Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 301–375

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 27

Page 6
301
MCQhard

An engineer is troubleshooting a BGP peering problem between two routers, R1 (AS 65001) and R2 (AS 65002), connected via a firewall. The BGP session is flapping every few seconds. The engineer notices that the TCP connection is established, but BGP OPEN messages are not exchanged. The firewall logs show that TCP port 179 is allowed, but packets with the BGP marker (0xFFFFFFFF) are being dropped. What is the most likely cause?

A.The firewall is dropping BGP packets because the BGP marker (0xFFFFFFFF) is being flagged as a potential attack or malformed packet.
B.The BGP session is flapping because the keepalive timer is set too low on both routers.
C.The BGP session is flapping because the routers have mismatched BGP AS numbers.
D.The BGP session is flapping because the firewall is performing TCP sequence number randomization, breaking the BGP session.
AnswerA

Correct because some security devices inspect BGP messages and may drop packets with the all-ones marker, especially if they are not configured to allow BGP properly.

Why this answer

BGP uses a 16-byte marker (all 0xFF) in its messages. Some firewalls or intrusion prevention systems may misinterpret this as a malformed packet and drop it, preventing BGP from establishing.

Full explanation →
302
Multi-Selecthard

Which TWO statements about the 'show ip bgp vpnv4 vrf <vrf-name>' command output are correct? (Choose TWO.)

Select 2 answers
A.The output displays only routes that are locally originated by the PE router.
B.The output includes the Route Distinguisher (RD) for each prefix.
C.The output shows the MPLS label assigned to each route.
D.The output is equivalent to 'show ip route vrf <vrf-name>'.
E.The output provides the CEF forwarding information for each prefix.
AnswersB, C

Correct. The RD is displayed as part of the prefix (e.g., '100:1:10.1.1.0/24').

Why this answer

The command 'show ip bgp vpnv4 vrf <vrf-name>' displays the BGP table for the specified VRF, including VPNv4 routes that have been imported. It shows the RD, the next-hop, and the route label. It does not show the full VRF routing table (which is seen with 'show ip route vrf'), nor does it show the CEF forwarding table.

The output includes both locally originated and remote routes that have been accepted. The label information is present in the output.

Full explanation →
303
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip dhcp snooping binding MacAddress IpAddress Lease(sec) Type VLAN Interface AA:BB:CC:01:02:03 192.168.1.10 86400 dhcp-snooping 10 GigabitEthernet0/1 AA:BB:CC:01:02:04 192.168.1.11 86400 dhcp-snooping 10 GigabitEthernet0/1 AA:BB:CC:01:02:05 192.168.1.12 86400 dhcp-snooping 10 GigabitEthernet0/2 Based on this output, which statement is correct?

A.DHCP snooping is enabled and has recorded bindings for three clients.
B.DHCP snooping has detected a rogue DHCP server on GigabitEthernet0/1.
C.DHCP snooping is not functioning because the bindings are not trusted.
D.DHCP snooping has a conflict because two clients are on the same interface.
AnswerA

The table shows valid bindings.

Why this answer

The output shows three DHCP snooping bindings with MAC addresses, IP addresses, lease times, and associated VLANs and interfaces, which indicates that DHCP snooping is enabled and has successfully recorded these bindings for clients. The 'dhcp-snooping' type confirms these are dynamically learned from DHCP messages, and the presence of multiple clients on the same interface (GigabitEthernet0/1) is valid as long as they are on the same VLAN.

Exam trap

Cisco often tests the misconception that multiple DHCP clients on the same interface indicate a conflict or misconfiguration, but DHCP snooping bindings can legitimately show multiple entries per interface as long as they are in the same VLAN and have unique MAC/IP pairs.

How to eliminate wrong answers

Option B is wrong because the output shows only DHCP snooping bindings, not any information about a rogue DHCP server; a rogue server would be detected via DHCP snooping's 'trusted' and 'untrusted' port configuration, which is not displayed here. Option C is wrong because the bindings are present and valid, indicating DHCP snooping is functioning correctly; the 'trusted' status applies to ports, not bindings, and untrusted ports can still have valid bindings. Option D is wrong because having two clients on the same interface (GigabitEthernet0/1) is not a conflict; DHCP snooping allows multiple bindings per interface as long as they are in the same VLAN and have unique MAC/IP pairs.

Full explanation →
304
MCQmedium

A network engineer is troubleshooting a BGP peering issue between two directly connected routers, R1 and R2. R1 is configured with 'neighbor 10.1.1.2 remote-as 65002' and 'neighbor 10.1.1.2 update-source Loopback0', while R2 uses 'neighbor 10.1.1.1 remote-as 65001' and 'neighbor 10.1.1.1 update-source Loopback0'. The loopback interfaces are not advertised into any IGP, and there is no static route for the loopback addresses. The BGP session remains in Idle state. What is the most likely cause?

A.The BGP session is stuck in Idle because the neighbor statements reference loopback interfaces that are not reachable.
B.The BGP session is stuck in Idle because the remote-as values are mismatched.
C.The BGP session is stuck in Idle because the update-source command is not allowed on directly connected interfaces.
D.The BGP session is stuck in Idle because the neighbor statements must use the directly connected interface IP addresses.
AnswerA

Correct because BGP uses the update-source address for peering; without reachability, TCP cannot establish.

Why this answer

BGP requires reachability to the neighbor's update-source address. Since the loopback addresses are not reachable via any routing protocol or static route, the TCP connection fails, keeping the session in Idle state.

Full explanation →
305
MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# show ip ospf database router 10.1.1.2 OSPF Router with ID (10.1.1.1) (Process ID 1) Router Link States (Area 0) LS age: 150 Options: (No TOS-capability, DC) LS Type: Router Links Link State ID: 10.1.1.2 Advertising Router: 10.1.1.2 LS Seq Number: 80000002 Checksum: 0x1234 Length: 48 Number of Links: 2 Link connected to: a Transit Network (Link ID) Designated Router address: 10.1.1.2 (Link Data) Router Interface address: 10.1.1.2 Number of TOS metrics: 0 TOS 0 Metrics: 10 Link connected to: a Stub Network (Link ID) Network/subnet number: 192.168.1.0 (Link Data) Network Mask: 255.255.255.0 Number of TOS metrics: 0 TOS 0 Metrics: 10 What does this output indicate?

A.The router 10.1.1.2 is advertising two links: one to a transit network and one to a stub network, both with cost 10.
B.The router 10.1.1.2 is the DR for the transit network 10.1.1.0/24.
C.The router 10.1.1.2 is advertising a single link to a point-to-point network.
D.The router 10.1.1.2 has a misconfigured network type because it shows both transit and stub links.
AnswerA

The LSA shows exactly that: a transit link (to a DR) and a stub link (192.168.1.0/24), both with metric 10.

Why this answer

The output shows two links in the Router LSA from router 10.1.1.2: a transit network link (to a DR) and a stub network link (to a subnet). Both links have a metric of 10, confirming that router 10.1.1.2 is advertising exactly two links with equal cost. This matches option A exactly.

Exam trap

Cisco often tests the ability to interpret the 'Link connected to' fields in a Router LSA, where candidates may mistakenly think a transit link implies a point-to-point connection or that a stub link indicates a misconfiguration, rather than recognizing both are normal for a DR on a multi-access network.

How to eliminate wrong answers

Option B is wrong because the transit network link shows the Designated Router address as 10.1.1.2, which indicates that 10.1.1.2 is the DR for that segment, but the question asks what the output indicates overall, and the output shows two links, not just the DR role. Option C is wrong because the output clearly lists two links (transit and stub), not a single point-to-point link. Option D is wrong because having both a transit link and a stub link in a Router LSA is normal for a multi-access network where the router is the DR; it is not a misconfiguration.

Full explanation →
306
MCQmedium

Consider this configuration on Router R2: ``` interface Tunnel0 ipv6 address 2001:DB8:3::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre ipv6 tunnel destination 2001:DB8:4::2 ``` Which statement is true?

A.This tunnel can only carry IPv6 traffic.
B.The tunnel source and destination must be IPv4 addresses.
C.This tunnel will encapsulate packets using GRE over an IPv6 transport.
D.The tunnel mode should be 'ipv6ip' for IPv6 transport.
AnswerC

GRE over IPv6 is correctly configured, allowing multiprotocol payload.

Why this answer

The configuration shows a tunnel with `tunnel mode gre ipv6`, which explicitly sets the tunnel to use GRE encapsulation over an IPv6 transport. The tunnel source and destination are IPv6 addresses, and GRE can carry multiple protocols (including IPv4, IPv6, and others) over the IPv6 transport. Therefore, option C is correct because the tunnel encapsulates packets using GRE over an IPv6 transport.

Exam trap

Cisco often tests the distinction between 'tunnel mode gre ipv6' (GRE over IPv6 transport) and 'tunnel mode ipv6ip' (IPv6 over IPv4 transport), and candidates mistakenly assume that any tunnel with IPv6 addresses must use ipv6ip mode.

How to eliminate wrong answers

Option A is wrong because GRE tunnels can carry multiple protocol types (IPv4, IPv6, MPLS, etc.), not just IPv6 traffic. Option B is wrong because the tunnel source and destination are explicitly configured as IPv6 addresses (2001:DB8:3::1 and 2001:DB8:4::2), not IPv4 addresses. Option D is wrong because 'tunnel mode ipv6ip' is used for IPv6-over-IPv4 tunnels (6in4), not for GRE over IPv6; the correct mode for GRE over IPv6 is 'tunnel mode gre ipv6'.

Full explanation →
307
MCQhard

A network engineer configures IP SLA tracking for a static route on a Cisco router. The IP SLA operation is configured with a threshold of 100 ms and a timeout of 5000 ms. The tracked object is configured with a delay of 5 seconds for both up and down transitions. The engineer notices that when the remote host becomes unreachable, the static route is not removed from the routing table immediately. Which is the most likely explanation?

A.The IP SLA operation is still in the 'pending' state and has not yet timed out.
B.The tracked object delay of 5 seconds for down transition causes a 5-second wait before the route is removed.
C.The static route has a higher administrative distance than the IP SLA tracked route, so it remains preferred.
D.The IP SLA operation is configured with a frequency that is too low, causing a delay in detection.
AnswerB

The delay down command in the tracked object introduces a hold-down period before the object state changes, so the route remains for that duration.

Why this answer

The IP SLA tracking delay configuration introduces a delay before the tracked object changes state; this is designed to prevent route flapping but can cause the static route to remain in the routing table for the configured delay period after the IP SLA operation fails.

Full explanation →
308
MCQhard

An engineer configures OSPF on two routers connected via a serial link. Both routers have 'ip ospf network point-to-point' configured, but the link is actually a Frame Relay multipoint subinterface. The OSPF neighbors remain stuck in EXSTART state. Which is the most likely explanation?

A.The MTU on the serial link is not consistent between the two routers, causing DBD packets to be dropped.
B.The OSPF hello timer is set too high, causing the neighbor to time out.
C.The area ID is different on the two routers.
D.The OSPF router ID is duplicated.
AnswerA

Correct. OSPF uses the interface MTU for DBD packets; mismatch prevents exchange.

Why this answer

When OSPF neighbors are stuck in EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange. In this scenario, the 'ip ospf network point-to-point' command overrides the default Frame Relay multipoint behavior, but the actual link is a multipoint subinterface. This mismatch can cause MTU inconsistencies because the multipoint subinterface may have a different MTU than the point-to-point OSPF network type expects.

If the MTU is not consistent between the two routers, DBD packets larger than the smaller MTU will be silently dropped, preventing the neighbors from progressing beyond EXSTART.

Exam trap

Cisco often tests the distinction between neighbor states—specifically that EXSTART is reached only after hello and 2-WAY states are complete, so issues like mismatched area IDs or duplicate router IDs would prevent reaching EXSTART, while MTU mismatches specifically block DBD exchange at EXSTART.

How to eliminate wrong answers

Option B is wrong because a hello timer set too high would cause neighbors to fail to form adjacency or stay in DOWN/INIT state, not get stuck in EXSTART; EXSTART is reached only after hello exchange succeeds. Option C is wrong because mismatched area IDs would prevent the routers from even reaching the 2-WAY state, as OSPF requires matching area IDs for neighbor discovery; they would not reach EXSTART. Option D is wrong because a duplicate OSPF router ID would cause one router to reject the other's hello packets, resulting in a neighbor state of DOWN or INIT, not EXSTART; EXSTART requires successful hello and database description negotiation.

Full explanation →
309
MCQhard

R1 and R2 are OSPF neighbors over a VLAN interface with BFD enabled. R1#show ip ospf interface vlan10 shows 'BFD is enabled' but R1#show bfd neighbors shows no sessions. R2#show bfd neighbors shows no sessions. R1 has 'bfd interval 100 min_rx 100 multiplier 3' under vlan10. R2 has same. The VLAN is up. What is the root cause?

A.BFD must be enabled on the physical interface as well as the VLAN interface.
B.The VLAN interface must have 'ip ospf bfd' disabled.
C.OSPF must be configured with 'bfd all-interfaces' globally.
D.The BFD timers must match exactly on both sides.
AnswerA

BFD sessions are established on the physical interface; without BFD on the physical, the VLAN interface BFD configuration is ineffective.

Why this answer

BFD on VLAN interfaces requires that the underlying physical interface also support BFD. If the physical interface (e.g., GigabitEthernet0/1) does not have BFD enabled, the VLAN interface cannot establish BFD sessions. BFD is not automatically inherited from VLAN to physical.

Full explanation →
310
MCQmedium

A network engineer runs the following command to verify DHCPv6 pool configuration on router R1: R1# show ipv6 dhcp pool Output: Pool DHCPv6_POOL : Prefix number: 1 Prefix: 2001:DB8:1::/48 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 01 2025 12:00 PM (2592000 seconds) DNS server: 2001:DB8::1 Domain name: example.com Active clients: 5 What does this output indicate?

A.The DHCPv6 pool has 5 active clients and provides prefix delegation, DNS, and domain name.
B.The DHCPv6 pool is used only for stateless address autoconfiguration (SLAAC).
C.The DHCPv6 pool has 5 clients with addresses from the prefix 2001:DB8:1::/48.
D.The DHCPv6 pool has a preferred lifetime of 2592000 seconds.
AnswerA

The output shows a prefix for delegation, DNS server, domain name, and 5 active clients.

Why this answer

The output shows a DHCPv6 pool configured with prefix delegation (2001:DB8:1::/48), DNS server, and domain name, along with 5 active clients. This confirms that the pool is used for stateful DHCPv6 (prefix delegation) and provides additional options, making option A correct.

Exam trap

Cisco often tests the distinction between DHCPv6 address assignment and prefix delegation, where candidates mistakenly interpret 'Active clients' as hosts with IPv6 addresses rather than routers that have received delegated prefixes.

How to eliminate wrong answers

Option B is wrong because the pool includes prefix delegation and DNS/domain options, which are not used in stateless address autoconfiguration (SLAAC); SLAAC relies on Router Advertisements and does not require a DHCPv6 pool. Option C is wrong because the 'Active clients: 5' indicates clients that have been delegated prefixes from the pool, not that they have addresses from the prefix 2001:DB8:1::/48; DHCPv6 prefix delegation assigns prefixes to requesting routers, not host addresses. Option D is wrong because the preferred lifetime shown is 604800 seconds (not 2592000 seconds), which is the valid lifetime; the output clearly lists 'Preferred lifetime 604800, valid lifetime 2592000'.

Full explanation →
311
MCQhard

What is the default threshold value (in milliseconds) for an IP SLA operation?

A.1000 ms
B.5000 ms
C.10000 ms
D.No default threshold
AnswerB

Correct. The default threshold is 5000 ms, same as the default timeout.

Why this answer

The default threshold for an IP SLA operation is 5000 milliseconds (5 seconds). This is the value above which the operation is considered to have exceeded a tolerable delay, triggering reaction conditions.

Full explanation →
312
Multi-Selecthard

Which THREE symptoms indicate that an administrative distance misconfiguration might be causing routing issues? (Choose THREE.)

Select 3 answers
A.The router prefers a route learned via a less reliable protocol over a more reliable one.
B.Routes are flapping in the routing table due to metric changes.
C.Traffic to a destination takes a suboptimal path.
D.The routing table shows two routes to the same network with different AD values.
E.Connectivity to a remote network is intermittent, depending on which protocol converges first.
AnswersA, C, E

This indicates that the AD for the less reliable protocol is set lower than for the more reliable one.

Why this answer

When AD is misconfigured, the router may prefer a less reliable route, causing suboptimal or intermittent connectivity. Common symptoms include incorrect route selection, flapping routes, and traffic taking unexpected paths. These are all signs that the AD values should be reviewed.

Full explanation →
313
MCQeasy

What is the default transport protocol used by NetFlow exporters on Cisco IOS-XE?

A.TCP
B.UDP
C.SCTP
D.ICMP
AnswerB

Correct. NetFlow uses UDP by default.

Why this answer

The default transport protocol is UDP, typically on port 2055, though configurable.

Full explanation →
314
MCQhard

An engineer configures BGP between two routers in the same AS. The iBGP session is established, but routes learned from the eBGP neighbor are not advertised to the iBGP peer. The 'show ip bgp' output shows the routes as valid but not best. Which is the most likely explanation?

A.The 'synchronization' rule is enabled and the IGP does not carry the prefix.
B.The next-hop IP of the eBGP route is not reachable via IGP, making the route invalid.
C.The 'maximum-paths' command is set to 1, preventing load balancing.
D.The 'bgp bestpath med missing-as-worst' command causes the route to be considered worse.
AnswerB

iBGP requires next-hop reachability; without next-hop-self, the next-hop is the eBGP peer's IP.

Why this answer

For iBGP, the next-hop must be reachable via IGP. If the next-hop is not reachable (e.g., no IGP route for the eBGP peer's interface IP), the route is considered invalid and not installed. This is a common edge case where next-hop-self is not configured.

Full explanation →
315
Multi-Selecthard

Which THREE statements about IPv4 access control list sequence numbers are true? (Choose THREE.)

Select 3 answers
A.Sequence numbers allow insertion of new entries between existing ones.
B.Sequence numbers are automatically assigned in increments of 10 for numbered ACLs.
C.Named ACLs support sequence numbers.
D.The ip access-list resequence command can renumber ACL entries.
E.Resequencing an ACL changes the order of evaluation.
AnswersA, C, D

You can specify a sequence number to place an entry at a specific position in the ACL.

Why this answer

Sequence numbers in IPv4 ACLs allow administrators to insert new entries between existing ones without deleting and re-entering the entire ACL. This is because each entry is assigned a unique sequence number, and new entries can be added with a sequence number that falls between two existing numbers, enabling granular control over the order of evaluation.

Exam trap

Cisco often tests the misconception that resequencing an ACL changes the order of evaluation, but in reality, it only renumbers the entries while preserving their original sequence; the trap is confusing sequence number reassignment with rule reordering.

Full explanation →
316
MCQhard

In an iBGP network, router R1 has: router bgp 65000 bgp bestpath as-path multipath-relax neighbor 10.1.1.2 route-map SET-MED in route-map SET-MED permit 10 set metric 50 neighbor 10.1.1.3 route-map SET-MED2 in route-map SET-MED2 permit 10 set metric 100 Router R2 shows: R2# show ip bgp 192.168.1.0/24 BGP routing table entry for 192.168.1.0/24, version 2 Paths: (2 available, best #2) Path #1: via 10.1.1.1, metric 50 Path #2: via 10.1.1.4, metric 100 R2# show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "bgp 65000", distance 200, metric 100 Last update from 10.1.1.4 00:00:10 Serial0/0/1 R2 is choosing the path with higher metric. What is the root cause?

A.The path with lower MED is from a different AS, so MED is not compared.
B.The route-map on R1 is misconfigured; it should set metric on the neighbor statement.
C.R2 has a higher local preference for the path via 10.1.1.4.
D.The 'bgp bestpath as-path multipath-relax' command causes MED to be ignored.
AnswerA

MED is only compared between paths from the same AS. The path via 10.1.1.1 might have a different AS_PATH.

Why this answer

BGP best path selection compares MED only if paths come from the same AS. If the paths have different AS_PATH lengths, MED is ignored. The output shows two paths, but the path via 10.1.1.1 might have a different AS_PATH length.

The 'bgp bestpath as-path multipath-relax' allows multipath but does not affect MED comparison. The higher metric path is chosen due to a different tie-breaker (e.g., lower neighbor IP).

Full explanation →
317
Multi-Selecthard

An engineer is troubleshooting an OSPF network where route summarization is configured on an ABR. Which TWO statements correctly describe the behavior of OSPF inter-area route summarization using the 'area range' command? (Choose TWO.)

Select 2 answers
A.The 'area range' command creates a single Type 3 LSA for the summary prefix and suppresses the advertisement of individual Type 3 LSAs for the component networks.
B.The cost of the summary LSA is set to the lowest cost among the component routes within the range.
C.The 'area range' command also summarizes external routes redistributed into OSPF from other protocols.
D.The summary route is advertised with a metric type of E1 or E2, depending on the original external metric type.
E.The 'area range' command can be configured only on ABRs and not on ASBRs.
AnswersA, E

Correct. The ABR generates one Type 3 LSA for the range and does not advertise the individual Type 3 LSAs for the more specific routes.

Why this answer

The 'area range' command on an ABR summarizes routes from one area into another. It creates a single Type 3 LSA for the summary prefix, suppresses the individual Type 3 LSAs for the component networks, and does not affect Type 1 or Type 2 LSAs within the area. The summary LSA is advertised with a cost equal to the highest cost among the component routes, not the lowest.

The command does not automatically summarize redistributed routes; that requires the 'summary-address' command under the OSPF process.

Full explanation →
318
MCQhard

A network engineer is troubleshooting an EIGRP issue where a route is flapping in and out of the routing table. The engineer checks the logs and sees messages indicating that the route is being learned from two different neighbors, but the metric keeps changing. The route is a summary route. What is the most likely cause of the flapping?

A.The summary route is being advertised by multiple routers with different metrics.
B.The EIGRP stub feature is configured on one of the neighbors.
C.The passive-interface command is applied to the interface receiving the summary route.
D.The EIGRP router ID is the same on both neighbors.
AnswerA

Correct because if the summary route is originated by multiple routers, the metric may vary, causing the router to flap between the best paths.

Why this answer

When a summary route is learned from multiple EIGRP neighbors with different metrics, the router will alternate between the best paths as the metrics change, causing the route to flap in and out of the routing table. EIGRP uses the feasible successor logic, but if the metric from each neighbor varies (e.g., due to unequal link speeds or load), the route may be repeatedly inserted and withdrawn as the topology table updates.

Exam trap

The trap here is that candidates often assume flapping is caused by neighbor adjacency issues (like duplicate router IDs) or interface misconfigurations, rather than recognizing that metric instability between multiple sources of the same summary route is the root cause.

How to eliminate wrong answers

Option B is wrong because the EIGRP stub feature prevents the stub router from advertising routes learned from other neighbors, but it does not cause a summary route to flap due to metric changes; stubs simply limit query propagation and route advertisement. Option C is wrong because the passive-interface command suppresses the sending of EIGRP hellos and updates on an interface, which would prevent the route from being learned at all, not cause flapping. Option D is wrong because duplicate EIGRP router IDs would cause neighbor adjacency issues or routing loops, but they do not directly cause a summary route to flap due to metric changes; the router would reject the second neighbor or have inconsistent topology tables.

Full explanation →
319
MCQhard

An engineer configures EIGRP stub with `eigrp stub connected static` on a remote router. The remote router has a directly connected network and a static route redistributed into EIGRP. Unexpectedly, the hub router does not receive the static route, although the connected route is learned. Which is the most likely explanation?

A.The stub router must also have `redistribute static` configured under the EIGRP process for the static route to be advertised.
B.The hub router has a route filter that blocks the static route due to administrative distance mismatch.
C.The stub router is configured with `eigrp stub connected static` but the static route is not directly connected, so it is ignored.
D.The stub router must use `eigrp stub receive-only` to advertise static routes.
AnswerA

The `eigrp stub static` keyword only permits advertisement of static routes that are already in the EIGRP topology; redistribution is required first.

Why this answer

The `eigrp stub connected static` command only advertises connected and static routes that are directly configured on the stub router, but it does not automatically redistribute the static route into EIGRP unless redistribution is explicitly configured. The stub command only controls which routes are advertised, not the redistribution process. Without `redistribute static` under the EIGRP process, the static route is not injected into EIGRP.

Full explanation →
320
MCQhard

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue: R1# show ip bgp vpnv4 vrf CUSTOMER routes BGP table version is 10, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:1 (default for vrf CUSTOMER) *> 10.0.0.0/24 10.1.1.2 0 100 0 65001 i *> 192.168.1.0/24 10.1.1.2 0 100 0 65001 i Total number of prefixes 2 What does this output indicate?

A.The VRF CUSTOMER has two routes, both learned via BGP from AS 65001.
B.The VRF CUSTOMER is not receiving any routes because the RD is incorrect.
C.The VRF CUSTOMER has two routes, but they are not installed in the routing table.
D.The VRF CUSTOMER has two routes, but they are filtered by RT import policy.
AnswerA

The output shows two prefixes with path AS 65001, valid and best in the VRF.

Why this answer

The show ip bgp vpnv4 vrf CUSTOMER routes command displays BGP VPNv4 routes for a specific VRF. The output shows two routes with route distinguisher 100:1, received from AS 65001. These are the routes available in the VRF CUSTOMER.

Full explanation →
321
MCQmedium

Given the following BGP configuration on router R1: router bgp 65001 bgp router-id 1.1.1.1 neighbor 10.1.1.2 remote-as 65002 neighbor 10.1.1.2 route-map SET-MED out ! route-map SET-MED permit 10 match ip address prefix-list LOOPBACKS set metric 100 ! route-map SET-MED permit 20 ! ip prefix-list LOOPBACKS permit 192.168.0.0/24 What is the effect of this configuration?

A.Only the 192.168.0.0/24 route is advertised to 10.1.1.2, with MED 100.
B.All routes are advertised to 10.1.1.2; the 192.168.0.0/24 route has MED 100, others have no MED.
C.All routes are advertised with MED 100 because the route-map is applied outbound.
D.Only the 192.168.0.0/24 route is advertised with no MED because the set metric is ignored.
AnswerB

Sequence 10 matches and sets MED 100 for 192.168.0.0/24; sequence 20 permits all other routes without modifying MED.

Why this answer

The route-map SET-MED has two sequences. Sequence 10 matches prefix-list LOOPBACKS (192.168.0.0/24) and sets MED to 100. Sequence 20 permits everything else without setting MED, so other routes are advertised with their original MED.

Full explanation →
322
MCQmedium

Examine the following partial router configuration: logging buffered 16384 logging console warnings logging monitor notifications logging trap debugging logging source-interface Loopback0 logging 192.168.1.100 What is the effect of this configuration?

A.Syslog messages of severity 0 through 7 are sent to the server 192.168.1.100.
B.Only syslog messages of severity 0 through 4 are sent to the server 192.168.1.100.
C.The syslog server receives messages with the IP address of the outgoing interface as the source.
D.The logging buffer stores up to 16384 syslog messages.
AnswerA

The 'logging trap debugging' command sets the syslog trap level to debugging, which includes all severities (0-7).

Why this answer

This configuration sets up logging with different severity levels for different destinations. The 'logging trap debugging' sends all messages (severity 0-7) to the syslog server at 192.168.1.100, while console gets only warnings (severity 4) and monitor gets notifications (severity 5). The buffer is set to 16384 bytes.

Full explanation →
323
MCQmedium

A network engineer runs the following command to debug NetFlow export: R1# debug ip flow export IP Flow export debugging is on R1# *Mar 1 00:05:23.123: FLOW: export v9 flow 1 with 30 packets *Mar 1 00:05:23.124: FLOW: export v9 flow 2 with 15 packets *Mar 1 00:05:23.125: FLOW: export v9 flow 3 with 22 packets *Mar 1 00:05:23.126: FLOW: export v9 flow 4 with 8 packets *Mar 1 00:05:23.127: FLOW: export v9 flow 5 with 12 packets What does this output indicate?

A.NetFlow export is failing because the flows are too small.
B.NetFlow version 9 export is functioning correctly, exporting multiple flows with their packet counts.
C.Only one flow is being exported at a time.
D.The export is using NetFlow version 5.
AnswerB

The debug messages confirm that NetFlow v9 export is operational and exporting flows with their respective packet counts.

Why this answer

The debug output shows that NetFlow version 9 export is working, with flows being exported in real time. Each line shows a flow ID and the number of packets in that flow. This indicates that NetFlow is actively exporting flow data.

Full explanation →
324
MCQmedium

A network engineer runs the following command to troubleshoot an SNMP issue: R1# debug snmp packets SNMP: Packet received via UDP from 10.1.1.1 on port 161 SNMP: GetRequest, reqid 12345, errstat 0, errindex 0 SNMP: Community string: public SNMP: MIB object: 1.3.6.1.2.1.1.1.0 (sysDescr) SNMP: Value: Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.7(3)M SNMP: Packet sent via UDP to 10.1.1.1 on port 161 SNMP: GetResponse, reqid 12345, errstat 0, errindex 0 What does this debug output indicate?

A.The SNMP agent is correctly responding to a GetRequest from the NMS at 10.1.1.1.
B.The SNMP agent is failing to process the request due to a community string mismatch.
C.The SNMP agent is sending a trap to the NMS at 10.1.1.1.
D.The SNMP agent is ignoring the request due to an ACL blocking the NMS.
AnswerA

The debug output shows a GetRequest followed by a GetResponse with errstat 0, indicating successful communication.

Why this answer

The debug output shows a complete SNMP GetRequest/GetResponse exchange between the NMS at 10.1.1.1 and the router acting as an SNMP agent. The agent receives a GetRequest for sysDescr (OID 1.3.6.1.2.1.1.1.0), processes it successfully (errstat 0, errindex 0), and sends back a GetResponse containing the system description. This confirms the SNMP agent is functioning correctly and responding to queries from the NMS.

Exam trap

Cisco often tests the distinction between SNMP Get/Set operations (which use UDP 161) and SNMP traps/informs (which use UDP 162), so candidates may mistakenly interpret a GetResponse as a trap if they overlook the direction and port details in the debug output.

How to eliminate wrong answers

Option B is wrong because the debug output shows the community string 'public' is accepted and the request is processed with errstat 0, indicating no authentication failure or mismatch. Option C is wrong because the output shows a GetRequest/GetResponse pair, not a trap; traps are unsolicited messages sent from agent to NMS, not a response to a query. Option D is wrong because the packet is received and processed successfully, with no indication of an ACL drop; if an ACL were blocking the NMS, the packet would not appear in the debug output at all.

Full explanation →
325
MCQhard

What is the maximum number of entries that can be configured in a single IPv4 ACL in Cisco IOS?

A.1000
B.500
C.Unlimited
D.256
AnswerA

Cisco IOS generally supports up to 1000 ACEs per ACL, though hardware limits may be lower.

Why this answer

Cisco IOS limits a single IPv4 ACL to a maximum of 1000 entries (ACE lines) to prevent performance degradation and excessive memory consumption on the router. This hard limit applies to both standard and extended numbered ACLs, as well as named ACLs, and is enforced by the software to ensure predictable forwarding behavior.

Exam trap

Cisco often tests the 1000-entry limit to catch candidates who assume ACLs are unlimited or who confuse the limit with the 256-entry limit common on older Catalyst switch ACLs.

How to eliminate wrong answers

Option B is wrong because 500 is not the maximum; it is a common misconception that the limit is lower, but Cisco documentation explicitly states 1000 as the cap. Option C is wrong because ACL entries are not unlimited; a finite limit exists to protect router CPU and memory resources, and attempting to exceed 1000 entries results in a configuration rejection. Option D is wrong because 256 is the maximum number of entries for an older or platform-specific ACL (e.g., some Catalyst switches), but for general Cisco IOS routers, the limit is 1000.

Full explanation →
326
MCQeasy

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show ip route summary IP routing table name: Default-IP-Routing-Table (0x0) IP routing table maximum-paths: 32 Route entry limits: 1000000 active, 2000000 total Number of prefixes: 500 Prefixes with memory: 500 Number of paths: 600 Paths with memory: 600 Number of operations: 1200 Number of deleted entries: 0 What does this output indicate?

A.The routing table is empty due to CoPP dropping routing updates.
B.The routing table has 500 prefixes, indicating that routing protocols are functioning and CoPP is not blocking updates.
C.The routing table has too many prefixes, causing CoPP to drop packets.
D.The routing table is not being updated due to a CoPP policy.
AnswerB

A healthy routing table with no deleted entries suggests CoPP is not causing issues.

Why this answer

The output shows 500 prefixes and 600 paths in the routing table, which indicates that routing protocols are exchanging routes and the routing table is being populated normally. Since CoPP is designed to protect the control plane by rate-limiting or dropping excessive traffic, a healthy routing table with a typical number of prefixes suggests that CoPP is not blocking routing updates. Therefore, option B is correct.

Exam trap

Cisco often tests the misconception that a low or moderate number of prefixes automatically indicates CoPP is dropping updates, when in fact CoPP would cause routing table instability or missing routes, not a static but healthy prefix count.

How to eliminate wrong answers

Option A is wrong because the routing table is not empty; it contains 500 prefixes, proving that routing updates are being received and processed. Option C is wrong because 500 prefixes is not an excessive number; modern routers can handle hundreds of thousands of routes, and CoPP would only drop packets if the control plane were overwhelmed, which is not indicated here. Option D is wrong because the routing table is being updated (as shown by the 500 prefixes and 600 paths), so CoPP is not blocking updates.

Full explanation →
327
MCQhard

An engineer configures SPAN on a Cisco switch to monitor both ingress and egress traffic on a trunk port. The monitor session shows only egress traffic, not ingress. What is the most likely explanation?

A.The trunk port is configured with 'switchport trunk allowed vlan' that excludes the VLANs carrying the ingress traffic.
B.The SPAN session is configured with 'monitor session 1 source interface gigabitethernet0/1 rx', missing the 'tx' keyword.
C.The switch has 'spanning-tree portfast' enabled on the trunk, disabling ingress monitoring.
D.The SPAN destination port is in the same VLAN as the ingress traffic, causing a loop.
AnswerA

SPAN only captures traffic on VLANs that are allowed on the trunk; pruned VLANs are not monitored.

Why this answer

When monitoring a trunk port with SPAN, the source can be specified as both ingress and egress. However, if the trunk port is configured with 'switchport trunk allowed vlan' to prune certain VLANs, ingress traffic on pruned VLANs is not forwarded to the SPAN destination. Additionally, SPAN may not capture ingress traffic on the native VLAN if the native VLAN is not explicitly included.

Full explanation →
328
MCQmedium

Consider the following configuration on router R2: !--- R2 configuration ip prefix-list FILTER seq 5 deny 10.1.0.0/16 le 24 ip prefix-list FILTER seq 10 permit 0.0.0.0/0 le 32 ! route-map BGP-IN permit 10 match ip address prefix-list FILTER ! router bgp 65000 neighbor 192.168.1.1 route-map BGP-IN in ! What is the effect of this configuration?

A.All routes from neighbor 192.168.1.1 are accepted; the prefix-list is not applied correctly because the route-map only has a permit sequence.
B.Routes within 10.1.0.0/16 with mask length 24 or shorter are denied; all other routes are permitted.
C.Only routes with mask length exactly 24 are denied; all other routes are permitted.
D.The configuration is incomplete; a route-map must have a deny statement to filter routes.
AnswerB

Correct. The prefix-list denies 10.1.0.0/16 le 24, which includes /16 to /24 subnets; all other prefixes are permitted.

Why this answer

The prefix-list FILTER denies any prefix within 10.1.0.0/16 with a mask length less than or equal to 24 (i.e., 10.1.0.0/16 through 10.1.255.0/24). The permit statement allows all other prefixes. The route-map BGP-IN calls this prefix-list; since there is only one permit sequence, routes that match the deny statement in the prefix-list are implicitly denied by the route-map.

Therefore, routes like 10.1.0.0/16, 10.1.1.0/24, etc., are filtered out.

Full explanation →
329
MCQhard

An experienced network engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes to the same prefix, but after redistribution, a routing loop occurs. The engineer did not use route tagging. Which is the most likely explanation?

A.The seed metric for EIGRP was not configured, causing routes to be rejected.
B.The redistribute command without route-map or tag allows routes to be re-advertised back into the source protocol, creating a loop.
C.OSPF has a lower administrative distance than EIGRP, so OSPF routes are always preferred.
D.EIGRP stub configuration on the redistributing router prevents routes from being advertised.
AnswerB

Mutual redistribution without tagging and filtering causes a feedback loop.

Why this answer

Without route tagging, redistributed routes are re-injected back into the original protocol, causing a feedback loop. Administrative distance comparison (OSPF 110 vs EIGRP 90/170) can cause suboptimal path selection, but the loop is primarily due to lack of tagging and filtering.

Full explanation →
330
MCQhard

An engineer is troubleshooting an issue where a rogue IPv6 router is sending false Router Advertisements on the network, causing hosts to use a malicious default gateway. The switch is configured with IPv6 First Hop Security features. The engineer wants to prevent this attack while allowing the legitimate router to send RAs. What is the correct configuration approach?

A.Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.
B.Enable DHCPv6 Guard on all ports to block any DHCPv6 server messages, which will also block RAs.
C.Use IPv6 Source Guard to filter traffic from the rogue router based on its IPv6 address.
D.Configure a static IPv6 neighbor entry for the legitimate router on the switch to override rogue RAs.
AnswerA

Correct because RA Guard will allow RAs only on ports configured as 'device-role router', blocking rogue RAs on host ports.

Why this answer

RA Guard is the correct IPv6 First Hop Security feature to block rogue Router Advertisements (RAs) while allowing legitimate RAs. By configuring a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', the switch will forward RAs only from the trusted router port and drop RAs received on host ports. This directly prevents the attack described.

Exam trap

Cisco often tests the distinction between IPv6 First Hop Security features (RA Guard, DHCPv6 Guard, Source Guard, ND Inspection) and expects candidates to know that only RA Guard specifically blocks rogue Router Advertisements based on port role.

How to eliminate wrong answers

Option B is wrong because DHCPv6 Guard blocks DHCPv6 server messages, not Router Advertisements; RAs are sent by routers using ICMPv6, not DHCPv6, so this would not prevent the attack. Option C is wrong because IPv6 Source Guard filters traffic based on source IPv6 address and MAC address binding, but a rogue router can use a legitimate IPv6 address or a different address, and Source Guard does not inspect RA content or device role. Option D is wrong because a static neighbor entry only maps an IPv6 address to a MAC address for neighbor discovery; it does not prevent the switch from forwarding rogue RAs to hosts, and hosts would still process the malicious RA.

Full explanation →
331
MCQmedium

An engineer is troubleshooting a routing loop between two routers. R1 and R2 are running both OSPF and EIGRP. R1 learns the prefix 172.16.1.0/24 via OSPF with AD 110 and via EIGRP internal with AD 90. The engineer notices that R1 installs the EIGRP route, but traffic to 172.16.1.0/24 is being dropped. What is the most likely issue?

A.The OSPF route has a better metric, but the EIGRP route is preferred due to lower AD.
B.The EIGRP route is a summary route pointing to a null0 interface.
C.The OSPF route has a higher AD because it is a type 5 LSA.
D.The EIGRP route is an external route with AD 170.
AnswerB

If R1 has an EIGRP summary route for 172.16.1.0/24 pointing to Null0, it will be installed with AD 90 and drop traffic, causing a black hole.

Why this answer

EIGRP internal routes have AD 90, which is lower than OSPF's 110, so EIGRP is preferred. However, if the EIGRP route points to a next-hop that is not reachable or is a backup path, traffic may be dropped. The root cause could be that the EIGRP route is learned via a secondary path that is not optimal or has a next-hop issue.

Full explanation →
332
MCQeasy

A router has a CoPP policy that includes a class-map matching all traffic from a specific source IP address (the management station) and polices it to 100000 bps. The engineer notices that SNMP polls from the management station are timing out. The SNMP traffic uses UDP port 161. The engineer checks the CoPP statistics and sees that the class for the management station has dropped packets. What is the most likely cause?

A.The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.
B.The SNMP community string is incorrect on the management station.
C.The CoPP class-map is matching the wrong source IP address.
D.The SNMP agent on the router is not responding due to high CPU.
AnswerA

SNMP polls can be bursty, and 100000 bps may not be sufficient, leading to drops and timeouts.

Why this answer

The CoPP policy polices traffic from the management station to 100,000 bps. SNMP polls typically consist of multiple small UDP packets (e.g., get-request, get-response), but the aggregate rate of these polls can exceed 100 kbps if the polling interval is aggressive or multiple OIDs are queried. The dropped packets in the CoPP class statistics confirm that the policer is throttling the SNMP traffic, causing timeouts.

Therefore, the police rate is too low for the actual SNMP traffic volume.

Exam trap

Cisco often tests the misconception that CoPP drops are always due to incorrect classification or CPU issues, but the trap here is that the engineer sees drops in the correct class, so the root cause is simply that the police rate is insufficient for the actual traffic load.

How to eliminate wrong answers

Option B is wrong because an incorrect SNMP community string would cause authentication failures (e.g., 'noSuchName' or timeouts due to access denial), not CoPP drops; the engineer already sees dropped packets in the CoPP class, which points to policing, not authentication. Option C is wrong because if the class-map matched the wrong source IP, the management station's traffic would not be classified into that class, and no drops would be seen for that class; the fact that drops are occurring in the class indicates the traffic is being matched correctly. Option D is wrong because high CPU on the router would cause general packet loss or slow responses, but the CoPP statistics show drops specifically in the management station's class, which is a direct result of the policer, not CPU overload; CoPP drops occur before the packets reach the control plane CPU.

Full explanation →
333
MCQmedium

A network engineer configured the following: monitor session 3 type erspan-source source interface GigabitEthernet0/0/2 rx destination erspan-id 2 ip address 10.0.0.2 origin ip address 10.0.0.1 What traffic will be mirrored?

A.Only traffic received on GigabitEthernet0/0/2.
B.Only traffic transmitted on GigabitEthernet0/0/2.
C.Both received and transmitted traffic on GigabitEthernet0/0/2.
D.All traffic on the router, regardless of interface.
AnswerA

The 'rx' keyword specifies receive-only.

Why this answer

The 'rx' keyword indicates that only ingress (received) traffic on GigabitEthernet0/0/2 will be mirrored.

Full explanation →
334
MCQhard

An OSPFv3 network has multiple areas. Area 0 includes R1 and R2. Area 1 includes R2 and R3. R2 is an ABR. R1 has an IPv6 ACL applied inbound on the interface to R2 that permits only OSPFv3 and denies all other traffic. R3 advertises a prefix 2001:db8:3::/48 into Area 1. R1's routing table shows the prefix but with a next-hop of R2. R1's uRPF is configured in strict mode on the interface to R2. Traffic from R1 to 2001:db8:3::1 is dropped. R1 shows 'show ipv6 cef 2001:db8:3::/48' points to R2's link-local address. What is the root cause?

A.The source address of the traffic from R1 is not in the FIB as reachable via the interface facing R2, causing uRPF strict mode to drop the packet.
B.The ACL on R1 blocks the return traffic from the destination, causing asymmetric routing.
C.R2's link-local address is not reachable due to OSPFv3 network type mismatch.
D.The prefix 2001:db8:3::/48 is not in the OSPFv3 database on R1 due to area filtering.
AnswerA

uRPF strict requires the source address to be reachable via the incoming interface. If the source is a directly connected subnet that is not in the FIB (e.g., due to filtering), the check fails.

Why this answer

The root cause is that R1's uRPF strict mode checks the source address of incoming packets against the FIB to ensure the best reverse path to that source is via the same interface. Traffic from R1 to 2001:db8:3::1 uses a source address from R1's own subnet, but the FIB entry for that source address points out a different interface (or is not present), causing uRPF to drop the packet. The ACL permits OSPFv3 but blocks all other traffic, which prevents the return traffic from R3 from reaching R1, but the immediate failure is due to uRPF dropping the forward packet.

Exam trap

Cisco often tests the distinction between uRPF dropping forward traffic due to source address validation versus ACLs blocking return traffic, leading candidates to incorrectly blame the ACL when the real issue is the uRPF check failing on the source address.

How to eliminate wrong answers

Option B is wrong because the ACL on R1 blocks all non-OSPFv3 traffic inbound from R2, which would drop return traffic from the destination, but the question states the forward traffic from R1 is dropped, not the return traffic; asymmetric routing is not the direct cause here. Option C is wrong because R2's link-local address is reachable (as shown by the CEF entry pointing to it), and there is no indication of an OSPFv3 network type mismatch, which would prevent adjacency formation entirely. Option D is wrong because R1's routing table shows the prefix 2001:db8:3::/48 with a next-hop of R2, proving it is in the OSPFv3 database and not filtered by area.

Full explanation →
335
MCQeasy

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.1.1.0/24 BGP routing table entry for 10.1.1.0/24, version 2 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.1.1.1 from 0.0.0.0 (10.1.1.1) Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, best rx pathid: 0, tx pathid: 0x0 Based on this output, which statement is correct?

A.The route 10.1.1.0/24 was learned from an eBGP peer.
B.The route 10.1.1.0/24 is locally originated and is the best path.
C.The route 10.1.1.0/24 has a weight of 100.
D.The route 10.1.1.0/24 is not being advertised to any peer.
AnswerB

The output shows 'sourced' and 'best', meaning it is a local network that is the best path in the BGP table.

Why this answer

The output shows a locally originated network (10.1.1.0/24) with next hop 10.1.1.1 (the router itself). It is marked as valid, sourced, and best, meaning it is injected into BGP and will be advertised to peers.

Full explanation →
336
MCQhard

A switch is configured with SPAN to monitor traffic on interface Gi0/0/0 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source interface Gi0/0/0 both monitor session 1 destination interface Gi0/1. The analyzer sees only half of the traffic (only incoming or outgoing). The switch also has an EtherChannel configured on Gi0/0/0 as part of a port-channel. The port-channel is up/up. What is the root cause?

A.The SPAN source is a physical interface that is part of an EtherChannel; SPAN should be configured on the port-channel interface instead.
B.The destination interface Gi0/1 is not in the same VLAN as the source.
C.The monitor session is missing the 'no shutdown' command.
D.The EtherChannel load-balancing algorithm causes some traffic to be missed.
AnswerA

SPAN on a physical member of an EtherChannel only monitors that link, not the entire bundle.

Why this answer

When a source interface is part of an EtherChannel, SPAN must be configured on the port-channel interface, not on the individual physical interface. If SPAN is configured on a physical interface that is part of a port-channel, the switch may only monitor traffic on that specific physical link, not the entire EtherChannel. This can result in only a portion of the traffic being mirrored.

The fix is to use the port-channel interface as the source.

Full explanation →
337
MCQhard

An engineer configures ERSPAN on a Cisco router to monitor traffic from a VRF. The mirrored traffic reaches the collector, but the source IP address in the ERSPAN header is the router's loopback, not the expected interface IP. What is the most likely cause?

A.The ERSPAN session does not specify a source IP address, so the router uses the loopback as the best source for the destination.
B.The VRF has a default route pointing to the loopback, forcing all traffic to use that IP.
C.The ERSPAN session is configured with 'erspan-id' that overrides the source IP.
D.The collector expects the loopback IP for filtering, so the router automatically uses it.
AnswerA

Without an explicit source IP, the router uses the routing table to pick the source, often the loopback.

Why this answer

When configuring ERSPAN with a source interface in a VRF, the ERSPAN session uses the VRF's routing table to determine the source IP. If the 'ip address' of the source interface is not used, the router may use the loopback if it is the preferred source for the destination. The 'monitor session' command allows specifying the source IP explicitly; otherwise, the router selects based on routing.

Full explanation →
338
Multi-Selectmedium

Which TWO statements about the Cisco IOS-XE SSH server configuration are true? (Choose TWO.)

Select 2 answers
A.The hostname and domain name must be configured before generating RSA keys.
B.SSH version 2 is the default and is automatically enabled when RSA keys are generated.
C.The command 'ip ssh version 1' is required to enable SSH.
D.The command 'transport input ssh' must be configured globally.
E.RSA key modulus size must be at least 2048 bits for SSH version 2.
AnswersA, B

RSA keys require a fully qualified domain name (FQDN) which uses both hostname and domain name.

Why this answer

Cisco IOS-XE requires both a hostname and a domain name to be configured before generating RSA keys. The RSA key generation process uses the fully qualified domain name (FQDN) as part of the key label, and without these values, the 'crypto key generate rsa' command will fail or prompt for missing parameters.

Exam trap

Cisco often tests the misconception that SSH must be explicitly enabled with a version command, when in fact SSH version 2 is the default and is automatically activated upon RSA key generation, and that 'transport input ssh' is a VTY-line command, not a global one.

Full explanation →
339
MCQmedium

Given the configuration: monitor session 2 source vlan 10-12 both monitor session 2 destination interface GigabitEthernet1/0/3 Which statement is true?

A.Traffic from all ports in VLANs 10, 11, and 12 is copied to GigabitEthernet1/0/3.
B.Only traffic from the access ports in VLAN 10 is copied.
C.The destination port must be in VLAN 10.
D.The destination port will become a SPAN destination and cannot be used for normal traffic.
AnswerA

VLAN SPAN monitors all ports in the specified VLANs.

Why this answer

This configures a VLAN-based SPAN session that monitors all traffic on VLANs 10, 11, and 12 and sends a copy to GigabitEthernet1/0/3.

Full explanation →
340
MCQhard

A network uses ACLs to filter traffic. Router R1 has the following ACL applied to interface GigabitEthernet0/0 in the inbound direction: access-list 100 permit tcp any any eq 22. Router R2, connected to R1, cannot SSH to R1's loopback address. R1 shows: 'show ip interface GigabitEthernet0/0' indicates the ACL is applied. What is the root cause?

A.The ACL permits only SSH, but the implicit deny blocks all other traffic, including EIGRP hellos, causing the neighbor relationship to fail and making the loopback unreachable.
B.The ACL is applied inbound, so it filters traffic entering R1; SSH traffic from R2 to R1's loopback is outbound from R2, so it is not affected.
C.R2's SSH client uses a source port that is not TCP 22.
D.R1's loopback interface has a separate ACL that blocks SSH.
AnswerA

Without explicit permit for routing protocols, the ACL blocks them, causing routing failure.

Why this answer

The ACL applied inbound on R1's GigabitEthernet0/0 permits only SSH (TCP port 22) and implicitly denies all other traffic. EIGRP uses multicast IP 224.0.0.10 and protocol number 88, which is not TCP and not permitted by the ACL. Without EIGRP hellos, the neighbor relationship between R1 and R2 fails, making R1's loopback unreachable from R2 because EIGRP cannot install the route.

Exam trap

Cisco often tests the implicit deny at the end of every ACL and how it can break routing protocols (like EIGRP, OSPF, or BGP) when the ACL does not explicitly permit the protocol's traffic, leading candidates to overlook the impact on control plane traffic.

How to eliminate wrong answers

Option B is wrong because the ACL is applied inbound on R1's interface, meaning it filters traffic entering R1; SSH traffic from R2 to R1's loopback enters R1 through that interface, so it is affected by the ACL. Option C is wrong because SSH clients use a random source port (ephemeral port) above 1023, but the ACL permits TCP any any eq 22, which matches the destination port 22 regardless of source port. Option D is wrong because the question states the ACL is applied to GigabitEthernet0/0, and there is no mention of a separate ACL on the loopback interface; the issue is caused by the inbound ACL on the physical interface.

Full explanation →
341
MCQhard

In a VRF-Lite environment running EIGRP, what is the default maximum hop count for routes?

A.15
B.100
C.255
D.16
AnswerB

EIGRP defaults to a maximum hop count of 100.

Why this answer

EIGRP uses a maximum hop count of 100 by default, though it is not a metric but a TTL-like limit to prevent routing loops.

Full explanation →
342
MCQmedium

A network engineer configured IP SLA 30 to monitor the reachability of a server (10.10.10.10) using ICMP echo probes. The IP SLA is linked to a track object that is used in a static default route. The engineer notices that the IP SLA state is 'Active', but the static route is not present in the routing table. The track object shows 'Up'. What should the engineer check first?

A.Verify that the static route includes the 'track' keyword and references the correct track object number.
B.Check if the server is responding to ICMP echo requests.
C.Ensure the IP SLA probe is configured with a timeout value less than the frequency.
D.Reboot the router to clear any routing table inconsistencies.
AnswerA

The static route must be configured with 'ip route 0.0.0.0 0.0.0.0 <next-hop> track <track-number>'. If missing or wrong track number, the route will not be installed.

Why this answer

If the track object is up and the static route is not installed, the issue is likely that the static route configuration does not properly reference the track object, or the route is being overridden by another route with lower administrative distance.

Full explanation →
343
MCQhard

An engineer configures a DMVPN Phase 2 network. Spoke routers can communicate with the hub, but spoke-to-spoke tunnels do not form. The NHRP registration is successful, and the hub has the spoke's NBMA address. Which is the most likely explanation?

A.The spoke routers are missing the `ip nhrp redirect` command on the hub.
B.The spoke routers have different tunnel keys configured.
C.The spoke routers are using the same NHRP authentication string.
D.The hub router has a lower MTU on the physical interface, causing fragmentation.
AnswerA

In Phase 2, the hub must send NHRP redirect messages to inform spokes of better paths; without it, spokes send traffic through the hub.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels require that the spoke routers have a route to the remote spoke's tunnel IP via the hub, and that the hub has NHRP redirect enabled. Without the redirect, the spoke does not know to initiate a direct tunnel.

Full explanation →
344
MCQhard

A network administrator notices that SSH access to router R1 from a management station 10.10.10.10 is failing intermittently. R1 has the following configuration: access-list 100 permit tcp 10.10.10.0 0.0.0.255 host 192.168.1.1 eq 22, line vty 0 4 access-class 100 in, and control-plane host control-plane security copp policy-map COPP class MANAGEMENT police cir 8000 bc 1500 conform-action transmit exceed-action drop. The management station is on a different subnet than the management interface. The failure occurs during peak hours. What is the root cause?

A.The access-class on the VTY lines is incorrectly configured, blocking SSH traffic from the management station.
B.The CoPP policy is rate-limiting SSH traffic to 8 kbps, and during peak hours, the traffic exceeds this rate, causing drops.
C.The management station is not reachable due to a routing issue.
D.The SSH server on R1 has a maximum session limit that is being reached.
AnswerB

The police command limits SSH traffic, and exceed-action drop causes intermittent failures when the rate is exceeded.

Why this answer

The CoPP policy-map COPP class MANAGEMENT applies a police rate of 8000 bps (8 kbps) with a burst of 1500 bytes to SSH traffic destined for the control plane. During peak hours, the SSH traffic from the management station exceeds this rate, causing packets to be dropped by the exceed-action drop. This intermittent failure aligns with the rate-limiting behavior of CoPP, not with access-list or routing issues.

Exam trap

Cisco often tests the interaction between CoPP and VTY access-class, where candidates mistakenly think the access-class is the issue, but the real culprit is CoPP rate-limiting the control plane traffic before it reaches the VTY lines.

How to eliminate wrong answers

Option A is wrong because the access-list 100 permits tcp from subnet 10.10.10.0/24 to host 192.168.1.1 on port 22, and the access-class 100 in on VTY lines correctly applies this permit to inbound SSH sessions; it does not block traffic. Option C is wrong because the management station is on a different subnet, but the question states the failure is intermittent and during peak hours, not a persistent unreachability; a routing issue would cause constant failure, not intermittent. Option D is wrong because there is no mention of an SSH session limit in the configuration; the default SSH server on Cisco IOS does not have a maximum session limit that would cause intermittent drops during peak hours, and the symptom matches rate-limiting, not session exhaustion.

Full explanation →
345
MCQmedium

Router R2 has the following configuration: ``` interface GigabitEthernet0/2 ip address 10.2.2.2 255.255.255.0 ip policy route-map CHECK ! route-map CHECK permit 10 match ip address 101 set interface GigabitEthernet0/3 ! access-list 101 permit tcp any any eq 80 ``` What is the effect of this configuration?

A.Incoming TCP packets with destination port 80 on G0/2 are forwarded out G0/3, overriding the routing table.
B.Outgoing TCP packets with source port 80 on G0/2 are forwarded out G0/3.
C.All TCP traffic is forwarded out G0/3 regardless of port.
D.The configuration is invalid because 'set interface' cannot be used with a route-map.
AnswerA

PBR matches the ACL and sets the output interface, bypassing the routing table.

Why this answer

The route-map matches TCP traffic with destination port 80 (HTTP) and sets the output interface to GigabitEthernet0/3. This is applied inbound on GigabitEthernet0/2.

Full explanation →
346
MCQhard

Router R1 has an ACL applied to its VTY lines for SSH access: access-list 10 permit 10.1.1.0 0.0.0.255 line vty 0 4 access-class 10 in transport input ssh R1 also has CoPP policy: class-map match-all SSH-CLASS match access-group name SSH-ACL policy-map COPP class SSH-CLASS police cir 8000 bc 1500 conform-action transmit exceed-action drop R2 (10.1.1.2) shows: R2# ssh -l admin 10.2.2.1 % Connection refused by remote host R2# telnet 10.2.2.1 Trying 10.2.2.1 ... % Connection timed out; remote host not responding What is the root cause?

A.The CoPP policy is rate-limiting SSH traffic from R2, causing drops.
B.The access-class on VTY lines blocks R2's IP address.
C.SSH is not enabled on R1's VTY lines.
D.The SSH-ACL in the class-map does not match SSH traffic.
AnswerA

The police rate of 8000 bps is too low, causing exceed-action drop for SSH packets.

Why this answer

The ACL on VTY lines permits only 10.1.1.0/24, but the SSH connection from R2 (10.1.1.2) should be allowed. However, the CoPP policy is rate-limiting SSH traffic to 8000 bps. If the police rate is exceeded, packets are dropped.

The SSH connection might be failing due to CoPP dropping the packets. The telnet is also failing because it is not permitted by the access-class (only SSH is allowed). The root cause is CoPP rate-limiting SSH traffic, causing drops.

Full explanation →
347
MCQhard

An engineer configures IPv6 RA Guard on a switch port connected to a router running OSPFv3. Unexpectedly, OSPFv3 neighbor adjacencies fail to form on that link. Which is the most likely explanation?

A.RA Guard with device-role host drops all IPv6 traffic except Neighbor Discovery and DHCP, including OSPFv3 hellos.
B.OSPFv3 uses multicast address FF02::5 which is filtered by RA Guard by default.
C.RA Guard changes the MAC address of the router, causing OSPFv3 neighbor to be unreachable.
D.The router must send Router Advertisements for OSPFv3 to work, and RA Guard blocks them.
AnswerA

RA Guard host role restricts traffic to ND and DHCP only, blocking OSPFv3.

Why this answer

RA Guard with the device-role host command is designed to block all IPv6 traffic except Neighbor Discovery (ND) and DHCPv6 on the port. This includes OSPFv3 hellos, which use multicast address FF02::5. Since OSPFv3 relies on these hellos to form neighbor adjacencies, blocking them prevents adjacency establishment.

Exam trap

Cisco often tests the misconception that RA Guard only filters Router Advertisements, when in fact the device-role host option blocks all non-ND/DHCPv6 traffic, including OSPFv3 hellos.

How to eliminate wrong answers

Option B is wrong because RA Guard does not filter based on multicast address FF02::5 by default; it filters based on the device role (host vs router) and blocks all non-ND/DHCPv6 traffic when device-role host is configured. Option C is wrong because RA Guard does not modify MAC addresses; it inspects and potentially drops Router Advertisement messages but does not alter the router's MAC address. Option D is wrong because OSPFv3 does not require Router Advertisements to function; it uses its own hello protocol over IPv6 multicast, and RA Guard with device-role host blocks OSPFv3 hellos, not RAs.

Full explanation →
348
MCQmedium

An engineer is troubleshooting a DMVPN phase 2 network where the hub router is not forming an EIGRP neighbor relationship with a spoke. The spoke's tunnel interface is configured with 'ip nhrp nhs 10.0.0.1' and 'ip nhrp map 10.0.0.1 192.168.1.1'. The hub's tunnel interface IP is 10.0.0.1. The engineer pings the hub's tunnel IP from the spoke and it succeeds. The engineer checks 'show ip eigrp neighbors' on the hub and sees no neighbors. What is the most likely cause?

A.The spoke's tunnel interface is missing the 'ip nhrp map multicast dynamic' command.
B.The hub's tunnel interface has 'no ip nhrp redirect' configured.
C.The spoke's EIGRP AS number does not match the hub's.
D.The hub's tunnel interface has 'ip nhrp authentication' configured but the spoke does not.
AnswerA

Correct because without multicast mapping, the spoke cannot send multicast traffic (including EIGRP hellos) to the hub.

Why this answer

EIGRP neighbor formation over a tunnel requires multicast support. In DMVPN, multicast traffic is sent via NHRP to the hub. If the spoke's tunnel interface does not have 'ip nhrp map multicast dynamic' or a static multicast map, the hub will not receive EIGRP hello packets from the spoke.

Full explanation →
349
MCQeasy

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue: R1# show ip access-lists 101 Extended IP access list 101 10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (12 matches) 20 deny tcp any any eq 443 (5 matches) 30 permit ip any any (100 matches) What does this output indicate?

A.The ACL is permitting TCP traffic from 192.168.1.0/24 to any destination on port 80, denying all TCP traffic to port 443, and permitting all other IP traffic.
B.The ACL is denying all traffic because line 20 is an explicit deny.
C.The ACL is applied inbound on an interface and is blocking all traffic to port 443.
D.The ACL has no effect because the match counts are too low.
AnswerA

The ACL lines and match counts confirm this behavior.

Why this answer

The ACL explicitly permits TCP traffic from source 192.168.1.0/24 to any destination on port 80 (line 10), denies TCP traffic from any source to any destination on port 443 (line 20), and then permits all other IP traffic (line 30). The match counts confirm that traffic matching each line has been processed, and the implicit deny at the end is never reached because line 30 permits everything else.

Exam trap

Cisco often tests the misconception that an explicit deny statement (like line 20) blocks all traffic, when in fact it only blocks the specific protocol and port, and subsequent permit entries can still allow other traffic.

How to eliminate wrong answers

Option B is wrong because line 20 is an explicit deny for TCP port 443 only, not an implicit deny at the end of the ACL; the ACL continues to line 30 which permits all other IP traffic, so it does not deny all traffic. Option C is wrong because the output does not indicate the direction (inbound or outbound) or the interface where the ACL is applied; the show ip access-lists command only displays the ACL contents and match counters, not its application point. Option D is wrong because match counts are not required to be high for an ACL to have effect; even low counts indicate that traffic has matched, and the ACL is actively filtering based on its entries.

Full explanation →
350
MCQhard

An engineer configures EIGRP named mode on a router. After making a change to the metric weights, the router becomes stuck-in-active (SIA) for a route. Why does this happen in named mode but not in classic mode?

A.Named mode EIGRP uses a different metric calculation algorithm that is more sensitive to weight changes.
B.Named mode EIGRP requires a 'metric weights' change to be followed by a 'clear ip eigrp neighbors' command; otherwise, the router sends incorrect queries.
C.Named mode EIGRP does not support changing k-values on the fly; it must be done during maintenance.
D.Named mode EIGRP automatically adjusts the metric weights to match neighbors, causing a temporary SIA.
AnswerB

In named mode, changing k-values without resetting neighbors causes the router to use the new metric for new queries but the old metric for existing routes, leading to inconsistencies and SIA.

Why this answer

In named mode EIGRP, changing metric weights (k-values) does not automatically trigger a neighbor reset. Without a 'clear ip eigrp neighbors' command, the router continues to use the old k-values for existing neighbors while sending queries with the new k-values, causing a mismatch that leads to stuck-in-active (SIA) routes. Classic mode EIGRP automatically resets neighbors when metric weights change, avoiding this issue.

Exam trap

Cisco often tests the subtle difference that named mode EIGRP requires an explicit 'clear ip eigrp neighbors' after changing metric weights, while classic mode handles it automatically, leading candidates to assume both modes behave identically.

How to eliminate wrong answers

Option A is wrong because both named and classic mode EIGRP use the same composite metric calculation algorithm (based on bandwidth, delay, reliability, load, and MTU); named mode is not inherently more sensitive to weight changes. Option C is wrong because named mode EIGRP does support changing k-values on the fly, but it requires a manual neighbor reset to avoid SIA; it is not restricted to maintenance windows. Option D is wrong because named mode EIGRP does not automatically adjust metric weights to match neighbors; it uses the locally configured k-values, and mismatches cause SIA, not automatic adjustment.

Full explanation →
351
MCQmedium

According to RFC 5880, what is the maximum number of BFD sessions that can be supported by a single interface on a Cisco router?

A.1 session per interface
B.256 sessions per interface
C.Unlimited, but limited by platform resources
D.16 sessions per interface
AnswerC

Correct. RFC 5880 does not define a maximum; it is implementation-specific.

Why this answer

RFC 5880 does not specify a maximum number of BFD sessions per interface; it is platform-dependent. Cisco routers can support multiple BFD sessions per interface, limited only by hardware resources.

Full explanation →
352
MCQeasy

What is the default NHRP holdtime value on a Cisco router?

A.3600 seconds
B.1800 seconds
C.7200 seconds
D.600 seconds
AnswerA

This is the default holdtime for NHRP mappings.

Why this answer

The default NHRP holdtime is 3600 seconds (1 hour). This value can be modified with the 'ip nhrp holdtime' command.

Full explanation →
353
MCQmedium

Consider the following partial configuration on router R2: interface GigabitEthernet0/0 ip address 10.0.0.2 255.255.255.0 ip ospf 1 area 0 ! interface GigabitEthernet0/1 ip address 192.168.1.2 255.255.255.0 ip ospf 1 area 0 ! router ospf 1 router-id 2.2.2.2 network 10.0.0.0 0.0.0.255 area 0 network 192.168.1.0 0.0.0.255 area 0 What is the effect of this configuration?

A.OSPF will not form adjacencies because the interface and network commands conflict, causing OSPF to ignore the network statements.
B.OSPF will form adjacencies on both interfaces, but the router-id 2.2.2.2 will be overridden by the highest loopback IP.
C.OSPF will form adjacencies on both interfaces as intended; the configuration is redundant but functional.
D.OSPF will only form adjacency on GigabitEthernet0/1 because the network statement for 10.0.0.0 is incorrect.
AnswerC

Both interfaces have OSPF enabled via the interface command and the network statement. This is acceptable and OSPF will operate normally.

Why this answer

The configuration redundantly enables OSPF on both interfaces via both the `ip ospf 1 area 0` interface-level command and the `network` statements under the OSPF process. This is valid and does not cause conflicts; OSPF will form adjacencies on both interfaces as intended. The router-id 2.2.2.2 is explicitly configured and will not be overridden by any loopback IP unless the router-id is not set or is removed.

Exam trap

The trap here is that candidates often think interface-level and network-level OSPF commands conflict or cause redundancy errors, when in fact they are both valid and can coexist without issue.

How to eliminate wrong answers

Option A is wrong because interface and network commands do not conflict; they are both valid ways to enable OSPF on an interface, and OSPF does not ignore network statements when interface commands are present. Option B is wrong because the explicitly configured `router-id 2.2.2.2` takes precedence over any loopback IP; the router-id is only overridden by a higher loopback IP if no explicit router-id is configured. Option D is wrong because the network statement `10.0.0.0 0.0.0.255 area 0` is correct and matches the interface GigabitEthernet0/0; OSPF will form adjacency on both interfaces.

Full explanation →
354
MCQmedium

Which of the following statements about MPLS label imposition and disposition is true?

A.The egress LER always performs the label pop operation.
B.The ingress LER performs the label push operation, and the egress LER performs the label pop operation unless PHP is used.
C.The penultimate hop router always pushes an additional label.
D.Label disposition occurs only at the ingress LER.
AnswerB

Standard MPLS operation: ingress pushes, egress pops. PHP allows the penultimate hop to pop, so the egress does not need to.

Why this answer

In MPLS, the ingress LER (Label Edge Router) imposes a label on the packet (push operation). The egress LER removes the label (pop operation). The penultimate hop router may perform penultimate hop popping (PHP) to remove the label before the egress, reducing the egress's workload.

Full explanation →
355
MCQhard

In an MPLS network, routers R1 and R2 are LDP neighbors with BFD enabled. R1#show mpls ldp neighbor shows R2 as 'Oper Down' for the BFD session. R2#show bfd neighbors shows the session with R1 as 'Down'. R1 and R2 have matching 'mpls ldp router-id' loopback0. The link between them is up. What is the root cause?

A.The LDP router-id must be the IP address of the interface where BFD is enabled.
B.BFD is not supported with LDP on this platform.
C.The BFD interval is too low for LDP.
D.LDP must be configured with 'no bfd' to work properly.
AnswerA

BFD for LDP requires the LDP session to use the same source IP as the BFD session; otherwise, BFD cannot monitor the LDP session.

Why this answer

BFD for LDP requires that the LDP session be established over the same interface as the BFD session. If the LDP router-id is not the interface IP used for BFD, the BFD session may fail. Here, the loopback0 is used as LDP router-id, but BFD is configured on the physical link, causing mismatch.

Full explanation →
356
Drag & Dropmedium

Drag and drop the steps to verify and validate BFD operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Begin with a high-level summary of all BFD sessions, then examine detailed session information, validate timers and counters, confirm BFD is active for the routing protocol, and finally test failover behavior by disabling the peer interface.

Full explanation →
357
MCQhard

A network engineer configures IP SLA to track a BGP next-hop for a backup path. Router R1 has: ip sla 7 icmp-echo 192.168.3.3 source-ip 10.0.0.1 frequency 5 ip sla schedule 7 life forever start-time now track 7 ip sla 7 reachability router bgp 65001 neighbor 192.168.3.3 remote-as 65003 neighbor 192.168.3.3 fall-over bfd neighbor 192.168.3.3 track 7 But when the link to 192.168.3.3 goes down, the BGP session resets after 5 seconds, but the backup route is not used immediately. What is the root cause?

A.The BGP fall-over bfd overrides the track, so the BGP session resets via BFD, but the track remains up, preventing the backup route from being installed.
B.The IP SLA frequency is too low, so the track does not detect the failure quickly enough.
C.The backup route has a higher administrative distance, so it is not installed until the primary route is removed, but the primary route is still present.
D.The track 7 is not applied to the BGP neighbor correctly; it should be under the address-family.
AnswerA

When BFD is used, the track is ignored for BGP session reset, but the track might still be up, so the static route associated with the track is not removed, causing the backup route to not be used.

Why this answer

The BGP fall-over bfd and track 7 are both configured. When the link goes down, BFD detects the failure quickly and resets the BGP session. However, the track 7 might still be up because the IP SLA probe might be successful via an alternate path, so the tracked route is not removed.

The correct answer is that the track 7 is not used because BFD takes precedence, and the track does not influence the route removal.

Full explanation →
358
MCQhard

A network engineer runs the following command to troubleshoot a VRF-Lite DMVPN issue: R1# show ip nhrp vrf CUSTOMER_G detail Output: 10.6.6.1/32 via 10.6.6.1, Tunnel0 created 00:01:00, expire 01:59:00 Type: dynamic, Flags: used NBMA address: 192.168.1.1 (no-socket) Registration handle: 0x00000001 Cache entries: 1 What does this output indicate?

A.The NHRP mapping is static and was manually configured.
B.The NHRP mapping for 10.6.6.1 is dynamic, with NBMA address 192.168.1.1, and is actively used.
C.The NHRP mapping has expired and needs to be refreshed.
D.The NHRP mapping is for a multicast group address.
AnswerB

Correct. The output shows a dynamic mapping with NBMA address 192.168.1.1 and the 'used' flag.

Why this answer

The 'show ip nhrp vrf detail' command displays NHRP cache entries for a specific VRF. The output shows a dynamic NHRP mapping for destination 10.6.6.1/32, with NBMA address 192.168.1.1, learned via Tunnel0. The entry was created 1 minute ago and will expire in 1 hour 59 minutes.

The 'used' flag indicates the mapping is actively being used.

Full explanation →
359
Multi-Selecthard

Which THREE statements about IPv6 Source Guard are true? (Choose THREE.)

Select 3 answers
A.It filters IPv6 traffic based on the source IPv6 address of incoming packets.
B.It relies on the IPv6 snooping binding table, which is populated by DHCPv6 snooping or ND Inspection.
C.It can be configured to allow traffic from specific prefixes using a static prefix list.
D.It filters both incoming and outgoing IPv6 traffic on a port.
E.It requires DHCPv6 snooping to be enabled on the VLAN to function.
AnswersA, B, C

IPv6 Source Guard checks the source address against the binding table and drops packets with invalid source addresses.

Why this answer

IPv6 Source Guard filters incoming IPv6 traffic on a per-port basis by examining the source IPv6 address of packets and comparing it against the IPv6 snooping binding table. If the source address does not match a valid binding, the packet is dropped, preventing spoofing attacks.

Exam trap

Cisco often tests the misconception that IPv6 Source Guard filters both inbound and outbound traffic, when in fact it only filters inbound traffic, and the trap here is assuming DHCPv6 snooping is mandatory when ND Inspection can also supply the binding table.

Full explanation →
360
MCQeasy

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla statistics 10 Round Trip Time (RTT) for Index 10 Latest RTT: 12 ms Latest RTT (milliseconds): 12 Latest RTT (microseconds): 12000 Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Last operation return code: OK Number of successes: 100 Number of failures: 0 Operation time to live: Forever What does this output indicate?

A.The IP SLA operation has failed because the RTT is too low.
B.The IP SLA operation is working correctly with no failures.
C.The IP SLA operation has timed out and needs to be reconfigured.
D.The IP SLA operation is not configured for this index.
AnswerB

The return code 'OK' and zero failures confirm successful operation.

Why this answer

This output shows the operational state of IP SLA operation 10. The 'Latest RTT' of 12 ms, 'return code: OK', and 100 successes with 0 failures indicate the probe is functioning correctly.

Full explanation →
361
MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto isakmp sa detail Codes: C - IKEv1, I - IKEv2 C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap 1 10.1.1.1 10.1.1.2 ACTIVE aes sha psk 14 23:59:59 Based on this output, which statement is correct?

A.The IKEv1 SA is established with the peer 10.1.1.2.
B.The IKEv2 SA is established with the peer 10.1.1.2.
C.The ISAKMP SA is not established; status is MM_NO_STATE.
D.The Diffie-Hellman group is group 2.
AnswerA

The 'C' code indicates IKEv1, and the status is ACTIVE.

Why this answer

The ISAKMP SA is active, using AES encryption, SHA hash, pre-shared key authentication, and Diffie-Hellman group 14. The lifetime is about 24 hours.

Full explanation →
362
MCQhard

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show policy-map control-plane input class CoPP-Class Class-map: CoPP-Class (match-all) 1500 packets, 120000 bytes 5 minute offered rate 10000 bps, drop rate 5000 bps Match: access-group name CoPP-ACL police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 1000 packets, 80000 bytes; actions: transmit exceeded 500 packets, 40000 bytes; actions: drop conformed 8000 bps, exceed 2000 bps, violated 0 bps What does this output indicate?

A.The CoPP policy is dropping all traffic because the CIR is too low.
B.The CoPP policy is causing packet loss for traffic that exceeds the 8 kbps rate, which may impact legitimate control plane traffic.
C.The CoPP policy is not applied correctly because the drop rate is higher than the conform rate.
D.The CoPP policy is working as intended with no issues.
AnswerB

The drop rate of 5 kbps indicates that half the offered traffic is being dropped, which could affect protocols like OSPF or BGP.

Why this answer

The output shows that the CoPP policy uses a CIR of 8000 bps with a conformed rate of 8000 bps and an exceed rate of 2000 bps. The drop rate of 5000 bps indicates that traffic exceeding the CIR is being dropped, which can include legitimate control plane traffic (e.g., routing protocol packets) if they are classified under the CoPP-Class. This confirms that the policy is causing packet loss for traffic that exceeds the 8 kbps rate, potentially impacting critical control plane operations.

Exam trap

Cisco often tests the misinterpretation of CoPP output statistics, where candidates confuse the 'drop rate' with the 'exceed rate' or assume that a high drop rate always indicates a misconfiguration, rather than recognizing that it shows the policer is actively dropping traffic that exceeds the CIR, which may be intentional or problematic depending on the traffic class.

How to eliminate wrong answers

Option A is wrong because the policy is not dropping all traffic; it drops only exceeded traffic (500 packets) while conformed traffic (1000 packets) is transmitted, so the CIR is not too low for all traffic. Option C is wrong because the drop rate (5000 bps) being higher than the conform rate (8000 bps) is not an indication of incorrect application; CoPP uses a single-rate policer where exceeded traffic is dropped, and the drop rate can be lower than the conform rate as seen here. Option D is wrong because the policy is not working as intended; the drop rate of 5000 bps indicates packet loss, which may affect legitimate control plane traffic if the CoPP-ACL matches such traffic.

Full explanation →
363
MCQmedium

Examine the following configuration: logging host 10.1.1.1 logging host 10.1.1.2 logging host 10.1.1.3 logging origin-id hostname logging facility local7 What is the purpose of the 'logging origin-id hostname' command?

A.It causes the syslog messages to include the router's hostname as the origin, overriding the default IP address.
B.It sets the syslog message format to include the hostname in the timestamp field.
C.It configures the router to send syslog messages only when the hostname changes.
D.It is used to authenticate syslog messages using the hostname as a key.
AnswerA

The origin-id hostname replaces the default source IP with the hostname in the syslog message header.

Why this answer

The 'logging origin-id' command sets the origin identifier in syslog messages. When set to 'hostname', the router's hostname is used as the origin ID instead of the default (which is the IP address of the source interface). This helps identify the source of messages in a multi-device environment.

Full explanation →
364
MCQhard

A network engineer is troubleshooting reachability issues in a VRF-lite environment. R1 has the following configuration: ip vrf BLUE rd 100:1 route-target export 100:1 route-target import 100:1. R2 has: ip vrf BLUE rd 100:2 route-target export 100:2 route-target import 100:2. Both routers are connected via a link in the global routing table and are running OSPF in the VRF. R1 shows: 'show ip route vrf BLUE' has a route to 10.1.1.0/24 via OSPF, but R2 shows: 'show ip route vrf BLUE' does not have this route. What is the root cause?

A.The route-target export on R1 (100:1) does not match the route-target import on R2 (100:2), so R2 does not import routes from R1.
B.The OSPF process on R1 is not configured with the 'vrf BLUE' keyword.
C.The link between R1 and R2 is not in the VRF, so OSPF cannot form adjacency.
D.The route 10.1.1.0/24 is being filtered by a distribute-list in OSPF.
AnswerC

Correct. The link between R1 and R2 is not part of VRF BLUE, so OSPF cannot form an adjacency in that VRF, preventing route learning.

Why this answer

In VRF-lite, OSPF adjacency requires the link to be in the VRF context. The configuration shows both routers have OSPF in the VRF, but the connecting link is in the global routing table, not in VRF BLUE. Therefore, OSPF cannot form an adjacency over that link, and routes learned via OSPF within the VRF on R1 are not propagated to R2.

Route-target import/export is used for MP-BGP VPNv4 route distribution, not for OSPF in VRF-lite. The correct fix is to put the link in the VRF (e.g., using 'ip vrf forwarding BLUE' on the interface).

Exam trap

Candidates often confuse VRF-lite with MPLS L3VPN and assume route-target mismatch prevents route exchange, but in VRF-lite, OSPF over a link in the global table cannot form an adjacency within the VRF.

Full explanation →
365
Multi-Selectmedium

Which TWO commands would a network engineer use to verify that EIGRP is correctly forming neighbor adjacencies and exchanging routes on an interface? (Choose TWO.)

Select 2 answers
A.show ip eigrp neighbors
B.show ip eigrp interfaces
C.show ip route eigrp
D.show ip protocols
E.show ip ospf neighbor
AnswersA, B

This command directly lists all EIGRP neighbors, their interfaces, and hold time, confirming adjacency.

Why this answer

The 'show ip eigrp neighbors' command displays the EIGRP neighbor table, which confirms that neighbor adjacencies have been successfully formed. The 'show ip eigrp interfaces' command shows which interfaces are enabled for EIGRP, including the number of peers (neighbors) on each interface, which verifies that the interface is actively participating in EIGRP and exchanging routes.

Exam trap

Cisco often tests the distinction between commands that verify the adjacency formation process (neighbor table and interface status) versus commands that show the result of that process (routing table), leading candidates to incorrectly choose 'show ip route eigrp'.

Full explanation →
366
MCQhard

An engineer configures syslog logging to a remote server using the 'logging host' command. The engineer notices that syslog messages are not being received on the server, but the router can ping the server successfully. The engineer verifies that the logging level is set to debugging and that the server is configured to receive syslog messages. Which is the most likely explanation?

A.An ACL on the router is blocking UDP port 514 outbound
B.The logging host command requires the 'transport tcp' option to work
C.The syslog server is not configured to accept messages from the router's IP
D.The logging level is set to emergencies only
AnswerA

Correct. If an ACL is applied to the interface that blocks UDP 514, syslog messages will not reach the server.

Why this answer

A common edge case is that the syslog messages are sent via UDP port 514, but the router may have a firewall or ACL that blocks UDP traffic. Additionally, the 'logging source-interface' command might be configured, but if the source interface is not reachable from the server (e.g., due to routing issues), the server may drop the messages. Another possibility is that the server is listening on a different port or the router is using a different port due to configuration.

However, a less obvious issue is that the 'logging monitor' or 'logging buffered' commands can interfere if the logging process is overwhelmed, but the most likely is that the syslog messages are being sent but the server's firewall or the router's own ACL is blocking them.

Full explanation →
367
MCQhard

Router R1 is leaking routes from VRF-A to the global table using route-map LEAK. The global table receives the routes, but traffic from the global table to destinations in VRF-A is dropped. R1 configuration: ip vrf VRF-A, rd 100:1, route-target export 100:1, route-target import 100:1. The route-map LEAK is applied to the VRF export. The global table has a default route pointing to null0. What is the root cause?

A.The leaked routes have a next-hop that is only reachable within VRF-A, not in the global routing table, causing traffic to be dropped.
B.The global table default route is overriding the leaked routes.
C.The route-map should be applied to the VRF import instead of export.
D.The VRF must have a route to the global table.
AnswerA

Correct: When leaking, the next-hop must be reachable in the destination table; otherwise, packets are dropped.

Why this answer

When routes are leaked from VRF to global, the global table installs them, but the reverse path (global to VRF) requires proper routing. If the global table has a default route pointing to null0, traffic to the leaked prefixes may match the default and be discarded if the leaked routes are less specific. However, the more specific leaked routes should override the default.

The issue could be that the leaked routes are not being installed due to administrative distance or that the default route is preferred. But the most common cause is that the route-map does not set the next-hop correctly, or the VRF interface is not reachable from the global table. The root cause is that the leaked routes have a next-hop that is not reachable in the global table, often because the next-hop is in the VRF.

Full explanation →
368
MCQeasy

A network engineer runs the following command on Router R9: R9# show ip route 192.168.50.0 Routing entry for 192.168.50.0/24 Known via "ospf 1", distance 110, metric 20 Redistributing via ospf 1 Last update from 10.0.0.1 on GigabitEthernet0/0, 00:00:10 ago Routing Descriptor Blocks: * 10.0.0.1, from 10.0.0.1, 00:00:10 ago, via GigabitEthernet0/0 Route metric is 20, traffic share count is 1 R9 also has an EIGRP route for the same prefix with distance 90 and metric 28160. Which route will be installed?

A.The OSPF route will be installed because it has a lower metric.
B.The EIGRP route will be installed because it has a lower administrative distance.
C.Both routes will be installed for load balancing.
D.Neither route will be installed due to a conflict.
AnswerB

EIGRP's distance of 90 is lower than OSPF's 110, so the EIGRP route is preferred.

Why this answer

EIGRP internal routes have a default administrative distance of 90, which is lower than OSPF's default distance of 110. Therefore, the EIGRP route will be preferred and installed in the routing table.

Full explanation →
369
MCQmedium

A network engineer runs the following command on switch SW2: SW2# show monitor session 2 Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/4 Source VLANs : RX Only : 100 Destination Ports : Gi0/5 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?

A.The session is an RSPAN source session, and the mirrored traffic is sent to Gi0/5.
B.The session is an ERSPAN source session because it monitors VLAN 100.
C.The session is a local SPAN session with source VLAN.
D.The session is misconfigured because source VLANs cannot be combined with source ports.
AnswerA

The type 'Remote Source Session' indicates RSPAN source, and the destination port Gi0/5 receives the mirrored traffic.

Why this answer

This is a remote source session (RSPAN source session). It monitors source port Gi0/4 and source VLAN 100 (RX only), and sends the mirrored traffic to destination port Gi0/5, which is typically configured as a trunk port carrying the RSPAN VLAN. The session is correctly configured for RSPAN.

Full explanation →
370
Multi-Selecthard

Which TWO statements about Policy-Based Routing (PBR) are true? (Choose TWO.)

Select 2 answers
A.PBR is applied on the inbound interface of the router.
B.If a 'set interface' command specifies a down interface, the packet is automatically routed using the routing table.
C.PBR can be used to override the routing table for locally generated packets.
D.The 'set ip default next-hop' command overrides the routing table even when a route exists.
E.PBR uses a route-map to define match criteria and set actions for traffic.
AnswersA, E

PBR is configured with 'ip policy route-map' under the interface, which processes incoming packets.

Why this answer

PBR uses a route-map with match and set commands to override the routing table for selected traffic. The 'set interface' command can specify an outgoing interface, and if that interface is down, the packet is dropped unless a 'set ip next-hop' is also configured as a backup. PBR does not affect the router's own originated traffic by default.

The 'set ip default next-hop' is used only when there is no explicit route in the routing table, not for overriding an existing route. PBR is applied on the inbound interface.

Full explanation →
371
MCQmedium

What is the default behavior of the 'logging buffered' command in Cisco IOS-XE when no severity level is specified?

A.It captures only messages of severity 0 through 4.
B.It captures only messages of severity 0 through 5.
C.It captures only messages of severity 0 through 6.
D.It captures messages of severity 0 through 7.
AnswerD

The default severity for buffered logging is 7, so all messages from emergencies to debugging are logged.

Why this answer

When 'logging buffered' is configured without a severity level, it defaults to severity 7 (debugging), capturing all messages.

Full explanation →
372
MCQhard

A network engineer runs the following command to troubleshoot OSPF route redistribution: R1# show ip ospf database external 5.5.5.5 OSPF Router with ID (1.1.1.1) (Process ID 1) Type-5 AS External Link States LS age: 120 Options: (No TOS-capability, DC, Upward) LS Type: AS External Link Link State ID: 5.5.5.5 (External Network Number) Advertising Router: 3.3.3.3 LS Seq Number: 80000001 Checksum: 0xABCD Length: 36 Network Mask: /32 Metric Type: 2 (Larger than any link state path) TOS: 0 Metric: 20 Forward Address: 0.0.0.0 External Route Tag: 0 What does this output indicate?

A.The prefix 5.5.5.5/32 is a network inside the OSPF domain.
B.The route was redistributed into OSPF by router 3.3.3.3 with a metric of 20.
C.The forward address indicates the next-hop is 5.5.5.5.
D.This is a Type 4 Summary ASBR LSA.
AnswerB

The LSA is Type-5, advertising router is 3.3.3.3, metric type E2 with metric 20.

Why this answer

The output shows an OSPF Type 5 External LSA for prefix 5.5.5.5/32, advertised by router 3.3.3.3 with a metric type E2 and metric 20.

Full explanation →
373
MCQmedium

Examine the following configuration on R6: !--- R6 configuration route-map FILTER deny 10 match tag 50 ! route-map FILTER permit 20 ! router eigrp 200 distribute-list route-map FILTER in ! What is the effect of this configuration?

A.All routes with tag 50 are denied; all other routes are permitted.
B.Routes with tag 50 are permitted; all other routes are denied.
C.The distribute-list is applied only to the first interface; routes with tag 50 are filtered on that interface.
D.The configuration is invalid because route-maps cannot be used with distribute-list in EIGRP.
AnswerA

Correct. Sequence 10 denies routes with tag 50; sequence 20 permits everything else.

Why this answer

The distribute-list route-map FILTER in is applied to EIGRP updates received on all interfaces (since no interface is specified). Sequence 10 denies any route with tag 50. Sequence 20 permits all other routes.

Therefore, routes with tag 50 are filtered out (not installed in the routing table), while all other routes are accepted.

Full explanation →
374
MCQeasy

What is the maximum number of IPv6 over IPv4 tunnels that can be configured on a Cisco IOS router?

A.256
B.1024
C.Platform-dependent, no fixed maximum.
D.64
AnswerC

The number is limited by memory and CPU.

Why this answer

C is correct because the maximum number of IPv6 over IPv4 tunnels on a Cisco IOS router is platform-dependent and limited by available system resources such as CPU and memory, not by a fixed software limit. Cisco IOS does not impose a hard-coded maximum; the actual number depends on the router model, the type of tunnel (e.g., manual, 6to4, ISATAP, GRE), and the configuration complexity.

Exam trap

Cisco often tests the misconception that there is a fixed numerical limit (like 256, 1024, or 64) for IPv6 over IPv4 tunnels, when in fact the correct answer is that the limit is platform-dependent and resource-driven.

How to eliminate wrong answers

Option A is wrong because 256 is not a universal limit; while some older platforms might have had lower practical limits, modern Cisco IOS routers can support far more tunnels. Option B is wrong because 1024 is a common misconception based on a default limit for certain tunnel types (e.g., 6to4) in some IOS versions, but it is not a fixed maximum and can be exceeded with proper resource allocation. Option D is wrong because 64 is too low and does not reflect the scalability of Cisco IOS; it might be confused with the maximum number of tunnels in a specific legacy feature or a different protocol context.

Full explanation →
375
MCQeasy

What is the default BGP hold timer value in Cisco IOS-XE?

A.90 seconds
B.120 seconds
C.180 seconds
D.240 seconds
AnswerC

Correct. BGP hold timer defaults to 180 seconds.

Why this answer

The default BGP hold timer is 180 seconds, as per RFC 4271 and Cisco IOS-XE defaults.

Full explanation →
Page 4

Page 5 of 27

Page 6

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →