach that source. In an ECMP scenario with two upstream providers, traffic from the router to a destination may be load-balanced across both links, but return traffic from that destination may arrive on a different interface than the one uRPF expects. This asymmetric routing causes uRPF strict mode to drop the packets, as they fail the single-interface check.

Exam trap

Cisco often tests the subtle interaction between uRPF strict mode and ECMP, where candidates mistakenly think uRPF works with any valid route, but they overlook the requirement that the incoming interface must match the FIB's outgoing interface for the source prefix.

How to eliminate wrong answers

Option B is wrong because BGP routes are installed in the routing table (and FIB) when they are received and selected; if they were not installed, the router would not have equal-cost paths and the issue would not be intermittent drops. Option C is wrong because 'ipv6 cef' is enabled by default on Cisco IOS and IOS-XE, and disabling it would cause a complete failure of uRPF, not intermittent drops. Option D is wrong because different AS paths do not prevent BGP from installing equal-cost paths; BGP can still have multiple paths with different AS paths if they have the same local preference, weight, and MED, and the 'maximum-paths' command is configured.

Full explanation →
243
Drag & Drophard

Drag and drop the steps to troubleshoot NAT and PAT adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Troubleshooting NAT connectivity failures should start with verifying basic reachability using ping, then checking NAT translations with show ip nat translations, then examining the routing table to ensure return traffic is routed correctly, then verifying access lists for NAT, and finally checking for asymmetric routing or adjacency issues.

Full explanation →
244
MCQmedium

Which of the following is a limitation of local SPAN on a Cisco switch?

A.It can only monitor one source interface per session.
B.The destination port must be in the same VLAN as the source.
C.It cannot mirror traffic to a remote switch.
D.It cannot monitor both ingress and egress traffic simultaneously.
AnswerC

Local SPAN is confined to the local switch.

Why this answer

Local SPAN can only mirror traffic to a destination port on the same switch; it cannot send mirrored traffic across the network without additional configuration like RSPAN or ERSPAN.

Full explanation →
245
Multi-Selectmedium

Which THREE statements about IPsec transform sets are true? (Choose THREE.)

Select 3 answers
A.A transform set can specify both ESP and AH protocols.
B.A transform set must include an encryption algorithm.
C.Multiple transform sets can be configured and tried in order.
D.AH provides both authentication and encryption.
E.The 'crypto ipsec transform-set' command is used to define the transform set.
AnswersA, C, E

A transform set can include ESP (with or without encryption) and AH for authentication.

Why this answer

An IPsec transform set can specify both ESP and AH protocols simultaneously. This allows a single transform set to define the combined use of AH for authentication and ESP for encryption (or encryption plus authentication), providing flexibility in securing IPsec traffic.

Exam trap

Cisco often tests the misconception that AH provides encryption, when in fact AH only offers authentication and integrity, while encryption is exclusively the domain of ESP.

Full explanation →
246
MCQmedium

A network engineer runs the following command to verify CoPP (Control Plane Policing) with route-maps: R1# show policy-map control-plane input class class-default Control Plane Service-policy input: CoPP Class-map: class-default (match-any) 12234 packets, 1234567 bytes 5 minute offered rate 1000 bps, drop rate 0 bps Match: any police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 12234 packets, 1234567 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop What does this output indicate?

A.The CoPP policy is dropping all traffic because the CIR is too low.
B.The CoPP policy is allowing all traffic and not dropping any packets.
C.The CoPP policy is only matching specific traffic classes.
D.The CoPP policy is not applied to the control plane.
AnswerB

All packets have conformed to the police rate and have been transmitted, with no drops.

Why this answer

The output shows the CoPP policy applied to the control plane. The class-default matches all traffic and polices it at 8000 bps. All packets have conformed and been transmitted, with no drops.

This indicates that the CoPP policy is working and not dropping any traffic.

Full explanation →
247
MCQhard

An engineer is troubleshooting a router that is configured to archive configurations to a TFTP server at 192.168.1.10. The 'archive' configuration includes 'path tftp://192.168.1.10/config-archive' and 'write-memory'. The engineer notices that the archive is not being created after 'copy running-config startup-config'. What is the most likely cause?

A.The TFTP server does not have write permissions for the directory.
B.The 'archive' configuration is missing the 'time-period' command.
C.The router's 'file prompt quiet' command is configured, suppressing error messages.
D.The TFTP server's IP address is incorrect in the path.
AnswerA

TFTP servers often require a pre-existing file or write permissions; if the server cannot create the file, the archive fails silently.

Why this answer

The 'write-memory' command under the 'archive' configuration triggers an automatic archive of the running configuration to the specified TFTP server whenever 'copy running-config startup-config' is executed. If the TFTP server does not have write permissions for the target directory, the file transfer will fail silently or with an error, preventing the archive from being created. This is the most likely cause because the configuration syntax is correct, and the issue is on the server side.

Exam trap

Cisco often tests the distinction between archive triggers (write-memory vs. time-period) to see if candidates mistakenly think a missing time-period prevents all archiving, when in fact write-memory triggers archiving on config saves without needing a timer.

How to eliminate wrong answers

Option B is wrong because the 'time-period' command is used for periodic archiving (e.g., every 1440 minutes), not for triggering an archive on 'write-memory' or 'copy running-config startup-config'. Option C is wrong because 'file prompt quiet' suppresses user prompts (like confirmation dialogs) but does not suppress error messages from TFTP failures; error messages would still appear in logs or console output. Option D is wrong because if the IP address were incorrect, the router would fail to reach the server entirely, but the question states the archive is 'not being created'—a wrong IP would cause a connectivity failure, not a permission issue, and the engineer would likely see a timeout or unreachable error.

Full explanation →
248
Drag & Drophard

Drag and drop the steps to troubleshoot route summarization adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by verifying that the summarization router has a route to the null0 interface to prevent loops. Then, confirm that the summary route is being advertised to neighbors using show ip route. Next, check that the neighbor router receives the summary in its routing table.

After that, examine the neighbor's routing table for the specific summarized prefix. Finally, test end-to-end connectivity using ping or traceroute to ensure the summary works.

Full explanation →
249
MCQeasy

What is the default OSPF dead interval on an Ethernet broadcast network?

A.10 seconds
B.30 seconds
C.40 seconds
D.120 seconds
AnswerC

The dead interval is 4 times the hello interval (10 seconds) = 40 seconds.

Why this answer

On an Ethernet broadcast network, OSPF defaults to a hello interval of 10 seconds and a dead interval of 40 seconds (four times the hello interval). This is defined in RFC 2328 and is the standard for broadcast multiaccess networks like Ethernet. Option C is correct because the dead interval is explicitly 40 seconds in this scenario.

Exam trap

Cisco often tests the distinction between broadcast and NBMA networks, where candidates mistakenly apply the NBMA dead interval (120 seconds) to Ethernet broadcast networks, or confuse the hello interval (10 seconds) with the dead interval.

How to eliminate wrong answers

Option A is wrong because 10 seconds is the default OSPF hello interval on broadcast networks, not the dead interval. Option B is wrong because 30 seconds is not a standard OSPF timer value; it might be confused with the dead interval on non-broadcast networks (which is 120 seconds) or a misremembered multiplier. Option D is wrong because 120 seconds is the default dead interval on NBMA (Non-Broadcast Multi-Access) networks, such as Frame Relay, where the hello interval is 30 seconds, not on Ethernet broadcast networks.

Full explanation →
250
MCQmedium

A network engineer runs the following command to troubleshoot route redistribution: R1# debug ip routing IP: route table insert (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20] IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720] IP: route table delete (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20] IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720] What does this output indicate?

A.The router is load-balancing between OSPF and EIGRP routes.
B.The EIGRP route replaces the OSPF route due to lower administrative distance.
C.The OSPF route is preferred due to lower metric.
D.Both routes are installed in the routing table.
AnswerB

EIGRP AD 90 is lower than OSPF AD 110, so the EIGRP route is preferred.

Why this answer

The debug output shows the OSPF route (AD 110) being inserted first, then the EIGRP route (AD 90) being inserted, followed by the deletion of the OSPF route and re-insertion of the EIGRP route. This sequence indicates that the EIGRP route replaces the OSPF route because EIGRP has a lower administrative distance (90 vs. 110), making it more trustworthy. The routing table only keeps the best route based on AD, not metric, when comparing routes from different protocols.

Exam trap

Cisco often tests the distinction between administrative distance and metric, trapping candidates who assume that a lower metric (like OSPF's 20) automatically makes a route preferred, when in fact AD is the first criterion for routes from different protocols.

How to eliminate wrong answers

Option A is wrong because load-balancing requires multiple routes with equal administrative distance and equal metric to the same destination, but here the routes have different ADs (110 vs. 90) and different metrics, so only one route is installed. Option C is wrong because administrative distance, not metric, is the primary tiebreaker when comparing routes from different routing protocols; OSPF's metric [110/20] is irrelevant against EIGRP's lower AD. Option D is wrong because the debug explicitly shows a route table delete for the OSPF route after the EIGRP route is inserted, proving only one route (the EIGRP route) remains in the routing table.

Full explanation →
251
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip dhcp database URL : flash:/dhcpdb Read/write : Read/Write Last updated : Mar 01 2020 00:00:00 Status : Last read succeeded. Next write scheduled in 0 seconds. Based on this output, which statement is correct?

A.The DHCP database is stored in NVRAM and is read-only.
B.The DHCP database is stored in flash and is functioning correctly.
C.The DHCP database write failed and needs to be rescheduled.
D.The DHCP database is empty because no bindings exist.
AnswerB

The status shows success.

Why this answer

The output shows the DHCP database is stored in flash (URL: flash:/dhcpdb) with read/write access, and the status indicates the last read succeeded with a write scheduled in 0 seconds. This confirms the database is functioning correctly, as the router can read and write DHCP bindings to flash memory, which is the default storage location for DHCP database persistence.

Exam trap

Cisco often tests the distinction between DHCP database storage locations (flash vs. NVRAM vs. TFTP) and the interpretation of status messages like 'Last read succeeded' versus 'Last write failed', tricking candidates into assuming a failure or empty database without reading the full output.

How to eliminate wrong answers

Option A is wrong because the URL shows flash:/dhcpdb, not NVRAM, and the access is read/write, not read-only. Option C is wrong because the status clearly states 'Last read succeeded' and 'Next write scheduled in 0 seconds', indicating no failure occurred. Option D is wrong because the output does not provide any information about the number of bindings; the database could contain bindings or be empty, but the status does not indicate emptiness.

Full explanation →
252
MCQmedium

A network engineer runs the following command to verify MPLS LDP discovery sources: R1# show mpls ldp discovery detail Output: Local LDP Identifier: 10.0.0.1:0 Discovery Sources: Interfaces: GigabitEthernet0/0 (hello interval 5 s, targeted hello interval 10 s) LDP Id: 10.0.0.2:0, transport address: 10.0.0.2 Hold time: 15 s (local: 15, peer: 15) GigabitEthernet0/1 (hello interval 5 s, targeted hello interval 10 s) LDP Id: 10.0.0.3:0, transport address: 10.0.0.3 Hold time: 15 s (local: 15, peer: 15) What does this output indicate?

A.R1 has discovered two LDP neighbors via link hellos on two different interfaces
B.R1 is using targeted hellos only
C.R1 has no LDP neighbors
D.The LDP session with 10.0.0.2 is down
AnswerA

The output shows two interfaces with LDP neighbors discovered via link hellos.

Why this answer

The output shows LDP discovery sources. R1 has discovered two LDP neighbors via link hellos on interfaces GigabitEthernet0/0 and GigabitEthernet0/1. Both neighbors have a hold time of 15 seconds.

Full explanation →
253
Multi-Selecthard

Which TWO statements about DHCPv6 prefix delegation are true? (Choose TWO.)

Select 2 answers
A.The requesting router uses the IA_NA option to request a prefix.
B.The delegating router must have a DHCPv6 pool configured with a prefix-delegation statement.
C.The requesting router uses the 'ipv6 dhcp client pd' command on its upstream interface to request a prefix.
D.The delegating router must be configured with 'ipv6 dhcp server' under the downstream interface facing the requesting router.
E.The requesting router can only use the delegated prefix on the interface that received it.
AnswersB, C

Correct. The delegating router uses a DHCPv6 pool with the 'prefix-delegation' command to define the prefix to be delegated.

Why this answer

The delegating router (DHCPv6 server) must have a DHCPv6 pool configured with a prefix-delegation statement to define the prefix pool from which it can assign prefixes to requesting routers. This is a mandatory configuration for the server to provide prefix delegation as per RFC 3633.

Exam trap

Cisco often tests the distinction between IA_NA (for addresses) and IA_PD (for prefixes), and the correct placement of the 'ipv6 dhcp server' command on the upstream interface of the delegating router, not the downstream.

Full explanation →
254
MCQhard

An engineer configures a 6rd tunnel on a router. The tunnel comes up and the router can reach IPv6 hosts on the 6rd domain, but IPv6 hosts behind the router cannot reach the internet (native IPv6). The 6rd border relay is configured correctly. What is the most likely cause?

A.The 6rd router does not have a default route pointing to the tunnel interface; a static route to ::/0 via the tunnel is required.
B.The 6rd prefix length is incorrect; it must be /32 for the tunnel to work.
C.The border relay is not configured with the same 6rd prefix.
D.The router's IPv4 address is not in the 6rd delegated prefix range.
AnswerA

6rd does not automatically install a default route. Without a default route via the tunnel, traffic to native IPv6 destinations is dropped.

Why this answer

The 6rd tunnel is up and the router can reach IPv6 hosts on the 6rd domain, but native IPv6 hosts behind the router cannot reach the internet. This indicates that the tunnel encapsulation works, but return traffic from the native IPv6 internet cannot reach the hosts because the router lacks a default route pointing to the tunnel interface. A static route to ::/0 via the tunnel interface is required to forward all non-6rd IPv6 traffic to the border relay, which then encapsulates it for the native IPv6 internet.

Exam trap

Cisco often tests the nuance that a tunnel being up and reachable within the 6rd domain does not imply a default route exists for native IPv6 internet access, leading candidates to overlook the missing static route.

How to eliminate wrong answers

Option B is wrong because the 6rd prefix length is not fixed at /32; it can vary (e.g., /32, /48, /56) and must match the operator's delegated prefix. Option C is wrong because the border relay is already configured correctly per the question, and a mismatch in the 6rd prefix would prevent the tunnel from coming up or reaching the 6rd domain, which is not the case here. Option D is wrong because the router's IPv4 address does not need to be in the 6rd delegated prefix range; the 6rd prefix is derived from the IPv4 address and the configured 6rd prefix/mask, and the tunnel works, so the IPv4 address is valid.

Full explanation →
255
MCQmedium

Consider the following partial configuration on router R6: flow exporter EXPORTER-3 destination 192.168.2.200 source Loopback0 transport udp 2055 template data timeout 120 ! flow monitor MONITOR-6 exporter EXPORTER-3 record netflow ipv4 original-input ! interface GigabitEthernet0/6 ip flow monitor MONITOR-6 input ! What is the effect of the 'template data timeout 120' command?

A.The router will resend the NetFlow v9 template to the collector every 120 seconds to ensure the collector has the latest template.
B.The router will wait 120 seconds before sending any flow data after the first template is sent.
C.The router will export flow data only if the template has been successfully acknowledged by the collector within 120 seconds.
D.The router will store flow data for 120 seconds before exporting to allow batching.
AnswerA

The 'template data timeout' command controls how often the router re-sends the template to the collector, which is necessary because NetFlow v9 uses templates that may be lost.

Why this answer

This question tests understanding of template refresh timing in NetFlow v9 export.

Full explanation →
256
Multi-Selecthard

Which THREE symptoms indicate a potential IPsec site-to-site VPN failure due to mismatched IKE parameters? (Choose THREE.)

Select 3 answers
A.The 'show crypto isakmp sa' output shows 'MM_NO_STATE'.
B.The 'show crypto ipsec sa' output shows packet errors.
C.The router logs display '%CRYPTO-4-IKMP_NO_POLICY' error messages.
D.The 'show crypto isakmp sa' output shows 'ACTIVE' state.
E.Pings across the VPN fail, and 'show crypto isakmp sa' shows no SA.
AnswersA, C, E

MM_NO_STATE indicates that IKE phase 1 has not completed, often due to mismatched parameters.

Why this answer

The 'show crypto isakmp sa' output showing 'MM_NO_STATE' indicates that the IKE Phase 1 negotiation has failed to progress past the Main Mode initial exchange. This typically occurs when IKE parameters such as encryption, hash, Diffie-Hellman group, or authentication method do not match between the two VPN peers, preventing the establishment of an ISAKMP security association.

Exam trap

Cisco often tests the distinction between IKE Phase 1 and Phase 2 failure symptoms, and the trap here is confusing packet errors in 'show crypto ipsec sa' (Phase 2) with IKE parameter mismatches (Phase 1), leading candidates to incorrectly select option B.

Full explanation →
257
Multi-Selectmedium

Which TWO commands would a network engineer use to verify the BGP next-hop reachability issue when a route is not being installed in the routing table? (Choose TWO.)

Select 2 answers
A.show ip bgp
B.show ip route
C.show ip bgp neighbors
D.show ip bgp summary
E.debug ip bgp updates
AnswersA, B

Displays the BGP table; routes with unreachable next hops may show as 'r' or not be installed.

Why this answer

The show ip bgp command displays the BGP table with status codes; if the next hop is not reachable, the route will show as 'r' (RIB-failure) or not be installed. The show ip route command verifies if the next-hop IP is present in the routing table. show ip bgp neighbors displays neighbor state but not next-hop reachability. show ip bgp summary shows neighbor summary, not route details. debug ip bgp updates is a debug command, not a verification command.

Full explanation →
258
Multi-Selecthard

Which THREE symptoms indicate that NetFlow data export is failing or misconfigured? (Choose THREE.)

Select 3 answers
A.The 'show ip cache flow' output shows a high number of active flows but zero export packets sent.
B.The 'show ip flow export' output shows 'Export state: active'.
C.The 'show ip flow export' output shows 'Export state: idle'.
D.The 'show ip flow export' output shows 'Export packets discarded: 150' with reason 'no route'.
E.The 'show flow monitor name FLOW-MON cache' output displays multiple flow entries with valid timestamps.
AnswersA, C, D

This indicates flows are being created but not exported, likely due to export configuration issues.

Why this answer

When NetFlow export fails, the 'show ip cache flow' output will show increasing flows but no export packets. A 'show ip flow export' output with 'Export state: idle' indicates the exporter is not sending data. If the destination collector is unreachable, the router will report 'Export packets discarded' due to no route.

Option B is incorrect because 'Export state: active' is normal. Option E is incorrect because 'show flow monitor cache' showing entries means flows are being cached, but export may still fail.

Full explanation →
259
Multi-Selecthard

Which TWO configuration steps are required to use IP SLA for tracking an object in a routing protocol like EIGRP? (Choose TWO.)

Select 2 answers
A.Configure an IP SLA operation (e.g., icmp-echo).
B.Create a tracking object that references the IP SLA operation.
C.Configure a static route pointing to the tracked interface.
D.Apply a prefix-list to filter routes based on the tracking object.
E.Schedule the IP SLA operation with the 'ip sla schedule' command.
AnswersA, B

The IP SLA operation must be defined first to generate the probe data.

Why this answer

To use IP SLA for routing protocol tracking, you must first configure an IP SLA operation (e.g., ICMP echo) and then create a tracking object that references the IP SLA operation. The tracking object is then used in the routing protocol configuration (e.g., 'track 1 ip sla 1 reachability'). Configuring a static route or a prefix-list is not required for tracking itself.

The 'ip sla schedule' is needed to start the operation, but the question asks for steps to use it for tracking, so the tracking object and its reference are key.

Full explanation →
260
MCQmedium

In MPLS LDP, what is the default label retention mode on Cisco IOS-XE routers?

A.Liberal Label Retention mode
B.Conservative Label Retention mode
C.Ordered Label Retention mode
D.Independent Label Retention mode
AnswerA

Liberal retention is the default; it allows faster convergence but uses more memory.

Why this answer

The default label retention mode is Liberal, meaning that a router retains all label bindings received from neighbors, even if the neighbor is not the next hop for the FEC.

Full explanation →
261
MCQhard

Two routers are configured with EIGRP and have a neighbor relationship. One router has a route to 192.168.1.0/24 with metric 100. The other router has a route to the same prefix with metric 200. An engineer configures an offset-list on the first router to increase the metric of 192.168.1.0/24 by 50, expecting the second router to prefer its own route. Unexpectedly, the second router still prefers the first router's route after the offset. Which is the most likely explanation?

A.The offset-list increased the metric from 100 to 150, which is still lower than the second router's metric of 200, so the second router still prefers the first router's route.
B.The offset-list must be applied inbound on the second router to increase the metric of the received route.
C.The offset-list command only affects feasible distance, not advertised distance, so the second router ignores it.
D.The second router has a higher administrative distance for the route, so it always prefers the first router's route.
AnswerA

The offset was insufficient to flip the preference; the second router's metric (200) is still higher than 150.

Why this answer

The offset-list affects the metric of the route as advertised to the neighbor. However, if the offset-list is applied inbound on the second router, it increases the metric of the received route, making it less preferred. But if the offset-list is applied outbound on the first router, it increases the metric of the route sent to the second router.

The second router then compares the received metric (150) with its own metric (200) and still prefers the lower metric (150). The engineer likely applied the offset-list outbound on the first router, but the increase was insufficient to make the second router's route better.

Full explanation →
262
MCQmedium

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

A.The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
B.The EIGRP router ID is not configured.
C.The ACL is applied outbound, blocking the EIGRP updates from being sent.
D.The EIGRP for IPv6 is not enabled on the interface.
AnswerA

Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.

Why this answer

EIGRP for IPv6 uses multicast address FF02::A for all EIGRP packets, including hello, update, query, and reply. The ACL permits only hello and update packets, blocking query and reply packets. EIGRP requires query and reply packets for the Diffusing Update Algorithm (DUAL) to converge and install routes; without them, the router cannot complete the route installation process, even though the neighbor relationship is established.

Exam trap

Cisco often tests the misconception that only hello and update packets are needed for EIGRP route installation, but the trap here is that query and reply packets are essential for DUAL convergence and route installation, even when neighbors are up.

How to eliminate wrong answers

Option B is wrong because the EIGRP router ID is not required for EIGRP for IPv6; it uses a 32-bit router ID derived from an IPv4 address or manually configured, but its absence does not prevent route installation if neighbors are established. Option C is wrong because the engineer checked the interface configuration and found an inbound ACL, not outbound; an outbound ACL would affect sending updates, not receiving them, and the issue is with missing routes, not updates being sent. Option D is wrong because the neighbor relationship is established, which confirms that EIGRP for IPv6 is enabled on the interface; if it were not enabled, no neighbors would form.

Full explanation →
263
MCQmedium

A network engineer runs the following command to verify MPLS L3VPN operation: R1# show mpls ldp bindings Output: lib entry: 10.1.1.0/24, rev 2 local binding: label: 101 remote binding: lsr: 10.0.0.2:0, label: 201 lib entry: 10.2.2.0/24, rev 4 local binding: label: 102 remote binding: lsr: 10.0.0.2:0, label: 202 lib entry: 10.3.3.0/24, rev 6 local binding: label: 103 remote binding: lsr: 10.0.0.2:0, label: imp-null What does this output indicate?

A.The router has learned labels for three prefixes from LSR 10.0.0.2
B.The router is using MPLS TE
C.The router is a route reflector
D.The router has a label for 10.3.3.0/24 that is implicit null
AnswerA

The output shows three LIB entries with remote bindings from 10.0.0.2.

Why this answer

The show mpls ldp bindings command displays the Label Information Base (LIB) entries. Each entry shows a prefix, the local label assigned by this router, and the remote label learned from a specific LSR (10.0.0.2). The third entry shows 'imp-null' for the remote label, meaning the neighbor is using implicit null (label 3) for that prefix, typically for BGP-free core or PHP.

Full explanation →
264
MCQeasy

What is the default OSPF hello interval on a Cisco IOS-XE router for a broadcast network type?

A.10 seconds
B.30 seconds
C.40 seconds
D.60 seconds
AnswerA

Correct. The default hello interval is 10 seconds for broadcast and point-to-point networks.

Why this answer

The default hello interval for OSPF on broadcast and point-to-point networks is 10 seconds, as defined by RFC 2328 and implemented in Cisco IOS-XE.

Full explanation →
265
Multi-Selecthard

Which TWO statements about BFD authentication are true? (Choose TWO.)

Select 2 answers
A.BFD authentication supports both MD5 and SHA-1 hashing algorithms.
B.BFD authentication can be configured in either strict or loose mode.
C.BFD authentication is only supported for single-hop BFD sessions.
D.The BFD authentication key is configured directly under the BFD interface configuration.
E.BFD authentication uses a pre-shared key that must be identical on both sides.
AnswersA, B

Correct. BFD authentication supports MD5 and SHA-1, and on newer platforms SHA-256 as well.

Why this answer

BFD authentication can use MD5, SHA-1, or SHA-256 (depending on platform). The authentication mode can be strict (mandatory) or loose (optional). Key chains are used to manage authentication keys, and the key chain must be configured before applying it to BFD.

BFD authentication is supported for both single-hop and multihop sessions.

Full explanation →
266
MCQhard

A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?

A.The PAT port range is exhausted.
B.The router's SIP ALG is disabled, so the private IP in the SDP is not translated.
C.The phone's default gateway is misconfigured.
D.The outside interface has a firewall blocking UDP ports.
AnswerB

Correct because without SIP ALG, the router does not inspect and translate the IP addresses inside the SIP messages, causing media to be sent to the private IP.

Why this answer

The SIP signaling includes the phone's private IP in the SDP body, which is used for media negotiation. When the router's SIP Application Layer Gateway (ALG) is disabled, it does not inspect and translate the private IP addresses embedded in the SDP payload. As a result, the SIP server sends media (RTP) to the private IP 192.168.2.10, which is unreachable from outside, causing the call to fail after the initial registration and signaling succeed.

Exam trap

Cisco often tests the distinction between control plane (SIP signaling) and data plane (RTP media) failures, and the trap here is that candidates assume registration success means NAT is working correctly, overlooking the need for ALG to translate embedded IPs in the SDP body.

How to eliminate wrong answers

Option A is wrong because PAT port exhaustion would cause all new outbound translations to fail, not specifically cause calls to fail after 30 seconds while registration succeeds. Option C is wrong because a misconfigured default gateway would prevent the phone from reaching the SIP server at all, not allow registration and then fail calls after 30 seconds. Option D is wrong because a firewall blocking UDP ports would likely prevent registration or call setup entirely, not allow the call to proceed for 30 seconds before failing.

Full explanation →
267
MCQmedium

A network engineer is troubleshooting an IPv6 over IPv4 tunnel using Teredo on a Windows host. The host can access some IPv6 resources on the internet but cannot reach a specific internal IPv6 server. The engineer suspects the Teredo relay is misconfigured. What is the most likely issue?

A.The Teredo relay is not in the same IPv4 network as the host, or the relay does not have a route to the internal IPv6 server.
B.The host's firewall is blocking Teredo traffic on UDP port 3544.
C.The internal server is not configured with an IPv6 address.
D.The Teredo client on the host is using an incorrect server.
AnswerA

Correct because the Teredo relay must be able to forward packets to the destination IPv6 network. If the relay lacks a route, traffic will be dropped.

Why this answer

Teredo relays are responsible for forwarding traffic between the Teredo IPv6 tunnel and the native IPv6 network. If the relay is not on the same IPv4 subnet as the host or lacks a route to the internal IPv6 server, the host can reach public IPv6 resources (via other relays) but fails to reach the internal server. This matches the symptom of partial connectivity.

Exam trap

Cisco often tests the distinction between Teredo relay and Teredo server roles, and the trap here is that candidates confuse a misconfigured relay (which affects specific destinations) with a misconfigured server (which breaks all Teredo connectivity).

How to eliminate wrong answers

Option B is wrong because a firewall blocking UDP 3544 would prevent all Teredo communication, not just access to a specific internal server. Option C is wrong because if the internal server lacked an IPv6 address, the host would not be able to reach it via any IPv6 method, but the question states the host can access some IPv6 resources, implying the server has an IPv6 address. Option D is wrong because an incorrect Teredo server would prevent the client from obtaining a valid Teredo address or establishing the tunnel, breaking all IPv6 connectivity, not just access to one internal server.

Full explanation →
268
MCQhard

What is the maximum number of source ports that can be monitored in a single SPAN session on a typical Cisco Catalyst switch?

A.16
B.32
C.64
D.128
AnswerC

Up to 64 source ports can be included in a single SPAN session, though hardware-dependent.

Why this answer

A single SPAN session can monitor up to 64 source ports (or source VLANs, but not both in the same session). This is a hardware limitation on most Catalyst switches.

Full explanation →
269
MCQmedium

Which control plane protocol packets are classified as 'critical' in the default CoPP policy?

A.ICMP echo requests and SSH
B.OSPF hello packets and BGP keepalives
C.Telnet and HTTP
D.NTP and SNMP
AnswerB

Routing protocol hello and keepalive packets are considered critical for network stability and are assigned to the critical class in CoPP.

Why this answer

In the default Control Plane Policing (CoPP) policy on Cisco IOS/IOS-XE devices, control plane protocol packets are classified into three categories: critical, normal, and medium. OSPF hello packets and BGP keepalives are classified as 'critical' because they are essential for maintaining neighbor adjacencies and routing protocol convergence; dropping these packets can cause immediate network instability. The default CoPP policy uses class maps to match these protocols and applies a higher priority (e.g., police rate) to ensure they are processed before less critical traffic.

Exam trap

Cisco often tests the misconception that all management plane protocols (like SSH, Telnet, SNMP) are critical, but the default CoPP policy specifically reserves 'critical' for routing protocol packets that maintain control plane stability, such as OSPF hellos and BGP keepalives.

How to eliminate wrong answers

Option A is wrong because ICMP echo requests and SSH are not classified as 'critical' in the default CoPP policy; ICMP echo requests are typically classified as 'normal' (or sometimes 'medium') and SSH as 'normal' or 'medium' depending on the platform, as they are not essential for control plane stability. Option C is wrong because Telnet and HTTP are management plane protocols, not control plane protocols, and are classified as 'normal' or 'medium' in the default CoPP policy; they are not critical for routing protocol operation. Option D is wrong because NTP and SNMP are classified as 'normal' or 'medium' in the default CoPP policy; while they are important for network time synchronization and monitoring, they are not considered critical for immediate control plane functionality like routing protocol keepalives.

Full explanation →
270
Drag & Dropmedium

Drag and drop the steps to verify and validate the EIGRP operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Begin by checking the overall EIGRP process status, then verify the neighbor table for adjacency, examine the topology table for feasible successors, review the routing table for installed routes, and finally use debug commands to validate ongoing operations if needed.

Full explanation →
271
Multi-Selecthard

An engineer is troubleshooting a VRF-Lite setup where two VRFs (BLUE and RED) are configured on a router. Hosts in VRF BLUE cannot ping the default gateway of VRF RED. Which TWO statements correctly explain why this is expected behavior? (Choose TWO.)

Select 2 answers
A.Each VRF maintains its own separate routing table, so VRF BLUE has no route to the subnet of VRF RED.
B.The ARP cache in VRF BLUE does not contain the MAC address of the VRF RED gateway.
C.By default, a router does not forward packets between different VRFs unless inter-VRF routing is explicitly configured.
D.The default gateway in VRF RED is not reachable from VRF BLUE because the gateway interface is in a different VRF.
E.The ping fails because VRF BLUE does not have a default route pointing to the VRF RED gateway.
AnswersA, C

Correct. VRFs have isolated routing tables; without inter-VRF routing, there is no path.

Why this answer

VRF-Lite provides complete isolation between VRFs at Layer 3. By default, no traffic can flow between VRFs unless explicit inter-VRF routing is configured (e.g., using a router with two interfaces in different VRFs or using route leaking). Option A is correct because VRFs maintain separate routing tables.

Option C is correct because by default, a router does not forward packets between VRFs. Option B is incorrect because ARP is per-interface, but the issue is routing, not ARP. Option D is incorrect because the default gateway is reachable within its own VRF.

Option E is incorrect because the ping fails due to routing, not because of a missing default route in the source VRF.

Full explanation →
272
MCQhard

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers across a Frame Relay network. R1 and R2 are connected via a point-to-point subinterface. The engineer configures 'ip ospf network point-to-point' on both subinterfaces. However, the adjacency does not form. 'show ip ospf interface' on R1 shows the interface is up and OSPF is enabled, but no neighbors are seen. What is the most likely cause?

A.The OSPF network type is set to broadcast, causing a DR/BDR election that fails on a point-to-point subinterface.
B.The subinterface is not configured with an IP address.
C.The Frame Relay map is missing or the DLCI is not assigned to the subinterface.
D.The OSPF hello and dead timers are mismatched between R1 and R2.
AnswerC

Without a proper DLCI mapping, the router cannot send Layer 2 frames to the neighbor, preventing OSPF hello packets from being exchanged.

Why this answer

On Frame Relay point-to-point subinterfaces, the OSPF network type should be point-to-point, but the adjacency may still fail if the Layer 2 mapping is incorrect. The subinterface must be mapped to the correct DLCI. If the 'frame-relay interface-dlci' command is missing or misconfigured, the router cannot send packets to the neighbor, even though OSPF is enabled.

The engineer should verify the DLCI mapping.

Full explanation →
273
MCQhard

In a DMVPN Phase 2 network with EIGRP, R1 (hub) and R2 (spoke) are configured with EIGRP stub leaking. R2 is a stub router with 'eigrp stub connected summary'. R3 (another spoke) is not a stub. R2's loopback 10.0.0.1/32 is not reachable from R3, even though R2 advertises it via EIGRP. What is the root cause?

A.R2 is configured with 'eigrp stub receive-only', which prevents it from advertising any routes, including connected ones.
B.R3 has a distribute-list filtering the prefix 10.0.0.1/32 from EIGRP updates.
C.R2's loopback is not in the same EIGRP autonomous system as the tunnel.
D.NHRP is not configured on R2, preventing route advertisement.
AnswerD

Correct. Without NHRP on R2, R3 cannot resolve R2's tunnel IP to a physical address, so the route to 10.0.0.1/32 remains unreachable despite being advertised.

Why this answer

In DMVPN Phase 2, EIGRP stub leaking allows the hub to advertise spoke routes to other spokes, but the next-hop remains the spoke's tunnel IP. For R3 to install the route to 10.0.0.1/32, it must have an NHRP mapping to reach R2's tunnel IP. Without NHRP configured on R2, R3 cannot resolve the next-hop, making the route unreachable.

The EIGRP stub configuration is correct, but NHRP is missing.

Exam trap

Candidates often overlook the necessity of NHRP in DMVPN Phase 2 when focusing on EIGRP stub configuration. Even with proper stub leaking, a spoke without NHRP will prevent other spokes from routing to its networks.

Full explanation →
274
MCQhard

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

A.The EEM applet is not enabled globally.
B.The syslog pattern 'SYS-5-RESTART' is misspelled.
C.The EEM applet runs before the router is fully booted, so the CLI commands fail.
D.The EEM applet requires a 'event manager directory user' command to be configured.
AnswerC

Correct because the syslog message may be generated early in the boot process, and the router may not be ready to accept configuration commands at that point.

Why this answer

The EEM applet uses the wrong event trigger. The 'SYS-5-RESTART' syslog message may not be generated or may be generated too early before the router is fully ready for configuration commands. The engineer should use 'event none' with a manual trigger or use 'event timer' to delay execution.

Full explanation →
275
MCQhard

A DMVPN Phase 2 network is configured with VRF-Lite. Spokes can communicate with the hub, but spoke-to-spoke traffic is not working. The engineer verifies that NHRP registrations are successful and that the spoke routers have the correct NHRP mappings for other spokes. Which is the most likely explanation?

A.The hub router has 'next-hop-self' configured under BGP, causing spokes to send traffic to the hub instead of directly to the destination spoke.
B.The NHRP authentication is mismatched between spokes, preventing the establishment of spoke-to-spoke tunnels.
C.The spoke routers have a lower MTU on the physical interface, causing fragmentation issues for the GRE/IPsec packets.
D.The DMVPN phase is actually Phase 3, which requires additional configuration for spoke-to-spoke traffic.
AnswerA

In Phase 2, spokes need to know the next-hop is the remote spoke's tunnel IP. 'next-hop-self' on the hub overrides this, forcing traffic through the hub.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels are created dynamically using NHRP. However, for spoke-to-spoke traffic to work, the spoke routers must have a route to the destination subnet via the tunnel interface. Additionally, the next-hop for the spoke-to-spoke route must be the spoke router's tunnel IP, not the hub.

If the hub is configured with 'next-hop-self' under BGP or if the IGP is not propagating the correct next-hop, spoke-to-spoke traffic may be forwarded through the hub instead of directly.

Full explanation →
276
MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# show mpls ldp bindings 10.10.10.0 24 lib entry: 10.10.10.0/24, rev 2 local binding: label: 101 remote binding: lsr: 10.1.1.2:0, label: 102 remote binding: lsr: 10.1.2.2:0, label: 103 What does this output indicate?

A.The router has a local label of 101 for the prefix and has learned two remote labels from two different neighbors.
B.The router has only a local label of 101; the remote bindings are not used because they are from the same LSR.
C.The label 102 is the local label for the prefix 10.10.10.0/24.
D.The router has no label for the prefix because the lib entry is incomplete.
AnswerA

The output clearly shows one local binding and two remote bindings from different LSRs.

Why this answer

The output of 'show mpls ldp bindings 10.10.10.0 24' displays the Label Information Base (LIB) entry for prefix 10.10.10.0/24. The 'local binding: label: 101' indicates that this router has assigned label 101 to the prefix. The two 'remote binding' lines show that two different LDP neighbors (LSR IDs 10.1.1.2 and 10.1.2.2) have advertised labels 102 and 103 respectively for the same prefix.

This is the normal operation of LDP, where a router learns multiple remote labels for the same FEC from different peers.

Exam trap

Cisco often tests the distinction between local and remote bindings in the LIB, and the trap here is that candidates may confuse the 'local binding' with a remote label or assume that multiple remote bindings from different LSRs are not used, when in fact they are all valid entries for potential forwarding paths.

How to eliminate wrong answers

Option B is wrong because the remote bindings are indeed used; they are from two different LSRs (10.1.1.2 and 10.1.2.2), not the same LSR, and each provides a viable label-switched path. Option C is wrong because label 102 is a remote binding learned from LSR 10.1.1.2, not a local binding; the local label is 101. Option D is wrong because the LIB entry is complete, showing both a local binding and two remote bindings, which is a fully populated entry for the prefix.

Full explanation →
277
MCQhard

An engineer is troubleshooting an EIGRP convergence issue. After a link failure, the network takes an unusually long time to converge. The engineer notices that the EIGRP hello and hold timers are set to the default values. The network has many routers in a hub-and-spoke topology. What is the most likely cause of the slow convergence?

A.The hub router has too many EIGRP neighbors, causing CPU overload and dropped hello packets.
B.The EIGRP stub feature is not enabled on the spoke routers.
C.The EIGRP variance command is configured, causing unequal-cost load balancing.
D.The EIGRP router ID is not configured, so it defaults to the highest loopback IP.
AnswerA

Correct because a high number of neighbors can overwhelm the hub, leading to missed hello packets and adjacency resets, which prolongs convergence.

Why this answer

In a hub-and-spoke EIGRP topology, the hub router maintains a large number of neighbor adjacencies. When a link failure occurs, the hub must process many queries and replies, which can overwhelm its CPU. If the CPU is overloaded, hello packets may be dropped, causing neighbor hold timers to expire and triggering unnecessary route recomputations.

This leads to the observed slow convergence, even though hello and hold timers are at default values.

Exam trap

Cisco often tests the misconception that slow convergence is always due to timer mismatches or stub configuration, but the trap here is that default timers are fine and the real issue is hub CPU overload from excessive neighbor processing, which causes hello packet drops.

How to eliminate wrong answers

Option B is wrong because the EIGRP stub feature on spoke routers reduces query propagation and improves convergence, but its absence does not directly cause slow convergence due to CPU overload on the hub; it would instead cause the hub to send queries to all spokes, increasing convergence time but not necessarily dropping hellos. Option C is wrong because the variance command enables unequal-cost load balancing, which does not inherently slow convergence after a link failure; it affects routing table selection, not neighbor maintenance or hello processing. Option D is wrong because the EIGRP router ID defaults to the highest loopback IP if not configured, but this does not impact convergence speed; it is used for route identification and neighbor establishment, not for hello timer processing or CPU load.

Full explanation →
278
Multi-Selectmedium

Which TWO commands would a network engineer use to verify the status of local authentication and authorization for device access control on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show aaa local user lockout
B.show running-config | include aaa authentication login
C.show aaa servers
D.debug aaa authentication
E.show ip local policy
AnswersA, B

This command shows users locked out due to failed authentication attempts, which is part of verifying local AAA behavior.

Why this answer

'show aaa local user lockout' displays whether local users have been locked out due to failed authentication attempts, which is directly relevant to verifying local authentication and authorization status. Option B is correct because 'show running-config | include aaa authentication login' shows the configured AAA authentication method lists for login, allowing verification of local authentication policies.

Exam trap

Cisco often tests the distinction between commands that verify configuration (show commands) versus those that monitor live events (debug commands), and between local AAA status versus external server status, leading candidates to mistakenly select 'show aaa servers' or 'debug aaa authentication'.

Full explanation →
279
MCQmedium

In Flexible NetFlow, which of the following is true regarding the 'match' and 'collect' commands in a flow record?

A.The 'match' command defines fields that are used to identify unique flows, while 'collect' defines additional fields to include in the exported record.
B.Both 'match' and 'collect' define key fields; the difference is that 'match' fields are required and 'collect' fields are optional.
C.The 'match' command is used for input flows, and 'collect' is used for output flows.
D.The 'collect' command is used to aggregate flows, while 'match' is used to filter them.
AnswerA

Match fields are used to create flow keys (e.g., source/destination IP, protocol), while collect fields are non-key fields that are included in the exported data.

Why this answer

This question tests understanding of the difference between match and collect in flow record definition.

Full explanation →
280
MCQeasy

Which BFD session state indicates that the session is fully established and operational?

A.Down
B.Init
C.Up
D.AdminDown
AnswerC

Up is the state where the BFD session is fully established and both routers agree on parameters.

Why this answer

The Up state indicates that the BFD session is fully established, and both routers are exchanging control packets successfully.

Full explanation →
281
MCQhard

An EIGRP network is experiencing stuck-in-active (SIA) routes after a link failure. Router R1 has the following relevant configuration: router eigrp 100 network 10.0.0.0 0.255.255.255 Router R2 shows: show ip eigrp topology 10.1.1.0/24 IP-EIGRP topology entry for 10.1.1.0/24 State: Active, 00:01:30, Reply status 10.2.2.2, 10.3.3.3 What is the root cause?

A.Query scope is too wide; configure stub routing or summarization to limit queries.
B.The K-values are mismatched; check metric weights.
C.The network command includes too many interfaces; use passive-interface.
D.The hold time is too short; increase to 180 seconds.
AnswerA

EIGRP queries propagate to all neighbors; if a router has no alternate path, it queries further, causing SIA. Stub routing or summarization reduces query domain.

Why this answer

The route is stuck-in-active because queries are sent to all neighbors and one or more are not replying. This can be due to query scope issue where routers in the query path have no route and keep querying further, causing timeout. The correct fix is to use summary routes or distribute-lists to limit query scope.

Full explanation →
282
MCQhard

A network engineer configures mutual redistribution between EIGRP and OSPF on a DMVPN hub router. The EIGRP domain includes the DMVPN tunnel network, and OSPF includes a corporate backbone. Unexpectedly, after a few minutes, the routing table on the hub shows oscillating routes between EIGRP and OSPF for the same prefix, causing intermittent connectivity. Which is the most likely explanation?

A.The mutual redistribution creates a routing loop because the redistributed routes are re-injected into the original protocol without proper filtering, causing the hub to prefer the redistributed route with a lower AD.
B.The DMVPN tunnel interface is not included in the OSPF process, causing the redistributed routes to have an incorrect next-hop that points to the tunnel interface.
C.The EIGRP and OSPF processes are using different metric styles, causing the redistributed routes to have infinite metrics and be ignored.
D.The hub router's routing table is overloaded due to the DMVPN tunnel being a multipoint interface, causing route flapping.
AnswerA

Without route tagging, a route redistributed from EIGRP into OSPF (AD 110) and then back into EIGRP (AD 170) may be preferred over the original EIGRP internal route (AD 90) if the AD is misconfigured, but typically the original internal route has lower AD. However, if the route is external in EIGRP, the AD is 170, so the OSPF route (110) is preferred, causing a loop.

Why this answer

Mutual redistribution without route tagging or filtering can cause routing loops. When a route is redistributed from EIGRP into OSPF, it is then redistributed back into EIGRP with a different administrative distance (AD). Since OSPF has AD 110 and EIGRP has AD 90 (internal) or 170 (external), the redistributed route may be preferred over the original, causing a feedback loop.

The corner case is that the default AD values cause the redistributed route to be installed, and then the router advertises it back, leading to instability. The fix is to use route tags or distribute-lists to prevent re-redistribution.

Full explanation →
283
Multi-Selecthard

Which TWO statements about BFD echo mode are true? (Choose TWO.)

Select 2 answers
A.Echo packets are generated by the sending router and forwarded back by the remote router.
B.Echo mode reduces the processing load on the remote router's control plane.
C.Echo mode requires a separate BFD session for each direction.
D.Echo mode increases the number of BFD control packets sent between routers.
E.Echo mode is enabled by default on all interfaces.
AnswersA, B

The sending router creates echo packets that the remote router loops back.

Why this answer

In BFD echo mode, the sending router generates echo packets that are looped back by the remote router, allowing detection of failures without involving the remote router's control plane. This reduces CPU load on the remote router. The other statements are false because echo mode does not require a separate session for each direction, and it does not increase the number of BFD control packets.

Full explanation →
284
MCQhard

A service provider network uses OSPF with route summarization on Area Border Routers (ABRs). Router R1 (ABR) has the configuration: router ospf 1 area 1 range 10.1.0.0 255.255.240.0 area 1 range 10.1.16.0 255.255.240.0 Router R2 (internal to area 1) shows: R2# show ip route ospf 10.1.0.0/20 is subnetted, 1 subnets O IA 10.1.0.0/20 [110/2] via 10.2.1.1, 00:00:15, Serial0/0/0 10.1.16.0/20 is subnetted, 1 subnets O IA 10.1.16.0/20 [110/2] via 10.2.1.1, 00:00:10, Serial0/0/0 10.1.32.0/20 [110/3] via 10.2.1.2, 00:00:05, Serial0/0/1 R2 is missing a route to 10.1.48.0/20. What is the root cause?

A.The ABR R1 has a missing 'area 1 range 10.1.48.0 255.255.240.0' command.
B.R2 has a routing table limit that prevents installation of the route.
C.R1's OSPF process has a distribute-list blocking the route.
D.The missing route is a result of OSPF route filtering at the area boundary.
AnswerA

The summary range for 10.1.48.0/20 is not configured, so that route is not advertised into area 0.

Why this answer

The ABR R1 configured two summary ranges for area 1, but the missing route 10.1.48.0/20 is not covered by either summary. OSPF summarization on the ABR creates Type 3 LSAs for the configured ranges, but any routes not falling within those ranges are not advertised as summaries and are also not advertised as individual routes (unless the 'no discard-route' option is used). This causes the missing route.

The correct fix is to add an additional summary range covering 10.1.48.0/20 or use a broader summary.

Full explanation →
285
MCQhard

A network engineer is troubleshooting an OSPF network where an ABR (R1) is configured with the 'area 1 range 10.0.0.0 255.255.0.0' command to summarize routes from area 1 into area 0. After the configuration, routers in area 0 lose connectivity to the 10.0.1.0/24 subnet, although the summary route 10.0.0.0/16 is present in their routing tables. What is the most likely cause?

A.The summary route 10.0.0.0/16 is being advertised with a metric of 0, causing routers to prefer a default route instead.
B.The ABR is not generating the summary route because the component routes are not all in the same area.
C.The 10.0.1.0/24 subnet is not included in the summary range because the range command uses a network mask that does not match the subnet's network address.
D.The summary route is installed, but the next-hop IP address for the summary route is not reachable from routers in area 0, causing traffic to be dropped.
AnswerD

Correct. In OSPF, the summary route's next hop is set to the ABR's interface IP. If that interface is down or the path is not reachable, traffic to the summary may fail, and since specific routes are suppressed, connectivity to the subnet is lost.

Why this answer

The issue is that the summary route may be installed, but the more specific routes are suppressed. If the summary route points to a next hop that is not reachable or has a higher metric, traffic may be black-holed.

Full explanation →
286
MCQeasy

A network engineer runs the following command to troubleshoot a VRF route issue: R1# show ip route vrf CUSTOMER summary IP routing table name is CUSTOMER (0x1) IP routing table maximum-paths is 32 Route Source Networks Subnets Overhead Memory (bytes) connected 2 0 0 320 static 1 0 0 160 eigrp 100 3 0 0 480 Internal 3 Total 6 0 0 960 What does this output indicate?

A.The VRF CUSTOMER routing table has 6 routes, including static and EIGRP routes.
B.The VRF CUSTOMER routing table is empty.
C.The VRF CUSTOMER has only connected routes.
D.The VRF CUSTOMER routing table has an error due to overlapping subnets.
AnswerA

The summary shows connected, static, and EIGRP routes totaling 6.

Why this answer

The output shows the VRF CUSTOMER routing table summary, listing 2 connected routes, 1 static route, and 3 EIGRP routes, totaling 6 routes. This confirms that the VRF contains routes from multiple sources, including static and EIGRP, making option A correct.

Exam trap

Cisco often tests the ability to interpret the 'summary' keyword output, where candidates may mistakenly think the table is empty or only contains connected routes if they overlook the route source breakdown.

How to eliminate wrong answers

Option B is wrong because the output clearly shows 6 routes, not an empty table. Option C is wrong because the table includes static and EIGRP routes in addition to connected routes. Option D is wrong because there is no indication of overlapping subnets or errors; the summary simply lists route counts without any error messages.

Full explanation →
287
Drag & Dropmedium

Drag and drop the steps to establish a BFD session with OSPF into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with enabling BFD globally, then configuring BFD on the interface, enabling OSPF BFD support, verifying the BFD session, and finally verifying OSPF neighbor state reflects BFD integration.

Full explanation →
288
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip policy Interface Route-map GigabitEthernet0/1 PBR-MAP R1# show route-map PBR-MAP route-map PBR-MAP, permit, sequence 10 Match clauses: ip address (access-lists): 101 Set clauses: ip next-hop verify-availability 10.1.1.2 10 track 1 Policy routing matches: 150 packets, 12000 bytes R1# show track 1 Track 1 IP SLA 1 reachability Reachability is Down 1 change, last change 00:05:20 Latest operation return code: timeout Tracked by: ROUTE-MAP 0 Based on this output, what is the most likely outcome?

A.Packets matching ACL 101 are forwarded to 10.1.1.2 regardless.
B.Packets matching ACL 101 are dropped.
C.Packets matching ACL 101 are routed normally via the routing table.
D.The route map is removed from the interface due to the track failure.
AnswerC

When the tracked object is down, PBR skips the set clause and the packet is forwarded using the destination-based routing table.

Why this answer

The route map uses 'ip next-hop verify-availability' with tracking. Track 1 is down because IP SLA 1 reports unreachability. Therefore, the set clause will not be applied, and packets matching ACL 101 will not be forwarded to 10.1.1.2; they will be routed normally via the routing table.

Full explanation →
289
MCQmedium

A network engineer runs the following command to verify BFD with EIGRP: R1# show ip eigrp 100 topology 10.2.2.0/24 EIGRP-IPv4 Topology Entry for AS(100)/ID(10.2.2.0/24) State: Passive, Query origin flag: 1, 1 Successor(s), FD is 131072 Descriptor Blocks: 10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag: 0x0 Composite metric: (131072/130816), Route is Internal Vector metric: Minimum bandwidth is 100000 Kbit Total delay is 100 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 Originating router is 2.2.2.2 BFD enabled, BFD state: UP What does this output indicate?

A.EIGRP is using BFD with state UP, providing sub-second convergence.
B.EIGRP has no BFD session for this neighbor.
C.BFD is down, so EIGRP relies on its own hello/dead timers.
D.EIGRP is using BFD in passive mode only.
AnswerA

BFD is enabled and UP, allowing EIGRP to detect failures faster than EIGRP hello/dead timers.

Why this answer

The output shows that BFD is enabled for the EIGRP neighbor and the BFD state is UP, indicating fast failure detection is active for this route.

Full explanation →
290
MCQmedium

A network engineer runs the following command on Router R9: R9# show logging | include %DMVPN-5-ADJCHG *Mar 1 00:01:05.123: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP *Mar 1 00:02:10.456: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN *Mar 1 00:03:15.789: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP *Mar 1 00:04:20.012: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN Based on this output, what is the most likely problem?

A.The DMVPN tunnel is flapping due to an unstable IPsec SA.
B.The NHRP hold time is set too high.
C.The router has a mismatched DMVPN phase configuration.
D.The tunnel interface is administratively down.
AnswerA

DMVPN uses IPsec for encryption; if the IPsec SA is not established or is flapping, the NHRP peer will go up and down.

Why this answer

The output shows NHRP peer flapping on Tunnel0, indicating that the DMVPN tunnel is unstable. This is often due to a flaking physical interface, IPsec SA expiration, or routing issues. The peer 10.0.0.1 is going up and down repeatedly.

Full explanation →
291
MCQmedium

Consider the following partial configuration on router R6: router bgp 65001 bgp router-id 6.6.6.6 neighbor 10.0.0.2 remote-as 65002 neighbor 10.0.0.2 route-map SET-MED out ! route-map SET-MED permit 10 set metric 50 What is the effect of this configuration?

A.Only routes that match a specific prefix will have MED set to 50; other routes will not be advertised.
B.The route-map will set the MED to 50 for all routes advertised to neighbor 10.0.0.2, and all routes will be advertised.
C.The configuration is invalid because the route-map must have a match clause.
D.The MED will only be set if the neighbor is also configured with a route-map for inbound updates.
AnswerB

The route-map has no match, so it matches all routes. The set metric command applies to all matched routes, setting MED to 50.

Why this answer

The route-map SET-MED is applied as an outbound route-map on the BGP neighbor 10.0.0.2. Since the route-map has a permit statement with no match clause, it implicitly matches all routes. The set metric 50 command then sets the MED (Multi-Exit Discriminator) to 50 for all routes advertised to that neighbor.

All routes are still advertised because the route-map does not contain any deny statements or match conditions that would filter them.

Exam trap

The trap here is that candidates often assume a route-map must have a match clause to be valid, but Cisco permits a route-map with only a set clause, which then applies to all routes matched by the permit statement.

How to eliminate wrong answers

Option A is wrong because the route-map has no match clause, so it matches all routes, not just a specific prefix; also, all routes are advertised, not withheld. Option C is wrong because a route-map does not require a match clause; a permit statement without match conditions matches everything, making the configuration valid. Option D is wrong because the MED is set by the outbound route-map on R6, and no inbound route-map on the neighbor is required for the MED to be set; the neighbor's inbound policy is irrelevant to the outbound set action.

Full explanation →
292
MCQhard

A network engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using OSPF with the CEs and MP-BGP between them. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route as well. However, traffic from CE1 to CE2 fails. The show ip cef vrf CUSTOMER 10.2.2.0 command on PE1 shows the next-hop as 192.168.1.2 but the output interface is 'no route'. What is the most likely cause?

A.The OSPF process on PE1 is not redistributing connected routes.
B.The PE2 loopback is not advertised into the IGP (OSPF/IS-IS) of the service provider core.
C.The VRF route-target import is misconfigured.
D.MPLS is not enabled on the core-facing interfaces.
AnswerB

Correct: The BGP next-hop must be reachable via IGP for CEF to resolve the output interface.

Why this answer

CEF has a next-hop but no output interface because the recursive routing table lookup for the BGP next-hop (192.168.1.2) fails. The IGP (OSPF or IS-IS) does not have a route to the PE2 loopback, so CEF cannot resolve the adjacency.

Full explanation →
293
MCQhard

A network engineer configures VRF-Lite with OSPF as the routing protocol. Two routers in the same VRF are directly connected, but the OSPF neighbor state remains stuck in EXSTART/EXCHANGE. The engineer verifies that the MTU on both interfaces is 1500. Which is the most likely explanation?

A.The OSPF network type is set to point-to-multipoint on one side and broadcast on the other, causing a mismatch in DBD packet size.
B.The 'ip mtu' command is configured on one interface with a value lower than 1500, causing the DBD packet to be larger than the receiving interface's IP MTU.
C.The VRF forwarding table is missing the OSPF route for the neighbor's router ID, preventing the exchange of DBD packets.
D.The OSPF dead interval is set to 40 seconds on one router and 120 seconds on the other, causing a mismatch in hello parameters.
AnswerB

OSPF uses the IP MTU for DBD packets. If one interface has a lower IP MTU (e.g., 1400), the DBD packet from the other side (1500) is dropped, causing the stuck state.

Why this answer

OSPF uses the IP MTU of the outgoing interface to set the size of Database Description (DBD) packets. If the receiving interface has a smaller IP MTU, the DBD packet is silently dropped, causing the neighbor to stay in EXSTART/EXCHANGE. Even if the physical MTU is 1500, the IP MTU can be lowered via 'ip mtu' command, and OSPF will use that lower value.

The MTU mismatch is not necessarily the physical MTU but the IP MTU, which is a common edge case.

Full explanation →
294
MCQhard

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal host 192.168.1.10 can ping external host 203.0.113.50, but cannot establish a TCP connection to port 443. Router R1 shows: debug ip nat: NAT: s=192.168.1.10->203.0.113.1, d=203.0.113.50 [0]. The external host shows no received packets. What is the root cause?

A.An ACL on the outside interface is blocking TCP port 443; configure an ACL to permit it.
B.The NAT translation is failing for TCP due to port exhaustion.
C.The internal host has a firewall blocking outbound TCP.
D.The external host is not responding to TCP SYN packets.
AnswerA

ICMP is permitted, but TCP 443 is likely denied by an implicit or explicit ACL.

Why this answer

The debug output shows a successful NAT translation (s=192.168.1.10->203.0.113.1, d=203.0.113.50), yet the external host receives no packets. This indicates that the translated packets are being dropped after leaving R1, most likely by an ACL applied to the outside interface (GigabitEthernet0/1) that blocks TCP port 443. Since ICMP (ping) succeeds but TCP/443 fails, the ACL is filtering only TCP traffic on that port, not all traffic.

Exam trap

Cisco often tests the distinction between NAT translation success and packet forwarding success; candidates mistakenly assume that a successful NAT debug entry means the packet reached the destination, but the trap is that an ACL on the outside interface can drop the packet after translation, causing asymmetric behavior between ICMP and TCP.

How to eliminate wrong answers

Option B is wrong because port exhaustion would cause NAT to fail or show 'NAT: translation failed' in debug, but the debug shows a successful translation with a specific source port [0], indicating a fresh translation is created. Option C is wrong because the internal host can successfully ping the external host, proving outbound traffic is not blocked by a local firewall; a host firewall blocking TCP/443 would also block the TCP SYN from leaving the host, but the NAT translation occurs, meaning the packet reached R1. Option D is wrong because the external host shows no received packets, meaning the issue is before the packet reaches the external host; if the external host were not responding, R1 would still forward the SYN, and the external host would show received packets (even if it drops them).

Full explanation →
295
Multi-Selectmedium

Which TWO statements about route targets (RT) in MPLS L3VPN are true? (Choose TWO.)

Select 2 answers
A.The export RT is added to VPNv4 routes when they are advertised from a PE to a P router.
B.The import RT is used to filter incoming VPNv4 routes into a VRF on the receiving PE.
C.Route targets are 64-bit values typically formatted as an IP address and a 16-bit number.
D.Route targets are used by LDP to distribute VPN labels between PEs.
E.The route target must match the route distinguisher for the VRF to function.
AnswersB, C

Import RT determines which routes are installed into the VRF routing table.

Why this answer

Route targets control the import and export of VPNv4 routes between VRFs. The export RT is attached to routes when they are advertised from a VRF to MP-BGP. The import RT determines which routes are imported into a VRF.

RTs are not used for label distribution (LDP handles that) and do not affect the IGP. They are not directly involved in the VRF route distinguisher (RD) process, though RD and RT are often configured together.

Full explanation →
296
MCQmedium

Consider the following BGP configuration on router R2: router bgp 65002 bgp router-id 2.2.2.2 neighbor 10.2.2.1 remote-as 65001 neighbor 10.2.2.1 route-map FILTER in ! route-map FILTER deny 10 match ip address prefix-list BLOCKED ! route-map FILTER permit 20 ! ip prefix-list BLOCKED permit 10.0.0.0/8 le 32 Which statement is true about routes received from 10.2.2.1?

A.All routes are accepted because the deny statement is misconfigured.
B.Routes with prefix 10.0.0.0/8 or more specific are denied; all others are permitted.
C.Only routes exactly matching 10.0.0.0/8 are denied; other 10.x.x.x routes are permitted.
D.The route-map is applied outbound, so it affects routes sent to 10.2.2.1.
AnswerB

Prefix-list BLOCKED matches 10.0.0.0/8 and any more specific prefix (le 32), so those are denied. Sequence 20 permits the rest.

Why this answer

The route-map FILTER is applied inbound. Sequence 10 denies any route matching prefix-list BLOCKED (10.0.0.0/8 and more specific). Sequence 20 permits all other routes.

Routes with 10.x.x.x are denied.

Full explanation →
297
MCQmedium

Which SNMP version introduced the use of a User-based Security Model (USM) and View-based Access Control Model (VACM)?

A.SNMPv1
B.SNMPv2c
C.SNMPv3
D.SNMPv2u
AnswerC

SNMPv3 introduced USM and VACM for security and access control.

Why this answer

SNMPv3 introduced the User-based Security Model (USM) for authentication and encryption, and the View-based Access Control Model (VACM) for granular access control. These models provide message integrity, authentication, and encryption, addressing the security deficiencies of earlier SNMP versions.

Exam trap

Cisco often tests the distinction between SNMPv2u (which introduced user-based security but not VACM) and SNMPv3 (which combined USM and VACM), leading candidates to mistakenly select SNMPv2u as the version that introduced both models.

How to eliminate wrong answers

Option A is wrong because SNMPv1 uses community strings for authentication with no security model like USM or VACM. Option B is wrong because SNMPv2c also relies on community strings and lacks USM and VACM, despite being an enhanced version of SNMPv2. Option D is wrong because SNMPv2u was an experimental version that introduced user-based security but did not include VACM; it was a precursor to SNMPv3's USM and VACM.

Full explanation →
298
Drag & Dropmedium

Drag and drop the steps to verify and validate BGP operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking the BGP summary for session state; then examine the BGP table for received prefixes; next verify prefix advertisement with show ip bgp neighbors; then check route propagation with show ip route bgp; finally validate path selection with show ip bgp bestpath.

Full explanation →
299
MCQmedium

A network engineer is troubleshooting an IPv6 neighbor discovery issue on a switch running IOS-XE. Hosts on VLAN 100 are intermittently losing connectivity to the default gateway. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The engineer notices that the switch is dropping valid Router Advertisements from the legitimate router. What is the most likely cause of this issue?

A.The RA Guard policy is configured with 'device-role router' on the port connected to the legitimate router, but the router's MAC address is not in the allowed list.
B.DHCPv6 Guard is blocking DHCPv6 Advertise messages from the router, preventing hosts from obtaining IPv6 addresses.
C.IPv6 Source Guard is dropping packets from the router because the router's IPv6 address is not in the binding table.
D.The switch has IPv6 unicast-routing enabled, causing it to send its own RAs and override the legitimate router.
AnswerA

Correct because RA Guard requires explicit authorization of routers; if the legitimate router's MAC is not allowed, its RAs are dropped.

Why this answer

The RA Guard policy with 'device-role router' on the port connected to the legitimate router expects the router's MAC address to be in an allowed list. If the MAC address is not explicitly permitted, the switch drops all Router Advertisements from that port, including valid ones. This causes hosts on VLAN 100 to lose connectivity to the default gateway because they never receive the necessary RA to learn the gateway's IPv6 address and on-link prefix.

Exam trap

Cisco often tests the nuance that RA Guard with 'device-role router' does not automatically trust all routers; it requires explicit MAC address matching, and candidates may mistakenly think that setting the device role to 'router' alone is sufficient to permit RAs.

How to eliminate wrong answers

Option B is wrong because DHCPv6 Guard blocks DHCPv6 Reply and Advertise messages from unauthorized DHCPv6 servers, but the issue is about Router Advertisements (RA), not DHCPv6 messages; RA Guard is the feature that filters RAs. Option C is wrong because IPv6 Source Guard drops packets based on source IPv6 address and MAC address mismatches in the binding table, but it does not filter Router Advertisements; RA Guard is specifically designed to filter RAs. Option D is wrong because enabling IPv6 unicast-routing on the switch does not cause it to send its own RAs unless an IPv6 address is configured on the VLAN interface and the 'ipv6 nd ra-interval' command is active; even if it did, the switch would not override the legitimate router's RAs unless it had a higher priority, and the issue is that valid RAs are being dropped, not that conflicting RAs are being sent.

Full explanation →
300
Multi-Selecthard

Which THREE commands can be used to troubleshoot NAT issues on a Cisco IOS router? (Choose THREE.)

Select 3 answers
A.show ip nat translations
B.debug ip nat
C.clear ip nat translation
D.show ip nat verbose
E.show ip interface brief
AnswersA, B, C

Displays active translations, which helps verify if mappings are created correctly.

Why this answer

A is correct because 'show ip nat translations' displays the current NAT translation table, showing inside local, inside global, outside local, and outside global addresses. This command is essential for verifying whether translations are being created correctly and for identifying translation mismatches or exhaustion.

Exam trap

Cisco often tests the distinction between valid troubleshooting commands and commands that sound plausible but are either nonexistent or irrelevant to the specific technology, such as 'show ip nat verbose' or 'show ip interface brief'.

Full explanation →
Page 3

Page 4 of 27

Page 5

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →