Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 451–525

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 27

Page 8
451
MCQhard

In a VRF-Lite network, OSPF is configured with a distribute-list that filters routes from being installed in the routing table. The engineer notices that the distribute-list is working, but the filtered routes are still being advertised to OSPF neighbors. Which is the most likely explanation?

A.The distribute-list is applied inbound, which only prevents the route from being installed in the RIB, but the route remains in the OSPF LSDB and is advertised to neighbors.
B.The distribute-list is applied outbound, but the neighbor has a higher priority, so the route is still advertised.
C.The OSPF process has the 'database-filter all out' command configured, which overrides the distribute-list.
D.The distribute-list uses an ACL that does not match the route correctly, so the route is not filtered.
AnswerA

Distribute-list in filters routes from the RIB, not the LSDB. OSPF advertises based on the LSDB, so the route is still advertised.

Why this answer

The OSPF distribute-list in (or out) filters routes from being installed in the routing table (RIB) but does not affect the OSPF link-state database (LSDB) or the advertisement of routes. To filter routes from being advertised, the distribute-list must be applied outbound, or an area filter (using 'area range' with 'not-advertise') must be used. This is a common misconception: distribute-list in only affects local RIB installation, not LSDB propagation.

Full explanation →
452
MCQhard

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal host 192.168.1.10 can access the internet, but when it tries to connect to an internal server at 10.1.1.10 via its public IP 203.0.113.10, the connection fails. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 10.1.1.10 --- ---. The host's traffic is being NATed to 203.0.113.1, but the server's response is sent to 203.0.113.1. What is the root cause?

A.Enable NAT hairpinning by configuring ip nat inside source static tcp 10.1.1.10 80 203.0.113.10 80 and ensuring the router has a route to the public IP.
B.Configure the host to use the private IP of the server instead of the public IP.
C.Add a static route on the router for 203.0.113.10 pointing to the server.
D.Use ip nat outside source list 100 interface GigabitEthernet0/1 overload.
AnswerA

Hairpinning allows the router to forward traffic from inside to inside via the public IP.

Why this answer

The root cause is that NAT hairpinning (also known as NAT reflection or NAT loopback) is not enabled. When an internal host (192.168.1.10) tries to reach an internal server (10.1.1.10) using the server's public IP (203.0.113.10), the router performs NAT for the host's traffic, translating its source to 203.0.113.1. The server's response is sent to 203.0.113.1 (the router's outside interface), but without hairpinning, the router does not know to forward this response back to the internal host because it expects the traffic to come from the outside.

Option A corrects this by adding a static NAT for the server (mapping 10.1.1.10:80 to 203.0.113.10:80) and ensuring the router has a route to the public IP, which enables the router to perform the necessary NAT translation and forward the response back to the internal host.

Exam trap

Cisco often tests the misconception that NAT hairpinning is automatically handled by dynamic PAT, when in fact it requires explicit static NAT configuration and a route to the public IP to force the router to perform the necessary translations.

How to eliminate wrong answers

Option B is wrong because telling the host to use the private IP of the server bypasses the need for NAT entirely, but it does not solve the underlying NAT hairpinning issue; the host should be able to use the public IP as intended. Option C is wrong because adding a static route for 203.0.113.10 pointing to the server does not address the NAT translation problem; the router already knows how to reach the server (10.1.1.10) via its routing table, but the issue is that the router does not perform NAT for traffic that enters and exits the same inside interface. Option D is wrong because using 'ip nat outside source list 100 interface GigabitEthernet0/1 overload' would translate the source of traffic coming from the outside, which is not relevant here; the problem involves internal-to-internal traffic that needs NAT hairpinning, not outside source translation.

Full explanation →
453
MCQhard

A DMVPN network with NHRP is configured for spoke-to-spoke tunnels. Spoke routers R1 and R2 are both connected to a hub router H1. Spoke-to-spoke traffic is not working. R1's show dmvpn shows a dynamic NHRP mapping for R2's tunnel IP to R2's physical IP, but ping from R1's tunnel IP to R2's tunnel IP fails. R1's show ip nhrp shows the mapping as 'dynamic' with no flags. The hub has no special configuration. What is the root cause?

A.The hub is missing the ip nhrp redirect command, and the spokes are missing ip nhrp shortcut, preventing spoke-to-spoke direct communication.
B.The spoke routers have incorrect NHRP authentication, causing the mapping to be invalid.
C.The tunnel interface on R1 is not in the correct VRF.
D.The IPsec transform set is mismatched between spokes.
AnswerA

Without these commands, the hub does not trigger NHRP resolution for spoke-to-spoke traffic, and spokes do not install the necessary routes.

Why this answer

In a DMVPN phase 3 network, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to process them via the `ip nhrp shortcut` command. Without `ip nhrp redirect` on the hub, the hub forwards traffic between spokes without signaling them to establish a direct tunnel. The dynamic NHRP mapping on R1 for R2's tunnel IP indicates that R1 has learned R2's physical address via NHRP registration, but without the shortcut flag, R1 will not use that mapping to send traffic directly; instead, it continues to send traffic through the hub, which fails if the hub does not have a route or if the spoke-to-spoke tunnel is not triggered.

Exam trap

Cisco often tests the distinction between DMVPN phase 2 (where spokes automatically build direct tunnels without redirect) and phase 3 (which requires explicit redirect and shortcut commands), leading candidates to assume that a dynamic NHRP mapping alone is sufficient for spoke-to-spoke communication.

How to eliminate wrong answers

Option B is wrong because incorrect NHRP authentication would prevent the NHRP registration and mapping from being created at all; the show dmvpn output shows a dynamic mapping, so authentication is not the issue. Option C is wrong because a VRF mismatch would typically prevent the tunnel interface from being reachable or routing correctly, but the presence of a dynamic NHRP mapping indicates that the tunnel interface is operational and in the correct VRF. Option D is wrong because an IPsec transform set mismatch would cause the IPsec tunnel to fail to establish, but the question states that the mapping is present and the ping fails at the tunnel IP level, not at the IPsec level; DMVPN can operate without IPsec, and the issue is with NHRP routing, not encryption.

Full explanation →
454
MCQhard

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up but traffic from the remote LAN to the local LAN is not working. The engineer pings from the remote router to the local LAN IP and it succeeds. However, pings from a host on the remote LAN to a host on the local LAN fail. What is the most likely cause?

A.The crypto map access list on the remote router does not include the remote LAN subnet.
B.The local router does not have a route to the remote LAN subnet in its routing table.
C.The IPsec transform set is missing the esp-sha-hmac authentication.
D.The pre-shared key is mismatched between the two routers.
AnswerB

Correct because the local router must have a route to the remote LAN subnet to route the return traffic back through the tunnel. Without it, the return traffic is dropped.

Why this answer

The symptom indicates that the VPN tunnel is working for traffic sourced from the router itself, but not for traffic from the remote LAN. This is typically caused by a missing route on the local router for the remote LAN subnet, or a missing route on the remote router for the local LAN subnet, preventing the return traffic from being routed correctly.

Full explanation →
455
Drag & Dropmedium

Drag and drop the steps to verify and validate syslog operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, check the logging status with show logging. Then, verify that syslog messages are being sent to the configured server. Next, confirm the severity level of logged messages.

After that, validate that the syslog server is receiving messages. Finally, test by generating a test log message.

Full explanation →
456
MCQmedium

A network engineer runs the following command to verify IPv6 device tracking: R1# show ipv6 device-tracking database Interface MAC Address VLAN IPv6 Address State Age Policy Fa0/0 0011.2233.4455 10 2001:db8::1 ACTIVE 10 TRUSTED Fa0/0 00aa.bbcc.ddee 10 2001:db8::2 ACTIVE 5 INSPECT Fa0/0 1111.2222.3333 10 2001:db8::3 VERIFY 0 - What does this output indicate?

A.Device tracking shows two devices in ACTIVE state and one in VERIFY state, indicating ongoing ND verification for the third device.
B.All devices are in ACTIVE state, indicating stable tracking.
C.Device tracking is disabled, and the database is empty.
D.Device tracking only tracks IPv4 addresses.
AnswerA

The VERIFY state means the device is being validated before becoming active.

Why this answer

The output shows three entries: two in ACTIVE state (indicating successful ND verification) and one in VERIFY state (meaning the device is currently undergoing Neighbor Discovery verification). The VERIFY state with age 0 indicates that the device has been recently discovered and is being validated before transitioning to ACTIVE. This confirms that device tracking is actively monitoring IPv6 devices, with ongoing ND verification for the third device.

Exam trap

Cisco often tests the distinction between ACTIVE and VERIFY states in IPv6 device tracking, where candidates mistakenly assume all entries are stable (ACTIVE) or that VERIFY indicates a failure, rather than recognizing it as a normal transitional state during ND verification.

How to eliminate wrong answers

Option B is wrong because not all devices are in ACTIVE state; the third device is in VERIFY state, which indicates ongoing verification, not stable tracking. Option C is wrong because the database is not empty; it contains three entries, and device tracking is clearly enabled as shown by the populated output. Option D is wrong because device tracking supports IPv6 addresses, as evidenced by the IPv6 Address column containing IPv6 addresses (2001:db8::1, etc.), not IPv4 addresses.

Full explanation →
457
MCQhard

What is the default IPv6 hop limit for packets sent over a tunnel interface in Cisco IOS-XE?

A.64
B.128
C.255
D.32
AnswerA

The default hop limit for originated IPv6 packets is 64.

Why this answer

The default IPv6 hop limit for packets sent over a tunnel interface in Cisco IOS-XE is 64. This value is defined in RFC 2473 and is used by Cisco for tunnel interfaces such as GRE, IPv6-in-IPv4, and ISATAP. The hop limit is decremented by one when the packet is encapsulated and again when it is decapsulated, so the effective end-to-end hop count is reduced by two.

Exam trap

Cisco often tests the distinction between default values for native interfaces (128) versus tunnel interfaces (64), and candidates mistakenly apply the native interface default to tunnels.

How to eliminate wrong answers

Option B (128) is wrong because 128 is the default hop limit for IPv6 packets sent over native interfaces (e.g., physical Ethernet) in Cisco IOS-XE, not for tunnel interfaces. Option C (255) is wrong because 255 is the default TTL for IPv4 packets on Cisco routers, not the IPv6 hop limit for tunnels. Option D (32) is wrong because 32 is not a standard default value for IPv6 hop limits; it might be confused with the default hop limit used in some older or non-Cisco implementations.

Full explanation →
458
MCQmedium

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue: R1# show ipv6 access-list FILTER IPv6 access list FILTER permit ipv6 2001:DB8:1::/48 any sequence 10 deny ipv6 2001:DB8:2::/48 any sequence 20 permit ipv6 any any sequence 30 What does this output indicate?

A.The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.
B.The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.
C.The access list will deny all traffic because of the deny statement.
D.The access list is invalid because IPv6 access lists require implicit deny at the end.
AnswerA

Correct. Sequence 10 permits the first prefix, sequence 20 denies the second, and sequence 30 permits everything else.

Why this answer

The output shows an IPv6 access list with three explicit entries. Sequence 10 permits traffic from source 2001:DB8:1::/48 to any destination, sequence 20 denies traffic from 2001:DB8:2::/48 to any destination, and sequence 30 permits all other IPv6 traffic. Because sequence 30 explicitly permits any any, traffic not matching the first two entries is permitted, overriding the default implicit deny at the end of the list.

Exam trap

Cisco often tests the interaction between explicit permit entries and the implicit deny, where candidates mistakenly assume the implicit deny applies even when a later explicit permit any any exists.

How to eliminate wrong answers

Option B is wrong because it states that all other IPv6 traffic is implicitly denied, but the explicit permit any any entry at sequence 30 permits all remaining traffic, so the implicit deny is never reached. Option C is wrong because the deny statement only blocks traffic from 2001:DB8:2::/48; the permit entries allow other traffic, so the list does not deny all traffic. Option D is wrong because IPv6 access lists do have an implicit deny at the end, but the list is not invalid; the explicit permit any any entry is valid and overrides the implicit deny for unmatched traffic.

Full explanation →
459
MCQmedium

Given the partial configuration: crypto isakmp policy 10 encryption aes 256 authentication pre-share group 14 ! crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 192.168.1.2 set transform-set TSET match address 101 ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 crypto map CMAP ! access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 What is the effect of the 'crypto isakmp key' command with address 0.0.0.0 0.0.0.0?

A.The key will be used only for peer 192.168.1.2 because the crypto map specifies that peer.
B.The key will be accepted from any peer, creating a security vulnerability.
C.The configuration will fail because the key must specify a specific peer address.
D.The key will be ignored because there is no ISAKMP policy with a lifetime.
AnswerB

0.0.0.0 0.0.0.0 is a wildcard that matches any IP address, so any peer can use this key.

Why this answer

The `crypto isakmp key` command with address `0.0.0.0 0.0.0.0` acts as a wildcard, meaning the pre-shared key will be accepted from any peer IP address during IKE Phase 1 authentication. This effectively disables peer-specific validation, allowing any device that knows the key to establish an ISAKMP SA, which is a significant security vulnerability.

Exam trap

Cisco often tests the misconception that the crypto map's `set peer` command restricts which peers can authenticate with the pre-shared key, but in reality, the ISAKMP key wildcard overrides that restriction at the IKE layer.

How to eliminate wrong answers

Option A is wrong because the crypto map's peer specification only controls which peer is used for IPsec SA negotiation, not which peer is allowed to authenticate with the pre-shared key; the wildcard key overrides any peer restriction at the IKE level. Option C is wrong because the configuration is valid; Cisco IOS allows a wildcard address (0.0.0.0 0.0.0.0) for the ISAKMP key, and it will not cause a configuration failure. Option D is wrong because the ISAKMP key is not dependent on a lifetime being configured in the ISAKMP policy; the key is used regardless of whether a lifetime is explicitly set.

Full explanation →
460
MCQmedium

A network engineer configures CoPP on a router to limit ICMP traffic to 5000 bps. After the policy is applied, the engineer notices that the router is not responding to ping requests from a remote network. However, the router can ping other devices successfully. The engineer checks the CoPP statistics and sees that the ICMP class has dropped packets. What is the most likely root cause?

A.The CoPP policy is dropping incoming ICMP echo requests because the police rate is too low.
B.The CoPP policy is dropping outgoing ICMP echo replies because the police rate applies to both directions.
C.The router's interface ACL is blocking incoming ICMP traffic.
D.The router's ICMP rate-limit feature is enabled globally.
AnswerA

Incoming ICMP packets are policed by CoPP, and if the rate is exceeded, they are dropped, preventing the router from responding.

Why this answer

The CoPP policy is applied to control plane traffic, which includes ICMP echo requests destined to the router itself. When the police rate is set to 5000 bps, incoming ICMP echo requests are rate-limited and dropped if they exceed this threshold, causing the router to stop responding to pings. The fact that the router can still ping other devices confirms that the data plane is unaffected, isolating the issue to control plane policing of inbound ICMP.

Exam trap

The trap here is that candidates confuse the direction of CoPP policing, assuming it applies to both inbound and outbound control plane traffic, when in fact only inbound traffic to the control plane is policed by default.

How to eliminate wrong answers

Option B is wrong because CoPP polices traffic entering the control plane, not traffic leaving it; ICMP echo replies are generated by the router's control plane and are not subject to the same inbound CoPP policy. Option C is wrong because the engineer checked CoPP statistics and saw drops specifically in the ICMP class, which points to CoPP rather than an interface ACL; an ACL would show drops in ACL counters, not CoPP class counters. Option D is wrong because the ICMP rate-limit feature (using the 'ip icmp rate-limit' command) limits ICMP unreachable messages, not echo replies or requests, and would not cause the described behavior of dropped packets in CoPP statistics.

Full explanation →
461
Multi-Selecthard

Which THREE symptoms indicate that a device's NTP synchronization is failing? (Choose THREE.)

Select 3 answers
A.The output of 'show clock' does not have an asterisk (*) next to the time.
B.The output of 'show ntp associations' shows a dot (.) instead of an asterisk (*) for the peer.
C.Syslog messages indicate 'NTP synchronization lost'.
D.The output of 'show ntp status' shows 'Clock is synchronized'.
E.The command 'ntp peer 10.1.1.1' is configured.
AnswersA, B, C

The asterisk indicates the clock is synchronized to an NTP source.

Why this answer

The asterisk (*) next to the time in the output of 'show clock' indicates that the device's clock is synchronized via NTP. If the asterisk is missing, the clock is not synchronized, which is a direct symptom of NTP synchronization failure.

Exam trap

Cisco often tests the distinction between NTP association status symbols (asterisk vs. dot) and the synchronization state in 'show ntp status', leading candidates to confuse a reachable peer with a synchronized one.

Full explanation →
462
MCQeasy

In an MPLS L3VPN environment using MP-BGP, what is the default value of the BGP keepalive timer on Cisco IOS-XE?

A.30 seconds
B.60 seconds
C.90 seconds
D.180 seconds
AnswerB

Correct. The default keepalive timer is 60 seconds.

Why this answer

The default BGP keepalive timer is 60 seconds, as defined in RFC 4271 and implemented in Cisco IOS-XE.

Full explanation →
463
Multi-Selecthard

Which TWO statements about OSPFv2 LSA types and their troubleshooting significance are true? (Choose TWO.)

Select 2 answers
A.Type 5 LSAs are flooded throughout all OSPF areas, including the backbone area.
B.Type 7 LSAs are used in NSSA areas to advertise external routes and are translated to Type 5 LSAs at the ABR.
C.Type 3 LSAs describe stub network prefixes within an area and are generated by DRs.
D.Type 4 LSAs are used to advertise external routes into the OSPF domain by ASBRs.
E.Type 1 LSAs are summary LSAs that describe inter-area routes.
AnswersA, B

Correct. Type 5 (AS-External) LSAs are flooded across the entire OSPF domain, except stub areas and NSSAs (unless translated).

Why this answer

Type 5 LSAs are always flooded throughout the entire OSPF domain, and type 7 LSAs are used in NSSA areas to carry external routes. Type 3 LSAs are summary LSAs, not stub network LSAs. Type 4 LSAs advertise ASBR reachability, not external routes.

Type 1 LSAs are router LSAs, not summary LSAs.

Full explanation →
464
MCQhard

An engineer configures EIGRP named mode with an offset-list that increases the metric of a route on Router A. The route is still selected as the best path on Router A's neighbor, Router B, because Router B learns the same prefix via another EIGRP neighbor with a higher metric. Which is the most likely explanation?

A.The offset-list modifies the advertised distance (AD) sent to neighbors, but Router B ignores it.
B.The offset-list only affects the feasible distance (FD) on Router A; the advertised distance (AD) sent to Router B remains unchanged.
C.The offset-list is applied to the wrong interface; it must be applied to the outgoing interface towards Router B.
D.EIGRP named mode does not support offset-list; only classic mode supports it.
AnswerB

Router B uses the AD from Router A for its feasibility condition and metric comparison; the offset-list does not alter the AD.

Why this answer

The offset-list in EIGRP affects the composite metric (FD) of the route on the router where it is applied. However, the advertised distance (AD) sent to neighbors is not modified. Router B still sees the original AD from Router A and compares it with metrics from other neighbors.

Full explanation →
465
MCQhard

A network engineer runs the following command to troubleshoot a VRF-Lite redistribution issue: R1# debug ip routing vrf CUSTOMER_E Output: RT: add 10.3.3.0/24 via 10.1.1.2, ospf 200 metric [110/20] RT: add 10.3.3.0/24 via 10.1.1.2, eigrp 100 metric [90/131072] tag 0 RT: closer admin distance for 10.3.3.0/24, adding via eigrp 100 RT: add 10.3.3.0/24 to routing table, via eigrp 100 What does this output indicate?

A.The route 10.3.3.0/24 is added from OSPF 200 because it has a lower metric.
B.The route 10.3.3.0/24 is added from EIGRP 100 because it has a lower administrative distance than OSPF.
C.The route 10.3.3.0/24 is added from both OSPF and EIGRP, creating an equal-cost path.
D.The route 10.3.3.0/24 is not added to the routing table due to a tag mismatch.
AnswerB

Correct. EIGRP AD 90 is lower than OSPF AD 110, so EIGRP route is preferred.

Why this answer

The 'debug ip routing vrf' command shows route insertion and selection events for a specific VRF. The output shows that route 10.3.3.0/24 is learned from both OSPF 200 (with administrative distance 110) and EIGRP 100 (with administrative distance 90). Because EIGRP has a lower administrative distance, it is chosen as the best path and added to the routing table.

Full explanation →
466
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 traffic IPv6 statistics: Rcvd: 1000 total, 800 unicast, 200 multicast Sent: 900 total, 700 unicast, 200 multicast Errors: 0 Dropped: 0 ND statistics: NS: 50 received, 40 sent NA: 30 received, 20 sent RS: 10 received, 5 sent RA: 2 received, 8 sent Redirect: 0 received, 0 sent Based on this output, which statement is correct?

A.The router is not sending any Router Advertisements.
B.The router is receiving more Neighbor Solicitations than it is sending, which is expected.
C.There is a high number of errors in IPv6 traffic.
D.The router is dropping many packets.
AnswerB

NS received (50) vs sent (40) is typical as the router responds to queries.

Why this answer

In IPv6, Neighbor Solicitations (NS) are used for address resolution and duplicate address detection. A router typically receives more NS messages than it sends, as hosts send NS to resolve the router's link-layer address, while the router sends NS primarily for DAD or to verify neighbor reachability. The output shows 50 NS received versus 40 sent, which aligns with this expected behavior.

Exam trap

Cisco often tests the expected asymmetry in Neighbor Solicitation counts between routers and hosts, where candidates mistakenly think a router should send more NS than it receives, but in practice, routers receive more NS from hosts performing address resolution.

How to eliminate wrong answers

Option A is wrong because the router has sent 8 Router Advertisements (RA) and received 2, indicating it is actively sending RAs, not failing to do so. Option C is wrong because the output explicitly shows 'Errors: 0', meaning no errors in IPv6 traffic. Option D is wrong because the output shows 'Dropped: 0', indicating no packets are being dropped.

Full explanation →
467
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nhrp 10.0.0.2/32 via 10.0.0.2, Tunnel0 created 00:15:30, expire 01:44:30 Type: dynamic, Flags: used NBMA address: 192.168.1.2 10.0.0.3/32 via 10.0.0.3, Tunnel0 created 00:10:20, expire 01:49:40 Type: dynamic, Flags: used NBMA address: 192.168.1.3 Based on this output, which statement is correct?

A.Both NHRP entries are static.
B.Both NHRP entries are active and dynamically learned.
C.The NHRP entries have expired.
D.The NBMA addresses are IPv6 addresses.
AnswerB

Type dynamic and flags used indicate active dynamic entries.

Why this answer

The output shows two NHRP entries with 'Type: dynamic', meaning they were learned dynamically (not statically configured). Both have 'Flags: used', indicating they are active. The expiration times show they will expire in about 1 hour 44 minutes and 1 hour 49 minutes, respectively.

Full explanation →
468
Multi-Selecthard

Which TWO statements correctly describe the behavior of route summarization in RIP? (Choose TWO.)

Select 2 answers
A.RIPv2 automatically summarizes routes to their classful boundary by default, and this behavior can be disabled with the 'no auto-summary' command.
B.Manual route summarization in RIP is configured using the 'network' command under the RIP process.
C.When manual summarization is configured, RIP automatically installs a discard route for the summary prefix to prevent routing loops.
D.The summary route in RIP is advertised with a metric equal to the lowest hop count among the component routes.
E.RIP supports both automatic and manual summarization only for classful networks.
AnswersA, D

Correct. RIPv2 has auto-summary enabled by default, which causes classful summarization. It can be disabled to allow VLSM and CIDR prefixes.

Why this answer

RIPv2 automatically summarizes classful routes by default; this can be disabled with 'no auto-summary'. Manual summarization is configured per interface with 'ip summary-address rip', and the summary route is advertised with the metric (hop count) of the best component route—i.e., the lowest hop count among the contributing routes. Option C is incorrect because while a discard route is often installed to prevent loops, the statement 'RIP automatically installs a discard route' is not universally true for all manual summarizations; in many implementations, the discard route is created only when the summary route is more specific than the component routes, not automatically for every manual summary.

Full explanation →
469
MCQmedium

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

A.TCP port 49 is blocked between the router and the TACACS+ server.
B.The TACACS+ server shared key is incorrect.
C.The username 'admin' does not exist on the TACACS+ server.
D.The TACACS+ server is not configured for the router's IP address.
AnswerA

Correct because TACACS+ uses TCP port 49; if blocked, the router cannot establish a connection to the server.

Why this answer

The 'test aaa group tacacs+ admin cisco123 new-code' command uses the 'new-code' flag, which forces the test to use the TACACS+ protocol (TCP port 49) rather than the older, less secure method. Since the router can ping the TACACS+ server, Layer 3 connectivity is fine, but a failed authentication with 'new-code' strongly indicates that TCP port 49 is blocked by a firewall or ACL between the router and the server. TACACS+ relies on TCP port 49 for all communication, so blocking this port causes immediate failure.

Exam trap

Cisco often tests the distinction between Layer 3 reachability (ping) and Layer 4 connectivity (TCP port 49), trapping candidates who assume that successful ping implies full connectivity to the TACACS+ server.

How to eliminate wrong answers

Option B is wrong because if the shared key were incorrect, the TACACS+ server would typically respond with an authentication failure (e.g., 'authen failed') rather than a generic 'FAILED' from the test command, and the 'new-code' flag does not bypass key validation. Option C is wrong because the 'test aaa' command simulates authentication against the TACACS+ server; if the username 'admin' did not exist, the server would return a 'user not found' or similar error, not a generic 'FAILED' from the router's perspective. Option D is wrong because if the TACACS+ server were not configured for the router's IP address, the server would either drop the packet silently or respond with a rejection, but the router's ability to ping the server suggests no Layer 3 filtering; however, the server's configuration for the router's IP is a server-side setting that would cause a different failure mode (e.g., no response), not a generic 'FAILED' from the test command.

Full explanation →
470
MCQhard

A DMVPN network uses PBR to route traffic from spoke routers to specific hubs based on source IP. After a hub failure, traffic from spoke 1 (source 192.168.1.0/24) is being sent to a backup hub, but the backup hub drops the traffic. Router R1 (spoke) shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows traffic being forwarded to next-hop 10.1.1.2 (backup hub). Router R2 (backup hub) shows: 'show ip route 192.168.1.0' returns no route. What is the root cause?

A.The backup hub does not have a route to the source subnet, causing it to drop traffic. Add a static route or enable routing protocol on the backup hub for the spoke subnet.
B.The PBR route-map on the spoke is missing a 'set ip next-hop verify-availability' command, causing it to use the backup hub even when it is not fully reachable.
C.The spoke's routing table has a better route to the destination via the backup hub, overriding PBR.
D.The backup hub has a route to the source subnet but with a higher administrative distance, causing it to be ignored.
AnswerA

PBR forwards traffic to the backup hub, but without a return route, the hub cannot respond. This is a common issue in DMVPN with PBR when hubs are not fully meshed.

Why this answer

PBR on the spoke forwards traffic to the backup hub, but the backup hub does not have a route back to the source subnet (192.168.1.0/24). This causes asymmetric routing, where the backup hub drops the traffic because it cannot find a return route. The solution is to ensure the backup hub has a route to the spoke subnet, either via dynamic routing or a static route.

Full explanation →
471
MCQhard

An engineer configures OSPF on a link between two routers with MTU 1500 on one side and MTU 1400 on the other. The adjacency forms but is stuck in EXSTART. Which is the most likely explanation?

A.The router with the larger MTU sends DBD packets that exceed the smaller MTU, causing them to be dropped silently.
B.The router with the smaller MTU cannot process OSPF hello packets from the larger MTU side.
C.The adjacency is stuck because OSPF network type mismatch prevents DBD exchange.
D.The router with the larger MTU must have 'ip ospf mtu-ignore' configured to bypass the MTU check.
AnswerA

OSPF DBD packets are sized based on the outgoing interface MTU. If the packet is larger than the receiving interface MTU, it is dropped, preventing the exchange of LSAs.

Why this answer

When OSPF routers have mismatched MTUs, the router with the larger MTU (1500) will send Database Description (DBD) packets that include the full MTU size in the interface MTU field. The router with the smaller MTU (1400) will reject these packets because they exceed its MTU, causing them to be silently dropped. This prevents the DBD exchange from completing, leaving the adjacency stuck in EXSTART state.

Exam trap

Cisco often tests the specific state where the adjacency gets stuck (EXSTART) to distinguish between MTU mismatch and other OSPF issues, and the trap here is that candidates may incorrectly attribute the problem to hello packet failures or network type mismatches rather than the silent dropping of DBD packets due to MTU mismatch.

How to eliminate wrong answers

Option B is wrong because OSPF hello packets are small (typically 44 bytes) and will not be dropped due to MTU mismatch; the issue is with DBD packets, not hello packets. Option C is wrong because a network type mismatch would typically prevent the adjacency from forming at all or cause it to be stuck in INIT/2WAY, not EXSTART; EXSTART specifically indicates the DBD exchange phase has begun but cannot complete. Option D is wrong because the 'ip ospf mtu-ignore' command is used to bypass the MTU check on the router receiving the DBD packets, but it is not a requirement for the larger MTU side; the command should be configured on the router with the smaller MTU to allow larger DBD packets to be accepted.

Full explanation →
472
Drag & Dropmedium

Drag and drop the steps to configure a Control Plane Policing (CoPP) policy into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts by identifying traffic with a class-map, then grouping classes in a policy-map, applying actions (e.g., drop), attaching the policy to the control-plane, and finally verifying the configuration. This follows the standard MQC (Modular QoS CLI) workflow.

Full explanation →
473
Multi-Selecthard

Which TWO statements correctly describe the behavior of the 'default-information originate' command in the context of route redistribution? (Choose TWO.)

Select 2 answers
A.In OSPF, the 'default-information originate' command always injects a default route into the OSPF domain, even if no default route exists in the routing table, provided the 'always' keyword is used.
B.In EIGRP, the 'redistribute static' command automatically injects a default route if a static default route is configured.
C.In EIGRP, the 'default-information originate' command will inject a default route only if a default route is present in the routing table, unless the 'always' keyword is configured.
D.In OSPF, the 'default-information originate always' command will inject a default route even if OSPF is not configured on any interface.
E.In both OSPF and EIGRP, the 'default-information originate' command automatically redistributes all connected routes into the routing protocol.
AnswersA, C

Correct. The 'always' keyword forces OSPF to originate a default route even if no default route is present in the routing table.

Why this answer

The 'default-information originate' command in OSPF and EIGRP has specific behaviors. In OSPF, it always originates a default route regardless of the routing table, unless the 'always' keyword is omitted and there is no default route in the routing table. In EIGRP, it requires a default route in the routing table to inject the default, unless the 'always' keyword is used.

The command does not automatically redistribute all routes; it only injects a default route.

Full explanation →
474
MCQeasy

What is the default role of an interface in IPv6 Neighbor Discovery Inspection when no policy is explicitly applied?

A.Untrusted
B.Trusted
C.Server
D.Host
AnswerA

The default role is untrusted, so ND messages are inspected.

Why this answer

In IPv6 Neighbor Discovery Inspection (NDI), an interface is considered untrusted by default when no policy is explicitly applied. This default ensures that all incoming Neighbor Discovery (ND) messages are subject to validation against the binding table, preventing attacks such as Neighbor Advertisement spoofing and Duplicate Address Detection (DAD) exploitation. Only interfaces explicitly configured with a trust policy bypass this inspection.

Exam trap

Cisco often tests the misconception that all interfaces start as trusted or that a 'host' or 'server' role exists, when in fact the default is untrusted and only two roles (untrusted and trusted) are defined for NDI.

How to eliminate wrong answers

Option B is wrong because a trusted interface would bypass ND inspection entirely, which is not the default behavior; trust must be explicitly configured. Option C is wrong because 'Server' is not a valid role for an interface in IPv6 NDI; it refers to a DHCPv6 server role in other contexts. Option D is wrong because 'Host' is not a defined interface role in IPv6 NDI; the roles are only untrusted (default) and trusted (explicit).

Full explanation →
475
MCQmedium

A network engineer runs the following command to troubleshoot a VRF-Lite BGP route advertisement issue: R1# show bgp vpnv4 vrf CUSTOMER_D 10.2.2.0/24 Output: BGP routing table entry for 10.2.2.0/24, version 5 Paths: (1 available, best #1, table CUSTOMER_D) Advertised to update-groups: 1 Refresh Epoch 1 Local 10.1.1.2 (metric 20) from 10.1.1.2 (2.2.2.2) Origin incomplete, metric 0, localpref 100, valid, internal, best Extended Community: RT:100:200 mpls labels in/out nolabel/20 What does this output indicate?

A.The route 10.2.2.0/24 is learned via an external BGP peer and is not the best path.
B.The route 10.2.2.0/24 is learned from 10.1.1.2 with an MPLS label of 20 and is the best path.
C.The route 10.2.2.0/24 is not advertised to any update groups.
D.The route 10.2.2.0/24 has no extended community attached.
AnswerB

Correct. The output shows the route is internal, best, and has an MPLS label of 20.

Why this answer

The 'show bgp vpnv4 vrf' command displays BGP VPNv4 route details for a specific VRF. The output shows route 10.2.2.0/24 is learned from neighbor 10.1.1.2 (router ID 2.2.2.2) with a metric of 20. It is valid, internal, and the best path.

The route has an extended community RT:100:200 and an MPLS label of 20 (outgoing).

Full explanation →
476
MCQmedium

What is the default flow-cache timeout for NetFlow version 9 on Cisco IOS-XE?

A.15 minutes
B.30 minutes
C.60 minutes
D.5 minutes
AnswerB

Correct. The default flow-cache timeout for NetFlow v9 is 30 minutes.

Why this answer

The default flow-cache timeout for NetFlow version 9 is 30 minutes, after which inactive flows are aged out.

Full explanation →
477
MCQhard

An engineer configures Control Plane Policing (CoPP) with a policy that denies all traffic in class-default. After applying the policy, BGP sessions to the router fail. What is the most likely explanation?

A.The class-default has an explicit 'drop' action, which overrides the implicit permit and drops all unmatched traffic, including BGP packets.
B.The CoPP policy was applied to the wrong interface, so BGP packets are dropped by the interface ACL.
C.The BGP packets are matched by another class with a 'drop' action, but the class-default is irrelevant.
D.The CoPP policy uses 'rate-limit' in bps instead of pps, causing BGP packets to be dropped due to rate limiting.
AnswerA

Explicit deny in class-default changes the default behavior from permit to drop.

Why this answer

CoPP class-default has an implicit permit at the end, but if an explicit deny is configured in class-default, it will drop all traffic not matched by other classes, including BGP control packets. The explicit deny overrides the implicit permit.

Full explanation →
478
Multi-Selecthard

An engineer is troubleshooting a PAT overload configuration on a Cisco router. Inside hosts can access the Internet, but some applications (e.g., FTP, SIP) fail. Which TWO commands can be used to verify the NAT translations and identify the issue? (Choose TWO.)

Select 2 answers
A.'show ip nat translations'
B.'debug ip nat detailed'
C.'show ip nat statistics'
D.'show ip access-lists'
E.'show running-config | include nat'
AnswersA, B

Correct. This shows the current NAT table, including inside local, inside global, outside local, and outside global addresses and ports.

Why this answer

The 'show ip nat translations' command displays the current NAT translation table, including inside local, inside global, outside local, and outside global addresses. This allows the engineer to verify whether translations are being created correctly for protocols like FTP and SIP, which may fail due to missing or incorrect translations, especially when PAT overload is used and application-layer gateways (ALGs) are not handling embedded IP addresses or ports properly.

Exam trap

Cisco often tests the distinction between commands that show configuration versus commands that show operational state; the trap here is that candidates may pick 'show running-config | include nat' thinking it reveals translation issues, but it only shows static configuration, not dynamic translations or real-time failures.

Full explanation →
479
Drag & Drophard

Drag and drop the steps to troubleshoot Control Plane Policing (CoPP) adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Troubleshooting CoPP failures starts by checking if the control-plane policy is applied, then verifying the class-map matches the correct protocol, checking for dropped packets, temporarily disabling CoPP to test, and finally adjusting the policy to permit the necessary traffic. This systematic approach isolates the issue without disrupting the network.

Full explanation →
480
MCQhard

Router R1 is configured with ip nat inside source list 100 interface Loopback0 overload. Internal hosts at 192.168.1.0/24 can access the internet, but external hosts cannot initiate connections to an internal server at 10.1.1.10 that is also behind NAT. The server is supposed to be reachable via static NAT. Configuration: ip nat inside source static tcp 10.1.1.10 80 interface Loopback0 80. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global tcp 10.1.1.10:80 10.1.1.10:80 --- ---. External users get connection timeouts. What is the root cause?

A.The static NAT should use a specific global IP address instead of the interface; configure ip nat inside source static tcp 10.1.1.10 80 203.0.113.10 80.
B.The access-list 100 is blocking inbound traffic.
C.The Loopback0 interface is not in the routing table.
D.The static NAT entry is missing the 'add-route' option.
AnswerA

Using the interface IP for static NAT is not supported; a specific global IP must be defined.

Why this answer

The static NAT configuration uses 'interface Loopback0' as the global address, which means it relies on the interface's dynamically assigned IP address. However, the overload rule (PAT) is also using the same interface, and the static NAT entry shown in 'show ip nat translations' displays the inside local address as the inside global address (10.1.1.10:80), indicating that the static translation is not being applied correctly. The root cause is that static NAT requires a specific global IP address (e.g., 203.0.113.10) to map the internal server, not the interface keyword, because the interface keyword is used for PAT and does not create a fixed one-to-one mapping for inbound connections.

Exam trap

Cisco often tests the distinction between using 'interface' for dynamic PAT and a specific IP for static NAT, trapping candidates who think 'interface' can serve both purposes without understanding that static NAT requires a fixed global address for inbound reachability.

How to eliminate wrong answers

Option B is wrong because access-list 100 is used only for the dynamic NAT overload rule (ip nat inside source list 100 interface Loopback0 overload) and does not affect inbound traffic for static NAT; static NAT bypasses ACLs for translation. Option C is wrong because the Loopback0 interface must be in the routing table for the router to have a route to the internet, and the scenario states internal hosts can access the internet, confirming the interface is operational and reachable. Option D is wrong because the 'add-route' option is not a valid parameter for the 'ip nat inside source static' command; it is used with 'ip nat outside source static' or in some IOS versions for route injection, but it is not required for basic static NAT to function.

Full explanation →
481
MCQmedium

A network engineer runs the following command to troubleshoot a BFD issue: R1# debug bfd event *Mar 1 00:12:34.567: BFD: [R1-to-R2] state DOWN -> UP (async) *Mar 1 00:12:34.568: BFD: [R1-to-R2] echo mode enabled, min-echo-rx-interval 50 ms *Mar 1 00:12:34.569: BFD: [R1-to-R2] starting echo timer, interval 50 ms *Mar 1 00:12:34.570: BFD: [R1-to-R2] sending async packet, state UP, interval 300 ms What does this output indicate?

A.BFD session is flapping between DOWN and UP states.
B.BFD session is established and echo mode is active.
C.BFD session is down due to echo failure.
D.BFD async interval is misconfigured at 300 ms.
AnswerB

The output confirms BFD session is UP, echo mode enabled, and timers are running.

Why this answer

The debug output shows BFD session transitioning from DOWN to UP, with echo mode enabled and the async interval set to 300 ms. This indicates a successful BFD session establishment.

Full explanation →
482
MCQhard

An engineer configures a DMVPN Phase 2 network. Spoke routers can communicate with the hub, but spoke-to-spoke traffic is not establishing dynamically. The engineer verifies that NHRP is configured and that the hub is configured as an NHRP server. Which is the most likely explanation?

A.The hub is not configured with 'no ip next-hop-self' for the routing protocol on the tunnel interface
B.NHRP authentication is mismatched between spokes
C.The spoke routers have not enabled NHRP redirect
D.The tunnel mode is set to GRE multipoint on the spokes
AnswerA

Correct. In Phase 2, the hub must not change the next-hop to itself; otherwise, spokes cannot build direct tunnels.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels require that the spoke routers have a route to the remote spoke's tunnel IP address via the hub. This is achieved by the hub advertising the spoke's prefix with the next-hop set to the spoke's tunnel IP. However, if the hub does not configure 'no ip next-hop-self eigrp' (or similar for the routing protocol), the hub will set the next-hop to itself, preventing the spoke from directly reaching the remote spoke.

This is a common edge case because the default behavior of routing protocols is to set the next-hop to the router's own IP.

Full explanation →
483
MCQhard

A network engineer is troubleshooting NAT for a VPN tunnel. The router has a static NAT rule 'ip nat inside source static 10.0.0.10 203.0.113.10' for a server. The VPN traffic from the remote site to 203.0.113.10 is being NATed to 10.0.0.10, but the return traffic from the server to the remote site is not being translated back. The engineer sees that the server sends packets with source 10.0.0.10 to the remote site's public IP. What should the engineer do to fix this?

A.Add an 'ip nat outside' command on the inside interface.
B.Configure a route-map to exempt the VPN traffic from NAT.
C.Ensure that the router has a route to the remote site's public IP via the outside interface, and that the static NAT entry is correctly applied.
D.Change the static NAT to 'ip nat inside source static 10.0.0.10 203.0.113.10 extendable'.
AnswerC

Correct because if the return traffic from the server is routed out a different interface (e.g., a VPN tunnel interface), the NAT might not be applied; the router needs to route the traffic via the outside interface where NAT is configured.

Why this answer

The issue is that the router lacks a route back to the remote site's public IP via the outside interface, or the static NAT entry is not correctly applied for the return traffic. Without a proper route, the router cannot determine that the return packets (from the inside server 10.0.0.10 to the remote public IP) should be translated back to 203.0.113.10. Ensuring the route exists and the static NAT is correctly configured allows the router to perform the reverse translation and forward the traffic out the outside interface.

Exam trap

Cisco often tests the misconception that NAT issues are always due to missing 'ip nat outside' or 'extendable' keywords, when the real problem is a missing route or incorrect interface assignment for the return traffic.

How to eliminate wrong answers

Option A is wrong because 'ip nat outside' is placed on the interface facing the public network, not the inside interface; adding it on the inside interface would break NAT processing. Option B is wrong because the static NAT is explicitly intended to translate the server's private IP to a public IP for VPN traffic; exempting VPN traffic from NAT would prevent the translation entirely, breaking connectivity. Option D is wrong because the 'extendable' keyword allows multiple static NAT entries for the same inside local address but does not address the routing or translation of return traffic; the core problem is a missing route or misapplied NAT entry.

Full explanation →
484
MCQeasy

What is the default action for a packet that does not match any route-map entry in a PBR policy?

A.The packet is dropped.
B.The packet is forwarded using the routing table.
C.The packet is sent to the CPU for processing.
D.The router sends an ICMP unreachable message.
AnswerB

This is the default behavior for unmatched packets.

Why this answer

If no route-map entry matches, the packet is forwarded using the normal routing table lookup. PBR does not drop unmatched packets by default.

Full explanation →
485
MCQeasy

A network engineer runs the following command on Router R1: R1# show ipv6 access-list FILTER-IPv6 IPv6 access list FILTER-IPv6 permit ipv6 2001:DB8:1::/48 any sequence 10 deny ipv6 any any sequence 20 Based on this output, what is the effect of this access list when applied to an interface?

A.It permits all IPv6 traffic
B.It denies all IPv6 traffic from 2001:DB8:1::/48
C.It permits only IPv6 traffic from 2001:DB8:1::/48 and denies everything else
D.It permits all IPv6 traffic except from 2001:DB8:1::/48
AnswerC

Sequence 10 permits the prefix, sequence 20 denies all other traffic.

Why this answer

The access list FILTER-IPv6 has two entries: a permit statement for source 2001:DB8:1::/48 to any destination (sequence 10), followed by an implicit deny all (sequence 20). When applied to an interface, only traffic matching the permit entry is allowed; all other IPv6 traffic is denied by the implicit deny rule at the end of the list. This results in permitting only traffic from the specified prefix and denying everything else.

Exam trap

Cisco often tests the implicit deny all at the end of an access list, and the trap here is that candidates may overlook the deny ipv6 any any entry (sequence 20) or assume it is not present, leading them to incorrectly think the ACL permits all traffic (Option A) or permits all except the specified prefix (Option D).

How to eliminate wrong answers

Option A is wrong because the access list includes an explicit deny ipv6 any any (sequence 20), which blocks all traffic not matching the permit statement, so it does not permit all IPv6 traffic. Option B is wrong because the permit statement allows traffic from 2001:DB8:1::/48, not deny it; the deny statement applies to all other traffic. Option D is wrong because the permit statement allows traffic from 2001:DB8:1::/48, not deny it, and the deny statement blocks all other traffic, so the effect is the opposite of what is described.

Full explanation →
486
MCQhard

A network engineer configures SNMPv3 with authentication and privacy on a router. The NMS can poll the router successfully. After a router reload, the NMS fails to poll the router, but the SNMP configuration is unchanged. Which is the most likely explanation?

A.The SNMP engine ID changed after the reload because it was not explicitly configured, causing authentication keys to be recalculated.
B.The router lost its SNMP configuration due to a failed startup config.
C.The NMS's SNMPv3 credentials were deleted during the reload.
D.The router's SNMP process failed to start after reload.
AnswerA

SNMPv3 keys are derived from the engine ID; if the engine ID changes, the NMS must be reconfigured with the new engine ID or the router must have a persistent engine ID configured.

Why this answer

SNMPv3 uses the engine ID as a seed to generate authentication and privacy keys. If the engine ID is not explicitly configured, it is automatically derived from the router's MAC address or other unique identifier. After a reload, the engine ID may change (e.g., due to a different interface coming up first), causing the NMS to recalculate keys that no longer match the router's keys, breaking authentication even though the configuration appears unchanged.

Exam trap

Cisco often tests the subtle behavior that SNMPv3 keys are tied to the engine ID, and candidates mistakenly assume that unchanged SNMP configuration guarantees continued operation after a reload.

How to eliminate wrong answers

Option B is wrong because the router's SNMP configuration is stored in the startup config and would survive a reload unless explicitly erased; a failed startup config would cause a complete loss of all configurations, not just SNMP. Option C is wrong because the NMS's credentials are stored locally on the NMS, not on the router, and a router reload does not affect the NMS's stored data. Option D is wrong because the SNMP process is part of the router's IOS and starts automatically with the system; if it failed to start, other services would also be affected, and the question states the SNMP configuration is unchanged, implying the process is running.

Full explanation →
487
MCQhard

R1 and R2 are OSPF neighbors over a tunnel interface with BFD enabled. R1#show ip ospf interface tunnel0 shows 'BFD is enabled' but R1#show bfd neighbors shows the session as 'Down'. R2#show bfd neighbors shows the session as 'Down'. The tunnel is up and OSPF adjacency is full. R1 has 'bfd interval 100 min_rx 100 multiplier 3' under tunnel0. R2 has same. What is the root cause?

A.BFD is not supported over tunnel interfaces; it requires physical interfaces.
B.The tunnel mode must be changed to 'ipsec' for BFD to work.
C.OSPF must be configured with 'bfd all-interfaces' to work over tunnels.
D.The BFD timers must be increased for tunnel interfaces.
AnswerA

BFD cannot be used over tunnel interfaces because BFD requires direct layer 2 connectivity; tunnels are layer 3 virtual interfaces.

Why this answer

BFD over tunnel interfaces requires that the underlying transport (e.g., GRE) supports BFD. BFD cannot be established over a tunnel if the tunnel endpoint IP addresses are not directly connected; BFD requires physical connectivity. Since OSPF is full, the tunnel is working, but BFD fails because the tunnel is considered a virtual interface and BFD expects a direct physical link.

Full explanation →
488
MCQhard

An engineer configures BGP between two iBGP peers in the same AS. The engineer sets 'next-hop-self' on the neighbor statement. However, the routes received from the iBGP peer still show the original next-hop as unreachable. What is the most likely explanation?

A.The 'next-hop-self' command was applied under the wrong address-family.
B.The 'next-hop-self' command is not supported for iBGP peers.
C.The 'synchronization' command is enabled, causing the next-hop to be preserved.
D.The 'bgp bestpath as-path multipath-relax' command is interfering.
AnswerA

In BGP, 'next-hop-self' can be configured per address-family. If it is applied under the IPv4 unicast address-family but the routes are being exchanged in a different address-family (e.g., VPNv4), it will not take effect.

Why this answer

The 'next-hop-self' command in BGP modifies the next-hop attribute for routes advertised to the neighbor. However, if the route is received from an eBGP peer and then advertised to an iBGP peer, the next-hop is changed only for the iBGP peer if 'next-hop-self' is configured. But if the iBGP peer is also a route reflector client, the route reflector does not change the next-hop unless 'next-hop-self' is configured on the route reflector itself.

The edge case here is that the engineer may have configured 'next-hop-self' on the wrong router or the command is applied to the wrong address-family.

Full explanation →
489
MCQhard

An engineer configures an EEM applet to monitor CoPP (Control Plane Policing) drops using the event syslog pattern 'COPP-3-DROP'. The applet is intended to log when CoPP drops packets. The CoPP policy is applied with a rate-limit in bps, but the traffic exceeds the rate, and packets are dropped. The EEM applet does not trigger. Which is the most likely explanation?

A.CoPP does not generate syslog messages for individual drops unless the 'log' keyword is configured in the policy.
B.The EEM applet must use 'event class-map' to capture CoPP events.
C.The rate-limit in bps is incorrect; it should be in pps to generate syslog.
D.The CoPP policy must be applied to the input direction only for drops to be logged.
AnswerA

Correct. CoPP drops are not logged by default; the 'log' keyword must be added to the police action.

Why this answer

CoPP generates syslog messages only when the drop rate exceeds a certain threshold or when the policy is applied, not for every individual drop. By default, CoPP does not generate syslog messages for every dropped packet because it would overwhelm the router. The 'COPP-3-DROP' syslog is generated only if the 'police' action includes the 'log' keyword or if the drop rate is significant enough to trigger a log.

Without explicit logging configuration in the CoPP policy, no syslog is generated, and the EEM applet will not trigger.

Full explanation →
490
MCQhard

An OSPF network is experiencing routing loops between two routers. R1 has the following configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip ospf network point-to-point. R2 has: interface GigabitEthernet0/0 ip address 10.1.1.2 255.255.255.0 ip ospf network broadcast. Both routers are in area 0. R1 shows: 'show ip ospf neighbor' lists R2 as FULL/DR, but R2 shows R1 as FULL/DROTHER. Traffic between two subnets behind each router is looping. What is the root cause?

A.The OSPF network type mismatch causes both routers to become DR/BDR, leading to incorrect LSA generation and routing loops.
B.The IP addresses are on the same subnet, but the OSPF cost is set differently, causing unequal cost load balancing.
C.The OSPF hello and dead intervals are mismatched due to the network type, causing the adjacency to flap.
D.The OSPF area is misconfigured; one router is in a different area.
AnswerA

R1's point-to-point configuration means it does not participate in DR election, so R2 becomes DR. R1 treats the link as a point-to-point link and may not advertise the correct type 2 LSA, while R2 advertises a type 2 LSA. This mismatch can cause R1 to learn routes via R2 and R2 to learn routes via R1, creating a loop.

Why this answer

OSPF network type mismatch on a multi-access link can cause adjacency issues. R1 is configured as point-to-point, which does not participate in DR/BDR election and expects a point-to-point link. R2 is configured as broadcast, which expects a DR/BDR election.

This mismatch can cause both routers to form an adjacency (since OSPF still works), but they have different views of the network. R1 thinks the link is point-to-point and does not expect a DR, so it may advertise the link as a stub network or with different metrics. R2 thinks it is the DR (since R1 is not participating in election), and it advertises the link as a transit network.

This inconsistency can cause routing loops because R1 may advertise a route via R2, and R2 may advertise the same route via R1, creating a loop. The correct fix is to match the network type on both ends.

Full explanation →
491
MCQmedium

Examine the following partial configuration: ip access-list extended MGMT_ACCESS permit tcp 10.0.0.0 0.255.255.255 any eq 22 permit tcp 10.0.0.0 0.255.255.255 any eq 443 deny ip any any ! line vty 0 4 access-class MGMT_ACCESS in transport input ssh login local What is the effect of the 'access-class' command?

A.Only SSH and HTTPS connections from the 10.0.0.0/8 network are allowed to the VTY lines.
B.The ACL filters traffic leaving the VTY lines, allowing SSH and HTTPS from any source.
C.All traffic from the 10.0.0.0/8 network is permitted to the router.
D.The configuration is missing 'permit ip any any' to allow other management protocols.
AnswerA

The ACL permits TCP ports 22 and 443 from the specified source, and the access-class filters inbound VTY connections.

Why this answer

The `access-class` command applied to VTY lines with the `in` keyword filters inbound Telnet/SSH sessions to the router. The ACL `MGMT_ACCESS` permits TCP ports 22 (SSH) and 443 (HTTPS) from source network 10.0.0.0/8, and denies all other traffic. This restricts management access to only SSH and HTTPS connections originating from the 10.0.0.0/8 network.

Exam trap

Cisco often tests the distinction between `access-class` (applied to VTY lines for management access control) and `access-group` (applied to interfaces for transit traffic), leading candidates to confuse the direction or scope of the ACL.

How to eliminate wrong answers

Option B is wrong because the `in` keyword on `access-class` filters traffic entering the VTY lines (inbound to the router), not traffic leaving them. Option C is wrong because the ACL only permits TCP ports 22 and 443, not all traffic from 10.0.0.0/8; the implicit deny at the end blocks everything else. Option D is wrong because the configuration is complete as intended; adding `permit ip any any` would bypass the security restriction and allow all management protocols, which contradicts the purpose of the ACL.

Full explanation →
492
Multi-Selecthard

Which TWO statements correctly describe the behavior of Policy-Based Routing (PBR) when using the 'set ip next-hop' and 'set ip default next-hop' commands? (Choose TWO.)

Select 2 answers
A.The 'set ip next-hop' command overrides the routing table only when the next-hop address is reachable; if unreachable, the packet is dropped unless a default route exists.
B.The 'set ip default next-hop' command is used to forward packets that match the route-map permit statement, regardless of whether a route exists in the routing table.
C.The 'set ip next-hop verify-availability' feature uses ICMP echo requests to verify next-hop reachability before applying PBR.
D.When using 'set interface' in a PBR route map, the router forwards the packet out the specified interface without requiring a next-hop IP address, but the interface must be up/up.
E.If a route map with 'set ip next-hop' is applied inbound on an interface, PBR processes only the first packet of a flow; subsequent packets use the routing table.
AnswersA, D

Correct. PBR with 'set ip next-hop' requires the next hop to be reachable; if not, the packet is forwarded using the routing table (if a default route exists) or dropped.

Why this answer

PBR uses route maps to override the routing table. The 'set ip next-hop' command is applied only if the packet matches the match criteria; if the next hop is unreachable, the packet is dropped (unless a default route exists). The 'set ip default next-hop' command is used only when the routing table has no explicit route for the destination.

The 'set ip next-hop verify-availability' option tracks reachability using CEF. The 'set interface' command does not require a next-hop IP but can be used for directly connected networks.

Full explanation →
493
MCQeasy

What is the default uRPF mode when 'ipv6 verify unicast source reachable-via' is configured without any keyword?

A.Loose mode (any)
B.Strict mode (rx)
C.No uRPF is applied
D.Only default routes are allowed
AnswerB

Without keywords, the router uses strict uRPF, checking the source is reachable via the receiving interface.

Why this answer

When 'ipv6 verify unicast source reachable-via' is configured without any keyword, the default mode is strict (rx). In strict mode, the router checks that the source address of an incoming IPv6 packet is reachable via the exact interface on which the packet was received, using the FIB. This prevents source address spoofing by ensuring the return path matches the ingress interface.

Exam trap

Cisco often tests the default behavior of commands without keywords, and the trap here is that candidates mistakenly assume 'ipv6 verify unicast source reachable-via' defaults to loose mode or requires an explicit keyword to enable uRPF, when in fact strict mode is the default.

How to eliminate wrong answers

Option A is wrong because loose mode (any) requires the explicit 'any' keyword; without it, the default is strict, not loose. Option C is wrong because the command explicitly applies uRPF; omitting a keyword does not disable uRPF but defaults to strict mode. Option D is wrong because uRPF strict mode does not allow only default routes; it checks reachability via the FIB for any route, not just default routes.

Full explanation →
494
MCQmedium

Examine this BGP configuration on router R3: router bgp 65003 bgp router-id 3.3.3.3 neighbor 10.3.3.2 remote-as 65002 neighbor 10.3.3.2 ebgp-multihop 2 neighbor 10.3.3.2 update-source Loopback0 ! interface Loopback0 ip address 3.3.3.3 255.255.255.255 What is the likely issue with this configuration?

A.The ebgp-multihop value should be 1 for directly connected neighbors.
B.The neighbor 10.3.3.2 must be reachable via the loopback address 3.3.3.3; otherwise, the session will not come up.
C.The remote-as 65002 should be the same as the local AS for eBGP.
D.The update-source command is not needed when using ebgp-multihop.
AnswerB

BGP uses the update-source address as the source IP; the neighbor must be able to reach that IP.

Why this answer

The ebgp-multihop 2 allows the neighbor to be two hops away, but the update-source is set to Loopback0 (3.3.3.3). The neighbor 10.3.3.2 must be reachable via the loopback. If 10.3.3.2 is not reachable from 3.3.3.3, the session will not establish.

Full explanation →
495
MCQhard

A network engineer configures EEM to monitor BGP prefix limits on R1. R1 has: event manager applet BGP-PREFIX event syslog pattern "%BGP-3-PREFIX_LIMIT" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp 10.1.1.2" action 3.0 syslog msg "Cleared BGP session". Router R2 shows: BGP session with R1 is flapping, and logs show repeated prefix limit warnings. What is the root cause?

A.The EEM applet clears the BGP session, which resets the prefix count but does not prevent the neighbor from re-sending the same prefixes.
B.The syslog pattern is incorrect; it should be %BGP-4-PREFIX_LIMIT.
C.The clear command should be 'clear ip bgp *' to reset all sessions.
D.The BGP session is flapping due to a keepalive timer mismatch.
AnswerA

Clearing the session only provides temporary relief; the prefix limit is hit again after re-establishment.

Why this answer

The EEM applet clears the BGP session when a prefix limit is reached, but this does not solve the underlying issue. The prefix limit is exceeded because the neighbor is sending too many prefixes; clearing the session only temporarily resets the count, leading to a cycle. The correct fix is to increase the prefix limit or filter prefixes.

Full explanation →
496
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 route | include Tunnel O 2001:DB8:1::/48 [110/2] via FE80::1, Tunnel0 O 2001:DB8:2::/48 [110/3] via FE80::2, Tunnel1 Based on this output, which statement is correct?

A.The routes are learned via EIGRP.
B.The tunnels are using IPv4 as the transport.
C.OSPFv3 is running over the tunnel interfaces and these routes are reachable.
D.Tunnel0 has a higher metric than Tunnel1.
AnswerC

The OSPF routes are present with next-hop addresses via tunnel interfaces.

Why this answer

The output shows OSPF routes (indicated by 'O') learned over tunnel interfaces. Since the routes are IPv6 (2001:DB8::/48) and OSPFv3 is the IPv6-capable version of OSPF, the correct interpretation is that OSPFv3 is running over the tunnels. The 'via FE80::1, Tunnel0' confirms the next hop is a link-local address reachable through the tunnel, meaning the routes are reachable via OSPFv3 over those tunnels.

Exam trap

Cisco often tests the distinction between OSPFv3 and OSPFv2 by using the route code 'O' in IPv6 routing tables, leading candidates to mistakenly think it could be EIGRP or that the transport must be IPv4, when in fact 'O' always means OSPF in any routing table context.

How to eliminate wrong answers

Option A is wrong because the route code 'O' indicates OSPF, not EIGRP (which would show 'D' for EIGRP). Option B is wrong because the output shows IPv6 next-hop addresses (FE80::1, FE80::2) and IPv6 prefixes, so the tunnels are using IPv6 as the transport, not IPv4. Option D is wrong because a higher administrative distance value (110/3) indicates a worse metric, not better; Tunnel0 has a metric of 2 (lower) and Tunnel1 has a metric of 3 (higher), so Tunnel0 actually has a lower (better) metric.

Full explanation →
497
MCQmedium

Consider the following configuration on router R1: crypto isakmp policy 10 encryption aes 256 authentication pre-share group 14 lifetime 86400 ! crypto isakmp key cisco123 address 192.168.1.2 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 192.168.1.2 set transform-set TSET match address 101 ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 crypto map CMAP ! access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 If the remote peer has an ISAKMP policy with encryption 3des, what will happen?

A.The tunnel will use 3DES because the remote peer's policy is accepted.
B.IKE phase 1 will fail due to encryption algorithm mismatch.
C.The router will automatically adjust to use 3DES.
D.The tunnel will establish but use AES 256 anyway.
AnswerB

The encryption algorithm must match; AES 256 vs 3DES is a mismatch.

Why this answer

IKE phase 1 requires both peers to have a matching ISAKMP policy, including the encryption algorithm. Since R1 is configured with AES 256 and the remote peer uses 3DES, there is no common proposal, causing phase 1 to fail. Cisco IOS does not automatically negotiate or fall back to a different encryption algorithm; the mismatch results in a failed IKE SA.

Exam trap

Cisco often tests the misconception that IKE will automatically negotiate or fall back to a weaker algorithm, but in reality, IKE phase 1 requires an exact match of all policy parameters, and a mismatch causes the entire VPN to fail.

How to eliminate wrong answers

Option A is wrong because IKE phase 1 does not simply accept the remote peer's policy; both peers must have a matching proposal, and a mismatch causes failure. Option C is wrong because Cisco IOS does not automatically adjust encryption algorithms; each peer must have a compatible policy configured. Option D is wrong because the tunnel cannot establish if IKE phase 1 fails; no IPsec SA can be created without a successful IKE SA.

Full explanation →
498
MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.3.3.0/24 BGP routing table entry for 10.3.3.0/24, version 10 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch 1 65003 65004 10.1.13.3 from 10.1.13.3 (10.3.3.3) Origin IGP, metric 0, localpref 100, valid, external rx pathid: 0, tx pathid: 0 Refresh Epoch 1 65005 10.1.15.5 from 10.1.15.5 (10.5.5.5) Origin IGP, metric 0, localpref 200, valid, external, best rx pathid: 0, tx pathid: 0x0 Based on this output, why is the path via 10.1.15.5 chosen as best?

A.Because it has a shorter AS path (65005 vs 65003 65004).
B.Because it has a higher local preference of 200.
C.Because it has a lower metric (0 vs 0).
D.Because it was learned from a lower neighbor IP address.
AnswerB

Local preference is compared before AS path length. The path with localpref 200 is preferred over 100.

Why this answer

BGP selects the best path based on several criteria. Here, both paths are external, valid, and have the same weight (default 0). The path via 10.1.15.5 has a higher local preference (200 vs 100), which is the first tiebreaker after weight.

Therefore, it is chosen as best.

Full explanation →
499
MCQeasy

According to Cisco IOS default behavior, if a router learns the same route via both RIP and OSPF, which route will be installed in the routing table?

A.The RIP route, because RIP has a lower metric.
B.The OSPF route, because OSPF has a lower administrative distance.
C.Both routes are installed, and load balancing occurs.
D.Neither route is installed; the router will use a default route.
AnswerB

OSPF AD 110 < RIP AD 120.

Why this answer

OSPF has a default AD of 110, RIP has 120. Lower AD is preferred, so OSPF route is installed.

Full explanation →
500
MCQmedium

Which statement correctly describes the behavior of ISATAP tunneling regarding host configuration?

A.ISATAP requires manual configuration of the entire IPv6 address on each host.
B.ISATAP uses the prefix 2002::/16 for global addresses.
C.ISATAP embeds the IPv4 address into the interface identifier (last 64 bits) of the IPv6 address.
D.ISATAP is only used for site-to-site tunnels.
AnswerC

ISATAP uses the format ::5EFE:IPv4-address for the interface identifier.

Why this answer

ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) automatically generates the IPv6 address by embedding the host's IPv4 address into the interface identifier (the last 64 bits of the IPv6 address). This allows hosts to obtain a complete IPv6 address without manual configuration of the full 128-bit address, as the IPv4 address is used to form the unique interface ID. Option C correctly describes this behavior.

Exam trap

Cisco often tests the distinction between ISATAP and 6to4 tunneling, and the trap here is confusing the 2002::/16 prefix (used by 6to4) with ISATAP's use of a site-specific prefix and the embedded IPv4 address in the interface ID.

How to eliminate wrong answers

Option A is wrong because ISATAP does not require manual configuration of the entire IPv6 address; it automatically derives the interface identifier from the IPv4 address, and the prefix can be obtained via router discovery or DHCPv6. Option B is wrong because the prefix 2002::/16 is used by 6to4 tunneling, not ISATAP; ISATAP typically uses a site-specific unicast prefix (e.g., a global or unique local prefix) advertised by an ISATAP router. Option D is wrong because ISATAP is designed for host-to-router and host-to-host tunnels within a site, not exclusively for site-to-site tunnels; site-to-site tunnels are typically implemented with manual IPv6-in-IPv4 tunnels or GRE tunnels.

Full explanation →
501
MCQmedium

An engineer configures NAT overload on a router. The inside network uses 172.16.0.0/16, and the outside interface is 198.51.100.1. The engineer uses 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. ACL 1 permits 172.16.0.0 0.0.255.255. Traffic works, but the engineer notices that the router's CPU utilization is high, and 'show ip nat translations' shows thousands of entries. What is the most likely cause?

A.The router is under a DDoS attack generating many NAT translations.
B.The NAT translation timeout is set too high, causing old entries to remain.
C.The ACL is too permissive, allowing traffic from outside to initiate NAT.
D.The outside interface is using a different IP than configured.
AnswerB

Correct because if the timeout (e.g., 'ip nat translation timeout') is high, entries for short-lived flows (like DNS) stay longer, accumulating and consuming CPU.

Why this answer

The high CPU utilization and thousands of NAT translations indicate that the router is maintaining an excessive number of translation entries. The default NAT timeout for TCP is 86400 seconds (24 hours) and for UDP is 300 seconds. If the timeout is set too high, old entries are not cleared promptly, causing the translation table to grow large and consuming CPU resources for lookups and maintenance.

This is the most likely cause given the symptoms.

Exam trap

Cisco often tests the misconception that high CPU and many NAT entries are always due to an attack or ACL misconfiguration, when the real issue is often the NAT translation timeout being too high, causing stale entries to accumulate.

How to eliminate wrong answers

Option A is wrong because a DDoS attack would typically cause a sudden spike in traffic and translations, but the scenario describes a steady accumulation of thousands of entries over time, which aligns with timeout issues rather than an attack. Option C is wrong because the ACL is used to define which inside source addresses are eligible for NAT, not to control outside-initiated traffic; outside-initiated NAT requires 'ip nat outside source' or static NAT, and the overload configuration only translates inside sources. Option D is wrong because if the outside interface IP were different, NAT translations would fail or not be created, not result in thousands of entries; the command references the interface, so the router uses its configured IP automatically.

Full explanation →
502
Multi-Selecthard

Which TWO statements about the interaction between administrative distance and floating static routes are true? (Choose TWO.)

Select 2 answers
A.A floating static route must have an administrative distance higher than the primary route's AD to serve as a backup.
B.The default administrative distance for a static route is 0.
C.A floating static route will be installed in the routing table immediately after the primary route is removed, even if the next-hop is unreachable.
D.The 'ip route' command can be used to configure a floating static route by specifying an administrative distance value.
E.A floating static route can only be used with OSPF as the primary routing protocol.
AnswersA, D

Correct. The floating static route is configured with a higher AD so it is only used when the primary route (with lower AD) is not available.

Why this answer

A floating static route is a static route with an administrative distance greater than the dynamic routing protocol's AD, so it only appears in the routing table when the dynamic route is lost. The default AD for a static route is 1, but it can be changed. The floating static route will be installed when the primary route (with lower AD) is removed.

The backup route must have a higher AD than the primary route. The distance command under the routing protocol does not affect the static route's AD.

Full explanation →
503
MCQhard

A network engineer runs the following command on Router R1: R1# show ip bgp neighbors 192.168.1.2 advertised-routes BGP table version is 14, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.10.10.0/24 192.168.1.2 0 0 65001 i *> 10.20.20.0/24 192.168.1.2 0 0 65001 i Total number of prefixes 2 Based on this output, what is a likely issue?

A.The neighbor 192.168.1.2 is not receiving all routes because a route-map is filtering them.
B.The BGP session is down because there are no prefixes advertised.
C.The router is not receiving updates from its peers.
D.The prefix-list is misconfigured and blocking all routes.
AnswerA

Only two prefixes are advertised; a route-map applied to the neighbor could be restricting the advertisement.

Why this answer

The output shows only two prefixes advertised to the neighbor, but the network likely has more routes. The route-map applied to the neighbor may be filtering routes. The correct answer identifies that a route-map is likely filtering out other prefixes.

Full explanation →
504
Drag & Dropmedium

Drag and drop the steps to verify and validate the MPLS L3VPN operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking the VRF routing table with 'show ip route vrf <name>' to confirm CE routes are present. Then verify that VPNv4 routes are installed using 'show bgp vpnv4 unicast all'. Next, confirm the MPLS forwarding entry for a specific prefix with 'show mpls forwarding-table'.

After that, test end-to-end connectivity with a ping from the CE to a remote CE. Finally, validate that the label stack is correctly imposed using 'show ip cef vrf <name> <prefix>'.

Full explanation →
505
MCQhard

An engineer configures ERSPAN on a Cisco router to send mirrored traffic to a remote collector via IP. The collector receives the ERSPAN packets, but the payload appears truncated or malformed. What is the most likely cause?

A.The ERSPAN GRE encapsulation adds overhead exceeding the path MTU, causing fragmentation or drop.
B.The collector is not configured to reassemble IP fragments.
C.The ERSPAN session is configured with the wrong source interface, causing incorrect IP headers.
D.The router has IPsec configured on the egress interface, encrypting the ERSPAN packets.
AnswerA

ERSPAN adds 50 bytes of overhead; if the original packet is near MTU, the encapsulated packet exceeds it, leading to fragmentation or loss.

Why this answer

ERSPAN encapsulates mirrored packets in GRE with an additional ERSPAN header. The MTU of the path between the source and collector must accommodate the extra overhead (typically 50 bytes for GRE + ERSPAN). If the path MTU is too small, packets are fragmented or dropped, causing truncation.

Full explanation →
506
MCQmedium

Which DHCPv4 option is used by a client to request a specific IP address in the DHCPREQUEST message?

A.Option 12 (Host Name)
B.Option 50 (Requested IP Address)
C.Option 54 (Server Identifier)
D.Option 51 (IP Address Lease Time)
AnswerB

Option 50 carries the requested IP address in DHCPREQUEST.

Why this answer

DHCPv4 Option 50 (Requested IP Address) is specifically used by a client in the DHCPREQUEST message to request a previously offered IP address or to attempt to renew a specific address. This option allows the client to indicate which IP address it wants to use, ensuring the server can confirm or deny the request based on availability and policy.

Exam trap

Cisco often tests the distinction between Option 50 (Requested IP Address) and Option 54 (Server Identifier), as candidates may confuse the client's request for a specific IP with the server identification used in unicast DHCPREQUEST messages during the selection phase.

How to eliminate wrong answers

Option A is wrong because Option 12 (Host Name) is used to convey the client's hostname to the DHCP server, not to request a specific IP address. Option C is wrong because Option 54 (Server Identifier) is used by the client to identify which DHCP server it is responding to, typically in a DHCPREQUEST sent during the selection phase, but it does not request a specific IP address. Option D is wrong because Option 51 (IP Address Lease Time) is used to request or specify the lease duration for an IP address, not to request a particular IP address itself.

Full explanation →
507
MCQmedium

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

A.Remove the EEM applet entirely.
B.Modify the EEM applet trigger to match only the specific interfaces of interest.
C.Increase the debounce timer on the interface to reduce flapping.
D.Disable SNMP traps for interface state changes.
AnswerB

Correct because narrowing the trigger condition prevents false positives while retaining monitoring capability.

Why this answer

The EEM applet is too broadly triggered, causing unnecessary syslog messages that may be interpreted as traps. The engineer should narrow the trigger condition to match only specific interfaces or use a more specific event filter.

Full explanation →
508
MCQmedium

A network engineer runs the following command to troubleshoot DHCPv6 guard: R1# debug ipv6 dhcp guard *Mar 1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3, client DUID 00010001abcd1234 *Mar 1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3 is allowed by policy DHCP-POLICY *Mar 1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4, server DUID 0001000156789012 *Mar 1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4 is blocked by policy DHCP-POLICY What does this output indicate?

A.DHCPv6 guard is allowing client messages but blocking server messages from untrusted sources, preventing rogue DHCPv6 servers.
B.DHCPv6 guard is blocking all DHCPv6 messages, indicating a misconfiguration.
C.DHCPv6 guard is allowing all messages but logging them for analysis.
D.DHCPv6 guard is not configured; the debug output is from default DHCPv6 behavior.
AnswerA

The ADVERTISE from fe80::4 is blocked, which is typical for DHCPv6 guard on untrusted ports.

Why this answer

The debug output shows that DHCPv6 SOLICIT messages from client fe80::3 are allowed by policy DHCP-POLICY, while DHCPv6 ADVERTISE messages from server fe80::4 are blocked by the same policy. This is the expected behavior of DHCPv6 guard: it permits client messages (SOLICIT, REQUEST, etc.) to reach potential servers, but it blocks server messages (ADVERTISE, REPLY, etc.) from untrusted ports to prevent rogue DHCPv6 servers from assigning malicious configurations. Option A correctly identifies this selective filtering.

Exam trap

Cisco often tests the misconception that DHCPv6 guard blocks all DHCPv6 traffic, when in fact it only blocks server messages from untrusted sources, allowing client messages to pass through.

How to eliminate wrong answers

Option B is wrong because DHCPv6 guard is not blocking all messages; client SOLICIT messages are explicitly allowed, so the configuration is not misconfigured to block everything. Option C is wrong because the debug clearly shows messages are being allowed or blocked based on policy, not merely logged for analysis; DHCPv6 guard enforces actions, not just logging. Option D is wrong because DHCPv6 guard is configured and active (policy DHCP-POLICY is referenced), and the debug output is not from default behavior—default DHCPv6 guard would block all server messages from untrusted ports without a policy, but here a specific policy is applied.

Full explanation →
509
Multi-Selecthard

Which THREE symptoms indicate a potential OSPFv2 neighbor adjacency problem due to a mismatch in configuration? (Choose THREE.)

Select 3 answers
A.The neighbor state remains stuck in INIT or EXSTART.
B.The neighbor state is 2WAY/DROTHER.
C.The 'show ip ospf neighbor' output shows the neighbor but with a state of DOWN.
D.The 'show ip ospf neighbor' output shows the neighbor but with a state of EXSTART/EXCHANGE.
E.The OSPF routes are missing from the routing table.
AnswersA, D, E

Mismatched parameters (e.g., timers, area ID) often prevent full adjacency, leaving the state in INIT or EXSTART.

Why this answer

A mismatch in hello/dead timers, area ID, or authentication causes neighbors to stay stuck in INIT or EXSTART state. A mismatched MTU can cause stuck in EXSTART/EXCHANGE. A mismatched network type can also cause issues.

Routes missing from the routing table is a symptom of many issues, not specific to mismatches.

Full explanation →
510
Drag & Dropmedium

Drag and drop the steps to verify and validate Device Access Control operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, check the AAA server reachability to ensure the backend is accessible. Then verify the active authentication method list applied globally. Next, confirm the authorization method list for exec or commands.

After that, validate the accounting configuration to track access. Finally, test the actual access control by attempting a remote login.

Full explanation →
511
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DROTHER 00:00:35 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 FULL/DR 00:00:32 192.168.13.3 GigabitEthernet0/1 Based on this output, which statement is correct?

A.Router R1 is the DR on the segment connected to GigabitEthernet0/0.
B.Router R1 has a full adjacency with both neighbors and is in a stable state.
C.Router R1 is experiencing a neighbor timeout on GigabitEthernet0/1.
D.Router R1 is not receiving hello packets from 10.1.1.2.
AnswerB

Both neighbors show FULL state, indicating complete adjacency. Dead times are decreasing normally, so adjacencies are stable.

Why this answer

The output shows two OSPF neighbors. The neighbor with state FULL/DROTHER indicates it is not the DR or BDR on that segment. The neighbor with state FULL/DR is the designated router.

The dead times are within normal range, indicating the adjacency is stable.

Full explanation →
512
MCQeasy

What is the default CoPP policer action for packets that exceed the committed information rate (CIR)?

A.Transmit with best-effort
B.Drop
C.Set DSCP to 0
D.Queue for later transmission
AnswerB

The default policer action for exceeding traffic is to drop the packets.

Why this answer

The default action for a Control Plane Policing (CoPP) policy-map class when traffic exceeds the committed information rate (CIR) is to drop the excess packets. This is because CoPP uses a single-rate, two-color policer by default, where packets conforming to the CIR are marked as 'conform' and transmitted, while packets exceeding the CIR are marked as 'exceed' and dropped. No default 'violate' action exists unless explicitly configured.

Exam trap

Cisco often tests the misconception that CoPP defaults to 'transmit' or 'remark' for excess traffic, but the default exceed action is always 'drop' unless explicitly changed in the policy-map.

How to eliminate wrong answers

Option A is wrong because CoPP does not have a default 'transmit with best-effort' action for excess traffic; that would require an explicit 'transmit' action under the 'exceed' or 'violate' clause in the policy-map. Option C is wrong because setting DSCP to 0 is not a default policer action; it would require an explicit 'set dscp 0' command under the exceed action, and CoPP defaults to drop, not remark. Option D is wrong because CoPP does not queue packets for later transmission; policing is a dropping or remarking mechanism, not a queuing or shaping function.

Full explanation →
513
Drag & Drophard

Drag and drop the steps to troubleshoot Device Management adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Troubleshooting starts with checking basic IP connectivity, then verifying the management protocol (e.g., NETCONF/RESTCONF) status, ensuring the correct port is open, checking AAA/authorization, and finally reviewing logs for errors.

Full explanation →
514
MCQmedium

A network engineer runs the following command to verify NAT on an interface: R1# show ip nat interface GigabitEthernet0/1 GigabitEthernet0/1 is up, line protocol is up NAT: inside, active NAT: outside, active NAT: overload, active What is the issue with this configuration?

A.The interface is configured as both inside and outside, which is invalid.
B.The interface is correctly configured for NAT.
C.The interface is down.
D.Overload is not active.
AnswerA

NAT requires separate inside and outside interfaces.

Why this answer

The command output shows that GigabitEthernet0/1 is configured as both 'inside' and 'active' and 'outside' and 'active' simultaneously. In Cisco IOS NAT, an interface can be either a NAT inside interface or a NAT outside interface, but not both. This misconfiguration causes ambiguous NAT behavior because the router cannot determine whether traffic entering or leaving the interface should be translated from inside to outside or vice versa, leading to translation failures.

Exam trap

Cisco often tests the misconception that an interface can be both inside and outside for NAT, leading candidates to overlook the explicit 'inside' and 'outside' flags in the 'show ip nat interface' output and incorrectly assume the configuration is valid.

How to eliminate wrong answers

Option B is wrong because the interface is not correctly configured; a single interface cannot serve as both NAT inside and NAT outside simultaneously, which violates Cisco NAT design principles. Option C is wrong because the output explicitly states 'GigabitEthernet0/1 is up, line protocol is up', so the interface is operational, not down. Option D is wrong because the output shows 'NAT: overload, active', indicating that Port Address Translation (PAT) is indeed active and functioning.

Full explanation →
515
MCQhard

In a DMVPN network with VRF-Lite, Router R1 (hub) and R2 (spoke) are configured for VRF-A. The DMVPN tunnel is up, but spoke-to-spoke traffic between R2 and R3 (another spoke) fails. R1 has configuration: interface Tunnel0, ip vrf forwarding VRF-A, ip address 172.16.0.1 255.255.255.0, tunnel source Gig0/0, tunnel mode gre multipoint. R2 has similar configuration with tunnel destination dynamic. The NHRP map for R3 is missing on R2. What is the root cause?

A.The NHRP mapping for R3 is missing on R2, preventing direct spoke-to-spoke tunnel establishment.
B.The tunnel mode should be gre multipoint on all spokes.
C.The VRF must be removed from the tunnel interface for DMVPN to work.
D.The hub router must have a static route for each spoke.
AnswerA

Correct: Without NHRP mapping, R2 cannot send traffic directly to R3; it must go through the hub.

Why this answer

In DMVPN, spoke-to-spoke tunnels require NHRP resolution. If R2 does not have an NHRP map for R3, it cannot establish a direct tunnel. The hub (R1) should facilitate NHRP resolution, but if the VRF configuration is not properly propagated, NHRP may fail.

The root cause is that the NHRP mapping is missing, often due to VRF mismatch in NHRP configuration or because the hub is not properly forwarding NHRP requests.

Full explanation →
516
MCQhard

An engineer configures a route map to filter BGP routes based on AS-path using a regex. The route map is applied inbound to an eBGP neighbor. The engineer notices that routes with an AS-path containing the neighbor's AS are still being accepted. Which is the most likely explanation?

A.The AS-path is prepended with the local AS before the inbound route map is applied, so the regex does not match the original AS-path.
B.The route map is applied outbound instead of inbound.
C.The regex is incorrect; it should use _AS_ to match the AS number.
D.The neighbor is configured with 'send-community' which overrides the route map.
AnswerA

eBGP prepends the local AS before route map processing; the route map sees the modified path.

Why this answer

When an eBGP route is received, the router prepends its own AS to the AS-path before the route map is applied. Therefore, if the route map is trying to match the neighbor's AS in the AS-path, it will fail because the neighbor's AS is now the first AS in the path. The edge case is that the AS-path is modified before the route map is processed.

Full explanation →
517
MCQhard

A network engineer runs the following command on Router R1: R1# show ip eigrp topology 10.50.50.0/24 EIGRP-IPv4 Topology Entry for AS(100)/ID(192.168.1.1) for 10.50.50.0/24 State: Active, Reply status: 0, Originating router: 192.168.1.1 Routing Descriptor Blocks: 10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag: 0x0 Composite metric: (4294967295/4294967295), Route is Internal Vector metric: Minimum bandwidth: 100000 Kbit Total delay: 100 microseconds Reliability: 255/255 Load: 1/255 Minimum MTU: 1500 Hop count: 1 Based on this output, what is the problem?

A.The route is in Active state with an infinite metric, indicating that the router has lost the route and is querying for a new path.
B.The route is passive and stable.
C.The metric of 4294967295 is normal for a summary route.
D.The hop count of 1 indicates the route is one hop away and reachable.
AnswerA

Active state with Infinity metric means the route is unreachable and the router is actively seeking a replacement.

Why this answer

The route is in Active state with a composite metric of 4294967295 (the maximum 32-bit value, effectively infinite), which indicates that the router has lost the feasible successor and is actively sending queries to neighbors to find an alternative path. This is a classic sign of an EIGRP query process in progress, meaning the route is not stable or reachable.

Exam trap

Cisco often tests the misconception that a route in Active state with a high metric is still reachable or that the metric value is normal, when in fact the Active state and infinite metric together indicate a route that is being actively queried and is currently unreachable.

How to eliminate wrong answers

Option B is wrong because the route is in Active state, not Passive; a Passive state would indicate stability and convergence. Option C is wrong because a metric of 4294967295 is not normal for any route—it represents an infinite metric (unreachable) in EIGRP, not a summary route. Option D is wrong because a hop count of 1 does not guarantee reachability when the metric is infinite; the route is in Active state and the router is still querying for a valid path.

Full explanation →
518
MCQhard

A network engineer runs the following command on Router R1: R1# show ip policy Interface Route-map GigabitEthernet0/0 PBR-MULTI R1# show route-map PBR-MULTI route-map PBR-MULTI, permit, sequence 10 Match clauses: ip address (access-lists): 140 Set clauses: ip next-hop 10.0.0.2 10.0.0.3 Policy routing matches: 200 packets, 18000 bytes R1# show ip route 10.0.0.2 Routing entry for 10.0.0.2/32 Known via "eigrp 1", distance 90, metric 28160 Last update from 192.168.1.2 on GigabitEthernet0/1 R1# show ip route 10.0.0.3 % Network not in routing table Based on this output, what is the most likely behavior for packets matching ACL 140?

A.Packets are load-balanced between 10.0.0.2 and 10.0.0.3.
B.Packets are forwarded to 10.0.0.2.
C.Packets are dropped because one next-hop is unreachable.
D.Packets are forwarded to 10.0.0.3 via a recursive lookup.
AnswerB

Since 10.0.0.2 is reachable, PBR uses it. The unreachable 10.0.0.3 is ignored.

Why this answer

When multiple next-hops are specified in a set clause, PBR tries them in order. The first reachable next-hop is used. Here, 10.0.0.2 is reachable, so packets are forwarded to 10.0.0.2.

The second next-hop is not reachable, but that does not affect the first.

Full explanation →
519
Drag & Drophard

Drag and drop the steps to troubleshoot syslog connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, verify reachability to the syslog server using ping. Then, check if the syslog server port (UDP 514) is open. Next, review the logging configuration on the router.

After that, examine ACLs that may block syslog traffic. Finally, enable debug ip udp to monitor syslog packet flow.

Full explanation →
520
MCQhard

A network engineer is troubleshooting MPLS traffic engineering (TE) tunnels. A TE tunnel from Router A to Router B is configured but remains down. The engineer runs show mpls traffic-eng tunnels and sees that the tunnel is in 'down' state with the error 'Path computation failed'. The IGP is OSPF with MPLS TE enabled, and the network is fully meshed. What is the most likely root cause?

A.MPLS TE is not enabled on all interfaces along the path.
B.The tunnel destination is not reachable via the IGP.
C.RSVP is not configured on the tunnel interface.
D.The tunnel bandwidth is set too high, exceeding available bandwidth.
AnswerA

Correct because MPLS TE must be enabled on each interface to advertise link attributes into the TED; otherwise, the headend cannot compute a constraint-based path.

Why this answer

The 'Path computation failed' error indicates that the headend router cannot find a path meeting the constraints. Since OSPF TE is enabled, the issue is likely that the traffic engineering database (TED) is incomplete because MPLS TE is not enabled on all intermediate interfaces, preventing the headend from learning link attributes.

Full explanation →
521
Multi-Selectmedium

Which TWO commands can be used to verify OSPFv2 path selection and cost metrics on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show ip ospf interface
B.show ip route ospf
C.show ip ospf neighbor
D.traceroute
E.show ip protocols
AnswersA, B

This command displays the OSPF cost assigned to each interface.

Why this answer

The 'show ip ospf interface' command displays the cost of the interface. The 'show ip route ospf' command shows the metric for each OSPF route. 'show ip ospf neighbor' does not show cost; 'traceroute' shows path but not OSPF cost; 'show ip protocols' shows process info but not per-route metrics.

Full explanation →
522
MCQmedium

A network engineer runs the following command to troubleshoot OSPF route propagation: R1# show ip ospf database router 2.2.2.2 OSPF Router with ID (1.1.1.1) (Process ID 1) Router Link States (Area 0) LS age: 45 Options: (No TOS-capability, DC) LS Type: Router Links Link State ID: 2.2.2.2 Advertising Router: 2.2.2.2 LS Seq Number: 80000005 Checksum: 0x1234 Length: 48 Number of Links: 2 Link connected to: a Transit Network (Link ID) Designated Router address: 10.1.1.2 (Link Data) Router Interface address: 10.1.1.2 Number of TOS metrics: 0 TOS 0 Metrics: 10 Link connected to: a Stub Network (Link ID) Network/subnet number: 192.168.1.0 (Link Data) Network Mask: 255.255.255.0 Number of TOS metrics: 0 TOS 0 Metrics: 10 What does this output indicate?

A.Router 2.2.2.2 is advertising two stub networks.
B.Router 2.2.2.2 has a link to a transit network with DR address 10.1.1.2 and a stub network 192.168.1.0/24.
C.The LSA indicates a Type 5 External LSA from ASBR.
D.The output shows the network LSA for the transit network.
AnswerB

The LSA shows exactly these two links with their types and metrics.

Why this answer

The output shows the router LSA from neighbor 2.2.2.2, listing its connected links including a transit network and a stub network.

Full explanation →
523
Multi-Selecthard

Which TWO statements about SNMPv3 engine ID configuration are true? (Choose TWO.)

Select 2 answers
A.The engine ID must be manually configured for SNMPv3 to function.
B.If the engine ID is changed, all existing SNMPv3 users must be reconfigured.
C.The engine ID is used to generate the authentication and encryption keys for SNMPv3 users.
D.The engine ID can be up to 64 octets in length.
E.The engine ID is automatically generated based on the router's serial number.
AnswersB, C

Changing the engine ID invalidates the authentication and encryption keys derived from the old engine ID, requiring users to be reconfigured.

Why this answer

The SNMPv3 engine ID is a key component in generating the authentication and encryption keys for each user. If the engine ID changes, the keys derived from it become invalid, requiring all existing SNMPv3 users to be reconfigured with new passwords or keys to re-establish secure communication.

Exam trap

Cisco often tests the misconception that the engine ID is based on the router's serial number, but it is actually derived from the MAC address or IP address, and the maximum length is 27 octets, not 64.

Full explanation →
524
MCQhard

Examine this configuration on Router R6: router ospf 1 redistribute eigrp 100 subnets default-information originate always What is a likely problem with this configuration?

A.The 'default-information originate always' command is not allowed with redistribution.
B.The router will advertise a default route into OSPF even if it does not have a default route itself, potentially causing blackholing.
C.The 'subnets' keyword is missing for EIGRP redistribution.
D.The redistribution will only work if EIGRP routes have a metric set.
AnswerB

The 'always' keyword forces the default route advertisement regardless of the local routing table.

Why this answer

The 'default-information originate always' will generate a default route into OSPF regardless of whether a default route exists in the routing table. This can cause routing issues if the router does not actually have a default route, as it will attract traffic for unknown destinations.

Full explanation →
525
MCQeasy

A network engineer runs the following command on Router R1: R1# show flow monitor FLOW-MONITOR-1 statistics Monitor: FLOW-MONITOR-1 Record: netflow-original Exporter: EXPORTER-1 Cache size: 1000 Current entries: 0 Flows exported: 0 Packets exported: 0 Sampler: Not configured Flow Monitor is not attached to any interface Based on this output, what action should the engineer take to resolve the issue?

A.Configure a sampler on the flow monitor.
B.Apply the flow monitor to an interface using the 'ip flow monitor FLOW-MONITOR-1 input' command.
C.Increase the cache size to 2000 entries.
D.Change the record type to netflow ipv4 original.
AnswerB

The flow monitor must be attached to an interface to capture traffic.

Why this answer

The output explicitly states 'Flow Monitor is not attached to any interface'. The solution is to apply the flow monitor to an interface using the 'ip flow monitor' command.

Full explanation →
Page 6

Page 7 of 27

Page 8

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →