Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 376–450

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 27

Page 7
376
MCQhard

An engineer is troubleshooting a DHCPv6 prefix delegation scenario. The router (R1) is a DHCPv6 client on its WAN interface and is supposed to receive a /48 prefix from the ISP's DHCPv6 server to delegate to LAN interfaces. The WAN interface is configured with 'ipv6 address dhcp' and 'ipv6 dhcp client pd ISP-PREFIX'. The LAN interfaces have 'ipv6 address ISP-PREFIX 0:0:0:1::/64 eui-64'. The engineer sees that the WAN interface gets a global IPv6 address, but the LAN interfaces do not get any IPv6 address. What is the most likely cause?

A.The LAN interfaces are missing the 'ipv6 enable' command.
B.The ISP's DHCPv6 server is not configured to delegate a prefix.
C.The 'ipv6 dhcp client pd' command should be 'ipv6 dhcp client pd ISP-PREFIX hint ::/48'.
D.The WAN interface needs the 'ipv6 nd other-config-flag' command.
AnswerB

Correct because if the server does not delegate a prefix, the client's 'ipv6 dhcp client pd' request will fail, and the LAN interfaces will not receive any addresses from the delegated prefix.

Why this answer

The WAN interface successfully obtains a global IPv6 address via DHCPv6, but the LAN interfaces lack IPv6 addresses because the DHCPv6 client process on R1 has not received a delegated prefix. The 'ipv6 dhcp client pd ISP-PREFIX' command requests a prefix delegation from the ISP's DHCPv6 server; if the server is not configured to delegate prefixes (e.g., missing the 'prefix-delegation' pool or 'ipv6 dhcp server' with prefix assignment), the client never receives a prefix to assign to LAN interfaces. This is the most likely cause given the symptom.

Exam trap

Cisco often tests the distinction between DHCPv6 address assignment (IA_NA) and prefix delegation (IA_PD), trapping candidates who assume that obtaining a WAN address automatically implies a delegated prefix is also received.

How to eliminate wrong answers

Option A is wrong because 'ipv6 enable' is not required on LAN interfaces when they already have an explicit 'ipv6 address' command; the address configuration implicitly enables IPv6. Option C is wrong because the 'hint' keyword is optional and not required for prefix delegation to work; the client can request a prefix without a hint, and the server may still delegate one. Option D is wrong because 'ipv6 nd other-config-flag' is used to tell hosts to obtain other configuration (e.g., DNS) via DHCPv6, not to enable prefix delegation on the client or server side.

Full explanation →
377
MCQhard

A network engineer is troubleshooting a route filtering problem with prefix-lists. Router R6 is using a prefix-list to filter routes from a BGP neighbor. The prefix-list is configured to permit only 192.168.0.0/16 and 192.168.1.0/24, but routes with prefix 192.168.2.0/24 are also being accepted. The engineer checks the prefix-list configuration and sees only two permit statements. What is the most likely cause?

A.The prefix-list is not applied to the BGP neighbor; the neighbor is using a different filter or no filter.
B.The prefix-list has an implicit permit at the end for all routes.
C.The prefix-list is using 'ge 24' which permits any prefix with a mask >= 24, including 192.168.2.0/24.
D.The BGP neighbor is configured with 'soft-reconfiguration inbound' which overrides prefix-list filtering.
AnswerA

Correct because if the prefix-list is not applied, no filtering occurs.

Why this answer

Prefix-lists have an implicit deny at the end, but if the prefix-list is not applied correctly (e.g., to the neighbor inbound direction), or if the prefix-list has a 'ge' or 'le' operator that is too broad, it could permit more than intended. However, the most common issue is that the prefix-list is not applied at all, or the neighbor is using a different filter.

Full explanation →
378
MCQhard

A network engineer runs the following command on Router R1: R1# show access-lists 100 Extended IP access list 100 10 permit icmp any any echo 20 permit icmp any any echo-reply 30 permit icmp any any time-exceeded 40 permit icmp any any unreachable R1# show policy-map control-plane Control Plane Service-policy input: CoPP-IN Class-map: CoPP-ICMP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, what is the most likely problem?

A.The class-map uses 'match-all' instead of 'match-any'.
B.The access-list does not include all ICMP types that may be sent to the control plane.
C.The police rate is too low and is dropping all packets.
D.The policy-map is applied to the wrong direction.
AnswerB

The access-list only matches specific ICMP types, potentially missing others like router advertisement or parameter problem.

Why this answer

The access list 100 only permits four specific ICMP types (echo, echo-reply, time-exceeded, unreachable), but the control plane may receive many other ICMP types (e.g., parameter problem, redirect, timestamp, address mask request) that are not explicitly permitted. Since the class-map CoPP-ICMP matches all traffic that hits access-group 100, any ICMP packet with a type not listed will not match the class and will be handled by the default control-plane policy, which typically drops or polices such traffic, leading to legitimate ICMP packets being dropped.

Exam trap

Cisco often tests the misconception that a permit ACL in a CoPP class-map automatically allows all ICMP traffic, when in fact only the explicitly listed ICMP types are permitted, and any unlisted types are implicitly denied by the class-map and handled by the default policy.

How to eliminate wrong answers

Option A is wrong because 'match-all' requires all match conditions to be true, but here there is only one match condition (access-group 100), so 'match-all' vs 'match-any' makes no difference; the class-map will still match traffic permitted by the ACL. Option C is wrong because the police rate of 8000 bps is low but not zero, and the counters show 0 packets dropped (conformed, exceeded, violated all show 0 packets), indicating the policer is not actively dropping traffic; the problem is not rate-based. Option D is wrong because the policy-map is applied to the control-plane input direction, which is the correct direction for filtering traffic destined to the router's control plane; applying it output would be incorrect for CoPP.

Full explanation →
379
MCQmedium

Which authentication type is the default when BFD authentication is enabled on Cisco IOS-XE?

A.Simple password (auth type 1)
B.Keyed MD5 (auth type 2)
C.Meticulous Keyed MD5 (auth type 3)
D.Keyed SHA-1 (auth type 4)
AnswerD

Cisco IOS-XE defaults to keyed SHA-1 (auth type 4) when BFD authentication is enabled.

Why this answer

Cisco IOS-XE defaults to keyed SHA-1 (auth type 4) when BFD authentication is configured, as it provides stronger security than MD5.

Full explanation →
380
MCQhard

A network engineer runs the following command on Router R3: R3# show logging | include %OSPF-5-ADJCHG *Mar 1 00:05:10.123: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done *Mar 1 00:06:20.456: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired *Mar 1 00:07:30.789: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from DOWN to INIT, Received Hello *Mar 1 00:08:40.012: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from INIT to EXSTART, Event: start *Mar 1 00:09:50.345: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXSTART to EXCHANGE, Event: Negotiation Done *Mar 1 00:10:00.678: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXCHANGE to LOADING, Event: Exchange Done *Mar 1 00:11:10.901: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done *Mar 1 00:12:20.234: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired Based on this output, what is the most likely problem?

A.The OSPF process is misconfigured with mismatched area IDs.
B.There is a Layer 1 or Layer 2 issue causing intermittent connectivity on GigabitEthernet0/0.
C.The OSPF dead timer is set too high, causing slow convergence.
D.The router is running out of memory, causing OSPF process restarts.
AnswerB

The dead timer expiration indicates that hello packets are not received in time, which is often due to flapping interfaces or high error rates.

Why this answer

The output shows repeated OSPF adjacency changes between R3 and neighbor 10.0.0.1, with the neighbor going from FULL to DOWN due to dead timer expiration, then re-establishing. This pattern indicates an unstable OSPF neighbor relationship, likely due to a flapping interface, mismatched timers, or Layer 1 issues. The dead timer expiration suggests that hello packets are not being received consistently.

Full explanation →
381
MCQmedium

Consider the following configuration on R5: !--- R5 configuration ip prefix-list PL-2 seq 5 permit 10.0.0.0/8 ge 16 le 24 ! route-map RMAP permit 10 match ip address prefix-list PL-2 set community 100:100 ! router bgp 65200 neighbor 192.168.1.2 route-map RMAP out ! What is the effect of this configuration?

A.Only routes with prefix 10.0.0.0/8 and mask length between 16 and 24 are sent to neighbor with community 100:100.
B.All routes with prefix 10.0.0.0/8 are sent to neighbor; routes with mask length between 16 and 24 get community 100:100.
C.Routes that match the prefix-list are sent with community 100:100; all other routes are sent without any community.
D.The configuration is invalid because the prefix-list uses ge and le together; only one can be used.
AnswerA

Correct. The prefix-list permits 10.0.0.0/8 ge 16 le 24; matching routes get community set and are advertised.

Why this answer

The prefix-list PL-2 permits prefixes that match 10.0.0.0/8 with a mask length greater than or equal to 16 and less than or equal to 24. So, for example, 10.1.0.0/16, 10.1.1.0/24 are permitted, but 10.0.0.0/8 itself (mask 8) is not. The route-map RMAP sets community 100:100 on matching routes.

Routes that do not match the prefix-list are not processed by this route-map (since there is only one sequence), so they are denied (not sent to neighbor).

Full explanation →
382
MCQmedium

Router R3 has the following configuration: ``` interface GigabitEthernet0/4 ip address 10.3.3.3 255.255.255.0 ip policy route-map PBR-IN ! route-map PBR-IN permit 10 match ip address 102 set ip next-hop verify-availability 192.168.2.1 10 track 1 ! access-list 102 permit ip 10.3.3.0 0.0.0.255 any ``` What is the effect of the 'set ip next-hop verify-availability' command?

A.The next-hop 192.168.2.1 is used only if track object 1 is up; otherwise, normal routing applies.
B.The next-hop 192.168.2.1 is always used regardless of track status.
C.The router pings 192.168.2.1 every 10 seconds to verify reachability.
D.The configuration is invalid because 'verify-availability' requires a sequence number.
AnswerA

verify-availability checks the track object; if down, PBR does not use that next-hop and falls back to routing table.

Why this answer

This command enables Cisco Express Forwarding (CEF) and uses tracking to verify next-hop reachability. If the tracked object (track 1) is down, the next-hop is not used.

Full explanation →
383
MCQmedium

According to RFC 2460, what is the correct behavior when an IPv6 router receives a packet with a source address that is a multicast address?

A.The router forwards the packet normally.
B.The router drops the packet silently.
C.The router sends an ICMPv6 error message back to the source.
D.The router rewrites the source address to the link-local address of the interface.
AnswerB

Per RFC 2460, a packet with a multicast source address is invalid and must be discarded.

Why this answer

RFC 2460 specifies that an IPv6 router must silently drop any packet with a multicast source address, as multicast addresses are only valid as destination addresses. This behavior prevents loops and misuse of multicast addressing in the network layer.

Exam trap

The trap here is that candidates often confuse multicast source address rules with broadcast or unicast reverse path forwarding (uRPF) checks, assuming an ICMP error is sent or that the packet is forwarded normally.

How to eliminate wrong answers

Option A is wrong because forwarding a packet with a multicast source address would violate RFC 2460 and could cause routing loops or forwarding anomalies. Option C is wrong because the router does not send an ICMPv6 error message; the packet is dropped silently to avoid generating additional traffic from an invalid source. Option D is wrong because rewriting the source address to a link-local address is not defined in any RFC and would break the integrity of the packet's source information.

Full explanation →
384
MCQeasy

When redistributing routes from EIGRP into OSPF, what is the default OSPF metric assigned to redistributed routes if no metric is specified?

A.20
B.1
C.10
D.0
AnswerA

The default metric for redistributed routes into OSPF is 20.

Why this answer

Cisco IOS assigns a default metric of 20 to redistributed routes from other protocols into OSPF if no metric is explicitly configured. This is defined in Cisco's implementation.

Full explanation →
385
MCQhard

A network engineer runs the following command on Router R1: R1# show ip eigrp neighbors detail EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.1.2 Gi0/0 13 00:12:34 12 200 0 45 Version 12.0/2.0, Retrans: 0, Retries: 0, Restarts: 0 Topology ids from peer: 0 Passive interface: No Hello interval: 5 Hold time: 15 Based on this output, what is the problem?

A.The neighbor is operating normally with no issues.
B.The interface is configured as passive, preventing neighbor formation.
C.The neighbor has a high number of retransmissions.
D.The hold time of 15 seconds is too short and may cause flapping.
AnswerA

All parameters are within normal range, and the neighbor is fully established.

Why this answer

The output shows a fully established EIGRP neighbor adjacency with no errors. The 'Passive interface: No' confirms the interface is not configured as passive, the retransmission count is 0, and the hold time of 15 seconds is the default for a 5-second hello interval on high-speed interfaces. All metrics (SRTT, RTO, Q count, Seq Num) indicate stable operation, so there is no problem.

Exam trap

Cisco often tests the misconception that a hold time of 15 seconds is too short, but in EIGRP this is the default for high-speed interfaces and is perfectly normal; candidates may confuse it with OSPF's shorter dead intervals or misinterpret the 'Passive interface' field if they do not read the 'No' value.

How to eliminate wrong answers

Option B is wrong because the output explicitly states 'Passive interface: No', meaning the interface is not passive and neighbor formation is not blocked. Option C is wrong because the 'Retrans: 0' field shows zero retransmissions, indicating no retransmission issues. Option D is wrong because a hold time of 15 seconds is the default for EIGRP on high-speed interfaces (with a 5-second hello interval) and is not too short; it is standard and does not cause flapping.

Full explanation →
386
MCQhard

Two routers are configured with EIGRP using `network 0.0.0.0 0.0.0.0` to enable EIGRP on all interfaces. One router has a loopback interface with IP 10.1.1.1/32. The other router learns 10.1.1.1/32 via EIGRP. An engineer then configures `distribute-list prefix FILTER out` under the EIGRP process on the first router, where FILTER denies 10.1.1.1/32. Unexpectedly, the second router still receives the route. Which is the most likely explanation?

A.The distribute-list out does not filter routes that are directly connected and enabled via the `network` command; it only filters redistributed routes.
B.The distribute-list must be applied inbound on the second router to block the route.
C.The prefix-list FILTER is misconfigured; it should deny 10.1.1.1/32 with a ge/le condition.
D.The distribute-list command is not supported in classic mode; it must be used in named mode.
AnswerA

EIGRP distribute-list out filters only routes from redistribution; connected routes advertised via network statement are not affected.

Why this answer

In EIGRP, distribute-lists applied under the router process (classic mode) affect only routes that are redistributed or injected via `network` commands. However, if the route is directly connected and the interface is enabled for EIGRP via the `network` command, the distribute-list out does not filter connected routes advertised by the network statement. To filter such routes, the distribute-list must be applied under the interface configuration or use a prefix-list that matches the interface.

Full explanation →
387
MCQmedium

Examine the RSPAN configuration: vlan 100 name RSPAN_VLAN remote-span ! monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination remote vlan 100 What is the purpose of the 'remote-span' command under VLAN 100?

A.It allows VLAN 100 to be used for RSPAN traffic across multiple switches.
B.It enables spanning tree on VLAN 100.
C.It prevents VLAN 100 from being used for user data traffic.
D.It configures VLAN 100 as a native VLAN.
AnswerA

Correct. The 'remote-span' command marks VLAN 100 as an RSPAN VLAN, enabling it to carry mirrored traffic across switches in the network.

Why this answer

The 'remote-span' command designates VLAN 100 as an RSPAN VLAN, allowing it to carry mirrored traffic across switches. This is its primary purpose. While it also prevents user data traffic, that is a secondary effect, not the main purpose.

Full explanation →
388
MCQmedium

Which BGP loop prevention mechanism relies on the AS_PATH attribute?

A.Split horizon
B.AS_PATH loop detection
C.TTL expiration
D.Route poisoning
AnswerB

Correct. BGP discards routes with its own AS in the AS_PATH.

Why this answer

BGP uses AS_PATH loop detection: a router rejects a route if its own AS number appears in the AS_PATH.

Full explanation →
389
Multi-Selecthard

An engineer is configuring a DMVPN Phase 3 network with EIGRP as the routing protocol. The hub router has the following configuration snippet: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 ip nhrp redirect tunnel source GigabitEthernet0/1 tunnel mode gre multipoint ! router eigrp 100 network 10.0.0.0 0.0.0.255 Which TWO additional configuration changes are required on the hub to ensure that spokes can establish direct spoke-to-spoke tunnels? (Choose TWO.)

Select 2 answers
A.Add the command 'ip nhrp shortcut' under interface Tunnel0.
B.Add the command 'ip nhrp nhs 10.0.0.1' under interface Tunnel0.
C.Add the command 'ip nhrp map multicast dynamic' under interface Tunnel0.
D.Add the command 'no ip split-horizon eigrp 100' under interface Tunnel0.
E.Add the command 'ip nhrp authentication cisco123' under interface Tunnel0.
AnswersC, D

Correct. This command allows the hub to dynamically learn the NBMA addresses of spokes for multicast forwarding, which is required for routing protocol updates.

Why this answer

In DMVPN Phase 3, the hub must have 'ip nhrp redirect' to send redirect messages, and spokes need 'ip nhrp shortcut' to install the /32 route. However, the question asks about the hub. The hub already has 'ip nhrp redirect'.

To allow spokes to learn the hub's NBMA address, the hub needs 'ip nhrp map multicast dynamic' to accept dynamic registrations. Also, the hub must have a valid tunnel source IP and the tunnel interface must be up. The hub does not need 'ip nhrp shortcut' (that's for spokes).

The hub does not need 'ip nhrp nhs' (that's for spokes). The hub does not need 'no ip split-horizon' for EIGRP if using Phase 3 with BGP or if the hub is configured correctly; but in Phase 3, EIGRP split horizon can prevent spoke routes from being advertised to other spokes. Actually, to allow spokes to learn routes from other spokes, the hub must disable EIGRP split horizon on the tunnel interface.

So the two correct changes are: add 'ip nhrp map multicast dynamic' and 'no ip split-horizon eigrp 100'.

Full explanation →
390
MCQhard

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

A.Verify that the RSPAN VLAN is configured with the 'remote-span' command on both switches.
B.Check that the destination port is not in a shutdown state.
C.Ensure that the source interface is not configured with 'no monitor session'.
D.Confirm that the trunk between switches is configured as a dot1q trunk.
AnswerA

Correct because the 'remote-span' command is essential to designate the VLAN as an RSPAN VLAN; without it, the VLAN behaves as a normal VLAN.

Why this answer

RSPAN requires that the RSPAN VLAN be configured with the 'remote-span' command on all switches that participate. Without this, the VLAN may not be treated as an RSPAN VLAN and traffic may not be forwarded correctly.

Full explanation →
391
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla statistics 6 Round Trip Time (RTT) for Index 6 Latest RTT: 0 ms Latest RTT (milliseconds): 0 Latest RTT (microseconds): 0 Number of successes: 0 Number of failures: 100 Operation time to live: Forever Output: No connection R1# show track 4 Track 4 IP SLA 6 reachability Reachability is Down 3 changes, last change 00:05:00 Latest operation return code: No connection Latest RTT (milliseconds): 0 Tracked by: ip route 0.0.0.0 0.0.0.0 192.168.4.1 track 4 R1# show ip route 0.0.0.0 0.0.0.0 % Network not in table Based on this output, which statement is correct?

A.The static route is still present because the track is down.
B.The IP SLA operation is successful, but the track is misconfigured.
C.The target 192.168.4.1 is unreachable, causing the IP SLA to fail and the static route to be removed.
D.The IP SLA operation has a threshold violation, but the route is still active.
AnswerC

The 'No connection' indicates unreachability, and the track down removes the static route.

Why this answer

The track is down due to 'No connection', and the static route is not in the routing table. This indicates that the IP SLA probe cannot reach the target, and the tracked route has been removed.

Full explanation →
392
MCQhard

A network engineer runs the following command to debug NAT with overload: R1# debug ip nat overload NAT: overload: s=10.1.1.1:1234->203.0.113.1:5678, d=192.168.1.1:80 [50] NAT: overload: s=10.1.1.1:1235->203.0.113.1:5679, d=192.168.1.1:80 [51] NAT: overload: s=10.1.1.2:80->203.0.113.1:5680, d=192.168.1.1:1024 [52] What does this output indicate?

A.PAT is working correctly, translating multiple inside hosts to one outside IP.
B.NAT is failing because the outside address is the same for all.
C.The translations are static.
D.The inside hosts are using the same port numbers.
AnswerA

Each inside host gets a unique source port on the outside IP.

Why this answer

The debug output shows PAT (Port Address Translation) functioning correctly: three distinct inside local addresses (10.1.1.1:1234, 10.1.1.1:1235, 10.1.1.2:80) are being translated to the same outside global address (203.0.113.1) but with unique port numbers (5678, 5679, 5680). This is the essence of NAT with overload, where multiple inside hosts share a single public IP by multiplexing on Layer 4 ports.

Exam trap

Cisco often tests the misconception that NAT with overload is 'failing' when multiple inside hosts share the same outside IP, leading candidates to incorrectly select Option B, when in fact this is the intended behavior of PAT.

How to eliminate wrong answers

Option B is wrong because the output shows successful translations, not failures; NAT with overload deliberately uses the same outside address for all translations, and the debug confirms each translation is completed. Option C is wrong because static NAT would show a fixed one-to-one mapping without port translation, whereas this output shows dynamic port allocation (e.g., 10.1.1.1:1234→203.0.113.1:5678). Option D is wrong because the inside hosts are using different port numbers (1234, 1235, 80) and the translated ports are also unique (5678, 5679, 5680); the debug does not show any port conflict.

Full explanation →
393
MCQhard

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, the router becomes unreachable via SSH and SNMP. The engineer checks the policy and confirms that the class-map for SSH and SNMP traffic is set to 'permit'. What is the most likely explanation?

A.The class-default is set to 'drop', causing all unmatched traffic to be dropped, including SSH and SNMP if they are not correctly classified.
B.The 'rate-limit' is configured in bps instead of pps, causing excessive policing.
C.The 'service-policy' is applied to the control-plane input direction, but SSH and SNMP are output traffic.
D.The class-map for SSH and SNMP uses a 'match-all' condition, but the access-list has multiple entries that are ORed.
AnswerA

In CoPP, the class-default is the default class for all traffic not matched by other classes. If it is set to drop, any traffic that does not match the explicit classes will be dropped. If SSH or SNMP traffic is not correctly matched by the class-map (e.g., due to a typo in the access-list), it will fall into class-default and be dropped.

Why this answer

A common edge case with CoPP is that the default class class-default is often set to 'drop' or 'police' with a very low rate, which can drop all traffic not explicitly matched by other classes. Even if SSH and SNMP are permitted, if the class-default is set to drop, any traffic that does not match the explicit classes (e.g., due to a misclassification) will be dropped. Additionally, the order of class-maps matters; if a broader class matches before the specific one, the traffic may be policed incorrectly.

Full explanation →
394
Multi-Selecthard

Which THREE symptoms indicate that IPv6 unicast RPF is misconfigured or failing on an interface? (Choose THREE.)

Select 3 answers
A.Traffic from a valid source IP is being dropped on the interface.
B.The router logs 'IPv6 unicast RPF drop' messages.
C.The command 'ipv6 verify unicast source reachable-via any' is present in the running config.
D.High CPU utilization is observed due to RPF processing.
E.The 'show ipv6 interface' output shows an increasing 'RPF drops' counter.
AnswersA, B, E

uRPF drops packets when the source IP is not reachable via the incoming interface, even if the IP is valid.

Why this answer

IPv6 unicast RPF (uRPF) drops traffic when the source address is not reachable via the incoming interface according to the FIB. If a valid source IP is being dropped, it indicates that the RPF check is failing, often due to asymmetric routing or a missing route in the FIB for that source prefix.

Exam trap

Cisco often tests the distinction between strict and loose mode RPF, and the trap here is that candidates may incorrectly assume that the presence of the 'ipv6 verify unicast source reachable-via any' command itself is a symptom of misconfiguration, when in fact it is a legitimate configuration for loose mode.

Full explanation →
395
Drag & Dropmedium

Drag and drop the steps to verify and validate Device Management operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking the management interface status, then confirm the management protocol is operational, verify the device is reachable, validate data model support, and finally perform a test retrieval of configuration data.

Full explanation →
396
MCQmedium

A network engineer runs the following command on Router R1: R1# show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete N: NATed, L: Local, X: No Socket # Entries: 2 Interface: Tunnel0, IPv4 NHRP Details Type: Hub, NHRP Peers: 2, # Ent Peer NBMA Addr Peer Tunnel Addr State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 192.168.1.2 10.0.0.2 UP 00:15:30 D 2 192.168.2.2 10.0.0.3 UP 00:14:20 D Based on this output, which statement is correct?

A.The DMVPN tunnel is not functioning because there are only two peers.
B.Both spoke routers have established dynamic NHRP registrations with the hub.
C.The hub router has static NHRP entries for the spokes.
D.The spokes are not able to communicate with each other.
AnswerB

The state is UP and attribute is D (dynamic).

Why this answer

The output shows two dynamic (D) NHRP entries for peers 10.0.0.2 and 10.0.0.3, each with an NBMA address of 192.168.1.2 and 192.168.2.2 respectively. The 'D' attribute indicates these registrations were established dynamically via NHRP registration requests from the spoke routers to the hub, confirming that both spokes have successfully registered with the hub. This is the expected behavior for a DMVPN Phase 2 or Phase 3 hub, where spokes dynamically register their tunnel and NBMA addresses.

Exam trap

Cisco often tests the distinction between the NHRP 'Attrb' column attributes (S, D, I, N, L, X) to trick candidates into misinterpreting dynamic registrations as static or assuming that a hub output showing only hub-spoke entries implies a lack of spoke-to-spoke connectivity.

How to eliminate wrong answers

Option A is wrong because having two peers is normal for a DMVPN hub with two spokes; the number of peers does not indicate a malfunction. Option C is wrong because the 'D' attribute in the Attrb column explicitly indicates dynamic NHRP entries, not static (S). Option D is wrong because the output only shows hub-to-spoke relationships; spoke-to-spoke communication is possible in DMVPN Phase 2/3 via dynamic NHRP resolution and does not require direct hub involvement for data traffic, so the absence of spoke-to-spoke entries in this hub output does not imply they cannot communicate.

Full explanation →
397
MCQmedium

A network engineer runs the following command on Router R1: R1# show event manager history events Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog OSPF_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Up 3 00:01:32 UTC Mar 1 syslog OSPF_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Up Based on this output, which statement is correct?

A.The OSPF neighbor is stable.
B.The OSPF neighbor is flapping.
C.The EEM policy is not configured.
D.The OSPF neighbor is down permanently.
AnswerB

The rapid succession of down and up events is characteristic of flapping.

Why this answer

The event history shows alternating OSPF neighbor down and up events within seconds, indicating a flapping condition. The correct answer is that the OSPF neighbor is flapping.

Full explanation →
398
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 ospf neighbor Neighbor ID Pri State Dead Time Address Interface 192.168.1.2 1 FULL/DR 00:00:32 FE80::2 Tunnel0 192.168.1.3 1 FULL/BDR 00:00:35 FE80::3 Tunnel0 Based on this output, which statement is correct?

A.OSPFv3 is not running on this router.
B.The router with Neighbor ID 192.168.1.3 is the Designated Router.
C.OSPFv3 adjacencies are fully established over the tunnel.
D.The tunnel is using IPv4 transport.
AnswerC

Both neighbors are in FULL state.

Why this answer

The output shows two OSPFv3 neighbors in the FULL state, which indicates that the adjacency process has completed successfully and the routers are exchanging link-state advertisements. The presence of the FULL state for both neighbors confirms that OSPFv3 adjacencies are fully established over the Tunnel0 interface, making option C correct.

Exam trap

Cisco often tests the distinction between OSPFv2 and OSPFv3, and the trap here is that candidates may assume the presence of IPv4-like neighbor IDs (192.168.1.x) implies IPv4 transport, but OSPFv3 uses a 32-bit Router ID (often derived from an IPv4 address) regardless of the underlying IPv6 transport.

How to eliminate wrong answers

Option A is wrong because the 'show ipv6 ospf neighbor' command itself proves that OSPFv3 is running on this router; if it were not, the command would return no output or an error. Option B is wrong because the neighbor with Neighbor ID 192.168.1.3 is listed as BDR (Backup Designated Router), not DR; the DR is 192.168.1.2, as indicated by the 'FULL/DR' state. Option D is wrong because the output shows IPv6 link-local addresses (FE80::2 and FE80::3) and the command is specific to IPv6 OSPF (OSPFv3), which operates natively over IPv6; the tunnel could be using IPv6 transport, and there is no evidence of IPv4 transport in this output.

Full explanation →
399
MCQmedium

Consider this EIGRP configuration on router R5: interface GigabitEthernet0/0 ip summary-address eigrp 100 10.10.0.0 255.255.0.0 5 router eigrp 100 network 10.0.0.0 What is the effect of the 'ip summary-address eigrp' command on interface GigabitEthernet0/0?

A.It creates a summary route 10.10.0.0/16 with administrative distance 5, advertised only out GigabitEthernet0/0.
B.It creates a summary route 10.10.0.0/16 with metric 5, advertised out all interfaces.
C.It creates a summary route 10.10.0.0/16 and suppresses all more specific routes globally.
D.It creates a summary route 10.10.0.0/16 and redistributes it into other routing protocols.
AnswerA

Correct. The command is interface-specific and the distance value is optional.

Why this answer

The interface-level 'ip summary-address eigrp' command creates a summary route that is advertised out that specific interface. The optional administrative distance (5) sets the distance for the summary route.

Full explanation →
400
MCQhard

A network engineer runs the following command on Router R1: R1# show ip route 10.0.0.0 255.255.252.0 longer-prefixes Routing entry for 10.0.0.0/22 Known via "eigrp 100", distance 90, metric 2172416, type internal Last update from 192.168.1.2 on GigabitEthernet0/0, 00:00:10 ago Routing Descriptor Blocks: * 192.168.1.2, from 192.168.1.2, 00:00:10 ago, via GigabitEthernet0/0 Route metric is 2172416, traffic share count is 1 Routing entry for 10.0.1.0/24 Known via "eigrp 100", distance 90, metric 2812416, type internal Last update from 192.168.1.2 on GigabitEthernet0/0, 00:00:10 ago Routing Descriptor Blocks: * 192.168.1.2, from 192.168.1.2, 00:00:10 ago, via GigabitEthernet0/0 Route metric is 2812416, traffic share count is 1 Based on this output, what is the effect of the summary route 10.0.0.0/22?

A.The summary route is working correctly and suppressing all specifics.
B.The summary route is not suppressing the more specific route 10.0.1.0/24.
C.The summary route has a better metric than the specific route.
D.The summary route is not installed in the routing table.
AnswerB

Both the summary and a more specific route are in the table, indicating the summary is not suppressing specifics.

Why this answer

The presence of both the summary route (10.0.0.0/22) and a more specific route (10.0.1.0/24) in the routing table indicates that the summary route is not suppressing the more specific routes, possibly due to a configuration issue or because the summary is not configured as a discard route.

Full explanation →
401
MCQmedium

Examine the following partial configuration on R1: !--- R1 configuration route-map RMAP permit 10 match ip address prefix-list PL-1 set metric 100 ! route-map RMAP permit 20 set metric 200 ! router eigrp 100 network 10.0.0.0 redistribute ospf 1 metric 1000 100 255 1 1500 route-map RMAP ! What is the effect of this configuration?

A.Only routes matching prefix-list PL-1 are redistributed into EIGRP with metric 100; all other OSPF routes are denied.
B.Routes matching prefix-list PL-1 are redistributed with metric 100; all other OSPF routes are redistributed with metric 200.
C.The route-map is missing a deny statement; without it, all routes are permitted with default metric.
D.The route-map is applied to redistribution, but the metric values are ignored because redistribute command also specifies metric.
AnswerB

Correct. Sequence 10 matches PL-1 and sets metric 100; sequence 20 matches all other routes and sets metric 200.

Why this answer

The route-map RMAP has two permit sequences. The first matches prefix-list PL-1 and sets metric to 100. The second is a catch-all permit with no match, setting metric to 200.

All redistributed OSPF routes will match either sequence and have their metric set accordingly. If a route matches the first sequence, its metric is set to 100; otherwise, it matches the second and gets metric 200. There is no deny sequence, so no routes are filtered.

Full explanation →
402
MCQmedium

Examine the following EEM applet configuration: !--- event manager applet RELOAD_NOTIFY event syslog pattern "%SYS-5-RELOAD" action 1.0 cli command "enable" action 2.0 cli command "send log "Router is reloading"" !--- What is the effect of this configuration?

A.The applet will send a log message to the console when a reload is initiated.
B.The applet will fail because 'send log' is not a valid IOS command.
C.The applet will prevent the reload from occurring.
D.The applet will generate a syslog message with the text "Router is reloading".
AnswerB

Correct. 'send log' is not a valid command; the correct command would be 'logger' or 'send' with appropriate parameters.

Why this answer

The applet triggers on a syslog message indicating a reload. It then executes a 'send log' command, which is not a valid IOS command. The correct command is 'send log' is not valid; the intended command might be 'send' or 'logger'.

This will cause the action to fail, and the applet will not execute successfully.

Full explanation →
403
Multi-Selectmedium

Which TWO statements about IP SLA ICMP echo operations are true? (Choose TWO.)

Select 2 answers
A.It measures round-trip time (RTT) between the source and destination.
B.It measures jitter in the network path.
C.The operation must be scheduled using the 'ip sla schedule' command.
D.The destination can be specified as a hostname without any additional configuration.
E.The operation runs continuously by default after configuration.
AnswersA, C

The ICMP echo operation sends ICMP packets and calculates the RTT based on the reply.

Why this answer

IP SLA ICMP echo measures round-trip time (RTT) by sending ICMP echo requests and waiting for replies. It does not measure jitter (that requires UDP jitter operations). It can be configured with a frequency and a timeout, and the operation must be started with the 'ip sla schedule' command.

The source IP can be specified, but the destination must be an IP address, not a hostname unless DNS resolution is configured.

Full explanation →
404
MCQmedium

Which statement about RSPAN VLAN is correct?

A.The RSPAN VLAN must be the same as the native VLAN on the trunk.
B.The RSPAN VLAN can be used for normal user traffic if needed.
C.The RSPAN VLAN must be configured with the 'remote-span' command on all switches in the network.
D.The RSPAN VLAN must be pruned from all trunk links to avoid unnecessary flooding.
AnswerC

The 'remote-span' command is required on the VLAN to prevent it from being used for normal traffic and to allow it to be flooded across the network.

Why this answer

An RSPAN VLAN is a dedicated VLAN used to carry mirrored traffic from source switches to a destination switch. It must be configured as a remote-span VLAN, and no end devices should be connected to it.

Full explanation →
405
MCQhard

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up and traffic is flowing, but the engineer notices that the 'show crypto ipsec sa' output shows the 'pkts encaps failed' counter incrementing slowly over time. The tunnel remains up. What is the most likely cause?

A.There is a floating static route that points to the physical interface instead of the tunnel for some subnets.
B.The crypto map is applied to the tunnel interface instead of the physical interface.
C.The IPsec SA lifetime is set too high.
D.The access list in the crypto map is too restrictive and missing some subnets.
AnswerA

Correct because if a floating static route (with a higher administrative distance) becomes active for some traffic, those packets will be sent out the physical interface without encryption, causing encapsulation failures.

Why this answer

A slow but steady increase in 'pkts encaps failed' indicates that some packets that should be encrypted are not being encrypted. This is often caused by a routing issue where some traffic to the remote LAN is being routed out an interface that does not have the crypto map, bypassing encryption.

Full explanation →
406
MCQmedium

snmp-server community public RO\nsnmp-server community private RW\nsnmp-server location DataCenter\nsnmp-server contact admin@example.com What is the effect of this configuration?

A.SNMPv3 is enabled with authentication.
B.SNMPv2c is enabled with read-only community 'public' and read-write community 'private'.
C.Only read-only access is allowed using the 'private' community.
D.SNMP traps are enabled to the location DataCenter.
AnswerB

The 'snmp-server community' commands define SNMPv2c community strings with specified access levels.

Why this answer

The configuration uses SNMPv2c community strings 'public' (read-only) and 'private' (read-write), which are plain-text authentication mechanisms. SNMPv2c is enabled by default when community strings are configured, and the 'RO' and 'RW' keywords explicitly define the access levels. This matches option B exactly.

Exam trap

Cisco often tests the distinction between SNMP versions by hiding the version keyword; candidates assume SNMPv3 is in use when they see 'community', but community strings are exclusive to SNMPv1/v2c.

How to eliminate wrong answers

Option A is wrong because SNMPv3 requires 'snmp-server group' and 'snmp-server user' commands with authentication/hash parameters, not community strings. Option C is wrong because the 'private' community is configured with RW (read-write) access, not read-only. Option D is wrong because 'snmp-server location' sets the sysLocation MIB object, not trap destinations; traps require 'snmp-server host' and 'snmp-server enable traps' commands.

Full explanation →
407
MCQmedium

Examine this BGP configuration on router R3: router bgp 65001 neighbor 10.1.1.1 remote-as 65002 address-family ipv4 network 192.168.0.0 mask 255.255.252.0 aggregate-address 192.168.0.0 255.255.252.0 summary-only What is the effect of the 'aggregate-address' command with the 'summary-only' keyword?

A.It advertises the aggregate 192.168.0.0/22 and suppresses all more specific routes from being advertised to neighbor 10.1.1.1.
B.It advertises both the aggregate and all more specific routes.
C.It creates a static route for the aggregate.
D.It removes all more specific routes from the BGP table.
AnswerA

Correct. The summary-only keyword ensures only the aggregate is advertised, not the specifics.

Why this answer

The aggregate-address command creates an aggregate route in BGP. The summary-only keyword suppresses more specific routes from being advertised.

Full explanation →
408
MCQeasy

A network engineer runs the following command to verify NAT after a fix: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.1 10.1.1.1 192.168.1.1 192.168.1.1 --- 203.0.113.2 10.1.1.2 192.168.1.2 192.168.1.2 What is the most likely configuration?

A.Dynamic NAT without overload, using a pool of addresses.
B.Static NAT for each host.
C.PAT with a single address.
D.NAT is not configured.
AnswerA

Each inside host gets a unique global address from a pool.

Why this answer

The output shows two inside local addresses (10.1.1.1 and 10.1.1.2) translated to two different inside global addresses (203.0.113.1 and 203.0.113.2), with no port numbers listed in the 'Pro' column. This indicates a one-to-one mapping without port address translation, which is characteristic of dynamic NAT using a pool of addresses (not overloaded).

Exam trap

Cisco often tests the distinction between dynamic NAT and PAT by showing translation output without port numbers, leading candidates to mistakenly think it is static NAT or PAT with a single address.

How to eliminate wrong answers

Option B is wrong because static NAT would show a persistent one-to-one mapping in the configuration, but the output does not indicate static entries (which would typically appear with '---' but are manually configured and not dynamically learned). Option C is wrong because PAT (overload) would show multiple translations sharing the same inside global address with different port numbers in the 'Pro' column, which is absent here. Option D is wrong because the output clearly shows active translations, proving NAT is configured and operational.

Full explanation →
409
Multi-Selecthard

Which TWO statements about IPv6 unicast RPF (uRPF) behavior in Cisco IOS-XE are correct? (Choose TWO.)

Select 2 answers
A.Strict mode uRPF drops packets if the source address is not reachable via the incoming interface.
B.Loose mode uRPF drops packets if the source address is not present in the FIB at all.
C.The default uRPF mode on Cisco IOS-XE is strict mode.
D.IPv6 uRPF can be applied globally using the 'ipv6 unicast-rpf' command.
E.uRPF checks both source and destination addresses in the IPv6 header.
AnswersA, B

Correct. Strict mode requires the source prefix to be reachable via the exact incoming interface.

Why this answer

IPv6 unicast RPF strict mode verifies that the source address of an incoming packet is reachable via the exact interface on which the packet arrived, according to the FIB. If the source address is not reachable through that interface, the packet is dropped. This prevents spoofed traffic from entering the network from an unexpected path.

Exam trap

Cisco often tests the misconception that uRPF is enabled by default or that it can be applied globally, when in fact it is an interface-level feature that must be explicitly configured per interface.

Full explanation →
410
MCQhard

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.10.10.0/24 BGP routing table entry for 10.10.10.0/24, version 5 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.1.1.2 from 10.1.1.2 (10.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best rx pathid: 0, tx pathid: 0x0 (received-only) Based on this output, what does the "(received-only)" flag indicate?

A.The route is received but not installed in the routing table, likely due to a route-map filtering.
B.The route is best and installed in the routing table.
C.The route is suppressed by a route-map.
D.The route is being advertised to neighbors.
AnswerA

The received-only flag means the route is not used, often due to filtering.

Why this answer

The "(received-only)" flag indicates that the route was received from a neighbor but is not installed in the routing table, often due to a route-map filtering or a prefix-list. The correct answer is that a route-map is likely filtering this route from being installed.

Full explanation →
411
MCQhard

R1 and R2 are connected via an IPsec VPN tunnel. They are running EIGRP over the tunnel. R1's show ip eigrp neighbors shows R2 as up, but R1's show ip eigrp topology shows a route from R2 as 'stuck-in-active' (SIA). R1's show ip eigrp traffic shows queries being sent but no replies. What is the root cause?

A.The IPsec tunnel is not encrypting EIGRP multicast traffic, causing queries to be dropped.
B.EIGRP split-horizon is enabled on the tunnel interface.
C.The EIGRP active timer is set too low.
D.R2 has a passive interface for the tunnel.
AnswerA

EIGRP queries are sent to multicast address 224.0.0.10. If the crypto map does not protect multicast traffic, queries may be dropped, leading to SIA.

Why this answer

EIGRP uses multicast address 224.0.0.10 for neighbor discovery and route updates. If the IPsec VPN tunnel is misconfigured to not encrypt multicast traffic (e.g., using an ACL that only matches unicast or specific protocols), the EIGRP queries sent as multicast packets will be dropped by the IPsec process or the remote router, preventing replies. This results in the neighbor appearing up (due to unicast keepalives or a stale state) but routes stuck-in-active because queries are never answered.

Exam trap

Cisco often tests the misconception that a neighbor being 'up' in 'show ip eigrp neighbors' guarantees full EIGRP communication, when in fact the neighbor state can remain up due to unicast keepalives or a stale hold timer while multicast-based queries are blocked by IPsec ACLs.

How to eliminate wrong answers

Option B is wrong because EIGRP split-horizon prevents routes learned on an interface from being advertised back out the same interface, which could cause routing loops but does not cause queries to go unanswered or SIA routes; split-horizon does not block query transmission or reception. Option C is wrong because setting the EIGRP active timer too low would cause the route to transition to SIA faster, but the root cause here is that queries are sent and no replies are received, not that the timer expires prematurely; a low timer would still require replies to be sent. Option D is wrong because if R2 had a passive interface for the tunnel, R2 would not send or receive EIGRP hellos, so the neighbor adjacency would not form at all; the question states the neighbor is up, ruling out passive interface.

Full explanation →
412
MCQmedium

Consider the following partial DMVPN configuration on a hub router: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 100 ip nhrp authentication cisco123 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp map multicast dynamic ! What is the effect of this configuration?

A.The hub will dynamically register spoke NHRP addresses and forward multicast traffic to all registered spokes.
B.The hub will only forward multicast traffic to spokes that are statically mapped.
C.The hub will not forward multicast traffic at all because dynamic mapping is not supported.
D.The hub will use broadcast instead of multicast for all traffic.
AnswerA

This is correct; dynamic multicast mapping enables the hub to forward multicast to all spokes that have registered with NHRP.

Why this answer

The command 'ip nhrp map multicast dynamic' allows the hub to dynamically learn spoke NHRP addresses for multicast replication, which is essential for routing protocols (e.g., EIGRP, OSPF) that use multicast.

Full explanation →
413
MCQhard

A network engineer runs the following command on Router R1: R1# show ipv6 interface gigabitethernet 0/0 GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 1000 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. IPv6 uRPF: strict mode (drop invalid packets) Inbound access list: FILTER-IPv6 Based on this output, which two features are configured on this interface?

A.uRPF in strict mode and inbound IPv6 ACL
B.uRPF in loose mode and outbound IPv6 ACL
C.uRPF disabled and inbound IPv6 ACL
D.uRPF in strict mode and outbound IPv6 ACL
AnswerA

Both are clearly shown in the output.

Why this answer

The output shows 'IPv6 uRPF: strict mode (drop invalid packets)' and 'Inbound access list: FILTER-IPv6', confirming that unicast Reverse Path Forwarding in strict mode and an inbound IPv6 ACL are both configured on the interface. Strict uRPF verifies that the source address of incoming packets has a matching route in the FIB pointing back to the same interface, dropping packets that fail this check. The inbound ACL filters traffic before any routing decision, as indicated by the 'Inbound access list' line.

Exam trap

Cisco often tests the distinction between strict and loose uRPF modes, and the trap here is that candidates may overlook the 'Inbound access list' line and assume the ACL is outbound, or confuse the uRPF mode with the ACL direction.

How to eliminate wrong answers

Option B is wrong because the output explicitly states 'IPv6 uRPF: strict mode', not loose mode, and the ACL is applied inbound, not outbound. Option C is wrong because uRPF is not disabled; it is enabled in strict mode. Option D is wrong because while uRPF is correctly identified as strict mode, the ACL is applied inbound, not outbound.

Full explanation →
414
MCQhard

A network engineer runs the following command to verify OSPFv3 database: R1# show ipv6 ospf database router 2.2.2.2 OSPFv3 Router with ID (1.1.1.1) (Process ID 1) Router Link States (Area 0) LS age: 60 LS Type: Router Links Link State ID: 0.0.0.0 Advertising Router: 2.2.2.2 LS Seq Number: 80000003 Checksum: 0x5678 Length: 40 Number of Links: 1 Link connected to: a Transit Network (Link ID) Interface ID: 2 (Link Data) Neighbor Interface ID: 1 Number of TOS metrics: 0 TOS 0 Metrics: 10 What does this output indicate?

A.The LSA shows a link to a stub network with prefix information.
B.The LSA indicates a single transit link with interface IDs, typical for OSPFv3.
C.The advertising router is 1.1.1.1.
D.This is a Type 5 External LSA.
AnswerB

OSPFv3 uses interface IDs to identify links, and this LSA shows one transit link.

Why this answer

The output shows an OSPFv3 Router LSA from router 2.2.2.2 with one link to a transit network, using interface IDs instead of IP addresses.

Full explanation →
415
MCQeasy

What is the default behavior of LDP when establishing a session between two directly connected routers?

A.LDP sends hellos to the unicast address of each neighbor.
B.LDP uses TCP port 646 for session establishment and UDP port 646 for hellos.
C.LDP hellos are sent to the all-OSPF-routers multicast address 224.0.0.5.
D.LDP sessions are established using UDP for reliability.
AnswerB

LDP uses UDP port 646 for hello messages (discovery) and TCP port 646 for session establishment and label exchange.

Why this answer

LDP uses hello messages to discover neighbors. By default, LDP hellos are sent to the multicast address 224.0.0.2 (all routers) on the local link. The session is established using the transport address, which by default is the router ID (usually the highest loopback or interface IP).

Full explanation →
416
MCQeasy

What is the default tunnel mode for a tunnel interface on Cisco IOS?

A.tunnel mode ipv6ip
B.tunnel mode gre ip
C.tunnel mode gre ipv6
D.tunnel mode mpls traffic-eng
AnswerB

GRE over IPv4 is the default.

Why this answer

The default tunnel mode on Cisco IOS is GRE (Generic Routing Encapsulation) over IPv4, configured with the command `tunnel mode gre ip`. This mode encapsulates packets using the GRE protocol (RFC 2784) with an IPv4 transport header, and it is the default when no explicit tunnel mode is specified. GRE ip supports multiprotocol payloads (IPv4, IPv6, etc.) and is widely used for site-to-site VPNs and overlay networks.

Exam trap

Cisco often tests the assumption that the default tunnel mode is IPv6-in-IPv4 or GRE over IPv6, but the actual default is GRE over IPv4, which catches candidates who overlook the implicit IPv4 transport requirement.

How to eliminate wrong answers

Option A is wrong because `tunnel mode ipv6ip` is used for IPv6-in-IPv4 manual tunneling, not the default; it requires explicit configuration and does not use GRE encapsulation. Option C is wrong because `tunnel mode gre ipv6` is a valid mode for GRE over IPv6 transport, but it is not the default; the default transport is IPv4, not IPv6. Option D is wrong because `tunnel mode mpls traffic-eng` is used for MPLS Traffic Engineering tunnels, not for generic IP tunneling, and it is not the default tunnel mode.

Full explanation →
417
MCQeasy

What is the default SNMPv2c community string on most Cisco IOS devices?

A.public
B.private
C.cisco
D.No default community string is configured.
AnswerA

Many Cisco devices come with a default 'public' community string for read-only access.

Why this answer

The default SNMPv2c community string on most Cisco IOS devices is 'public' for read-only access. This is a well-known default that allows basic SNMP polling without additional configuration, as defined in Cisco's default configuration for SNMP agents.

Exam trap

Cisco often tests the default SNMP community string to catch candidates who assume 'private' is the default for read-write or that no default exists, exploiting the common confusion between vendor defaults and best-practice security hardening.

How to eliminate wrong answers

Option B is wrong because 'private' is not a default community string on Cisco IOS; it is sometimes used as a default for read-write access on other vendors but not Cisco. Option C is wrong because 'cisco' is not a default community string; it is a common misconception but Cisco devices do not ship with this as a default. Option D is wrong because a default community string of 'public' is indeed configured on most Cisco IOS devices for SNMPv2c, so stating no default is incorrect.

Full explanation →
418
MCQhard

In a manual IPv6 over IPv4 tunnel (tunnel mode ipv6ip), what is the default maximum number of hops (TTL) for the IPv4 header?

A.64
B.128
C.255
D.16
AnswerC

The default TTL is 255 for manual IPv6 over IPv4 tunnels.

Why this answer

In a manual IPv6 over IPv4 tunnel (tunnel mode ipv6ip), the IPv4 header's TTL (Time to Live) defaults to 255. This is because the tunnel is treated as a directly connected virtual link, and the IPv4 TTL is set to the maximum value of 255 to minimize the chance of the tunneled packet being dropped due to TTL expiry within the transit IPv4 network. This behavior is defined in RFC 2473 and is the default for IPv6-in-IPv4 tunnels on Cisco IOS.

Exam trap

Cisco often tests the distinction between the default TTL values for IPv6 (64) and the outer IPv4 header in a manual IPv6 over IPv4 tunnel (255), leading candidates to mistakenly choose 64 or 128.

How to eliminate wrong answers

Option A is wrong because 64 is the default TTL for IPv6 packets, not for the IPv4 header in a manual IPv6 over IPv4 tunnel. Option B is wrong because 128 is the default TTL for IPv4 packets on many operating systems (e.g., Windows), but Cisco routers set the IPv4 TTL to 255 for tunnel mode ipv6ip. Option D is wrong because 16 is a common default for certain routing protocols (e.g., RIP), but it is not the default TTL for the IPv4 header in this tunnel type.

Full explanation →
419
MCQhard

What is the default DHCPv6 client DUID type on a Cisco IOS-XE router?

A.DUID-LLT (Link-Layer plus Time)
B.DUID-EN (Enterprise Number)
C.DUID-LL (Link-Layer)
D.DUID-UUID (Universally Unique Identifier)
AnswerC

Cisco IOS-XE defaults to DUID-LL for DHCPv6 clients.

Why this answer

Cisco IOS-XE routers default to DUID-LL (Link-Layer) as the DHCPv6 client DUID type, as defined in RFC 8415. This DUID is generated using the router's link-layer address (MAC address) without a timestamp, making it stable across reboots. The DUID-LL is the default because it provides a consistent identifier without requiring clock synchronization or enterprise registration.

Exam trap

Cisco often tests the default DUID type by contrasting it with DUID-LLT, leading candidates to mistakenly choose DUID-LLT because they recall that DHCPv6 clients can use a time-based identifier, but they forget that Cisco defaults to the simpler, non-timestamped DUID-LL.

How to eliminate wrong answers

Option A is wrong because DUID-LLT (Link-Layer plus Time) includes a timestamp, which is not the default on Cisco IOS-XE; it is used by some other vendors but Cisco defaults to DUID-LL. Option B is wrong because DUID-EN (Enterprise Number) requires an enterprise number assigned by IANA and is not the default; it is used only when explicitly configured with the 'duid enterprise-number' command. Option D is wrong because DUID-UUID (Universally Unique Identifier) is not a standard DUID type defined in RFC 8415 for DHCPv6; it is a common misconception from other contexts like system identification.

Full explanation →
420
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip bgp 192.168.0.0 255.255.252.0 BGP routing table entry for 192.168.0.0/22, version 5 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 65001 10.1.1.1 from 10.1.1.1 (10.1.1.1) Origin IGP, metric 0, localpref 100, valid, external, best Community: 65001:100 rx pathid: 0, tx pathid: 0x0 Aggregator: 65001, 10.1.1.1 Based on this output, what is true about this route?

A.The route is a summary route aggregated by 10.1.1.1.
B.The route is a learned route from AS 65002.
C.The route is a default route.
D.The route is suppressed.
AnswerA

The Aggregator field shows 65001, 10.1.1.1, indicating this route is an aggregate.

Why this answer

The presence of 'Aggregator' indicates route summarization (aggregation) was performed by the router with IP 10.1.1.1 in AS 65001.

Full explanation →
421
MCQmedium

Which default IPsec transform set is automatically created in Cisco IOS when configuring a site-to-site VPN?

A.esp-aes 256 esp-sha-hmac
B.esp-3des esp-sha-hmac
C.No default transform set is created
D.esp-aes 128 esp-md5-hmac
AnswerC

Cisco IOS requires manual configuration of at least one transform set.

Why this answer

Cisco IOS does not automatically create any default IPsec transform set when configuring a site-to-site VPN. Transform sets must be explicitly defined using the `crypto ipsec transform-set` command, which specifies the encryption and authentication algorithms. The absence of a default ensures that administrators intentionally select the appropriate security parameters for their environment.

Exam trap

Cisco often tests the misconception that a default transform set exists, tempting candidates to select a common algorithm combination like `esp-aes 256 esp-sha-hmac` or `esp-3des esp-sha-hmac` as the default, when in fact no such default is automatically created.

How to eliminate wrong answers

Option A is wrong because `esp-aes 256 esp-sha-hmac` is not a default transform set; it is a valid user-defined transform set but must be manually configured. Option B is wrong because `esp-3des esp-sha-hmac` is also not a default; 3DES is a legacy algorithm that requires explicit configuration. Option D is wrong because `esp-aes 128 esp-md5-hmac` is not a default; MD5 is deprecated for security reasons and must be explicitly chosen if used.

Full explanation →
422
MCQmedium

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-IN Class-map: CoPP-ICMP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: CoPP-SSH (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 110 police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 1250 packets, 75000 bytes 5 minute offered rate 1000 bps, drop rate 0000 bps Match: any Based on this output, which statement is correct?

A.The CoPP policy is dropping all ICMP packets to the control plane.
B.The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.
C.The CoPP policy is rate-limiting SSH traffic to 16000 bps.
D.The CoPP policy is applied to the output direction.
AnswerB

The packet counters for both classes are zero, indicating no traffic matched these classes.

Why this answer

The output shows that the CoPP-ICMP and CoPP-SSH class-maps have zero packets matched (0 packets, 0 bytes), indicating that no traffic has been classified into these classes. This means the policy is not matching any ICMP or SSH packets, likely because the access-lists (100 and 110) are not correctly defined or applied, or the traffic is not reaching the control plane. Option B correctly identifies this lack of matching.

Exam trap

Cisco often tests the distinction between a configured policy and an active policy; candidates see police parameters and assume traffic is being policed, but the zero packet counters reveal that no classification is occurring, so the policy is effectively idle.

How to eliminate wrong answers

Option A is wrong because the CoPP-ICMP class shows 0 packets matched and 0 packets dropped, so no ICMP packets are being dropped; the policy is not affecting ICMP traffic at all. Option C is wrong because the CoPP-SSH class has 0 packets matched, meaning SSH traffic is not being rate-limited; the police cir 16000 bps is configured but never applied to any packets. Option D is wrong because the command 'show policy-map control-plane' and the output line 'Service-policy input: CoPP-IN' explicitly indicate the policy is applied to the input direction, not output.

Full explanation →
423
MCQmedium

Given this configuration on Router R6: ``` interface Tunnel0 ipv6 address 2001:DB8:8::1/64 tunnel source 2001:DB8:9::1 tunnel destination 2001:DB8:10::2 tunnel mode gre ipv6 tunnel path-mtu-discovery ``` What is the effect?

A.The tunnel will not work because path-mtu-discovery is not supported with GRE.
B.The tunnel will dynamically adjust the MTU based on the path MTU discovery.
C.The tunnel mode should be 'ipv6ip' for IPv6 transport.
D.The tunnel source and destination must be IPv4 addresses.
AnswerB

The 'tunnel path-mtu-discovery' command enables PMTUD for the tunnel.

Why this answer

The `tunnel path-mtu-discovery` command enables Path MTU Discovery (PMTUD) for the GRE tunnel, which dynamically determines the maximum MTU along the path to the tunnel destination and adjusts the tunnel interface's MTU accordingly. This prevents fragmentation issues by allowing the tunnel to use the smallest MTU in the path. Option B correctly identifies this behavior.

Exam trap

Cisco often tests the misconception that path-mtu-discovery is unsupported with GRE tunnels, but it is actually supported and commonly used to avoid fragmentation in overlay networks.

How to eliminate wrong answers

Option A is wrong because path-mtu-discovery is fully supported with GRE tunnels; it uses the DF bit and ICMPv6 Packet Too Big messages (or ICMPv4 Fragmentation Needed) to discover the path MTU. Option C is wrong because the tunnel mode 'gre ipv6' is correct for transporting IPv6 packets over an IPv6 transport network; 'ipv6ip' is used for IPv6-in-IPv4 tunnels, not for GRE over IPv6. Option D is wrong because the tunnel source and destination are IPv6 addresses (2001:DB8:9::1 and 2001:DB8:10::2), which is valid for a GRE tunnel operating over an IPv6 transport network.

Full explanation →
424
MCQmedium

A network engineer runs the following command to troubleshoot an Administrative Distance issue: R1# show bgp ipv4 unicast 192.168.4.0/24 BGP routing table entry for 192.168.4.0/24, version 2 Paths: (1 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.1.1.2 from 10.1.1.2 (2.2.2.2) Origin IGP, metric 0, localpref 100, valid, external, best rx pathid: 0, tx pathid: 0x0 What does this output indicate?

A.The route is an internal BGP route with administrative distance 200.
B.The route is an external BGP route with administrative distance 20.
C.The route has a local preference of 200, making it preferred.
D.The route is not the best path because it is external.
AnswerB

The output shows 'external', and eBGP routes have a default AD of 20.

Why this answer

The output shows BGP route details including the path attributes. The administrative distance for BGP external routes is 20 by default, but this is not shown here. The output indicates the route is learned via eBGP and is the best path.

Full explanation →
425
MCQmedium

Consider the following CoPP configuration: class-map match-any COPP-ROUTING match protocol ospf match protocol eigrp match protocol bgp ! policy-map COPP-POLICY class COPP-ROUTING police 32000 conform-action transmit exceed-action drop class class-default police 64000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY What is a potential issue with this configuration?

A.The class-map uses match-any instead of match-all, which will cause incorrect matching.
B.The police rate of 32000 bps is too low for routing protocol traffic and may cause adjacency drops.
C.The 'match protocol' command is not supported in CoPP class-maps; only ACLs or DSCP/IP precedence can be used.
D.The policy-map must be applied to the control-plane with the 'output' keyword instead of 'input'.
AnswerC

Correct. CoPP only supports match access-group, match ip dscp, or match ip precedence. match protocol is not allowed.

Why this answer

The 'match protocol' command is not supported in Control Plane Policing (CoPP) class-maps. CoPP operates on the control plane, which processes packets that are destined to the router itself; these packets are typically identified by ACLs, DSCP, or IP precedence values, not by protocol names like OSPF, EIGRP, or BGP. The 'match protocol' command is used in QoS policies applied to data-plane interfaces, not in control-plane service policies.

Exam trap

Cisco often tests the misconception that 'match protocol' can be used in CoPP class-maps because it is valid in data-plane QoS policies, but CoPP explicitly requires ACLs, DSCP, or IP precedence for classification.

How to eliminate wrong answers

Option A is wrong because 'match-any' is actually the correct and intended behavior for CoPP class-maps when you want to match any of the listed protocols; using 'match-all' would require all protocols to match simultaneously, which is not the goal. Option B is wrong because a police rate of 32000 bps (32 kbps) is not inherently too low for routing protocol traffic; routing protocol keepalives and updates are typically small and bursty, and the rate can be tuned based on network requirements—the issue is not the rate itself but the unsupported match criteria. Option D is wrong because CoPP is applied as a 'service-policy input' on the control-plane to police traffic entering the control plane from the data plane; applying it as 'output' would police traffic leaving the control plane, which is not the standard use case for protecting the router's CPU.

Full explanation →
426
MCQhard

A network engineer configures IP SLA with an ICMP echo operation to monitor a remote host. The engineer also configures a route map to set the next hop based on the IP SLA track object. The engineer notices that the route map is not applied to the routing table as expected. The show ip route shows the static route with the correct next hop, but the route map does not seem to affect the routing decision. Which is the most likely explanation?

A.The route map is not applied to the static route using the 'route-map' keyword under the 'ip route' command.
B.The IP SLA track object is not referenced in the route map.
C.The route map is configured with a match clause that does not match the static route.
D.The IP SLA operation is not reachable, so the route map is not triggered.
AnswerA

To use a route map with a static route, the route map must be referenced in the static route configuration; otherwise, it has no effect.

Why this answer

Route maps can be used with IP SLA tracking to modify route attributes, but the route map must be applied to the routing process or to the static route itself. If the route map is configured but not applied correctly, it will not affect the routing table. Additionally, route maps used with IP SLA tracking are typically applied to redistribution, not to static routes directly.

The most common edge case is that the route map is not applied to the static route using the 'route-map' keyword under the 'ip route' command.

Full explanation →
428
MCQhard

An engineer configures IPv6 Source Guard on a switch port with 'ipv6 verify source' and also enables 'ipv6 snooping' globally. A legitimate host on that port is unable to send traffic, and the switch logs show that packets are being dropped due to source address validation failure. The host has a static IPv6 address and the engineer has configured a static binding using 'ipv6 neighbor binding' command. What is the most likely oversight?

A.The static binding must be associated with a valid ND entry; without an NA from the host, the binding remains incomplete.
B.The 'ipv6 verify source' command must include the 'allow-default' option to work with static addresses.
C.The switch port must be configured as 'trusted' for IPv6 snooping.
D.The host must use DHCPv6 to obtain an address for Source Guard to work.
AnswerA

Source Guard requires the binding to be in REACHABLE state, which requires ND activity.

Why this answer

IPv6 Source Guard relies on the Neighbor Discovery (ND) cache to validate source addresses. Even with a static binding configured via 'ipv6 neighbor binding', the binding remains in an 'incomplete' state until the switch receives a valid Neighbor Advertisement (NA) from the host. Without a complete ND entry, the switch drops packets from the host as the source address cannot be verified against a valid binding.

Exam trap

Cisco often tests the misconception that a static binding alone is sufficient for IPv6 Source Guard, when in fact the binding must be resolved via ND (NA message) to become active and allow traffic.

How to eliminate wrong answers

Option B is wrong because the 'allow-default' option is used with IPv6 Source Guard to permit traffic from the unspecified address (::/0) or default routes, not to accommodate static addresses; static addresses are supported without this option. Option C is wrong because configuring the switch port as 'trusted' for IPv6 snooping would bypass source guard validation entirely, which is not the intended behavior for a port that should enforce source address verification. Option D is wrong because IPv6 Source Guard supports static addresses via manual bindings or ND-snooped entries; DHCPv6 is not a requirement, and the host can use a statically configured address as long as a valid binding exists.

Full explanation →
429
MCQeasy

By default in Cisco IOS-XE, what is the behavior of an IPv4 ACL when no entries match and the ACL is applied to an inbound interface?

A.The packet is permitted.
B.The packet is denied.
C.The packet is forwarded based on routing table lookup.
D.The ACL logs the packet and continues.
AnswerB

The implicit deny all at the end of every IPv4 ACL denies unmatched traffic.

Why this answer

By default, Cisco IOS-XE applies an implicit 'deny any' statement at the end of every IPv4 ACL. If no entries match the packet, the implicit deny triggers, and the packet is dropped. This behavior is consistent for ACLs applied to inbound interfaces, ensuring that only explicitly permitted traffic is allowed.

Exam trap

Cisco often tests the implicit deny any behavior by presenting scenarios where an ACL has no matching entries, leading candidates to mistakenly think the packet is permitted or forwarded based on routing.

How to eliminate wrong answers

Option A is wrong because the implicit deny any statement at the end of an ACL causes unmatched packets to be dropped, not permitted. Option C is wrong because ACLs operate independently of the routing table; a packet that is denied by an ACL is discarded before any routing decision is made. Option D is wrong because logging is not enabled by default; it requires the explicit 'log' keyword on an ACL entry, and even then, the packet is still subject to the implicit deny if no match occurs.

Full explanation →
430
MCQhard

In Cisco IOS, what is the default behavior of the ip nat service command?

A.It disables NAT for all protocols by default.
B.It enables NAT only for TCP and UDP by default.
C.It is used to configure NAT for specific application-layer protocols and is not enabled by default.
D.It configures the NAT translation timeout for all services.
AnswerC

Correct. The ip nat service command is used to fine-tune NAT for specific protocols and is not enabled by default; it is applied only when configured.

Why this answer

The `ip nat service` command in Cisco IOS is used to enable NAT for specific application-layer protocols (e.g., SIP, H.323, DNS) that embed IP addresses in their payloads, requiring the NAT router to perform deep packet inspection. By default, this command is not enabled; NAT only translates the IP header for TCP and UDP traffic without application-layer awareness. Option C correctly identifies that the command is not enabled by default and is used for specific protocol configuration.

Exam trap

The trap here is that candidates often assume NAT automatically supports all protocols, but Cisco tests the distinction that only TCP and UDP are translated by default, while application-layer protocols require explicit `ip nat service` configuration.

How to eliminate wrong answers

Option A is wrong because the default behavior of NAT is to translate IP addresses for TCP and UDP traffic, not to disable NAT for all protocols. Option B is wrong because NAT inherently supports TCP and UDP by default without needing the `ip nat service` command; this command is for additional application-layer protocols. Option D is wrong because the `ip nat service` command does not configure translation timeouts; timeouts are controlled by the `ip nat translation timeout` command.

Full explanation →
431
Multi-Selectmedium

Which TWO commands can be used to troubleshoot EIGRP route redistribution issues when routes are not appearing in the routing table? (Choose TWO.)

Select 2 answers
A.show ip protocols
B.show ip route
C.show ip eigrp topology all-links
D.show ip ospf database
E.debug ip routing
AnswersA, C

This shows redistribution settings, route maps, and administrative distances, helping identify misconfigurations.

Why this answer

The 'show ip protocols' command (A) is correct because it displays the routing protocol configuration, including redistribution settings such as the metric, route map, and which protocols are being redistributed. When EIGRP routes are missing from the routing table, this command helps verify that redistribution is correctly configured and active, which is a primary troubleshooting step for redistribution issues.

Exam trap

Cisco often tests the distinction between 'show ip eigrp topology' and 'show ip eigrp topology all-links', where the latter is necessary to see all routes, including those not selected as best paths, which is critical for troubleshooting redistribution failures.

Full explanation →
432
MCQmedium

In BGP, what is the default value of the keepalive timer?

A.30 seconds
B.60 seconds
C.90 seconds
D.180 seconds
AnswerB

Correct. The default BGP keepalive timer is 60 seconds.

Why this answer

In BGP, the default keepalive timer is 60 seconds, as specified in RFC 4271. This timer determines how often a BGP speaker sends Keepalive messages to its peer to maintain the session. The hold timer, which is three times the keepalive interval (default 180 seconds), triggers session teardown if no Keepalive or update is received within that period.

Exam trap

Cisco often tests the distinction between the keepalive timer (60 seconds) and the hold timer (180 seconds), and candidates frequently confuse the two or misremember the default as 30 seconds due to familiarity with other routing protocols like EIGRP.

How to eliminate wrong answers

Option A is wrong because 30 seconds is the default keepalive interval for EIGRP, not BGP. Option C is wrong because 90 seconds is not a standard BGP timer value; it might be confused with the OSPF dead interval (which is 40 seconds by default). Option D is wrong because 180 seconds is the default BGP hold timer, not the keepalive timer; the keepalive timer is one-third of the hold timer.

Full explanation →
433
MCQhard

A network engineer is troubleshooting a router that is not allowing SSH connections from any management station. The router has 'ip domain-name example.com' and 'crypto key generate rsa' configured. 'line vty 0 4' has 'transport input ssh' and 'login local'. The engineer can ping the router from a management station. What is the most likely cause?

A.The RSA key was generated with a modulus less than 768 bits, causing SSH to fail.
B.The VTY lines are missing the 'login local' command.
C.The router has 'ip ssh version 1' configured, and the client only supports SSHv2.
D.The management station is using the wrong username or password.
AnswerA

Cisco IOS requires a minimum 768-bit RSA key for SSHv2; if the key is smaller, SSH will not accept connections.

Why this answer

The most likely cause is that the RSA key was generated with a modulus less than 768 bits. Cisco IOS requires an RSA key modulus of at least 768 bits for SSH to function; if the modulus is smaller (e.g., 512 bits), SSH will fail to start even though the key is generated successfully. The presence of 'ip domain-name', 'crypto key generate rsa', 'transport input ssh', and 'login local' on the VTY lines, combined with successful ping reachability, points to an SSH-specific configuration issue rather than connectivity or authentication problems.

Exam trap

Cisco often tests the specific modulus requirement for SSH (768 bits minimum) and the fact that a successful 'crypto key generate rsa' does not guarantee SSH will work if the key is too small, leading candidates to overlook this subtle but critical detail.

How to eliminate wrong answers

Option B is wrong because the scenario explicitly states that 'login local' is configured on the VTY lines, so missing this command is not the issue. Option C is wrong because if the router had 'ip ssh version 1' and the client only supported SSHv2, the client would receive a version mismatch error, but SSH would still attempt negotiation; however, the question indicates no SSH connections are allowed at all, which is more consistent with a failed SSH server startup due to a weak RSA key. Option D is wrong because the management station can ping the router, indicating Layer 3 reachability, and the problem is that SSH connections are not allowed at all, not that authentication fails after a connection is established; wrong username/password would result in an authentication failure after the TCP connection is made, not a complete inability to connect.

Full explanation →
434
MCQhard

Router R1 is configured as an ERSPAN source to monitor traffic on interface Tunnel0 (a DMVPN tunnel). The destination is a collector at 172.16.0.100. R1's configuration: monitor session 1 type erspan-source source interface Tunnel0 both destination erspan-id 4 ip address 172.16.0.100 origin ip address 10.0.0.1. The collector receives no packets. The Tunnel0 interface is up/up and has an IP of 10.0.0.1/30. The tunnel destination is 192.168.1.1. The router has a route to 172.16.0.100 via 10.0.0.2. What is the root cause?

A.The ERSPAN source interface is a tunnel, which is not supported for ERSPAN.
B.The ERSPAN destination IP is routed via the tunnel interface, causing the encapsulated packets to be sent into the tunnel and double-encapsulated, leading to drop.
C.The tunnel interface is not in the same VRF as the collector.
D.The ERSPAN session ID 4 conflicts with the tunnel key.
AnswerB

The route to 172.16.0.100 via 10.0.0.2 points to the tunnel peer, so the encapsulated packets enter the tunnel, causing recursion.

Why this answer

ERSPAN monitors traffic on the source interface. When the source is a tunnel interface, the mirrored traffic is the original IP packets before encapsulation. The ERSPAN process then encapsulates these packets with a new IP header.

However, the encapsulated packets are sent using the routing table. If the destination IP is reachable via a route that points to the tunnel interface itself (e.g., via 10.0.0.2, which is the tunnel's peer), the encapsulated packets may be sent into the tunnel, causing them to be encapsulated again. This double encapsulation can cause issues.

But the more likely root cause is that the ERSPAN session is configured to monitor the tunnel interface, but the tunnel interface itself may not be able to generate the encapsulated packets correctly because the tunnel is used for the destination. The correct answer is that the ERSPAN source IP is the same as the tunnel interface IP, and the destination is routed via the tunnel, causing a recursive routing loop similar to the first question.

Full explanation →
435
MCQhard

A network engineer is troubleshooting an OSPFv3 adjacency issue between two routers over an IPv6-only link. The engineer configures OSPFv3 on both routers and sees that the adjacency is stuck in EXSTART state. 'debug ipv6 ospf packet' shows that the routers are exchanging DBD packets but not progressing. What is the most likely cause?

A.The OSPFv3 interface MTU is mismatched between the two routers.
B.The routers have different OSPFv3 router IDs.
C.The OSPFv3 process is configured with 'ipv6 ospf 1 area 0' on the interface, but the interface is not IPv6-enabled.
D.The link is a point-to-point link, but the OSPF network type is set to broadcast.
AnswerA

An MTU mismatch prevents DBD packets from being exchanged properly, causing the adjacency to be stuck in EXSTART.

Why this answer

The EXSTART state indicates that the routers are trying to establish the master/slave relationship and exchange DBD packets. If they are stuck, it is often due to a mismatch in the OSPF MTU or the interface MTU. If the MTU is mismatched, the DBD packets may be too large to be sent, causing the routers to keep retransmitting.

Another cause could be a mismatch in the OSPF network type, but that usually causes issues earlier. The most likely cause is an MTU mismatch.

Full explanation →
436
MCQmedium

Which BGP attribute is used as the first tie-breaker when selecting the best path for route summarization?

A.Local preference
B.Weight
C.AS path length
D.MED
AnswerB

Weight is Cisco-specific and is checked first.

Why this answer

The highest weight (locally configured) is the first tie-breaker in BGP path selection, before local preference.

Full explanation →
437
MCQhard

A DMVPN Phase 3 network with BGP as the routing protocol experiences high CPU usage on the hub router R1. The 'show process cpu' command shows high usage by the 'BGP Scanner' process. What is the root cause?

A.R1 is receiving a large number of BGP updates from many spokes, causing the BGP Scanner to process many prefixes and consume high CPU.
B.R1 has a CoPP policy that rate-limits BGP traffic, causing packet drops and retransmissions.
C.R1's BGP table is fragmented due to memory issues.
D.R1 has 'bgp update-delay' configured, causing delayed processing of updates.
AnswerA

Correct. BGP Scanner processes route updates and can become CPU-bound with many prefixes. Route aggregation or filtering can reduce the load.

Why this answer

High BGP Scanner CPU usage can be caused by a large number of prefixes being processed, especially if there are many updates or flapping routes. In a DMVPN network, if spokes are configured to advertise many prefixes or if there is route instability (e.g., due to flapping tunnels), the BGP Scanner process can consume high CPU. Another common cause is that the hub is processing many BGP updates from multiple spokes without proper route filtering or aggregation.

Full explanation →
438
MCQhard

An engineer configures Flexible NetFlow on a router to monitor traffic. Unexpectedly, the NetFlow exporter does not send any flow records to the collector. The engineer verifies that the monitor is applied to the correct interface and that the collector is reachable. Which is the most likely explanation?

A.The flow monitor references a record that does not include mandatory match fields, causing the monitor to remain inactive.
B.The exporter is configured with 'transport tcp' instead of 'transport udp', and the collector only accepts UDP.
C.The interface where the monitor is applied is in a VRF, and the exporter is not configured with the VRF name.
D.The flow monitor uses 'cache timeout inactive 60' which is too long, causing flows to be held until the cache is full.
AnswerA

Flexible NetFlow records require at least one match field (e.g., source IP, destination IP, protocol). Without it, the monitor cannot classify flows and will not export any data.

Why this answer

Flexible NetFlow requires a flow monitor to reference a record that defines the match and collect fields. If the record is not defined or is incomplete (e.g., missing key fields like source/destination IP), the monitor may not generate any flows. Additionally, the exporter configuration must include the correct source interface and transport protocol (UDP) to the collector.

A common edge case is when the record is defined but uses 'match ipv4 protocol' without 'match ipv4 source address', causing the flow monitor to fail to create flows.

Full explanation →
439
MCQmedium

Which of the following is the default EIGRP network type on a Frame Relay point-to-point subinterface?

A.NBMA
B.Point-to-point
C.Broadcast
D.Point-to-multipoint
AnswerB

Correct. Point-to-point subinterfaces default to point-to-point network type.

Why this answer

On a Frame Relay point-to-point subinterface, the default EIGRP network type is point-to-point. This is because each point-to-point subinterface creates a separate logical connection to a single remote router, eliminating the need for NBMA-specific mechanisms like split horizon or next-hop-self adjustments. The point-to-point network type enables EIGRP to use multicast hello packets (224.0.0.10) and form a single adjacency over the link.

Exam trap

Cisco often tests the misconception that Frame Relay always defaults to NBMA, but candidates must remember that point-to-point subinterfaces override this default to point-to-point, while only physical interfaces or multipoint subinterfaces retain the NBMA default.

How to eliminate wrong answers

Option A is wrong because NBMA is the default EIGRP network type on a Frame Relay physical interface or multipoint subinterface, not on a point-to-point subinterface. Option C is wrong because broadcast is a network type used on Ethernet or other multiaccess broadcast media, and it is not the default on any Frame Relay subinterface. Option D is wrong because point-to-multipoint is a network type that must be manually configured on a Frame Relay multipoint subinterface, and it is not the default on a point-to-point subinterface.

Full explanation →
441
MCQmedium

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

A.The SPAN session is configured to monitor only ingress traffic by default.
B.The destination port is in a different VLAN than the source VLAN.
C.The switch does not support SPAN on VLANs.
D.The laptop is not configured to accept tagged traffic.
AnswerA

Correct because the default direction for a SPAN source VLAN is 'rx' (received traffic); to capture all traffic, the engineer must add 'both' or 'tx'.

Why this answer

By default, SPAN monitors only ingress traffic on the source VLAN. To capture both directions, the command must specify 'both' for the source. The default is 'rx' only.

Full explanation →
442
MCQhard

A network redistributes OSPF into EIGRP. Router R1 has: redistribute ospf 1 metric 10000 100 255 1 1500. Router R2 shows: show ip route eigrp includes some OSPF routes but not 192.168.1.0/24. What is the root cause?

A.The OSPF route 192.168.1.0/24 is not in the OSPF database.
B.The EIGRP metric components are misordered; delay should be 100, not 10000.
C.The high delay metric (10000) may cause the route to be suppressed by EIGRP's feasibility condition.
D.Redistribution requires a route-map to filter specific routes.
AnswerC

EIGRP uses composite metric; high delay can make the route less feasible, preventing installation.

Why this answer

C is correct because EIGRP uses a feasibility condition to prevent routing loops, which requires that the reported distance (RD) from a neighbor be strictly less than the feasible distance (FD). The redistribute command sets the EIGRP metric components in the order bandwidth, delay, reliability, load, MTU. Here, the delay is set to 10000 tens of microseconds, which is extremely high (100,000 microseconds).

This high delay inflates the composite metric, making the FD very large. When this route is advertised to an EIGRP neighbor, the neighbor's RD may equal or exceed its own FD for that route, violating the feasibility condition and causing the route to be suppressed from the routing table.

Exam trap

Cisco often tests the EIGRP feasibility condition by hiding it behind a metric misconfiguration—candidates mistakenly think the metric values are simply wrong or misordered, when the real issue is that the high delay causes the route to be suppressed by EIGRP's loop-prevention mechanism.

How to eliminate wrong answers

Option A is wrong because the question states that 'show ip route eigrp includes some OSPF routes but not 192.168.1.0/24', implying that the route is present in the OSPF database and is being redistributed, but it is not appearing in the EIGRP topology table or routing table due to a metric or feasibility issue. Option B is wrong because the EIGRP metric components in the 'redistribute ospf 1 metric' command are correctly ordered as bandwidth (kbps), delay (tens of microseconds), reliability, load, MTU; the delay value of 10000 is valid and not misordered—the issue is that this value is too high, not that it is in the wrong position. Option D is wrong because redistribution into EIGRP does not require a route-map to filter specific routes; a route-map is optional and used for policy-based control, but the absence of a route-map does not prevent a redistributed route from appearing in the EIGRP table if the metric is valid and the feasibility condition is met.

Full explanation →
443
MCQmedium

Consider the following configuration on router R2: crypto isakmp policy 10 encryption aes 256 authentication pre-share group 14 lifetime 3600 ! crypto isakmp key secretkey address 192.168.1.1 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 192.168.1.1 set transform-set TSET match address 101 ! interface GigabitEthernet0/1 ip address 192.168.1.2 255.255.255.0 crypto map CMAP ! access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255 Which statement is true?

A.The IPsec tunnel will establish successfully because the transform sets match.
B.The IKE phase 1 will fail due to ISAKMP lifetime mismatch.
C.The tunnel will work but will rekey every hour due to the shorter lifetime.
D.The pre-shared key mismatch will cause the tunnel to fail.
AnswerB

ISAKMP policies must match exactly, including lifetime. A mismatch causes negotiation failure.

Why this answer

The ISAKMP lifetime configured on R2 is 3600 seconds (1 hour), but the question implies the remote peer (192.168.1.1) has a different lifetime (likely the default of 86400 seconds). During IKE phase 1 negotiation, the peers propose their lifetimes, and if they do not match, the session fails because Cisco IOS requires identical lifetime values for successful phase 1 establishment. This mismatch causes the IKE phase 1 to fail, preventing the IPsec tunnel from forming.

Exam trap

Cisco often tests the misconception that only transform sets (phase 2) need to match, while IKE phase 1 parameters like lifetime are overlooked, causing candidates to incorrectly select option A.

How to eliminate wrong answers

Option A is wrong because even if the transform sets match, the IKE phase 1 lifetime mismatch will cause the entire tunnel negotiation to fail before phase 2 (transform set matching) is ever reached. Option C is wrong because the tunnel will not work at all due to the phase 1 failure; rekeying is irrelevant if the initial IKE SA cannot be established. Option D is wrong because the pre-shared key is configured correctly on R2 with the address of the peer (192.168.1.1), and there is no evidence of a mismatch; the question specifically highlights the lifetime as the issue.

Full explanation →
444
MCQmedium

A network engineer runs the following command to troubleshoot a VRF-Lite issue: R1# show ip eigrp vrf CUSTOMER_B topology 10.1.1.0/24 Output: IP-EIGRP (AS 100): Topology entry for 10.1.1.0/24 for VRF CUSTOMER_B State is Passive, Query origin flag is 1, 1 Successor(s), FD is 131072 Routing Descriptor Blocks: 10.1.1.1 (GigabitEthernet0/1), from 10.1.1.1, Send flag is 0x0 Composite metric is (131072/128256), Route is Internal Vector metric: Minimum bandwidth is 100000 Kbit Total delay is 100 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 1 What does this output indicate?

A.The route 10.1.1.0/24 is in Active state, indicating an EIGRP query is in progress.
B.The route 10.1.1.0/24 has one successor with a feasible distance of 131072 and is learned via 10.1.1.1.
C.The route 10.1.1.0/24 is an external EIGRP route redistributed into the VRF.
D.The route 10.1.1.0/24 has multiple successors due to equal-cost paths.
AnswerB

Correct. The output shows one successor, FD 131072, and next hop 10.1.1.1.

Why this answer

The 'show ip eigrp vrf topology' command displays the EIGRP topology table entry for a specific prefix within a VRF. The output shows the route 10.1.1.0/24 is in Passive state, meaning no EIGRP query is pending. It has one successor (the best path) with a feasible distance (FD) of 131072.

The next hop is 10.1.1.1 via GigabitEthernet0/1.

Full explanation →
445
MCQmedium

When redistributing routes between OSPF and EIGRP, which of the following is a recommended best practice to prevent routing loops?

A.Use the same administrative distance for both protocols.
B.Apply route filtering using route-maps or prefix-lists to control which routes are redistributed.
C.Increase the default metric to a high value to discourage redistribution.
D.Disable route summarization on both protocols.
AnswerB

Route filtering prevents unwanted routes from being redistributed, reducing loop risk.

Why this answer

To prevent routing loops during mutual redistribution, it is recommended to use route-maps with distribute-lists or prefix-lists to filter routes, and to adjust administrative distances to prefer one protocol over the other. This prevents routes from being redistributed back and forth.

Full explanation →
446
MCQmedium

A network engineer runs the following command to verify IPv6 uRPF operation: R1# show ipv6 interface GigabitEthernet0/0 | include verify IPv6 verify source: strict What does this output indicate?

A.Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.
B.Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.
C.Loose uRPF is enabled, which only checks if the source address is in the routing table.
D.uRPF is disabled on this interface.
AnswerA

Correct. Strict uRPF requires both a matching route and that the interface used to reach the source is the same as the receiving interface.

Why this answer

The output 'IPv6 verify source: strict' indicates that strict unicast Reverse Path Forwarding (uRPF) is enabled on the interface. Strict uRPF verifies that the source IPv6 address of an incoming packet is reachable via the routing table AND that the best return path to that source uses the same interface on which the packet was received. If either condition fails, the packet is dropped.

This matches option A exactly.

Exam trap

Cisco often tests the distinction between strict and loose uRPF by showing the 'verify source' output and expecting candidates to remember that 'strict' requires both a routing table match and the correct incoming interface, while 'loose' only requires the source to be in the routing table.

How to eliminate wrong answers

Option B is wrong because it describes a loose uRPF behavior, where only the source address must exist in the routing table, regardless of the incoming interface; strict uRPF additionally checks that the best return path is through the receiving interface. Option C is wrong because the output explicitly shows 'strict', not 'loose'; loose uRPF would display 'IPv6 verify source: loose' and only checks the routing table for the source address. Option D is wrong because the output clearly indicates that uRPF is enabled (strict mode), not disabled; a disabled state would show no 'verify' line or 'IPv6 verify source: none'.

Full explanation →
447
MCQeasy

Which CoPP mechanism prevents the CPU from being overwhelmed by control plane traffic?

A.Shaping
B.Policing
C.Queuing
D.Compression
AnswerB

CoPP applies policing to control plane traffic, dropping packets that exceed the configured rate to protect the CPU.

Why this answer

CoPP uses a policer (typically a single-rate two-color or three-color marker) to rate-limit traffic destined to the control plane, dropping packets that exceed the configured rate.

Full explanation →
448
MCQhard

A DMVPN network uses FlexVPN with BGP as the routing protocol. Spoke routers are configured with Flexible NetFlow to monitor traffic. After a configuration change, spoke-to-spoke tunnels fail to establish. Router R1 (spoke) shows: show dmvpn detail | include (State|Tunnel) State: NHRP, Tunnel: Tunnel0. The BGP neighbor to the hub is up, but no BGP routes are received for the remote spoke's LAN. What is the root cause?

A.The flow monitor is applied to the tunnel interface in the input direction and uses a flow record that matches on BGP port 179, causing BGP packets to be dropped.
B.The flow exporter's source interface is set to Tunnel0, but the tunnel is not yet established, so BGP updates sourced from Tunnel0 are unreachable.
C.The BGP neighbor is configured with a password that does not match the hub.
D.The NHRP authentication key is missing, preventing spoke-to-spoke communication.
AnswerB

If the exporter source is the tunnel interface, the router will try to send BGP packets with that source IP, but the tunnel is not up, so the packets are dropped. This prevents BGP from establishing.

Why this answer

Flexible NetFlow can be applied to the tunnel interface, but if the flow monitor is configured with a sampler or a flow record that changes the interface behavior, it might interfere with NHRP or BGP. Specifically, if the flow monitor is configured to use a flow record that includes the 'input interface' field and is applied in the input direction, it may cause the router to process packets differently, potentially dropping NHRP packets or BGP updates. However, the most likely issue is that the flow monitor is configured with a match statement that inadvertently matches BGP packets and applies an action (like drop) or that the flow exporter is misconfigured to use the tunnel interface as source, causing BGP updates to be sourced from the tunnel IP, which is not reachable.

The correct answer is that the flow exporter's source interface is set to Tunnel0, which is not reachable from the hub until the tunnel is up, creating a chicken-and-egg problem.

Full explanation →
449
MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto ipsec sa | include pkts #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 Based on this output, what is the problem?

A.The IPsec SA is not established; the tunnel is down.
B.No interesting traffic is being sent through the tunnel; check the crypto ACL and routing.
C.The tunnel is working correctly; all packets are being encrypted.
D.The remote peer is not responding; the SA is in MM_NO_STATE.
AnswerB

Zero packet counts indicate no traffic matches the crypto ACL or routing is not directing traffic to the tunnel.

Why this answer

All packet counters are zero, indicating no traffic has been encrypted or decrypted. This could be due to a misconfigured crypto ACL that does not match the actual traffic, or routing issues preventing traffic from reaching the tunnel.

Full explanation →
450
MCQmedium

snmp-server group MyGroup v3 priv\nsnmp-server user MyUser MyGroup v3 auth sha MyPassword priv aes 128 MyPrivKey What is missing from this SNMPv3 configuration?

A.The group is missing a view definition to allow access to MIB objects.
B.The authentication protocol should be MD5 instead of SHA.
C.The privacy password must be at least 16 characters long.
D.The user must be configured under a different group name.
AnswerA

By default, an SNMPv3 group without a view has no access to MIB objects; a view must be configured using 'snmp-server view' and associated with the group.

Why this answer

The configuration creates an SNMPv3 group 'MyGroup' with priv security level and a user 'MyUser' with SHA authentication and AES 128 privacy, but it does not include a view definition for the group. Without a view (e.g., via the 'snmp-server group MyGroup v3 priv view MyView' command or a default view), the group has no access to any MIB objects, rendering the SNMPv3 configuration non-functional for queries or notifications.

Exam trap

Cisco often tests the misconception that configuring authentication and privacy alone is sufficient for SNMPv3 functionality, but the missing view definition is the critical oversight that prevents any MIB access.

How to eliminate wrong answers

Option B is wrong because SHA is a valid and commonly used authentication protocol for SNMPv3; MD5 is also supported but not required, and Cisco does not mandate MD5 over SHA. Option C is wrong because the privacy password length requirement for AES 128 is not a fixed 16-character minimum; Cisco SNMPv3 accepts passwords of varying lengths, and the key derivation process handles shorter or longer strings. Option D is wrong because the user is correctly associated with the group 'MyGroup' via the 'snmp-server user MyUser MyGroup v3' command; there is no requirement for a different group name.

Full explanation →
Page 5

Page 6 of 27

Page 7

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →